The explanations for why banks are losing standing are well rehearsed. Fees. Rates. Fintech. Larry Fink told the Milken conference in May that keeping money in a bank account is one of the worst financial decisions of a lifetime, and he runs a firm that profits when you agree with him.
Here is one that gets almost no attention, and I think it is the one that matters most.
Through the eighties, nineties, and early two-thousands, banks and their suppliers grew into each other. Consolidation created enormous processing volumes, and a small set of firms was built to absorb them: statement print and mail, card production, proxy and shareholder communications, marketing production, records destruction. The work expanded quietly. Welcome kits. PIN mailers. Mortgage disclosures. Trust statements. Compensation reports. Board books. The vendor who started as a printer became the 'personalized marketing expert' custodian of the bank's most intimate documents, but with Caribbean and DC partners — the invisible pipeline that carried customer data, executive decisions, and shareholder secrets from inside the institution to the outside world and back. The bank got scale. The vendor got proximity. And proximity, accumulated over decades, is a form of access that no contract can fully describe. Both sides did very well out of it.
And behind every investor relationship sat a second relationship nobody ever charted. A vendor team assigned to that account, funded by that account, whose jobs existed because the account existed. They had no intention of leaving it and every reason to stay. The bank rotated its people. The vendor's people did not. Fifteen years in, the outside team knew the file better than anyone left on the bank's side of it, and that was not a failure of anybody's diligence. It was the arrangement working exactly as designed.
Most of those relationships are still running. Many are governed by the original master agreements, amended at the edges, auto-renewed, and never reopened. They carry little real oversight, almost no chain of custody, and permissions over customer and shareholder material that were written before that material existed in the form it exists now.
That is not a compliance footnote. It is a structural liability sitting under the whole category, and it is the part least likely to survive scrutiny.
## What was normal before 2002
The vendor estate did not appear by accident, and none of it was assembled in secret.
Through the nineties and into the early two-thousands, shareholder and account data moved out of banks at a scale that is easy to forget now. Proxy distribution, statement production, tax documents, annual reports, account communications. All of it went to outside producers, because the volume was impossible in-house and the economics were obvious.
What travelled with it was a commercial culture the current controls environment would not permit. Production and media billing carried more than production. Hospitality, entertainment, travel and relationship spend were routinely absorbed into the cost of the work. Rates were set by relationship rather than by tender. Renewals were assumed rather than contested. Very little of it was concealed, and most of it was lawful at the time, which is the part worth holding onto.
And it was never only banks. Every Wall Street house, insurer and instruments firm touching regulated funds ran the same pattern. Data went out through devices wired directly into large processing warehouses, where forms and personal detail were integrated at breakneck speed. Names, addresses, account numbers, balances, claims histories. All of it keyed and merged by people paid by the hour, at volumes nobody in the building could have reconciled if asked.
It did not stay in the country either. That data went overseas as a matter of routine, and to the Caribbean in particular, where it was processed cheaply for what they called consumer marketing modeling. Financial and personal records, turned into targeting.
And the ones sitting at both ends of that pipe knew precisely what they were holding. The original records going in, the finished model coming out, and the same hands on each. They thought they had struck gold, and then struck it again on the next file, and the one after that. The processing fee was never the point of the work. The position was.
And the access was exactly as loose as that sounds. When a federal investigation needed completing, the formalities were often skipped entirely. Nobody served process on the vendor. They sent a wage worker to go take a job in the warehouse and process the data going out.
And access, once obtained, does not stay where it was granted. A job taken at the most advantageous and humble point in the chain is a seat inside the building. From there it travels: to the next contract, the next facility, the next operation, and in time to the people running development and holding the budgets. A temporary line worker keying forms is screened, if at all, against the job in front of them. Nobody is assessing what that seat connects to three moves later, in another state, under another program, at a scale nobody associated with a fulfillment warehouse with data sitting in multiple countries.
That is the shape of the exposure, and it has not changed. The advantageous point of entry opens onto the most expensive rooms, and no part of the chain was ever built on the assumption that somebody would walk it end to end.
That is the part to sit with. Not that anyone was breaking the law. That getting inside the place where the country's financial records were handled took nothing more than applying for a shift.
