Services level. Services levels should be defined. For example, are the service to be made available 24/7 365 days a year or are they only needed during normal business hours. When the services involve some type of software or online technology, what is the minimum amount of “uptime” required? Depending on the services involved, uptime might be 99.9%, for example. vendors will understandably push back on that figure and might suggest 98%. The right figure need not be either one of those numbers and is dependent on the type of service being provided and its criticality to the bank’s delivery of services to its customers. To the extent there is planned downtime for things such as software updates it should occur during off peak time periods. Service level measures can be used to motivate the third party’s performance, penalize poor performance, or reward outstanding performance. Performance measures should not incentivize undesirable performance, such as encouraging processing volume or speed without regard for accuracy, compliance requirements, or adverse effects on customers. Certain products and services have standards that are common across the industry while others may need to be developed to fit the particular transaction. Service levels should be revisited from time to time during the term of the relationship to provide an opportunity for them to evolve along with the services being provided.
Banks should consider what type of reporting they want the vendor to provide considering performance against the service level targets and what type of remedies to which the Bank is entitled in the event vendor fails to measure or report on the service levels. Banks should also consider including requiring a root cause analysis for incidents and service level failures. In other words, it is not just sufficient to report a failure, what caused the failure and exactly what needs to be done to remedy it. It can be very frustrating when a vendor’s performance affects customers and the bank is unable to explain to those customers how a problem is being fixed so that it will not reoccur.
One option to consider when addressing service levels is whether the service level requirement is an “all or nothing” target or whether it is merely one factor in determining whether the bank is entitled to credits against its normal monthly billing for the services. For example, if the service level on average for any given month is at 95%, perhaps the bank receives a credit against fees owed. If the service level falls below 95% then the contract may provide that such an event constitutes a material breach allowing the bank to terminate the contract.
Vendor reports. The vendor should provide and retain timely, accurate, and comprehensive information such as records and reports that allow bank management to monitor performance, service levels, and risks. Thought should be given to how long the vendor is required to maintain the records. That will play into audit requirements. The reports should include performance reports, control audits, financial statements, security reports, BSA/AML and Office of Foreign Asset Control (OFAC) compliance responsibilities and reports for monitoring potential suspicious activity, reports for monitoring customer complaint activity, and business resumption testing reports.
One element of reporting concerns how quickly the vendor determines that a problem has occurred. Depending on the services being provided, one may expect that the vendor will have in place automatic monitoring of services. The detection of a defect should then in turn trigger a report to the bank together with a proposed temporary fix/workaround and a resolution of such failure in accordance with agreed upon timeframes.
Breach and Termination.
Non-Material Defaults: What happens if the vendor is unable to meet its obligations under the contract? In some instances this may simply be a monetary issue and treated by an adjustment of fees. Certain non-material defaults may simply trigger a notice and a right to cure as well as a minor adjustment on fees. Failure to cure the defect or provide a temporary fix might elevate the matter to a more material breach.
Automatic Termination Events. In certain instances, however, a bank may wish to have the absolute right to terminate the contract with the vendor. For example, a bank should be able to terminate a contract in whole or in part if the vendor has breached the confidentiality or data privacy provisions, or if the service level failures are of a significant magnitude or because of the vendor’s intentional refusal to perform the services. Likewise, (i) the vendor’s failure to remediate significant deficiencies within a specified period of time after receipt of notice; (ii) or material weaknesses in the vendors Service Organization Controls Report (“SOC”); (iii) the vendor’s bankruptcy, (iv) a change of control without the bank’s consent; (v) extended force majeure events, and (v) bank regulatory directives to terminate, should give the bank the right to immediately terminate the contract without incurring substantial penalties. Consideration should be given to how much notice is necessary and the time frame to allow for the orderly movement of the services to another third party vendor. Upon termination the vendor should be obligated to return or destroy the bank’s data and other resources.
