A compliance officer is reviewing a vendor contract for providing services on behalf of the bank. Which information should be included within the contract?

When a financial institution outsources activities, it remains ultimately responsible for meeting its regulatory obligations. Therefore, the contract with the vendor is a critical control. It must legally obligate the vendor to adhere to all applicable sanctions laws and regulations. This clause ensures that the vendor is contractually bound to the same compliance standards as the bank, providing a legal basis for oversight, enforcement, and potential termination for non-compliance. This is a fundamental component of third-party risk management within a sanctions compliance program.

A. Risk assessment methodology: This is an internal process for the bank to evaluate the vendor; it is not a contractual obligation placed upon the vendor within the service agreement.
B. Investigation procedures for reviewing alerts: These are detailed operational instructions. While the vendor must follow them, they are typically included in a separate Statement of Work (SOW) or procedural manual, not the main legal contract.
C. Ongoing filter tuning procedures: This is a highly technical and operational detail. The contract would require effective filtering but would not typically contain the specific procedures for tuning.

1. ACAMS Certified Global Sanctions Specialist (CGSS) Study Guide, 6th Edition. Chapter 4, "Sanctions Compliance Program Components," in the section on Third-Party Management, emphasizes that contracts with third parties must include provisions requiring adherence to the institution's compliance policies and all applicable laws and regulations. This establishes the legal framework for the vendor relationship.

2. The Wolfsberg Group. (2019). Guidance on Sanctions Screening. Section 5.3, "Outsourcing," page 19, states: "The FIs should ensure that there is a written agreement/contract in place which clearly sets out the obligations of the service provider... The agreement should also include... a requirement to comply with the relevant legal and regulatory requirements..."

3. U.S. Department of the Treasury, Office of Foreign Assets Control (OFAC). (2019). A Framework for OFAC Compliance Commitments. Page 8, under the "Internal Controls" component, discusses the importance of ensuring that vendors and counterparties perform as expected to support the organization's sanctions compliance program. This is enforced through contractual obligations.