Vendor due diligence

Why this page exists

Institutions in the two-to-twenty branch band do not run formal procurement processes for ATM services. What they run is a due diligence file, because interagency third-party risk guidance and NCUA supervisory expectations require one before a vendor relationship starts and periodically after.

That file is the real work. So rather than make you request the documents one at a time, they are laid out here.

Corporate and financial

Entity structure and ownership, years in operation, states of operation, and terminal count under management. Financial statements are available under NDA on request.

Sponsorship and settlement

Terminals are sponsored through an FDIC-insured member bank. Sponsorship documentation, processor relationship, and settlement flow are provided in the full packet — we name counterparties in the packet rather than publicly, at their preference.

Insurance

General liability, cash-in-transit and cash-in-machine coverage, and errors and omissions. Certificates naming your institution as additional insured are issued at contract.

Service levels

Uptime commitment per terminal, first-line response window, second-line dispatch window, and cash-out prevention thresholds. These are contractual figures with reporting behind them, not marketing targets.

Business continuity

Route redundancy, carrier backup arrangements, and communications failover. Documented recovery expectations for terminal-level and route-level disruption.

Regulatory ownership

Reg E operator status follows terminal ownership and is stated explicitly in the agreement. Where Axis owns the terminal, Axis is operator of record and carries disclosure obligations and error research. Where you own it, you remain operator and we service it.

Accessibility, EMV, and PIN security compliance posture are documented per terminal and reported quarterly.

References

Provided on request, matched to your institution type and fleet size rather than pulled from a general list.