After onboarding, banks watch for changes in your financial condition and insurance, audit and test results, compliance and performance, subcontractor use, security posture, incident response, business continuity and key personnel. The 2023 interagency guidance lists these as monitoring items, scaled to the risk of the relationship.
This is general information, not legal advice.
The monitoring list
The guidance says monitoring should fit each relationship's risk, size and complexity and does not prescribe one method. Items it names include:
- Changes in financial condition and in insurance coverage.
- Relevant audits and testing results showing you remain capable of managing risk.
- Compliance with laws and performance against contract terms.
- Use of subcontractors, their location and any related data location.
- Your ability to protect confidentiality, availability and integrity, and your response to changing threats, new vulnerabilities and incidents.
- Incident response, continuity and resumption plans and test results.
- Changes in strategy, key agreements and key personnel.
- Customer complaint volume and trends.
Banks may also use collaborative arrangements or external parties to supplement their monitoring.
What this means in daily work
Security teams feel two items most: your response to new vulnerabilities and your subcontractor footprint. If a widely reported flaw hits a library you ship, your customer may ask whether you are affected before you have finished triage.
Having an answer ready is a process question. You need a current component inventory, a way to tell whether a vulnerable function is actually reachable in your code, and a record of what you did.
Send updates before they ask
- Keep a change log of subcontractor, hosting region and ownership changes.
- Share new test summaries when they finish.
- When a major vulnerability hits, send a short note: affected or not, evidence, planned action.
- Review insurance and key personnel changes against your customer notice terms.
Try it yourself
Click through it at your own pace, or open it full screen.
Click through to see how new findings surface after the first scan, which is the evidence a monitoring review wants.
Where Safeguard fits
Safeguard's SBOM and dependency scanning, zero-day discovery and reachability analysis can show which new advisories affect your software and which do not. A free scan is at gold.safeguard.sh/scan.
Quick check
Is monitoring the same as a yearly questionnaire?
No. The guidance describes ongoing monitoring across the relationship, scaled to risk, rather than a single annual form.
Do I have to tell the bank about subcontractor changes?
The guidance expects contracts to require notice of changes such as use of subcontractors. Check your own contract.
Sources
Last reviewed: 19 October 2026.
