RULES OF THE TENNESSEE DEPARTMENT OF FINANCIAL INSTITUTIONS CHAPTER 0180-13 ELECTRONIC DATA PROCESSING SERVICER EXAMINATION AND CONTINGENCY PLANNING

RULES OF THE TENNESSEE DEPARTMENT OF FINANCIAL INSTITUTIONS CHAPTER 0180-13 ELECTRONIC DATA PROCESSING SERVICER EXAMINATION AND CONTINGENCY PLANNING TABLE OF CONTENTS 0180-13-.01. Definitions 0180-13-.02. Report Distribution Policies and Procedures 0180-13-.03. Agreement and Prior Approval Required 0180-13-.04. Contingency Plan Required 0180-13-.01. DEFINITIONS. (1) Serviced Institution — a state-chartered financial institution which receives data processing services. (2) Servicer — any data center which provides data processing services for state-chartered financial institutions. (3) State chartered financial institution — for the purpose of this rule, state-chartered financial institutions include those financial institutions which are chartered and regulated by the department of financial institutions, which institutions shall include, but are not limited to, state-chartered banks, credit unions, savings and loan associations, industrial investment companies, industrial loan and thrift companies and trust companies. Authority: T.C.A. §§ 45-1-107, 45-2-616, 45-3-801, 45-4-1001 and 45-5-501. Administrative History: Original rule filed February 19, 1985; effective May 14, 1985. 0180-13-.02. REPORT DISTRIBUTION POLICIES AND PROCEDURES. (1) Distribution of the commissioner’s examination report comments to serviced institutions will be made only when in the opinion of the commissioner the financial condition or operations of the servicer could adversely or materially affect the serviced institutions. The commissioner shall notify the management of the data center of his intent to distribute report comments. Such notification shall be provided in the cover letter transmitting the completed report to the data center. (2) When it is determined by the commissioner that conditions of the servicer require distribution of the report, he shall distribute the report comments to the affected serviced institutions. (3) A transmittal letter will be used to advise each recipient that the comments are for their internal use only, are not to be construed to satisfy audit requirements, and remain the confidential property of the sending agency. A written receipt will be obtained from each recipient. (4) Whenever report comments are to be distributed to serviced institutions, they will be limited to the examiner’s conclusions, recommendations, and comments. Matters of a proprietary or competitive nature relating to the servicer shall be excluded from report comments prepared for distribution to serviced institutions. (5) Notwithstanding the above, the commissioner may in his discretion give the servicer up to ninety (90) days to respond to corrective action before reporting the status of uncorrected deficiencies to the serviced institutions. If in the opinion of the commissioner sufficient corrective action is taken by the servicer, no report shall be made to the serviced institutions. Authority: T.C.A. §§ 45-1-107, 45-2-616, 45-3-801, 45-4-1001 and 45-5-501. Administrative History: Original rule filed February 19, 1985; effective May 14, 1985. ELECTRONIC DATA PROCESSING SERVICER EXAMINATION CHAPTER 0180-13 AND CONTINGENCY PLANNING 0180-13-.03. AGREEMENT AND PRIOR APPROVAL REQUIRED. (1) Any state-chartered financial institution entering into an agreement with an electronic data processing (EDP) servicer shall notify the commissioner in writing within at least thirty (30) days prior to entering into such agreement. The commissioner may for good cause disapprove the financial institution’s choice of servicer upon written notice to the institution before the expiration of the thirty (30) days. The commissioner’s failure to either approve or disapprove the servicer within the thirty (30) days shall be deemed approval or the servicer. (2) Any state-chartered financial institution which desires to discontinue service with an electronic data processing (EDP) servicer and begin to perform this function in-house shall notify the commissioner in writing thirty (30) days prior to discontinuing the outside EDP service. (3) Any state-chartered financial institution entering into an agreement with an electronic data processing (EDP) servicer shall execute a written agreement with such servicer which shall include the following or similar language approved by the commissioner: AGREEMENT This AGREEMENT entered into as of the _______ day of _________________, 19_____, between _________________________________________________, hereafter referred to as __________ and ___________ (financial institution) the provider of Data Processing Services, hereafter referred to as the Servicer. WITNESSETH WHEREAS, the financial institution is a state chartered financial institution operating under the laws of the State of Tennessee and subject to the jurisdiction of the Commissioner of Financial Institutions, State of Tennessee; and WHEREAS, Servicer is a provider of Data Processing Services and desires to provide said services to the financial institution; and WHEREAS, Tennessee Code Annotated Section 45-2-616 provides that a financial institution chartered by the State of Tennessee may preserve its records with any person who agrees in writing to submit its operations to the examination of the Commissioner; NOW, THEREFORE, in consideration of the foregoing, the terms and conditions set forth herein and any other good and valuable consideration, the receipt and sufficiency of which is hereby acknowledged, the parties agree as follows: I The Servicer agrees that pursuant to Tennessee Code Annotated, Section 45-2-616, upon entering into a contract to provide data processing services to the financial institution it will subject itself to the law of the State of Tennessee and rules and regulations promulgated by the Department of Financial Institutions. This includes allowing the Commissioner of Financial Institutions or his agents to examine the operation of the data processing center and retain copies of the magnetic tapes containing records of the financial institution for a reasonable period of time. IN WITNESS WHEREOF, ___________________ and _________________ have caused this Agreement to (financial institution) (Servicer) be executed by their duly authorized officers as of the day and year first above written. (Financial Institution) BY: President ELECTRONIC DATA PROCESSING SERVICER EXAMINATION CHAPTER 0180-13 AND CONTINGENCY PLANNING (Servicer) BY: President (4) A copy of the written agreement by and between the serviced institution and the servicer shall be forwarded to the commissioner upon execution. (5) At the time the electronic data processing servicer enters into such a written agreement with the financial institution, and at such other times as the Commissioner may require, the electronic data processing servicer shall also be required to provide information to the Department concerning its current status which shall include, among other things, the following information: (a) a current financial statement certified by any managing official of the servicer; (b) a list of all Tennessee state chartered financial institutions serviced by the servicer and the location of the data center from which such service is provided; (c) the number of employees of the servicer; (d) the location of the third party software escrow; (e) if the servicer provides processing, how back-up is provided; (f) a copy of the most current EDP audit; and (g) a listing of the servicer’s insurance, including the type, amount, and with whom the coverage is held. Authority: T.C.A. §§ 45-1-107, 45-2-616, 45-3-801, 45-4-1001 and 45-5-501. Administrative History: Original rule filed February 19, 1985; effective May 14, 1985. Amendment filed August 29, 1989; effective November 29, 1989. Amendment filed July 13, 1992; effective October 25, 1992. 0180-13-.04. CONTINGENCY PLAN REQUIRED. The Board of Directors of all state chartered financial institutions shall annually review and approve a comprehensive contingency plan that will minimize disruption of services to the institution and its customers, minimize financial loss and ensure a timely resumption of operations in the event of a disaster. This annual review and approval shall be noted in the minutes of the Board of Directors.