Termination for Convenience. Another typical provision is “termination for convenience.” This simply means that the bank has decided for various business reasons that it no longer wishes to be party to the contract with this particular vendor. The bank needs to be aware, however that a termination for convenience usually will trigger some type of payment obligation on the part of the bike to the vendor. In some instances the vendor may require a pro rata portion of the unpaid fees for the life of the contract in order to allow for the termination. These fees can be significant and banks should review the exact terms of such provision very carefully prior to signing the contract. As part of the services, the contract should define the vendor’s obligations to facilitate the orderly, uninterrupted transfer and transition of the services back to Bank or to another service vendor, including the continued provision of the services for a reasonable period of time to allow the transition to occur. The obligation to provide this termination/expiration assistance should apply regardless of which party terminates the contract, unless the vendor is terminating due to Bank’s payment default.
Termination Assistance. Depending on the type of contract involved, the bank may need substantial cooperation and assistance from the exiting vendor to move the work being provided to either a new vendor or into the back office of the bank itself. The contract should clearly assign all costs and obligations associated with transition and termination so that the parties understand this allocation at the inception of the relationship. Upon the termination the contract should provide for the timely return or destruction of the bank’s data and other resources and ensure the contract provides for ongoing monitoring of the third party after the contract terms are satisfied as necessary.
Dispute resolution. It is not unusual for the bank and the vendor to get into disagreements about whether the vendor is performing under the contract. While a formal mediation or arbitration process is always something that is available, a more practical approach is to establish a more informal process where each side designates relationship managers who are required to meet within a specified time period, say seven days after the notice of the dispute, to try and reach an agreement about the nature of the deficiency and the corrective action to be taken. If they are unable to reach an agreement they then prepare a written reports to senior management and management attempts to resolve the matter. The typical provision includes a statement that the parties will seek to resolve the problem in good faith for a specified period of time. The dispute only goes to mediation, arbitration or litigation if all of the informal processes fail.
Foreign Based Vendors. It is important when negotiating a contract with a foreign vendor that the contract include choice-of-law covenants and jurisdictional covenants that provide for adjudication of all disputes between the parties under the laws of a single, specific jurisdiction. You should understand, however, that such contracts and covenants may be subject to the interpretation of foreign courts relying on local laws. Foreign courts and laws may differ substantially from U.S. courts and laws in the application and enforcement of choice-of-law covenants, requirements on banks, protection of privacy of customer information, and the types of information that the vendor or foreign governmental entities will provide upon request.
Choice of Law. If at all possible the bank is going to want the choice of law provision concerning what law applies to the interpretation and enforcement of the contract to specify the state in which the bank is located. Large national vendors will generally do the same and will seek to choose the state where they are located. Does it really make that much difference? In some instances it might. Some states recognize different legal causes of action against a party and thus legal exposure may differ depending on the jurisdiction whose laws are being applied. It may very well be that the commercial law in both states are similar enough that is does not really make a big deal but you should certainly be asking the question if the vendor has sufficient leverage to cause the choice of law to be another state than where the bank is located.
Some states, such as New York, have adopted laws that essentially encourage parties to a contract, even ones that have no physical ties to New York, to choose the law of that state for the interpretation of the contract. Whether a particular court will honor the choice of law provision can be complicated issue that revolves around public policy concerns and conflicts of law provisions.
Jurisdiction or Forum. Jurisdiction is sometimes confused with choice of law but it is a separate issue. Jurisdiction addresses the question of where a dispute will be heard. For example, a typical provision might say that a dispute will be heard in the state or federal courts located in a particular city or state. A bank will generally seek to litigate contract disputes in its home state for several reasons. The first is cost. The bank generally already has local counsel that it can reach out to handle litigation. If the matter is going to be litigated in another state by lawyers who do not have a current relationship with the bank then expectations are that the costs will be greater. Out of state litigation also increases travel expenses and introduce other inefficiencies. Finally, parties can be worried about what is commonly referred to as “home cooking” where the perception is that a local judge and jury might be inclined to protect the local party.
