In some cases, yes. Under the Bank Service Company Act, when a depository institution has certain authorized services performed for it by contract, that performance is subject to regulation and examination by its agency to the same extent as if the institution did the work on its own premises.
This is general information, not legal advice. Whether it reaches your product depends on the services.
What the statute says
Section 1867(c) of Title 12 covers services performed for a regularly examined depository institution, its subsidiary or affiliate. Performance is subject to regulation and examination by the agency as if the services were performed by the institution itself.
The institution must also notify each relevant agency of the service relationship within thirty days of making the contract or the service starting, whichever comes first.
What it does not say
The summary above does not mean every software company with a bank customer is examined. The provision speaks of services authorized under that chapter, so scope matters, and agency practice and other rules add detail. Treat it as a reason to be prepared, not as a prediction.
Why it is useful to know
| Situation | Practical consequence |
|---|---|
| Bank tells you the agency may review your service | Ask what scope, and what documents they will want |
| Contract grants audit and access rights | Make sure your own policies allow it |
| You are asked for evidence of testing | Treat it as examination readiness |
The 2023 interagency guidance points the same way: banks are expected to plan for audit rights and remediation, including periodic independent audits of the third party and relevant subcontractors.
An examination-ready folder
- Organization chart and security contacts.
- Security policies with last review dates.
- Recent independent test results with remediation status.
- Component inventory and vulnerability handling process.
- Incident log and response plan.
- Subcontractor list.
Where Safeguard fits
Safeguard's SBOM and dependency scanning and compliance and evidence automation help keep this kind of folder current instead of rebuilt in a hurry. A free scan is at gold.safeguard.sh/scan.
Quick check
Does my bank customer have to tell its regulator about me?
For services within the statute, the institution must notify its agency within thirty days. Whether your service is within it is a legal question.
Is being examined the same as failing?
No. An examination reviews controls. A prepared vendor with clear evidence usually has an easier time.
Sources
- 12 U.S.C. 1867, Bank Service Company Act
- Interagency Guidance on Third-Party Relationships, Federal Register, 9 June 2023
Last reviewed: 19 October 2026.