Sarbanes-Oxley, signed in July 2002, changed that environment. Section 302 put an officer's signature on the accuracy of the reports from August of that year. Section 404 required management to assess internal control over financial reporting, with an independent auditor attesting to the assessment. Section 802 made the destruction or falsification of records a criminal matter rather than a housekeeping question.
What the Act reached was financial reporting. What it did not reach was the vendor contracts themselves.
The agreements signed in that era stayed in place. The rates were absorbed into baselines nobody re-derived. The relationships continued, and the people who built them moved up and then out, many now retired, some still consulting, nearly all still known to one another. The estate outlived the culture that produced it, and nobody has had a reason to reopen it since.
## The regulators have already conceded the trap
Three federal agencies put their names to one sentence in June 2023. A bank remains responsible for an activity whether it performs that activity itself or pays somebody else to perform it. Outsourcing moves the work and not the accountability.
New York's Department of Financial Services said the quieter part plainly in an industry letter dated 21 October 2025. Covered firms face real constraints in selecting, contracting with, or transitioning away from a third-party service provider, because of limited vendor options, industry concentration, and legacy system dependencies.
Read that as a supervisor describing a market rather than as guidance. The regulator is acknowledging in writing that banks largely cannot leave these vendors.
So the bank carries full accountability for work it cannot move, performed by firms it did not re-underwrite, under terms it has not reopened in thirty years. That is the position. Everything else follows from it.
## How a secured media contract runs
In this industry, a media contract carrying a security requirement is not awarded and then policed. The obligations are disclosed at the outset, and the disclosure is itself the signal.
A well-run bank or agency states up front that the vendor will be subject to continuing verification for the life of the engagement. Including, but not limited to:
- background screening of every individual with access to the work, repeated on a schedule rather than run once at onboarding - employment eligibility verification and signed confidentiality undertakings across that same population - facility assessment, with access control, badging, and segregated areas for secured runs - documented chain of custody at job level, produced on request rather than after an incident - reconciliation of the full run, ordered against produced, delivered and destroyed, with overs and spoilage accounted for - destruction performed under witness, with the log rather than only the certificate - disclosure of every subcontracted party, with the same obligations flowed down by contract - a right to audit, exercised rather than reserved - defined incident notification windows, stated in hours - insurance and bonding at stated limits
That is a multistep standard, and running it is continuous work. The documentation is generated as the job moves rather than assembled when somebody asks for it, and any party the work is handed to carries the same terms.
Set against that, the common practice is a questionnaire. Attestations, certificates, a policy document, proof of insurance, a signature. Sometimes a SOC 2 report, whose exceptions section, where the auditor records what was actually found, goes unread.
The distinction that matters is not the paperwork. It is that very few firms in this layer hold a real chain of custody. Not a policy describing one. A timestamped record of who held a thing, for how long, and what happened at each handoff. It is unglamorous, it costs money, and it is the first line cut when procurement scores on unit price. What sits in its place is the attestation, which is a document about a control, produced by the party being examined.
A bank that accepts an attestation in place of a custody record has not verified anything. It has collected a promise and filed it.
The sequence is the tell. Counterparties that disclose the full standard before the award are the ones that go on to verify it. Where the requirements arrive afterwards, as a questionnaire, they are generally not verified at all. That is visible before anything is signed.
## Contracts written before the asset existed
The terms underneath these relationships were drafted for paper, microfiche, and physical mail. They now govern digital records, retained images, addressable customer files, and shareholder registries.
Nobody has gone back to read what secondary use that language actually permits, because reopening the contract means re-bidding a service the bank has no realistic way to move. The entrenchment and the silence are the same fact.
The result is reckless by construction rather than by intent. Firms are holding shareholder and customer material under permissions their counterparties would not knowingly grant today, and in some cases would be surprised to learn they are still granting. No one has to behave badly for that to be dangerous. The authority was written in 1994 and simply never expired.
## What a firm believes it is
There is a second thing here, harder to measure and more consequential.
A number of these vendors conceive of themselves as media companies. Publishers. Presses. That self-conception carries an assumption of latitude: that material crossing the floor is theirs to work with, that commercial judgment over it is theirs to exercise, that the freedoms attaching to a press attach to them.
A processor and a publisher hold very different views of what they may do with what passes through. When a bank contracts a processor and the counterparty believes it is a publisher, that gap appears nowhere in the questionnaire.
