One Friday in June 2022, a vendor that was handling certain customer-service calls for UMB Financial contacted the Kansas City, Missouri-based regional bank to say that its outsourcing services would be stopping, effective immediately.
UMB scrambled to find enough of its own workers who were willing to step into the void, according to a lawsuit filed by the bank. Those UMB employees worked through the weekend and well beyond, the bank alleges.
"The service breakdown giving rise to this lawsuit was not measured in minutes but in days and weeks," UMB said in the complaint, which it filed Wednesday in U.S. District Court in the Western District of Missouri.
UMB is suing Convergent Outsourcing, which contracted with the bank in 2018 to provide customer service in connection with certain credit cards and debit cards, for breach of contract. Also named as a defendant is Transworld Services, Inc., which bought Convergent in 2021.
UMB spokespeople did not respond Thursday to requests for comment. Jonathan Thompson, chief legal and compliance officer at Transworld, also did not respond to requests for comment.
UMB had a detailed contract with Convergent, which required the vendor to make its service available 99.99% of the time on nights and weekends.
The contract also laid out various standards for minimum acceptable service levels. The average speed to answer a call was supposed to be no more than 30 seconds. When UMB cards were reported lost or stolen, Convergent was supposed to immediately block those cards 100% of the time.
But UMB's lawsuit shines a light on an underlying risk that banks face when they outsource customer-service roles — the possibility that the vendor will simply stop performing its duties.
Convergent has not yet had a chance to tell its version of events in court filings. But according to UMB's lawsuit, the vendor told the bank that the service breakdown was the result of a "threat actor" gaining "unauthorized access" to "two data centers."
The vendor also told UMB that the outage was "caused by the presence of malware on a limited number of our information technology systems," according to the lawsuit.
UMB alleges that Convergent should have had various measures in place to prevent the service outage from occurring.
"Convergent had not instituted the minimum, basic protocols for allowing continuity of services in the event its system was compromised by external interference," the bank wrote in its lawsuit.
"UMB, during a time of uncertainty and short-staffing caused by the unprecedented events of the COVID-19 pandemic, had to expend significant manpower and internal resources to cover the customer support that was supposed to be the responsibility of Convergent to provide," the complaint alleges.
UMB, which had $41.2 billion of assets at the end of the second quarter, terminated its contract with Convergent about four weeks after the service outage began.
In its suit, UMB is seeking $596,000 in connection with the service outage, plus damages for negligence and other compensation, including reimbursement of its attorneys' fees.
Patrick Haggerty, senior director at the advisory firm Klaros Group, said that smaller banks, which may not have enough scale to make it cost-effective to build their own card-servicing operations, often outsource those services.
He said it's important for banks — before they enter into customer-service contracts with outside providers — to grapple with the question of what will happen in the event that the vendor stops performing the work it's obligated to do.
"Contingency planning is a big part of third-party risk management that often doesn't get the attention it deserves, particularly when you're dealing with customer-facing services," Haggerty said.
Banks should look at not only whether potential vendors are financially sound, but also at their business continuity planning, he said.
"Have we thought about the worst-case scenario, which is that you're going to have to bring this stuff in-house?" Haggerty asked.
