A retail bank sends a security questionnaire because its regulators expect it to manage third party risk. To handle one well, answer from a maintained evidence library, match depth to how critical your service is to the bank, and never claim a certification you do not hold.
Why does the bank ask at all?
In June 2023 the OCC, the Federal Reserve Board and the FDIC jointly issued Interagency Guidance on Third-Party Relationships: Risk Management (OCC Bulletin 2023-17). The OCC page says it outlines the third party risk management life cycle and the principles for each stage. It rescinded OCC Bulletins 2013-29 and 2020-10.
The same page makes two points that shape your questionnaire. Risk management should match the bank's risk profile and complexity and the criticality of the activity the third party supports. And not all third party relationships present the same level of risk or criticality. The OCC summary does not list the stages in detail, so read the full guidance for the exact life cycle language.
For you, this means the bank is trying to decide how deeply to look. You can help them decide quickly.
What should you do before the questionnaire arrives?
Build an evidence library once. Keep these ready, current and approved for sharing under NDA:
- A description of your architecture, data flows and where customer data is stored.
- Your security policies, with owners and review dates.
- The results of independent assessments you actually hold, stated with exact scope and dates.
- A software bill of materials practice description and your process for handling vulnerabilities in dependencies.
- Incident response and notification process, including who contacts the bank.
- Business continuity and recovery summary.
- Your list of subprocessors and how you review them.
- Access control, logging and encryption summaries.
Tag each answer with a source document. When a question repeats across banks, you reuse the answer instead of rewriting it.
How do you answer questions well?
Answer the question asked. If it asks whether you encrypt data at rest, say yes or no, name where, and point to the evidence. A paragraph of general philosophy slows the reviewer down.
State status exactly. If an audit is in progress, say in progress. If a control is planned, say planned and give the date you are committing to. Banks read these answers against contracts, so an overstatement becomes a contract problem later.
Say what you do not do. A clear "not applicable, because we do not process card data" beats silence. If a gap exists, describe the compensating control.
Flag the critical points up front. If your service touches customer account data or sits in the payment path, say so, and expect deeper review. If it does not, say that too. This is the criticality conversation the guidance expects.
Give one named contact who can answer follow ups within a day or two.
What happens after the answers?
Expect follow up questions, a request for documents, and sometimes a call. The guidance describes ongoing monitoring as part of the life cycle, so expect annual or event driven reviews. Keep your library current so the next cycle is a refresh, not a rebuild. Also keep the contract in mind. Security commitments in the questionnaire often end up as contract terms.
What to do
- Assemble the evidence library and assign an owner for each item.
- Record, for each assessment or certification, its exact scope and date, and make sure the wording matches the document.
- Write a standard answer set, tagged by topic.
- On receipt, classify the questionnaire by the criticality of your service to the bank.
- Answer from the library, with attachments, and mark gaps honestly.
- Log every answer you give, so contracts and answers stay consistent.
- Review the library quarterly.
Safeguard's compliance automation can help organize evidence and map it to frameworks. See the framework mapping demo.
Quick check
Why do banks send these questionnaires?
Their regulators expect them to manage third party risk. The 2023 interagency guidance covers the full life cycle of third party relationships.
Should you round up a status that is in progress?
No. Say in progress and give the scope and date. Overstatements become contract problems.
Sources
Last reviewed: 18 October 2026.
