For most community banks, the core processor is the most important vendor in the building and the one with the least negotiating leverage. On Sep 11, 2026, the Federal Reserve, FDIC and OCC put that relationship on the supervisory agenda with a joint statement on community banks' engagement with core service providers. Unlike the proposed TPRM guidance released the same day, the statement had no comment period. It is in effect now.
If your core contract has been sitting in a drawer since the last renewal, this is the time to pull it out.
What the joint statement says, and what it doesn't
The statement treats core providers as among community banks' highest-risk relationships and acknowledges that market concentration can limit a bank's ability to negotiate. According to Mayer Brown's summary, it identifies provider practices that may inform supervisory and enforcement decisions, including:
- Transparency with community banks
- Contract features that impede exit or the use of supplemental services
- Technology investments
- Handling of computer security incidents
- End-of-support and end-of-life asset management
- Demonstrated operational resilience
Coverage of the statement, such as this Wallcrest Media piece, highlights specifics like deconversion fees, back-billing windows, restrictions on integrating other vendors' software, and pricing that is hard to understand.
What it does not do is prescribe new contract terms. Nobody is going to renegotiate your contract for you. What changed is that examiners now have a public list of practices to ask you about, and "we didn't look" is a weak answer.
One note for credit unions: NCUA joined the proposed TPRM guidance but not this joint statement. The questions below are still the right ones to ask your core provider. Just don't tell your board the statement applies to you directly.
Read your contract the way an examiner will
Set aside two hours with the master agreement, every amendment, the current order forms and the last 12 months of invoices. Then work through these:
Exit
- What does deconversion cost, and is the fee fixed or "at then-current rates"?
- How much notice do you need to give, and when does the auto-renewal window close?
- In what format and how quickly do you get your data back, and does that include history, images and configuration?
Billing
- Is there a back-billing window? How far back can the provider invoice you?
- Could someone outside the vendor management team read last month's invoice and explain every line?
- Are price increases capped, and is the cap tied to something you can verify?
Integration and supplemental services
- Does the contract restrict you from using other vendors' products alongside the core, or charge extra for interfaces and API access?
- Who owns the interfaces you have already paid to build?
Security and resilience
- How quickly must the provider notify you of an incident, and what information are they required to give you?
- What evidence of resilience do you actually receive: SOC reports, test results, recovery time objectives that were demonstrated rather than promised?
- Which of the systems you depend on are approaching end of support, and what is the provider's plan?
Fourth parties
- Which subcontractors and data centers sit behind the core, and does the contract require notice when they change?
Write down what you find, even when the answer is "the contract is silent." Silence is a finding.
Don't wait for renewal to start
Your leverage is highest a year or more before a renewal or term end, while the provider still wants to keep you and you still have time to look at alternatives. It is easy to start too late when nobody owns the date.
- Put the notice date on the calendar of someone senior, with a reminder a year out.
- Build a short list of renewal asks, ranked: the two or three terms that matter most if things go wrong, and a few you can trade away.
- Talk to peers. Banks on the same core often face the same terms. Associations and user groups are a legitimate place to compare notes on contract practices.
- Fix what you can without renegotiating. Better invoice review, a documented exit plan and a tested data extract don't require the provider's signature.
Treat concentration as a resilience problem
Concentration risk is not only about your bank having one core. It is about a large share of the industry depending on a handful of providers. The Change Healthcare outage showed what happens in another sector when one provider stops: work halts for everyone downstream at once, and nobody can switch quickly.
For your core, that means having a realistic answer to "what do we do if the core is down for a week?" Paper procedures, manual posting limits, customer communication scripts and a clear decision-maker are part of that answer. We covered the warning signs in Single Point of Concentration = Failure.
What to do this week
- Find the current core agreement and every amendment. If no one can produce them in a day, that is your first finding.
- Write down the renewal or notice date and who owns it.
- Pull three months of core invoices and check whether each line ties to the contract.
- Ask your provider for its current SOC report and its end-of-life roadmap for the systems you use.
- Give the board a one-paragraph status: contract term, exit cost as written, top three gaps.
If you want a second set of eyes on the contract, our Core Contract Health Check reviews it against the practices named in the joint statement and gives you ranked renewal asks and a one-page board summary in two weeks.
Want to talk through your core contract? Book a 30-minute call.