It carries a generational cost that lands on no risk register. These are long-tenured firms whose public posture, customer manner, and stated view of their own role were formed decades ago and have not moved since. Banks are spending heavily to be legible to customers and employees under forty. The layer standing between them and those customers was built for a different era and still presents as one. That mismatch is visible to anyone who looks, and increasingly it is being looked at.
## The burning question
Which leaves the only question that matters to anyone actually holding a contract. How do you tell which kind you are dealing with, before something goes wrong.
Not by size. Not by the logo on the reference list. Not by how long the relationship has run, which is the measure used most often and the least informative of the three.
The determination is structural, and it reduces to one thing. Is there an independent check on the vendor file that does not run through the relationship.
Two examples, at opposite ends of the estate.
First Tech Federal Credit Union is the country's eighth largest credit union, $16.7 billion in assets, 650,000 members. Its supervisory committee independently reviews operations, management, procedures and internal controls, with routine external audit, and it states plainly that this extends to the health of its information security protocols. That is published on their own site, not extracted under pressure. The governance model puts a body between the institution and its own vendor decisions, and that body reports outside the relationship.
Ennis has been manufacturing since 1909, listed on the NYSE since 1969, across more than fifty locations, and secure documents are a named part of what it makes rather than something bolted onto a print shop. It goes to market only through the wholesale trade, through named distributors, never direct. That structure is itself a control: every job has an identified party on both sides of it, and the chain never disappears into an anonymous middle.
Neither of those is excellent because somebody likes them. They are excellent because the structure does not depend on anybody liking them. Right now they are the standard that no one can seem to attain.
Set against that is the pattern most of the estate actually rests on. An institution where nobody outside the relationship has read the vendor file. Where the contract was signed by people who knew each other, renewed by people who inherited it, and examined by nobody. Where the standard was never written down because it never had to be, and the control is the friendship.
That is what lets a vendor conclude it may do as it likes with shareholder material. Not malice. Permission that was never withheld, by a counterparty that never looked.
So the burning question is short, and anyone can ask it on Monday.
Who, outside this relationship, has read this contract and tested it. If the answer is a name, you are in the first category. If the answer is a pause, you already have your answer.
## The read
This is not a credit question and it is not the fee line. It sits in the vendor file, which is precisely where nobody looks, and it is compounding in three directions at once. Dependence is rising. Supervision of the fee side is being wound down. And the contracts governing the material are old enough that their permissions were written for a different asset class entirely.
A category does not lose standing in one quarter. It loses it when the things holding it up stop being examined, and then one of them is examined.
## The table
Here is the version of this that has nothing to do with contracts.
Picture the dinner. The bank president is there. The vendor's people are there, as they have been for years, because that is how the relationship has always worked. Everyone at that table has vouched for everyone else at that table, and not one of them has ever had to write down why.
Now put your grandchildren at that table.
The vendor's account men are seated with them. Three of them, because it is a large relationship and this is how it has always been done. All three are good company. All three have been good company for years, and that is precisely why not one of them has ever been checked. They were never strangers, so they were never screened.
The first is recently and completely single, and has spent the year discovering what that permits. He posts constantly, under a handle nobody at this table would recognise, a running inventory of a private life he waited thirty years to begin. He is not hiding it. He simply assumes the two worlds never touch.
They are open on the same machine. Same session, same taskbar. One window is that life, in full. The window beside it is an .xlsx.
That file is not a system. It has no permissions model, no access log, no session timeout, and nobody signs into or out of it. It is a spreadsheet, because this layer never moved past spreadsheets. It carries the account numbers and the balances, and it carries the columns somebody added over the years to make the relationship easier to service: preferences, sensitivities, who actually controls the money, who is not to be telephoned at home, and the nicknames the family use for one another.
He moves between the two windows without thinking about it, and there is no reason he would. Nothing on that machine has ever told him the two windows are different.
The second keeps a habit that lives on markets you have to reach for deliberately, paid in a currency chosen because it does not carry a name. He has been careful about it for four years. He is also, by now, familiar to people whose entire business is knowing what a given man can reach.
The third is servicing a five-figure hole he has not mentioned at home. It began as something on his phone during a flight. It is now a number he thinks about in the car. He has never taken anything. He considers what he could reach about once a week, the way you consider a door you happen to have the key to.
Not one of them is a villain. That is the part worth sitting with. They are three ordinary men carrying three ordinary problems, of the kind you would find in any three men at any table in the country.
