December 10, 2025
Hudson Cook Alert: OCC Requests Feedback on Community Banks' Engagement with Core and Essential Service Providers
On November 28, 2025, the Office of the Comptroller of the Currency ("OCC") issued a request for information ("RFI") on community banks' engagement with their core service providers and other essential third-party service providers. The OCC seeks to understand the challenges community banks face when working with these providers and how such challenges affect their ability to remain competitive in the marketplace.
The OCC identifies "core service providers" as third parties that provide the comprehensive back-end applications and infrastructure that support the operation and essential functions of one or more bank's lines of business, including, for example, through the provision of transaction processing, customer relationship management, compliance and reporting, online banking, and other material functions. The OCC is also interested in the community banks' engagement with "third parties who provide other essential functions supporting those core functions, including cloud processing, cloud storage, artificial intelligence, and compliance tools."
The RFI stems from the comments received in the OCC's May 12, 2025, RFI regarding community bank digitization. Those comments noted the industry's predominant reliance on large core service providers. The OCC expresses concern that community banks lack sufficient bargaining power when negotiating with these service providers due to the continued consolidation in the service provider market. The RFI references a survey indicating that the three largest core service providers served more than 70% of depository institutions in 2022, with the largest core service provider alone serving 42% of depository institutions.
Not only are there fewer service providers to choose from, community banks report high dissatisfaction with their core service providers, especially with the service provider's ability to deliver timely services that enable community banks to remain competitive in a rapidly evolving marketplace. This competition is particularly fierce in the growing stablecoin and crypto-asset markets and with developments in artificial intelligence.
In addition to seeking comments on the community banks' engagement with service providers, the OCC encouraged feedback on other aspects of service provider activities, relationships or supervisory or regulatory burdens. The OCC asked interested parties to address challenges related to contract negotiations, third-party risk management, and potential actions that the OCC could take to address these concerns, among other things. The RFI includes 33 specific questions covering topics such as innovation, cyber security risks, due diligence, supervisory and regulatory burdens, costs, service providers' billing practices, and the ways the OCC can better facilitate the dialogue between community banks and service providers.
Notably, the OCC reminds core service providers and other essential third-party service providers that certain services they perform for a bank are subject to regulation and examination by the OCC to the same extent as if such services were being performed by a client bank itself on its own premises.
The comments are due January 27, 2026.