Meridian's Eleven-Day Notification

Classification error drives everything else. A vendor that onboards customers, performs KYC, holds account access, and markets the product is a critical activity, not a technology vendor. Criticality should be assigned on the basis of what the vendor does and what happens if it fails, not on the vendor's corporate charter. The moderate rating is not defensible.

Due diligence and ongoing monitoring. A 26-month gap against a 12-month policy requirement is a self-identified violation. Monitoring should include periodic control attestations or SOC reports with review of exceptions and complementary controls, transaction and complaint metrics, financial condition, and regulatory status.

Contract deficiencies. The contract is unenforceable where it matters most:

• No audit rights, so the bank cannot independently verify controls it is relying on.
• No subcontractor or fourth-party approval, so the bank has no visibility into Meridian's subservice organizations.
• No incident notification deadline, which produced the eleven-day lag.
• A blanket assignment of legal responsibility to Meridian does not transfer the bank's regulatory obligations -- the bank remains accountable to its regulator and its customers.

The contract should be renegotiated with audit and examination rights, notification within a defined short window, subcontractor approval and flow-down obligations, data ownership and return, insurance, indemnification, and termination assistance.

Board visibility. Critical third-party relationships, concentration, and the results of monitoring belong in board reporting. The current arrangement appears not to have crossed that threshold internally.

Bank service provider notification. Under the interagency computer-security incident notification rule, a bank service provider must notify affected banking organization customers as soon as possible after a computer-security incident that materially disrupts or degrades services for four or more hours. Eleven days is not as soon as possible; the bank should treat the delay as a vendor failure and document it.

Regulator notification. The bank itself must notify its primary federal regulator within 36 hours of determining that a notification incident has occurred -- one that materially disrupts operations or has a material impact on the bank's financial condition. The bank should make that determination now, in writing, and not wait for Meridian's final report.

State breach notification. State laws typically require notice to affected residents without unreasonable delay and often within 30, 45, or 60 days, with separate obligations to state attorneys general and credit bureaus depending on volume. Because partial SSNs are involved, counsel should assess whether the exposure triggers notification in each state where affected customers reside. Do not wait for Meridian to run this analysis.

Customer and privacy obligations. Reg P requires accurate initial and annual privacy notices describing sharing practices. The notice's statement that data goes only to service providers and as permitted by law may be inaccurate if the affiliate's marketing-segment sales are not covered by an exception. Possible outcomes: stop the sharing, or amend the notice and provide opt-out rights with accurate disclosures.

Sequencing. Contain and confirm scope, make the 36-hour determination, engage counsel on state notices, prepare customer communications, preserve evidence, and open a corrective action plan with Meridian. Customer remediation -- credit monitoring where appropriate -- should be decided on the basis of the data elements actually exposed.

Amending the notice may be necessary, but it is not sufficient, and it does not address the core problem.

What amending alone would miss. A corrected notice does not fix absent audit rights, an unmonitored fourth-party chain, or a demonstrated failure to notify in a crisis. Nor does it establish that the marketing-segment sharing falls within a Reg P exception; if it does not, the bank must provide opt-out rights and honor them before the sharing continues. And a notice change cannot cure a past disclosure that may have been inaccurate -- that requires a lookback on what was shared, with whom, and under what representation.

Recommendation. Continue the relationship only on conditions, sequenced:

1. Immediate suspension of the marketing-segment data sales until the legal basis is confirmed and notices and opt-outs are correct.
2. A defined remediation window -- 60 to 90 days -- for a contract amendment covering audit rights, notification timing, subcontractor approval, and data security standards.
3. Independent validation of Meridian's controls, either through a qualified assessor or a detailed SOC review with exception analysis.
4. A re-rating of the vendor to critical, with a monitoring plan and a named relationship owner.
5. Quarterly reporting to the board technology and compliance committees until the remediation is closed.

If Meridian will not accept audit rights and notification terms, the bank should plan an orderly exit, including a customer communication and data migration plan. Keeping a critical vendor that refuses oversight is a decision the bank will have to defend to its examiner.