What varies is the neighbourhood.
Some regions carry a heavy military footprint, and the collection interest that has always followed it. Some carry established organised crime with a standing appetite for identity and money movement. A number of regions carry both. And the people whose profession is locating exactly the three appetites described above are already working those rooms, competently, and have been for years.
This is not espionage, and it is a mistake to picture it that way. It is how a cartel grows.
A cartel is a logistics business with a money problem. Expansion needs three things it cannot manufacture in-house: laundering capacity, identity supply, and payment channels. All three are obtainable, and the cheapest route is not to buy the thing at all. It is to acquire the man who already holds the access, by paying for something he already wanted.
Set against every other method available, it is close to free. No breach, no exploit, no forced entry, nothing that leaves a mark. A few years of generosity and the appetite performs the remainder of the work unassisted.
The method is not the one people picture. Nobody is threatened. Nobody is asked for anything. They are fed.
The habit becomes easier to maintain. The hole gets quietly serviced. The audience grows, and turns out to be unusually appreciative. Someone becomes reliably generous, then reliably present, then simply part of the week. There is no moment of recruitment because there is no recruitment. There is supply, escalating at the speed of appetite, and every stage of it feels to the man receiving it like a run of good luck.
That is why nobody notices. Nothing bad happens. No file is stolen, no alarm fires, no incident is opened, no control is defeated, because none of it touches a control. It all takes place in the part of the arrangement that was never instrumented: a man, his appetites, and unlogged access to a spreadsheet.
And the richest seam available is where banking, military, and international health cross.
That crossover exists because of the vendor layer, not in spite of it. And it is worth being specific about which vendors, because the ones that get assessed are never the ones that matter.
The statement house gets assessed. It is industrial, it is unmistakably data, it is on somebody's third-party register, and it is the one everybody pictures when this subject comes up.
These are the ones that are not.
The boardroom vendor. Board books, catering, the directors' gifts at year end. They set the room up before the meeting and clear it afterwards. They hold the calendar, they know which directors travel together and who arrives early, and they handle the printed pack — which contains what the meeting is about, days before the meeting happens.
The college account vendor. The giveaways that go out at freshman orientation, the branded goods on the table at the student union. That programme runs on a file of eighteen-year-olds: first accounts, campus addresses, home addresses, and very often a parent as co-signer. It is the youngest and least protected population the bank holds, and the vendor holding it was selected on price per unit.
The birthday club. A standing file of every customer's date of birth and home address. That is not a by-product of the programme, it is the programme. It is booked as marketing spend, assessed by nobody, and it is the single cleanest identity file in the entire estate.
Staff media. The internal newsletter, the service awards, the recognition programme. It carries the org chart, who reports to whom, who has just moved into signing authority, who is retiring, who is leaving and when. It is a live map of the institution, maintained by an outside party and updated monthly.
Not one of those four sits on a third-party register. Between them they hold the directors' movements, the students' addresses, every customer's date of birth, and a current map of who inside the bank can authorise what.
The statement house is assessed annually. These four are on the guest list.
By the time any of it is visible, it is not a security event. It is a relationship several years old that somebody else has been paying for.
It would be easy to read all of that as a story about files. It is not. The file is the doorway, and the doorway is the least interesting part of the building.
What gets acquired is the vendor's principals. Not their systems. The men themselves, and specifically whatever each one most wants and is least able to ask anyone for. Those appetites are identified, and then supplied. Then, and this is the part that does the real work, the consequences are handled. The mess is cleaned up. The problem that should have surfaced does not surface. The thing that ought to have cost him something costs him nothing.
From the inside it does not feel like capture. It feels like arrival. A man who has spent thirty years being careful finds he is finally being rewarded for being exactly who he is. The friction has gone out of his life. People of consequence find him valuable. He is certain he holds the upper hand, and every part of the arrangement is built to let him keep thinking so.
None of it requires a single record to move. The records are only what made him worth acquiring.
What he is given in exchange is not money, or not mainly. It is standing. He is spoken to as someone who is trusted with things, and told what he could not otherwise learn. That is a clearance, and nobody issued it. No institution granted it, no committee reviewed it, no register records it, and it cannot be revoked by anyone he could appeal to. It exists only inside the arrangement, and only one kind of organisation hands it out.
