Bank vendor spend beyond the core: put TPRM to work on cost

Digital banking, card processing, agencies and deposit media renew by default. The vendor file you keep for examiners is also your best cost tool.

The core contract gets the board's attention once every seven years. Most of the other vendor spend in a bank or credit union gets renewed by default: the digital banking platform, the card processor, the marketing agency, the media that buys deposits. Each of these sits under its own owner, on its own term, with its own auto-renewal clause.

There is a tool already built to fix this. Most institutions just point it in one direction only.

Your TPRM program is already a cost file

On June 6, 2023, the OCC, Federal Reserve and FDIC issued final interagency guidance on third-party relationships. It sets out a five-stage life cycle: planning, due diligence and selection, contract negotiation, ongoing monitoring, and termination. It says practices should be commensurate with the bank's risk profile and complexity, and that not every relationship carries the same risk or criticality.

Read the contract negotiation section with a CFO's eye. Among the provisions banks are told to consider are costs and compensation, performance measures or benchmarks, and default and termination. The guidance also expects banks to be able to exit a relationship in an efficient manner, whether the work moves to another provider, comes in-house or stops.

That is a cost program. The inventory, the criticality tiers, the contract terms, the performance reviews and the exit plans are exactly what a vendor renegotiation needs. In most institutions they live in a risk team's system that finance never queries.

The rules are changing, but the point holds. In September 2026 the OCC, with the Fed, FDIC and NCUA, proposed revised guidance that would replace the 2023 version (OCC Bulletin 2026-46). The proposal pushes institutions to match effort to each relationship's risk and to avoid treating every third party as high risk. Until it is final, the 2023 guidance stands. Either way, the data you collect for examiners is the data you need for cost.

We have written separately about what slow vendor risk reviews cost a bank. This piece runs the other direction: using the same program to cut what you already pay.

Digital banking platforms

Digital banking contracts run on long terms too. Q2 Holdings says in its fiscal 2025 10-K that the initial term of its digital banking platform agreements averages over five years, and that growth in its digital banking revenue depends on increasing registered users.

What to check:

• User tiers. Pricing tied to registered users ratchets up as you grow. Check whether inactive users count, and whether tiers ever step down.
• Overlap with the core. Bill pay, person-to-person payments, alerts and account opening often exist in both the core vendor's catalog and the digital platform's. Paying twice for one function is easy to miss when two teams own the contracts.
• Integration fees. The digital platform has to talk to the core. Find out who charges for that connection, and whether you are paying both sides.
• Coterminous dates. If the digital contract ends two years after the core, you lose the option to rebid them together.

Card processing

Card programs tend to be bundled, and bundles hide price. Jack Henry's fiscal 2023 10-K says its outsourced data processing and payment processing contracts generally run seven years or more. Card processing signed alongside the core often inherits the core's term without anyone deciding it should.

Ask for three things before renewal. A fee schedule that separates network pass-through costs from the processor's own markup. A termination clause that does not depend on the core contract. And per-transaction pricing tested against current volume, not the volume assumed at signing.

Marketing agencies and deposit-acquisition media

This is where spend has been growing. An ABA-sponsored 2026 survey of 121 institutions, written up by Capital Performance Group in the ABA Banking Journal, found deposit growth took the largest average share of marketing budgets at 30%, with new customer acquisition at 23%. Growth objectives combined took 73%. Some 85% of respondents planned to increase digital advertising.

Deposit media is a funding cost wearing a marketing label. Treat it like one. Every campaign should report the cost per dollar of retained deposits, and someone in finance should compare that against your other funding sources. If the agency cannot produce that number, the problem is the contract, not the creative.

Agency contracts in banking carry the same issues as anywhere else: who owns the ad accounts and the data, whether media is billed at cost, what the agency earns from platforms and vendors, and how fees are set. We cover those terms in our marketing procurement work. The difference in a bank is that the agency is a third party under your TPRM program, so you already have the right to ask.

Turning the program toward cost

• Add three fields to the vendor inventory: annual spend pulled from payables, term end with notice date, and fee basis. Now the risk inventory doubles as a renewal calendar.
• Use criticality to set lead time. Critical vendors such as the core need 24 to 36 months, as we set out in the core processor contract. Lower-risk vendors can be rebid in a single quarter.
• Use monitoring in the negotiation. The annual performance review already compares the vendor to its service levels. Put the price next to it. Missed service levels are a reason to renegotiate, not just a finding.
• Make the exit plan real. The guidance asks for one. A costed exit plan with a named alternative is also the strongest negotiating position you can hold.
• Run one joint review a year. Risk and finance in the same room, going through the top 20 vendors by spend.

Start this month by exporting the vendor inventory and joining it to twelve months of payables. Sort by spend, add term end dates, and circle anything renewing in the next 18 months. If you want an outside team to run that first pass, our four-week Diagnostic is built for it.

Sources: OCC, Bulletin 2023-17: Interagency Guidance on Third-Party Relationships, Hunton Andrews Kurth, FDIC, FRB and OCC issue interagency guidance on third-party relationships, OCC, Bulletin 2026-46: Third-Party Risk Management Proposed Guidance, Q2 Holdings, Form 10-K for fiscal 2025, Jack Henry & Associates, Form 10-K for fiscal 2023, ABA Banking Journal, The state of bank marketing budgets and staffing in 2026.