Federal banking regulators expect that financial institutions that outsource technology services to third party vendors will have contractual remedies that are adequate to protect the bank in the event that the vendor is negligent or fails to adequately perform its services for the institution. A typical expectation is articulated in the Office of the Comptroller of the Currency's Bulletin 2001-47 on "Third Party Relationships." In the Bulletin, the OCC states that it favors indemnification provisions that require each party to indemnify the other for damages and third party claims that result from the negligence of the "indemnifying" party, so that the bank is not liable to third parties for the failures of the service provider. We agree that, in an ideal world, technology service providers would agree to be fully accountable for the results of their own negligence and their failure to perform their services in accordance with the terms of the agreement with the institution.
Unfortunately, we have yet to encounter a major provider of technology products or services that is willing to provide such broad protection. With respect to failures to meet "service level agreements" (which assumes that the service provider will agree to meet a meaningful level of performance of the services), most service providers severely limit the recourse of the bank in the event of a failure. Although variations are many, a not uncommon provision attempts to limit the bank's remedy to a refund of a pro rata portion of the monthly or quarterly fees paid by the bank for the period of the service failure, with a cap on the amount of total damages. Consequential, special and similar damages are generally excluded. As for "actual damages," most service providers insist on limiting their exposure to a set number of months of fees paid by the bank, or to a fixed dollar "cap."
As to indemnification, while some service providers are willing to indemnify the bank without limit for claims related to a breach of confidentiality and security obligations, and, in some cases, for the service provider's "gross" (not "ordinary") negligence, others are either unwilling to do so or will attempt to impose severe dollar limits on their exposure. Others may agree to broader indemnification obligations, but only with respect to third party claims, not those of the bank itself, and/or only to such matters as personal injury and damage to tangible personal property. The variations are many, and often keyed to the "hot buttons" of the vendor's risk management policies (or general counsel).
Therefore, while the "guidance" of the regulators indicates that bank examiners will expect to see the bank indemnified for the negligence of the vendor, that rarely will be the case. The problem is not confined to banks and other financial institutions.
Earlier this year, the Wall Street Journal observed that major technology customers were "fed up" with spending millions of dollars for software that contained flaws, and with the software vendors' attempts to disclaim and/or severely limit their liability for such flaws. Chief Information, Technology and Security Officers at major companies such as General Motors, AT&T and Alcoa were demanding that "vendors should begin to stand behind their products as much as sellers of other products and services do."
The major corporations are frustrated with the technology service and product providers' attempts to disclaim most liability for breaches of their service level agreements, for damages caused by their failure to perform, or for their own negligence. As noted in the article, although purchasers have some bargaining power when technology markets "soften," the ultimate threat of "walking away" is difficult to carry out because of the cost of switching providers. In addition, some technology providers have a virtual monopoly in their areas, and can afford to dig in their heels. Banks are also facing these "facts of life."
Exacerbating the perceived problem are recent data security breaches, which have increased in notoriety since the Wall Street Journal article was published. Even experts within the technology industry agree that some liability may have to be imposed on the industry in order to get them to focus on security. "It's still not top of mind," said a Computer Associates International Inc. executive.
If General Motors has trouble imposing an obligation of full recourse on its technology service providers, the problem for a community, and even mid-sized regional, bank is many times more difficult. It might be of assistance, especially to smaller institutions that lack bargaining power, if the banking regulators took notice of which vendors were and which were not willing to "step up to the plate" and provide their bank customers with adequate recourse in the event of failures to perform. Letting the banks, or the vendors themselves, understand that those vendors who are not willing to give banks adequate protection will not, over the long haul, be acceptable as service providers to banks, may cause a "paradigm shift" among vendors. Obviously, there is a limit to what the regulators are able to do, but the "little guys" could use some help in this area.