And it does not stay inside one man's life, which is the part nobody plans for. It becomes the terms his firm runs on, then the terms his family lives inside, accreting quietly across years while everyone involved describes it as good fortune.
And every one of them can pull your granddaughter's mailing address, her school district, her parents' balance, the dates of birth and the month the trust distributes. All of it moves through their shop. No log records who opened which file, or when, or why. That is not a defect in their systems. It is the ordinary condition of this layer, and it is the condition three hundred other families are sitting inside tonight.
You cannot rule it out. That is the whole point. Nobody at that table can rule it out either — and every one of them would tell you the vendor is excellent, because they have known them twenty years and the work has always come back on time.
That is what an unexamined chain actually is. Not a compliance gap. A room of people who trust each other completely, vouching for three men not one of them has ever checked, who hold everything about your family that matters, and who are sitting next to your grandchildren.
The moment any of this becomes visible is never a breach notification. It is quieter than that, it arrives far earlier than anybody expects, and it comes from the youngest person in the room.
The grandchildren clock it first. They always do. They cannot name it and they have no standing to raise it, so it surfaces the way these things surface at that age: as something they tell their friends. That their grandparents have a couple of friends who are a bit creepy. That everyone says they are good guys.
They have seen the accounts, too. The words they use for what is on them are too modern for their parents to parse, which is why none of it ever travels upward. Every other kid in that group chat understands it on sight.
They are usually right, and nobody writes it down.
That is the last control in the chain. A fifteen-year-old's instinct at a dinner table. It appears on no register, in no report, and in no file — and it is the only assessment of that vendor anybody in the family has actually carried out.
And Fink, from the far end of all of it, is describing the same thing without knowing whose dinner table he is describing. He has lived what the real expense of an international investigation is, not just the flaunted version staged to grab budget money and put rubber to the road so more old men are paid. And the record on the other side of that is no better: fabricated assets, staged photographs and seeded data circulated to bait cartels have turned on the people running them over and over, at a cost that runs to billions. The unchecked relationships are the first to go. The people inside them are the last to know it is happening.
And none of it stays local.
Several thousand miles away there are groups, some entirely legitimate and some not, reading American consumer and transaction data and taking positions on what gets bought next quarter. That part is an industry. It operates in daylight and files its paperwork.
The rest of it moves through places like Antwerp, where more than 70% of Europe's cocaine lands, and where the hard problem was never the product but the proceeds. Converting money at that scale means running it through legitimate business, and legitimate business runs on identity: clean names, verified addresses, dates of birth, account histories, households under documented pressure.
Nobody is buying a spreadsheet. They are buying conversion capacity — and the spreadsheet is where it is kept.
Which is the moment the birthday club stops being a privacy footnote and becomes an input to something with tonnage attached.
What they can also see, at no cost and with no effort, is the network itself.
Because it is published. Industry award dinners. Charity golf outings. Board appointments. Association directories. The photograph on the firm's own news page, captioned with every name in the row. None of it has to be obtained. It is put out deliberately, by people who consider it good news.
From a distance the pictures mean nothing. What sits underneath them is the point. The caption is a roster. The date is a place. And the sequence, read across ten years, is a relationship map: who sits with whom, whose son joined which firm, which vendor was at the table the year the contract renewed.
Nobody had to breach anything to assemble that. It was announced.
And all of it traces back to people who would be honestly wounded to hear it put this way. They are not criminals. They are older men and women inside a groupthink that has drifted, by degrees and across decades, into territory a cartel would recognise as its own — and the reason nobody ever stopped is that every part of it feels good. The dinners are warm. The people are decent to one another. The loyalty is real. The charity is real.
But the grandchildren can tell what is clean and what is not, and they can tell on both sides of it. The cartels have children too, and a great many of them want to be legitimate. They want the degree, the licence, the firm with their own name on the door, and a life that does not require anybody to look away.
That is the part the older generation never accounted for. They built something that runs on nobody asking, and then handed it to people who ask.
And they all know each other. Same schools, same group chats, same summers abroad. The separation their grandparents maintained by never discussing any of it does not exist for them. It collapsed into one conversation years ago, and they have been comparing notes ever since.
That is what makes it durable. Nothing that felt wrong would have lasted this long. Or has it and why?
Deposits are insured. Nothing insures the assumption that a party three steps down the chain did what its certificate said it did.