Estimated read time: 7 minutes | Category: Compliance & Risk
Key takeaways
- Regulators are moving to principles-based third-party risk management. That changes how examiners review vendors; it doesn’t mean less scrutiny of your loan servicing vendor.
- Most lenders classify their loan servicing platform as a critical or high-risk third-party relationship due to its impact on borrower servicing, compliance, and financial reporting.
- Examiners look for evidence, not assurances: current SOC reports, tested continuity plans, subcontractor visibility, and an exit strategy.
- The strongest lenders keep a living vendor evidence file instead of rebuilding one before every exam.
When an examiner reviews your vendor program, the question is rarely “Who is your loan servicing vendor?” It is “How do you know that vendor is managing risk on your behalf?” The difference matters. Your servicing platform is your system of record for every payment, balance, fee, and borrower contact. If it fails, mishandles data, or misapplies a rule; the regulatory consequences belong to you, not the vendor.
Expectations are also shifting. In September 2026, the federal banking agencies proposed replacing the 2023 interagency third-party risk management guidance with a streamlined, principles-based framework. The Federal Reserve also proposed a companion guide for community banks, and the agencies issued a joint statement on core service providers. The message is not “less oversight.” It is “oversight sized to the risk,” and for most lenders, loan servicing sits near the top of that risk list.
Here are the ten questions we see examiners asking most often, and the evidence that answers them.
Why Examiners Focus on Your Loan Servicing Vendor
Few third-party relationships touch as many risk areas at once. A loan servicing platform typically:
- Stores and processes borrower personally identifiable information (PII)
- Calculates interest, fees, and payoffs, and posts every payment
- Enforces compliance logic such as SCRA protections, state fee limits, and credit-reporting status codes
- Feeds the general ledger, investor reporting, and regulatory reports
That combination of operational, compliance, information security, and financial reporting risk is why examiners give the servicing vendor more attention than almost any other relationship. Recent banking-sector incidents have highlighted the risks associated with third-party service providers, including technology and document-processing vendors.
10 Questions Examiners Ask About Your Loan Servicing Vendor
- How did you determine this relationship is critical?
Examiners want to see a documented risk assessment that explains why the servicing platform is tiered the way it is. That means data sensitivity, transaction volume, borrower impact, and how hard the vendor would be to replace. Under a principles-based approach, the reasoning matters as much as the label.
- What due diligence did you perform, and how recently?
Expect requests for current SOC 1 Type II and SOC 2 Type II reports, along with bridge letters for any gap periods. Examiners increasingly ask whether you reviewed the complementary user entity controls (CUECs); the controls your own team must operate for the vendor’s controls to work. A SOC report sitting unread in a shared drive is not due diligence.
- Who are your vendor’s vendors?
Fourth-party risk is now firmly on the radar. Know which subcontractors your servicing vendor relies on for hosting, payment processing, statement printing, and communications. The vendor’s SOC report is the place to start. It names its subservice organizations, says whether their controls are included or carved out, and lists the controls those providers are expected to perform. The proposed guidance focuses on managing this risk through your vendor, so ask how the vendor reviews each carved-out provider’s own SOC report.
- How does the platform enforce compliance rules, and who owns the configuration?
This is where servicing differs from most technology relationships. Examiners will ask how SCRA rate caps, state-specific fees, payment-application rules, and credit-reporting codes are configured. They will also ask who approves changes and how regulatory updates are delivered. Be ready to show which rules the vendor maintains and which ones your team owns.
- Where does borrower data live, and who can access it?
Be prepared to describe encryption, access controls, privileged-user monitoring, and data retention. A frequently overlooked area is non-production environments: if developers or testers work with real borrower data, that significantly increases compliance and information-security risk.
- What happens if the platform goes down?
Examiners want to see business continuity and disaster recovery plans that have actually been tested, with documented results, recovery time objectives, and lessons learned. A plan that exists only on paper won’t satisfy them.
- What happens if you need to leave?
An exit strategy is one of the most commonly missing pieces. Can you extract complete, usable loan-level data on demand? What transition support does the contract guarantee? Recent lender failures have demonstrated how quickly servicing transfers can become a business continuity issue.
