Federal Law states:
XVI. Third Party Arrangements
An institution that engages a third party to perform certain collateral valuation functions on its
behalf is responsible for understanding and managing the risks associated with the arrangement. An
institution should use caution if it engages a third party to administer any part of its appraisal
and evaluation function, including the ordering or reviewing of appraisals and evaluations,
selecting an appraiser or person to perform evaluations, or providing access to
analytical methods or technological tools.
An institution is accountable for ensuring that any services performed by a third party, both
affiliated and unaffiliated entities, comply with applicable laws and regulations and are
consistent with supervisory guidance.³² Therefore, an institution should have the resources and
expertise necessary for performing ongoing oversight of third party arrangements.
An institution should have internal controls for identifying, monitoring, and managing the risks
associated with using a third party arrangement for valuation services, including compliance,
legal, reputational, and operational risks. While the arrangement may allow an institution to
achieve specific business objectives, such as gaining access to expertise that is not available
internally, the reduced operational control over outsourced activities poses additional risk.
Consistent with safe and sound practices, an institution should have a written contract that
clearly defines the expectations and obligations of both the financial institution and the third
party, including that the third party will perform its services in compliance with the Agencies’
appraisal regulations and consistent with supervisory guidance.
Prior to entering into any arrangement with a third party for valuation services, an institution
should compare the risks, costs, and benefits of the proposed relationship to those associated with
using another vendor or conducting the activity in-house. The decision to outsource any part of the
collateral valuation function should not be unduly influenced by any short-term cost savings. An
institution should take into account all aspects of the long-term effect of the relationship,
including the managerial expertise and associated costs for effectively monitoring the arrangement
on an ongoing basis.
If an institution outsources any part of the collateral valuation function, it should exercise
appropriate due diligence in the selection of a third party. This process should include sufficient
analysis by the institution to assess whether the third party provider can perform the services
consistent with the institution’s performance standards and regulatory requirements. An institution
should be able to demonstrate that its policies and procedures establish effective internal
controls to monitor and periodically assess the collateral valuation functions performed by a third
party.
An institution also is responsible for ensuring that a third party selects an appraiser or a person
to perform an evaluation who is competent and independent, has the requisite experience and
training for the assignment, and thorough knowledge of the subject property’s market.
Appraisers must be appropriately certified or licensed, but this minimum credentialing requirement,
although necessary, is not sufficient to determine that an appraiser is competent to perform an
assignment for a particular property or geographic market.
³² See, for example, FFIEC Statement on Risk Management of Outsourced Technology Service (November
28, 2000) for guidance on the assessment, selection, contract review, and monitoring of a third
party that provides services to a regulated institution. Refer to the institution’s primary federal
regulator for additional guidance on third party arrangements: OCC Bulletin 2001-47, Third-Party
Relationships (November 1, 2001); OTS Thrift Bulletin 82a, Third Party Arrangements (September 1,
2004); NCUA Letter to Credit Unions: 01-CU-20, Due Diligence Over Third Party Service Arrangements
(November 2001), 07-CU-13, Supervisory Letter-Evaluation Third Party Relationships (December 2007),
08-CU-09, Evaluating Third Party Relationships Questionnaire (April 2008); and FDIC Financial
Institution Letter 44-2008, Guidance for Managing Third-Party Risk (June 2008).
An institution should ensure that when a third party engages an appraiser or a person who performs
an evaluation, the third party conveys to that person the intended use of the appraisal or
evaluation and that the regulated institution is the client. For example, an engagement letter
facilitates the communication of this information.
An institution’s risk management system should reflect the complexity of the outsourced activities
and associated risk. An institution should document the results of ongoing monitoring efforts and
periodic assessments of the arrangement(s) with a third party for compliance with applicable
regulations and consistency with supervisory guidance and its performance standards.
If deficiencies are discovered, an institution should take remedial action in a timely manner.