Bank and credit union — third-party agreement (Interagency Guidance on Third-Party Relationships, 2023)

Ongoing-monitoring record. Provider acknowledges that Bank will obtain, at onboarding and no less than monthly during the term, a dated read of the SAM.gov Exclusions public extract, the OFAC Specially Designated Nationals list, the Consolidated Screening List, SEC EDGAR filings by CIK where applicable, and the CFPB Consumer Complaint Database for Provider's exact legal name, together with the line-by-line changes since the previous read. The record shall state, for each source: the source's own file date or the read time, the official key (UEI, NPI, EIN, CIK or CCN) or the exact printed name used, the rows returned verbatim, and any source that was not read or did not answer. The record shall carry a SHA-256 of its canonical content and shall conform to the Alpha Covenant Receipt Format v1 (an open specification, CC BY 4.0, at https://alphacovenantholdings.com/spec), so that any party may recompute the hash and re-run the read. The record is evidence of what the files printed on a date; it is not a representation by the record's producer about the party's eligibility, identity or compliance, which remain the responsibility of the party and the reviewing officer. Bank's assessment of the record is Bank's own and is documented in Bank's third-party file.