Choosing a cleaning vendor for a bank or financial institution is not a service decision. It is a regulated vendor management decision, governed by the Gramm-Leach-Bliley Act (GLBA), the FTC Safeguards Rule, and the Federal Financial Institutions Examination Council (FFIEC) 2023 Interagency Guidance on Third-Party Relationships.
The wrong vendor doesn’t just deliver inconsistent cleaning. They can create a compliance finding at your next examination, expose Nonpublic Personal Information (NPI) to unauthorised handling, or become the third-party breach vector documented in Verizon’s 2024 Data Breach Investigations Report, which found that 15% of breaches involved a third party — a 68% year-over-year increase.
The right vendor understands the regulatory context of the environment they operate in and can produce documentation appropriate to your vendor management programme.
This guide is a practical reference for compliance officers, facility managers, and branch operations leaders at Rhode Island and New England banks, credit unions, and financial institutions evaluating cleaning partners. It covers the regulatory framework, six questions every vendor should be able to answer, and the red flags that signal a vendor isn’t equipped for a financial institution environment.
It draws on 40 years of facility services experience across more than 150 buildings, including banks, government buildings, defence technology companies, and other high-security environments.
The Regulatory Framework Your Cleaning Vendor Operates Within
Three regulatory frameworks touch cleaning vendors serving financial institutions.
GLBA Safeguards Rule. The Gramm-Leach-Bliley Act, enforced by the Federal Trade Commission through the Safeguards Rule (16 C.F.R. Part 314), requires financial institutions to implement administrative, technical, and physical safeguards to protect customer information. When a third-party service provider has physical access to spaces containing NPI, the institution must take reasonable steps to select vendors capable of maintaining appropriate safeguards, and must require those vendors by contract to implement and maintain them.
FFIEC Interagency Guidance on Third-Party Relationships. The FFIEC guidance, jointly issued by the FDIC, Federal Reserve, and OCC and effective June 2023, sets expectations for how institutions conduct due diligence, contract with, and monitor third-party service providers. Cleaning vendors are third parties. Their handling of due diligence documentation, contract terms, and ongoing monitoring is examinable during regulatory review.
FTC Safeguards Rule (Updated). Amendments effective 2023 require covered institutions to periodically assess service providers for adequacy of both technical and physical safeguards. Access controls, facility monitoring, and personnel vetting are all specifically identified.
The practical implication is straightforward. When examiners review your vendor management programme, cleaning contractors are part of the review. Vendors that can produce policies, background check documentation, insurance certificates, and quality assurance records support your compliance posture. Vendors that can’t create examination risk.
Six Questions to Ask Every Prospective Cleaning Vendor
1. Are Your Staff Background-Checked to Standards Appropriate for Financial Institution Access?
Every person on the cleaning crew has after-hours access to your branch, often with keys or alarm codes, and often unsupervised. The vetting standard has to reflect that access.
What a strong answer sounds like:
- Documented background checks on all staff assigned to financial institution contracts
- Rhode Island Bureau of Criminal Identification (BCI) checks where applicable
- Ongoing verification, not just one-time at hire
- The vendor uses employees, not subcontractors or day labour, for financial institution work
- Records available on request for your vendor file
What a weak answer sounds like:
- “We do background checks on our staff”
- No specific programme named
- Inability to distinguish financial institution staff from general cleaning staff
- Reliance on subcontractors whose vetting the vendor doesn’t control
2. How Do You Handle After-Hours Access, Alarm Codes, and Secure Area Protocols?
Cleaning happens after hours when the branch is closed. The vendor’s access protocols matter as much as their cleaning capability.
What a strong answer sounds like:
- Named point of contact for keys, codes, and alarm systems
- Documented sign-in and sign-out procedures
- Alarm code management including protocols when codes change
- Awareness that cleaning staff will be on branch surveillance cameras
- Documented protocols for restricted areas (vault vestibules, safe deposit rooms, IT rooms)
- Building lockup verification and alarm reset at completion
What a weak answer sounds like:
- Vague references to “trained staff”
- No documented access protocols
- No named contact for security escalation
- No awareness of restricted-area distinctions
3. What Are Your Protocols Around Nonpublic Personal Information and Confidential Documents?
This is the GLBA question. Bank interiors contain paper files, screens, printouts, and workstations that hold customer NPI. Cleaning staff must be trained to never interact with them.
What a strong answer sounds like:
- Staff trained explicitly to never touch, view, read, photograph, or dispose of any documents left on desks or workstations
- Trained not to log in to, wake, or touch computer equipment
- Clear protocols for confidential paper waste (typically not handled by cleaning staff; handled through the institution’s own shredding programme)
- Documented training on customer confidentiality expectations
- Understanding that violations are reportable events under GLBA
What a weak answer sounds like:
- No specific NPI awareness protocols
- Trash and shredding treated interchangeably
- No training records available
- Staff who “know to be careful” without documented protocol
4. What Insurance, Bonding, and Compliance Documentation Can You Produce?
Every financial institution vendor file needs specific documentation. The vendor should have it ready before you ask.
What a strong answer sounds like:
- General liability insurance with named limits appropriate to financial institution environments (typically $1 million minimum, often higher)
- Full workers’ compensation coverage
- Commercial automobile liability
- Bonding for staff with access to institution facilities
- Named additional insured status for the institution on vendor policies
- Certificates of insurance available on request and updated automatically at renewal
What a weak answer sounds like:
- General references to being “insured”
- No specific limits named
- No automatic renewal notification
- Unwillingness or inability to name the institution as additional insured
5. What Is Your Quality Assurance and Reporting Cadence?
FFIEC guidance requires ongoing monitoring of third-party service providers. The vendor’s quality assurance programme needs to produce documentation the institution can retain.
