Defending Your CU in Core Processing &amp Outsourced Technologies Contracts

By Charles J. Nerko
March 17, 2023 at 09:00 AM

Fully grasp the worth of specifications, remedies and indemnities.

Provide: Shutterstock

One particular unique of the greatest dangers credit unions face comes from the vendors they trust to allow with their day-to-day operations. Core processors and other third-celebration vendors are generally perceived as specialists by the credit unions that employ them, but that perception can breed unwarranted complacency. Outsourced technologies providers have been recognized to expose credit unions to substantial security dangers. And even the largest core processors have been recognized to make computational errors that outcome in inaccurate records.

To safeguard themselves and their members, credit unions will want to negotiate total vendor contracts that clearly outline the vendor’s responsibilities and place liability on the vendor for any issues that surface. With out obtaining a robust contract, credit unions could face immense legal liability for issues triggered by their vendors.

For instance, if a vendor’s code infringes on a patent, the credit union may possibly possibly finish up facing an pricey intellectual-residence infringement lawsuit primarily for the reason that the credit union utilizes the infringing code. And if a vendor causes a data breach or miscomputes account records, the credit union could be on the hook for pricey client class action lawsuits.

It is vital for credit unions to make confident their core processing contracts and other outsourced technologies agreements shift liability to the culpable vendor and safeguard the credit union from these sorts of liabilities. The following three finest practices can allow a credit union steer clear of pricey lawsuits and safeguard its members:

1. Specify clear general efficiency specifications. Contracts should really seriously totally lay out the vendor’s responsibilities and the credit union’s rights to audit the vendor. The contract should really seriously set detailed expectations with measurable general efficiency benchmarks even though permitting sufficient flexibility to adapt to emerging cybersecurity dangers and adjustments in law.

Credit unions should really seriously use data and details uncovered in the due diligence approach to shape the general efficiency specifications set forth in the contract. Take a seem at the vendor’s litigation history to see if they’ve triggered issues for other credit unions or banks in the prior. This data and details can allow credit unions steer clear of dealing with troublesome vendors or craft general efficiency specifications that steer clear of equivalent issues. Various of the most revealing details from prior litigation are not provided by indicates of net searches, so credit unions should really seriously turn to an lawyer capable of performing a nationwide court docket search to analyze this data.

two. Set remedies that incentivize the appropriate behavior. The contract should really seriously involve issues like reporting processes, escalation procedures and remedies for nonperformance that motivate the appropriate behavior. The vendor should really seriously be held accountable for their service offerings and compensate the credit union appropriately when the vendor falls swift.

3. Protected a meaningful indemnity. An indemnity implies that the vendor should really seriously be accountable for legal claims that arise due to their technologies. With out obtaining a properly crafted indemnity, the credit union could finish up assuming liability for issues that should really seriously have been the vendor’s duty.

Make confident the indemnity can be deployed in actual practice. Some core processors will provide an indemnity if they generate inaccurate records, nevertheless, far down in an unrelated section of the contract, hide a requirement for the credit union to overview all its records and report discrepancies by the subsequent firm day. This onerous requirement renders the indemnity meaningless. Added, credit unions should really seriously overview the vendor’s insurance coverage coverage policies to make positive the indemnity has appropriate financial backing.

In summary, technologies contracts are vital threat management tools for credit unions. It is crucial to have an skilled technologies lawyer craft and overview these agreements to make confident they are appropriately detailed and protective. And when issues arise, skilled technologies litigators can allow credit unions protected financial recoveries from their vendors.

Charles Nerko

Charles J. Nerko is co-leader of the cybersecurity group and a companion in the industrial litigation and financial institutions and lending practice areas at the law firm of Barclay Damon LLP mainly primarily based in Buffalo, N.Y.