AAO-008 / Regulation and Compliance
Critical Third Party Oversight and the Bank’s Retained Duty
Direct oversight of critical technology suppliers does not establish that a bank’s own agentic service is governed or recoverable. Directors should require a dependency review connecting the primary provider to the bank’s actual business service.