Community Banks and the Vendor Concentration Risk When Everybody Uses the Same AI Tool

Community Banks and the Vendor Concentration Risk When Everybody Uses the Same AI Tool

A quiet pattern has been forming across community banking for the past two years. Dozens, then hundreds, of banks under $10 billion in assets started adopting AI tools for BSA/AML monitoring, credit decisioning, and customer service automation. Reasonable enough. The problem is that a huge percentage of them are adopting the same tools from the same small cluster of vendors. And regulators have started noticing.

The Concentration Problem Nobody Budgeted For

When you think about vendor concentration risk in banking, your mind probably goes to core processors. Fiserv, FIS, and Jack Henry collectively serve something like 78% of U.S. banks and credit unions. The regulators have been worried about that for years. The OCC's 2023 Semiannual Risk Perspective explicitly flagged operational risk from third-party concentration, noting that "ichever disruption affects the service provider affects all its client institutions simultaneously."

Now layer AI on top of that existing concentration. A 2024 Cornerstone Advisors survey found that among community banks actively deploying AI, roughly 60% were using tools built on the same two or three foundation model providers. Many of those tools are white-labeled versions of each other, built on identical underlying architectures. So you get a situation where hundreds of banks are not just using similar technology; they are functionally running the same model with the same failure modes, the same biases, and the same blind spots.

This creates a form of systemic risk that is genuinely novel. If a single AI vendor's fraud detection model develops a systematic blind spot, say it starts underweighting a particular transaction pattern because of a training data gap, that vulnerability propagates across every institution using it. Simultaneously. With no natural diversification.

What the FFIEC and OCC Are Actually Saying

The FFIEC IT Examination Handbook has always included guidance on third-party risk management, but the 2023 updates to the "Architecture, Infrastructure, and Operations" booklet started pushing examiners to ask more pointed questions about concentration. Specifically, examiners are now expected to evaluate whether an institution's reliance on a single technology provider, or a small number of providers sharing common infrastructure, creates unacceptable operational risk.

The OCC's Bulletin 2023-17, issued in June 2023 jointly with the Fed and FDIC, replaced the older OCC 2013-29 guidance on third-party relationships. The new framework requires banks to assess concentration risk not just at the direct vendor level but through the supply chain. Section III.C explicitly calls out "subcontractors" and "fourth parties," which is exactly where AI model providers sit when a bank buys a fintech product that runs on, say, OpenAI or Anthropic infrastructure underneath.

The practical implication: if your BSA/AML tool runs on the same foundation model as 200 other community banks, and that model has a material failure, your examiner may reasonably ask why your risk assessment did not account for that shared dependency. The FFIEC's 2024 examination priorities memo reinforced this, listing "concentration in technology service providers" as a key area of focus.

The Fourth-Party Wrinkle

Here is where it gets particularly interesting for compliance teams. Many community banks have done solid due diligence on their direct AI vendors. They have reviewed SOC 2 reports, checked business continuity plans, negotiated SLAs. But the fourth-party question, meaning the infrastructure and model providers sitting behind your vendor, often goes unasked.

A community bank might use Vendor A for credit decisioning and Vendor B for document processing, thinking they have diversified. But if both vendors are built on the same foundation model API, the bank has single-point-of-failure risk it never identified. The OCC's heightened standards in 12 CFR Part 30, Appendix D (applicable to banks with $50 billion or more, but increasingly used as a benchmark by examiners at smaller institutions) require "identification of concentrations of risk" in third-party relationships. Examiners are reading that to include shared AI infrastructure.

Why Community Banks Are Especially Exposed

Larger banks have the budget and staff to run multiple AI systems in parallel, to build internal models, or to negotiate bespoke arrangements with vendors that include model transparency provisions. Community banks generally do not. They are buying off-the-shelf, often from the same short list of vendors that market specifically to the community bank segment.

The economics push toward concentration. A $2 billion community bank is not going to spend $4 million building a proprietary AI fraud detection system. It is going to buy one from a vendor for $150,000 a year. And the vendor that wins that contract tends to win a lot of similar contracts, because the community bank market is relatively homogeneous in its needs.

According to the Conference of State Bank Supervisors' 2024 survey, 71% of community banks with active AI deployments reported using a vendor that serves more than 100 other financial institutions. Only 12% had conducted any assessment of whether their AI vendors shared underlying model infrastructure with other vendors they also used.

Practical Steps That Actually Help

The regulatory expectation is not that every community bank needs to build its own AI. The expectation is that you understand and document the concentration risk you are taking on. A few concrete things examiners are looking for:

• Vendor dependency mapping. Document not just your direct vendors but the AI model providers and cloud infrastructure underneath them. Ask your vendors directly: what foundation models do you use, and do you have contingency plans if that model provider experiences an outage or discontinues service?
• Concentration risk assessment in your TPRM program. Your third-party risk management framework should explicitly address scenarios where multiple vendors share common AI infrastructure. This should be a standing item in your risk committee discussions, not a one-time checkbox.
• Business continuity planning that accounts for AI vendor failure. If your BSA/AML monitoring goes down because the underlying AI model is unavailable, what is your manual fallback? How long can you operate on it? The FFIEC Business Continuity Management booklet (updated 2019) requires this kind of planning for critical systems, and AI-dependent processes increasingly qualify.
• Contractual provisions for transparency. Negotiate the right to know when your vendor changes its underlying model provider. This is becoming a standard ask, and vendors that refuse to disclose this information are raising a red flag you should document.

The Examiner Conversation Is Coming

If you have not already been asked about AI vendor concentration in an exam, you likely will be in the next cycle. The OCC's 2024 bank supervision operating plan specifically references "evolving risks from the adoption of new technologies, including artificial intelligence" and ties it back to third-party risk management expectations. State regulators are following suit; New York DFS issued guidance in December 2023 on AI risk management that includes concentration considerations.

The banks that will have the smoothest exams are the ones that can show they thought about this proactively, documented their analysis, and made deliberate decisions about how much concentration risk they were willing to accept. Even if the answer is "we accept this concentration because the alternatives are not viable for an institution our size," having that documented is vastly better than having no analysis at all.

How FirmAdapt Addresses This

FirmAdapt's architecture was designed with vendor independence as a core principle. The platform does not lock institutions into a single foundation model provider; it supports multiple underlying AI models and allows institutions to configure which models handle which workloads. This means a community bank using FirmAdapt can document genuine infrastructure diversification in its TPRM program rather than discovering after the fact that all its AI tools share a single point of failure.

FirmAdapt also generates the vendor dependency documentation and concentration risk assessments that examiners are increasingly requesting. The platform maintains auditable records of which models are in use, when they change, and how decisions route through the system. For community banks preparing for FFIEC and OCC examinations, this turns a difficult compliance question into a straightforward one with clear, defensible answers.