What a strong answer sounds like:
- Structured inspection cadence with a defined frequency (weekly, bi-weekly, monthly)
- Named person responsible for audits, distinct from the cleaning staff being audited
- Documented walkthrough reports available to the institution
- Defined response times for complaints and escalation protocols
- Reports the institution can retain in the vendor file for annual reviews
What a weak answer sounds like:
- “We check our work regularly”
- No documented cadence
- No escalation path defined
- No reports produced for retention
6. Can You Support Our FFIEC Due Diligence and Ongoing Monitoring Requirements?
The 2023 FFIEC guidance requires financial institutions to conduct due diligence at vendor selection and continuous monitoring throughout the relationship. Your cleaning vendor should support this, not resist it.
What a strong answer sounds like:
- Willingness to complete vendor questionnaires
- Availability of policies, training records, and insurance documentation on request
- Support for annual vendor reviews
- Cooperation with the institution’s internal audit and compliance functions
- Documentation retention practices that support the institution’s audit trail
What a weak answer sounds like:
- Resistance to documentation requests
- No familiarity with the term “vendor management” or “third-party risk”
- Inability to produce records in a timeframe useful to the institution
Red Flags: When a Cleaning Vendor Isn’t Financial-Institution-Ready
- The vendor uses subcontractors or day labour whose vetting the vendor doesn’t directly control
- The vendor can’t produce Safety Data Sheets or insurance certificates on request
- The vendor’s staff have no specific NPI or confidentiality training
- The vendor treats access to a branch the same as access to any commercial building
- The vendor has no documented quality assurance programme with retention-ready reports
- The vendor resists vendor questionnaires or documentation requests
- The vendor has no experience with financial institutions and no interest in learning
If two or more red flags appear, the vendor isn’t ready for a bank environment. The right response is to keep evaluating.
For a wider view of vendor performance signals across any facility type, see the guide on the seven signs your commercial cleaning contractor is underperforming.
The Janitech Approach
Across 40 years and more than 150 buildings in Rhode Island and New England, Janitech services financial institutions alongside other high-security environments including government buildings, defence technology companies, educational institutions, and healthcare facilities.
The operational baseline for financial institution contracts:
- Background-checked cleaning staff, vetted to standards applied across banks, government buildings, and schools
- Documented after-hours access protocols with named institution contacts
- Staff trained on NPI awareness and customer confidentiality expectations
- Over $1 million in general liability insurance, full workers’ compensation coverage, and commercial automobile liability, with certificates available on request and additional insured status as required
- A structured quality assurance process with sensitive sites audited at least every other week and walkthrough reports submitted to ownership
- Written documentation available for vendor file retention and annual review
- 95% client retention across the client base; many clients with Janitech for 40 years or more, and most of Janitech’s growth has come from existing clients adding new locations
Veteran ownership has shaped how the business runs from day one. Accountability is how the work gets inspected, recorded, and reported every week, not a phrase in the marketing material.
Frequently Asked Questions
What regulations govern cleaning vendors at banks?
The Gramm-Leach-Bliley Act (GLBA) Safeguards Rule requires financial institutions to select and contractually oblige service providers capable of maintaining physical safeguards for customer information. The FFIEC 2023 Interagency Guidance on Third-Party Relationships establishes due diligence, contract, and ongoing monitoring expectations for all third-party providers, including cleaning vendors.
Do cleaning staff need to be background-checked to work in a bank?
Yes. GLBA and FFIEC guidance requires financial institutions to assess whether third-party service providers can maintain appropriate safeguards. Background checks on staff with after-hours physical access to bank facilities are a standard component of that assessment. Rhode Island institutions typically require BCI (Bureau of Criminal Identification) checks in addition to national background screening.
How does the FFIEC define third-party risk for cleaning contractors?
The FFIEC’s 2023 Interagency Guidance categorises third parties by the risk their access and services present. Cleaning contractors with after-hours access to facilities containing customer information fall within the guidance’s scope even though they do not directly handle systems. Institutions are expected to conduct due diligence, document contract provisions, and monitor performance on an ongoing basis.
What happens if a cleaning vendor mishandles customer information?
Under GLBA, financial institutions remain responsible for ensuring service providers maintain adequate safeguards. Vendor mishandling of Nonpublic Personal Information can result in a reportable incident, examination finding, or regulatory enforcement action against the institution itself. This is why vendor selection and contract terms are examined during regulatory review.
Can a general commercial cleaning company work in a bank?
Not without specific adaptation. Standard commercial cleaning contracts don’t typically address background check standards, NPI awareness training, after-hours access protocols, or vendor documentation appropriate to financial institution compliance requirements. A vendor without these elements will need to build them out before the institution can retain them.
Ready to Evaluate Your Cleaning Vendor Against This Framework?
If your current vendor can’t confidently answer all six of the questions above, it’s worth a compliance-grade conversation.
40 years. 95% client retention. 150+ buildings across Rhode Island and New England, including banks, government buildings, and other high-security facilities.
Request a custom proposal for your institution or book a free walkthrough. We’ll assess your facility and return a documented proposal within 2 business days.