- How do you monitor the vendor on an ongoing basis?
Due diligence at signing is not enough. Examiners look for ongoing monitoring: service-level reporting, incident notifications, periodic business reviews, issue tracking, and escalation paths, with evidence that management actually reviews them.
- How are changes and releases controlled?
Every software release can change how payments post or fees calculate. Expect questions about release notes, regression testing, your own user acceptance testing, and how you validate that a release didn’t break a compliance rule.
- Do your contract terms support oversight?
Examiners review contracts for audit rights, breach-notification timelines, data ownership, subcontractor disclosure, and termination assistance. The new joint statement on core service providers specifically raises concerns about vendor practices that unreasonably limit an institution’s ability to perform due diligence or negotiate terms.
Build a Vendor Evidence File Before the Exam
The lenders who handle vendor exams most smoothly treat oversight as an ongoing record, not a scramble the month before the exam. A practical evidence file for your servicing vendor includes:
| Exam area | Evidence to keep current |
| Risk assessment | Criticality rationale, risk rating, annual review sign-off |
| Due diligence | SOC 1 and SOC 2 Type II reports, bridge letters, CUEC mapping, financial condition review |
| Fourth parties | Subcontractor list, the vendor’s oversight approach, concentration risks |
| Compliance configuration | Rule inventory (SCRA, fees, credit reporting), change approvals, regulatory update log |
| Information security | Access reviews, encryption standards, incident history, test-data practices |
| Resilience | BC/DR test results, recovery objectives, remediation tracking |
| Exit strategy | Data extraction plan, transition provisions, backup, or alternate options |
| Ongoing monitoring | SLA reports, business review minutes, issue logs, escalations |
If you want to go further, our guides on building audit-ready servicing operations and five compliance traps in loan servicing cover the internal controls that sit alongside vendor oversight.
What Good Vendor Transparency Looks Like
A strong loan servicing vendor makes your examiner’s questions easier to answer, not harder. At Shaw Systems, we think of transparency as part of the product. That is why we maintain SOC 1 Type II and SOC 2 Type II certifications, publish our approach to disaster recovery and business continuity, and hold regular business reviews with clients so oversight is built into the relationship rather than bolted on before an exam.
The same thinking shapes the platform itself. SPECTRUM keeps servicing, COLLECTIONS, and RECOVERY activity in a single system of record with an auditable history, so compliance configuration and changes can be traced. helps lenders keep real borrower data out of test environments, which addresses question five directly. Whether you run on premises or in the cloud, the evidence your examiner asks for should be easy to produce.
Decades of servicing experience also teach that the relationship matters as much as the software. As we covered in why vendor experience matters, the vendors that hold up best under examiner scrutiny are the ones that have been through many exams with their clients.
Frequently Asked Questions
Is a loan servicing vendor considered a critical third party?
In most cases, yes. Because the servicing platform holds borrower data, processes payments, and enforces compliance rules, most lenders and examiners classify it as a critical or high-risk relationship that warrants deeper due diligence and ongoing monitoring.
What is the difference between a SOC 1 and a SOC 2 report?
A SOC 1 report covers controls relevant to your financial reporting. For a software vendor, these are typically IT general controls such as access, change management, backup, and continuity. A SOC 2 report covers security, and it can also cover availability, processing integrity, confidentiality, and privacy, so check which criteria are in scope. SOC 2 reports test whether controls worked over time, not just whether they were designed correctly. Lenders may need both from a loan servicing vendor.
Does the 2026 third-party risk proposal reduce vendor oversight requirements?
Not in practice. The proposal is more principles-based and lets institutions tailor oversight to risk. For high-risk relationships like loan servicing, that still means rigorous due diligence, monitoring, and exit planning.
The Bottom Line
Examiners aren’t asking whether you trust your loan servicing vendor. They are asking whether you can prove that trust is warranted. Lenders who keep a current evidence file, understand their vendor’s controls and subcontractors, and have a credible exit plan turn vendor oversight from an exam risk into a demonstration of strong governance.
Want to see how Shaw Systems supports client oversight and exam preparation? Talk with our team.
Get news from Shaw Systems Associates, LLC in your inbox.