Your Bank Can't Fire the Company That Runs Its Software. On September 11, Three Regulators Said That's Your Problem Too.

If your bank or credit union still can’t send an instant payment, still runs an app that feels like 2014, or went dark for a weekend and couldn’t tell you why, you probably blamed the bank. Mostly the wrong target.

The software holding your balance belongs to a vendor your bank didn’t build and can’t easily leave.

On September 11 the Federal Reserve, the FDIC, and the OCC put that in writing. Their joint statement on “core providers” is addressed to examiners, not to you, but it describes your account better than your bank ever has.

Core providers, in the agencies’ own list, run “transaction processing, account management, payments processing, customer relationship management, compliance and reporting, online banking, and other material functions.” They are the plumbing. The agencies note “a significant percentage of the core provider market is represented by just a few large providers, which limits” a community bank’s negotiating power. A Kansas City Fed briefing from March 2024 put numbers on it: Fiserv served 42 percent of banks, Jack Henry 21 percent, FIS 9 percent. Three companies, more than 70 percent of the banks surveyed in 2022.

Then the regulators listed what those contracts look like. “Opaque pricing structures and practices.” Billing with “extensive ‘back billing’ windows during which the core provider may issue retroactive charges.” Exit fees that are “unsupported or contractually undefined.” And the one worth reading twice: “excessive limitations on the ability of unaffiliated service providers to integrate with the core platform.”

A vendor can write a contract that makes it hard for your bank to bolt on somebody else’s better product. That isn’t a message-board theory. That is three federal banking agencies describing the market.

Look at instant payments. FedNow went live in July 2023. As of July 2026, only 20.7 percent of the nearly 8,500 small institutions have joined, and among small credit unions it is 13.6 percent. Cost and staffing explain plenty of that. But the agencies just said in writing that core provider contract terms obstruct a bank “seeking an alternative core provider or supplementary services.” Same-day money movement is exactly that kind of service.

The teeth sit in the last paragraph of the statement. The agencies wrote that core providers “may be held liable for the practices or violations of a CBO as an institution-affiliated party,” because their services “are integral to the functioning of the institution and its delivery of banking products and services, and directly impact the customer banking experience.” Translation: the vendor can be fined and barred, the way a bank officer can.

Don’t oversell it. This is non-binding guidance and nobody’s app improved on September 11. What changed is that regulators finally named the thing sitting between you and your money.

So ask your bank or credit union, in writing, whether it is on FedNow or RTP, and keep the answer. If it isn’t, and you ever need money to land the same day, open a second account at an institution that is and park a float there. Our savings hub and the best savings accounts page are the place to start. Then, if an outage or a botched posting costs you a late fee or an overdraft, complain in writing with the date and the length of the outage, to the bank and to its regulator. The bank can’t shrug and point at the vendor. As of September 11, neither can the vendor.

One detail worth filing. The NCUA joined the companion third-party risk management proposal but not this statement, which came from the Fed, the FDIC, and the OCC. Credit union members get the reasoning without the enforcement posture behind it.

How Candid Yak makes money. Some of the products we write about pay us if you apply or sign up through our links. That never changes our verdict, our rankings, or the numbers in this article. We call a bad deal a bad deal whether it pays us or not. Some brands shown in our comparison tools are placeholder examples while we finalize partner agreements, and we label them as such.