The government moves at the speed of a glacier with a bad hip. But every once in a while the glacier actually gets somewhere.
On September 11, 2026, the Federal Reserve, the FDIC and the OCC issued a Joint Statement on Community Banks’ Engagement with Core Service Providers (see also OCC Bulletin 2026-47). The Fed followed up on October 5 with SR 26-7, asking the Reserve Banks to distribute it to the institutions they supervise. In plain English, the regulators said out loud, in writing, what bankers have grumbled about in conference hallways for twenty years.
I read it twice. I smiled both times.
The agencies call core providers community banks’ “most material, complex, and highest-risk third-party relationships.” They also acknowledge that “a significant percentage of the core provider market is represented by just a few large providers, which limits CBOs’ negotiating power.” Translation: the Big Three Oligopoly holds the cards, and Washington finally noticed.
Then they got specific. When deciding how closely to supervise a core provider, the agencies will weigh contract terms and practices including:
They also flagged transparency, including service level agreements “using measurable performance standards,” and technology resilience.
Here is the part that should make every vendor’s general counsel sit up straight. The agencies say certain core providers may qualify as “institution-affiliated parties” under the Federal Deposit Insurance Act and “may be held liable for the practices or violations of a CBO.” That is an enforcement hook, not a suggestion.
Let’s not get carried away. This is a supervisory statement, not a new rule. It doesn’t rewrite a single contract you’ve already signed. NCUA didn’t sign it, so credit unions aren’t directly covered. But if you run a credit union on the same core, under the same paper, written with the same pen, the logic applies to you just the same.
And the regulators were careful to keep your name on the hook too. The statement says it “does not eliminate or reduce a CBO’s responsibility” for safe and sound practices, “regardless of whether they are outsourced to a third party.”
Would you let a borrower off the hook because his accountant wrote a bad tax return? Of course not. Neither will your examiner. The pendulum is swinging toward institutions, but the vendor management burden is still yours to carry.
Nineteen years ago we started introducing banks and credit unions to the exact same solutions to the exact same problems the government is now pointing out. Since 2010 I’ve stood in front of bankers in at least 100 presentations telling anyone who would listen about the one-sided deals these vendors hand the market.
In 2016 we launched the Golden Contract Coalition and got the attention of media across the country. The ABA took a real interest and wanted to understand what we were shouting from the mountaintops. A short time later it started the Core Platforms Committee to build on what the coalition had begun. Imitation, as they say, is the sincerest form of flattery.
Credit where it’s due: the ABA and other advocacy groups have pushed on this for years, and their heart is absolutely in the right place. But the committee ran into a wall quickly. Now, I wasn’t in the room, so take this for what it’s worth: the bankers on the committee were reportedly reminded that they couldn’t talk openly about their existing core agreements without running afoul of their confidentiality clauses. If that’s even half true, it explains a lot. When the people at the table can’t talk about the very contracts they came to fix, the conversation is over before it starts.
The lesson the industry learned is the one we bet on from day one. An advocacy organization, whether it’s a trade association or the government, is built to lobby, educate and convene. It isn’t built to go toe-to-toe with a vendor across the negotiating table. Holding the Big Three accountable takes free market forces: banks pooling their data, their buying power and their willingness to walk. That takes capitalistic chops, and that’s exactly why the Golden Contract Coalition exists.
Like a steer in a field of heifers: lots of interest, no idea what to do.
Over the years, more than one law firm has approached me about pulling together a class action against these suppliers. They know there’s something there. Maybe this statement finally shifts the focus squarely onto vendor behavior, once and for all.
It’s about time. And we’re proud to have led the charge.
The statement gives you something new: cover. Push back on these terms and you’re not being difficult. You’re doing what your regulators just said matters. Here’s how to map the four practices to contract language.
Opaque pricing. Benchmark every line item against Fair Market Value. The Paladin Blue Book exists for exactly this. When you negotiate without data, you’re guessing.
Opaque billing and back-billing. Require itemized invoices you can reconcile, and cap back-billing at a short, defined window or kill it entirely. If the vendor can’t bill it correctly the first time, why should you pay for its sloppiness three years later?
Deconversion fees. Define them in dollars, in the contract, today. Waive them when the vendor is at fault. And make sure any early termination penalty reflects what the vendor actually loses when you leave, not a windfall built on revenue it will never have to earn.
Think about the logic. When you leave, the vendor stops paying to serve you. Its servers, its support staff and its processing costs go away along with your fees. A penalty that charges you for most of the remaining contract anyway isn’t compensation. It’s a toll booth on the way out. The difference between a fair clause and a bad one can easily run into the millions at the exact moment you need flexibility most, like a merger or a conversion. Would you charge a depositor an early withdrawal penalty bigger than the CD itself? Your vendor would.
And business is good. Jack Henry reported $42.8 million in deconversion revenue for its fiscal year ended June 30, 2026, up from $33.9 million the year before, according to its fiscal 2026 results. That’s roughly a 26% jump in what banks paid on their way out the door, much of it when a client bank is acquired and its contract ends early. And to be fair, Jack Henry is simply the one disclosing it. Nice work if you can get it.
Integration limits. Demand open APIs and lock in integration pricing before you sign. They’re building toll roads, not highways, to your own data.
Finally, demand real SLAs, not SLOs. SLAs have teeth. SLOs are suggestions. You want measurable standards, credits that hurt, and the right to exit for cause without penalty.
None of this works if you wait until the last minute. Open talks 24 to 30 months before expiration, and plan to sign in the Sweet Spot, 18 to 24 months out. Stay out of the Red Zone, under 18 months, where your leverage evaporates and the vendor knows you can’t convert in time even if you wanted to. Kill the auto-renewal clause today. And never negotiate alone.
The appetite for change is real. A recent CSBS survey, reported by the ABA Banking Journal, found more than a quarter of community bankers dissatisfied with their cores and fewer than half satisfied. That’s a lot of unhappy customers for a supposedly healthy marriage.
The regulators did their part. Now it’s your turn. Pull that core contract off the shelf, blow the dust off it, and read it against the four practices above.
If you’d like a second set of eyes, I’ll do a free, no-obligation contract assessment. Schedule a 15-minute call with me directly at asilva@paladin-fs.com or 877-746-4859 x 704. And if you want to stand with other banks and credit unions demanding fair terms, join the Golden Contract Coalition at goldencontract.com.
Washington finally woke up. Don’t sleep through it.