Bank regulators have delivered an unusually harsh rebuke to NCR Corp. for having inadequate back-office controls in its outsourcing unit.
The Federal Deposit Insurance Corp. has urged NCR's bank customers to take steps to ensure that the vendor provides adequate security for data it processes.
In a confidential letter to NCR customers, the FDIC said it had found "weaknesses in data security, [softwarel program change control procedures, production control and contract guidelines."
Letter Details Complaints
The weaknesses were "serious and may adversely affect" the processing services provided to banks, according to a copy of the letter obtained by the American Banker.
Jim Wise, vice president of NCR's data services division, acknowledged that regulators had criticized the unit after an examination.
He declined to discuss the results of the examination, but noted that NCR's policy is to "take each recommendation [from regulators] and respond to them."
It is unclear what impact, if any, the rebuke will have on NCR's outsourcing business, which is one of the industry's oldest and largest Some customers played down the seriousness of the problem and said it would not affect their ties to NCR. But at a minimum, it represents an embarrassing episode.
Serves 750 Institutions
NCR, which is owned by American Telephone and Telegraph Co., runs a network of 10 computer facilities that act as the operational nerve centers for 750 financial institutions around the country, processing crucial financial transactions and maintaining important bank, records
NCR is also one of the largest makers of automated teller machines and general-purpose computers -- operations that were not in the examination.
Outsourcing companies are periodically examined by regulators to ensure that they do not endanger the institutions they serve. In the process of their exams, regulators normally point out to the outsourcers relatively minor problems they observe.
But it is rare for regulators to rebuke a vendor as strongly as they did NCR, industry experts said.
"It shouldn't be normal to have large outsourcers adversely affecting financial institutions," said a bank regulator who asked not to be named.
A senior official with an NCR competitor, also requesting anonymity, said he had heard of only one other instance in 14 years in which an outsourcer had been criticized as strongly as NCR.
Most sources spoke on the condition of anonymity since they can be fined or imprisoned for discussing regulatory examinations, the results of which are supposed to be known only by authorized parties.
Regulators normally mail copies of their reports to the top executives of the banks that contract with the outsourcers.
Several Regulators Involved
The banks are then responsible for making sure the vendors follow the examiners' recommendations.
Since outsourcing companies usually serve a range of banks, the examinations of these companies typically involve several agencies.
In this case, Dayton-based NCR was audited by the Federal Reserve Bank of Cleveland, according to the letter obtained by the American Banker.
The letter, which was sent in February, was signed by Nicholas J. Ketcha Jr., director of the Federal Deposit Insurance Corp.'s New York regional office.
Officials of three banks that obtained outsourcing services from NCR -- also requesting anonymity -- said they too had received from regulators a negative examination report on NCR.
The officials said that while the reports initially alarmed the senior management at their banks, the problems appeared to be rather technical upon further examination - and not a danger to the institutions' safety.
The bankers added that NCR has outlined a reasonable plan for fixing the problems outlined by the regulators.
Each of the bankers also said that the report has had no effect on their relationship with the vendor.
The official with the NCR competitor said he, too, had seen a copy of a negative letter similar to the one obtained by this paper. But he added that the negative exam had not resulted in his company picking up any business from NCR.
An FDIC spokeswoman in Washington declined to comment on any aspect of the examination.
