Third-party providers must follow proper controls to protect customer assets. Banks remain responsible for the oversight of all outsourced services.