An FDIC examiner recently told one institution it was over-analyzing its vendor list. His point: stop treating every provider the same way, and put the real attention on the handful of providers carrying identity-theft risk. That institution runs every vendor through the same assessment, the way it always has. Nothing about the standard has changed, but the vendor-versus-service-provider distinction he raised is worth working through.

What “Service Provider” Used to Mean

The original definition comes from the Bank Service Company Act, passed in 1962. Section 3 of the Act covers check and deposit sorting and posting, computing and posting interest and other credits and charges, preparing and mailing checks and statements, and any other clerical, bookkeeping, accounting, or statistical function performed for a depository institution.

How Far the Definition Has Grown

That list barely resembles what counts today. According to the FDIC, almost anything a bank outsources can qualify as a service provider now: core processing; information and transaction processing tied to lending, deposit-taking, funds transfer, fiduciary, or trading activity; internet-related services; security monitoring; systems development and maintenance; aggregation services; digital certification; and call centers.

Even the FDIC has said the line isn’t always sharp. Don Saxinger, who led IT and operations risk exams at the agency, put it simply in a 2010 interview: the test isn’t the label, it’s the function. If a company is performing a banking function or a decision-making function, including your operations or your technology, and you’ve outsourced it, that’s a reportable service under the Act.

Customer Information Is the Real Test

The Federal Reserve frames it around access instead of task type. A service provider is any party, affiliated or not, allowed access to a financial institution’s customer information through the services it provides. A processor that touches customer information on the bank’s behalf counts. So does an attorney, accountant, or consultant doing work for the institution with access to that same information. The Fed’s guidance on managing outsourcing risk keeps the definition just as wide: any entity under contract with a financial institution to handle a business function or activity.

Customer information access is the common thread here, not the specific service performed. Regulators keep widening what counts as a service provider, so the vendor management program should widen with it. Keep running every provider through the same risk-ranking approach, and keep going from there.

Different Names, Same Provider

One more note on terminology. The FDIC said back in 2001 that vendors, subcontractors, external service providers, and outsourcers are all synonyms for service provider. Don’t let the label change what you do with it.