Your institution is. The 2023 interagency third-party guidance says a banking organization's use of third parties does not diminish its responsibility to meet legal and regulatory requirements. Contracts can allocate remediation, indemnification and notification duties to the vendor, but regulators will still look to you for oversight and outcomes.
