Third party risk management and M&A: What third party risks did you just buy?

Under the Trump Administration, the regulatory priorities of the US federal banking agencies appear to be shifting to a more open stance towards approval of bank mergers and acquisitions (M&A). Notwithstanding that shift, the US federal banking agencies will likely continue to prioritise enhanced third party risk management (TPRM) as an important principle of safe and sound banking policy. Regardless of the winds in Washington, banks engaging in M&A need to effectively integrate vendors into the combined organisation. This paper aims to bridge the gap between bank M&A activity and TPRM by providing practical guidance into TPRM for banks engaging in M&A transactions. The authors have conducted a series of interviews with banking institutions of varying sizes and have surveyed applicable literature and regulatory guidance to discern best practices for TPRM in the context of bank M&A. The authors conclude that even in a regulatory environment friendlier to bank M&A activity, banks should consider third party contractual relationships in the context of each of the following deal-making phases: (1) strategy; (2) due diligence and (3) integration. This article is also included in The Business & Management Collection which can be accessed at https://hstalks.com/business/.