Some contracts will contain several “WHEREAS” clauses at the inception of the document followed by a recitation of various facts about the parties and what they are trying to accomplish by entering into the contract. From a pure legal standpoint, “WHEREAS” clauses are not required but many parties like to include them to properly set the stage for what is to come afterwards. If they are included, the bank needs to review them, particularly those that describe the parties and the services that the vendor will perform. The recitals provide for an introduction to the parties and provide a high level overview of their agreement. It is a bit like looking at a topographical map and following two streams as they wind their way through the mountains before finally coming together.
If there is a gap between the direction indicated in the recitals and the body of the agreement then there may be legitimate questions about what the true intent of the parties was when they entered into the contract. That becomes significant when a dispute later arises about the work actually being performed as well as the service level of the work. The gap can be created when the vendor uses a version of the contract that was heavily negotiated for a different party but forgets to revert back to its standard form contract when submitting it to the bank. Sometimes it is evidence of lack of sophistication by the vendor who may have simply downloaded the contract off of the internet and uses it without fully understanding the legal implications. Sometimes vendors will respond that they have used a particular form for years and never had a problem. That is confusing luck with carefully draftsmanship.
Nature and scope of the work to be done.
What exactly are the services to be performed? One would expect that the contract will specifically identify the frequency, content, and format of the service, product, or function provided. It is vitally important that the people at the bank, who have the substantive knowledge about the services in question, together with legal counsel, review the scope of services and understand how it relates to other contracts the bank has entered into or strategic initiatives the bank is looking at. A significant factor to keep in mind is whether any fee triggered by an early termination of the contract is of such a size that it becomes a material roadblock to doing a merger or acquisition. There have been instances involving smaller community banks where the termination fee was so large in comparison to the consideration being paid in a planned merger that the deal fell though. Thus, other corporate strategic matters may drive the bank to negotiate a shorter agreement than the vendor normally seeks or to seek out another vendor altogether.
It doesn’t matter how many discussions you have had with the vendor about the scope of the work, if you can’t tell from the contract itself, whether it is in a numbered paragraph or on an exhibit, exactly what the vendor is going to do, the contract is too vague and needs to be revised. This is not something to be shy about. We tell clients and younger lawyers who are drafting documents to imagine someone sitting in a windowless room reading the contract. If that person could not figure out exactly what work the vendor is doing from reading the contract and its exhibits, the contract is faulty. The trap many people fall into is that after having had numerous conversations back and forth, they mentally fill in the details when they come to a section in the contract that is vague and think they know what the “agreement” actually is, regardless of what is actually put on paper. What happens, of course, is that both the representatives of the bank and the vendor can have slightly different recollections about what had been discussed and those differences can pose real problems once issues begin to arise during the life of the contract.
The description of the nature and scope should be fairly specific. A lack of clarity here means that the vendor may not be held responsible if it fails to deliver the services the bank was expecting. The parties should be as comprehensive as they possibly can in describing the scope of the services. In some contracts the parties will utilize what is referred to as a “sweep clause” which provides that certain services that are incidental to providing the specified services are also impliedly covered by the contract. The sweeps clause ensures that all services not described in the Contract, but necessary to provide those that are services described in the Contract are included in the quoted price. Without the sweeps clause, the vendor is only obligated to perform those services that are specifically defined in the Contract.
Descriptions that seem to come from a marketing brochure or state that they will be agreed upon post-closing may be too vague as to be enforceable The Bank should not be afraid to push back and demand that the contract spell out in detail exactly what products or services the vendor is going to be providing.
Include in the contract, as applicable, ancillary services as software or other technology support and maintenance, employee training, and customer service. Address whether training be onsite or remote. If the bank’s employees need to be trained onsite the contract should specify how much training is going to be required, i.e., is it something that is going to take an hour or do they need to set aside an entire day to complete. If the training will be on the premises of the bank you should consider security issues. For example, will the person doing the training need to access bank computers or networks? Will they be uploading any type of training software onto bank computers? The bank should have in place information security policies that the vendor must comply with. The fact that someone is doing training does not mean you should allow them unfettered access to computers and systems. For example, security protocols might include restricting vendor employees to computers that have no internet access, printers or devices for removable storage; limiting the use (or prohibiting altogether) mobile phones that have cameras.