U.S. Department of Education Updates List of Functions Covered by Third-Party Servicer Requirements under Federal Financial Aid Rules, Triggering Obligation to Amend and Report a Wide Variety of Vendor Contracts

March 8, 2023

The U.S. Department of Education (Department) recently surprised the higher education community with a Dear Colleague Letter (DCL GEN-23-03) that sets forth new guidance on third-party servicers with whom institutions of higher education (IHE) contract to help administer student assistance programs under Title IV of the Higher Education Act of 1965, as amended (Title IV). Entities that fall under the definition of a third-party servicer are subject to Department oversight and must abide by specified rules, and IHEs have long been required to ensure that their agreements with third-party servicers contain specified provisions, and to disclose their relationships with those vendors to the Department.[1] Historically, these obligations had been limited to vendors assisting institutions with core Title IV administrative functions; DCL GEN-23-03 would expand these obligations to a wide array of institutional vendors.

The Higher Education Act defines a third-party servicer as any individual, State, private, for-profit, or nonprofit organization which enters into a contract with an IHE to “administer, through either manual or automated processing, any aspect of the IHE’s student assistance programs” under Title IV.”[2] In its regulations, the Department interprets this definition of a third-party servicer to include those that perform functions related to any aspect of the IHE’s participation in Title IV programs.[3]

The Department considers administration of participation in Title IV to include “performing any function required by any statutory provision of or applicable to Title IV,” among other things.[4] While this regulatory definition is seemingly broad, the regulation sets forth a non-exhaustive list of examples of activities and functions undertaken by third-party servicers that are those traditionally related to the awarding of financial aid, such as processing student financial aid applications, originating loans, and loan collection services. Furthermore, the regulation identifies specific functions that are not generally considered those of a third-party servicer, such as warehousing of records and providing computer services or software, with the caveat they still must be analyzed under the broader definition of third-party servicing.

DCL GEN-23-03 updates the list of third-party servicer functions in the Department’s regulation to include a broad range of activities and functions that the Department believes are intrinsically intertwined with the IHE’s administration of Title IV programs and thus go beyond those traditional financial aid activities. For example, recruitment activities performed by an outside entity that involve interacting with students with the goal of securing enrollment at a particular IHE, would trigger an obligation to comply with the third-party servicer requirements. Similarly, entities helping an IHE in its retention efforts by monitoring academic progress of students or conducting student outreach would be considered third-party servicers.

Computer and warehousing services that were generally excluded from the type of functions performed by a third-party servicer must also be scrutinized much more carefully under the new guidance. With regard to warehousing of data, if the computer host company has access to student-level data and/or exercises control over the data it would be considered a third-party servicer. The new guidance also states that entities providing software products and services involving Title IV administration activities are third-party servicers, which, on its face, is in stark contrast to the current regulation that specifically excludes the provision of computer services and software from third-party services. Although, as stated above, the computer service exclusion in the Department’s current regulation is conditional, the Department’s declaration in DCL GEN 23-03 that provision of computer services involving Title IV administration triggers third-party service requirements will cause much confusion to IHEs and their information technology vendors.

Another significant type of relationship now subject to the third-party servicer requirements under the new guidance is the use of external vendors to provide educational content and instruction. This type of service, when coupled with student recruitment and retention activities and provision of technological solutions, are typically undertaken by third-party vendors, commonly known as Online Program Managers, (OPMs) that contract with IHEs to assist with the delivery of online courses to attract new students. The Government Accountability Office (GAO) publicly issued a report in May 2022 on OPMs that highlighted a perceived need for the Department to provide more oversight of OPMs and their contracts with IHEs.[5] The GAO report and its review of OPM functions clearly appear to have precipitated issuance of DCL GEN 23-03, and the new guidance makes clear that many of the services OPMs provide trigger third-party servicer requirements that must be monitored by the Department; however, the scope of the new guidance reaches far beyond the OPM industry.

DCL GEN 23-03 highlights specific elements that must be included in third-party servicer agreements. For instance, the third-party servicer must be jointly and severally liable along with the IHE for any violation of Title IV requirements resulting from the functions performed by the servicer. Also, the third-party servicer must be required by contract to maintain appropriate safeguards to protect any consumer data, such as student information, shared by the IHE. Some vendors, particularly those not previously familiar with the third-party servicer requirements, are likely to react adversely to IHEs’ efforts to amend their contracts to ensure compliance.

Finally, because third-party servicers must be United States businesses, DCL GEN 23-03 will prohibit IHEs from contracting with any vendor to perform third-party servicer functions if the vendor is located outside of the U.S. or is owned or operated by an individual who is not a U.S. citizen or national or lawful U.S. permanent resident.

When DCL GEN 23-03 was issued on Feb. 15, 2023, the Department stated it was effective immediately and required IHEs to report relationships with third-party servicers to the Department under the new guidance by May 1, 2023. On Feb. 28, 2023, the Department delayed the effective date to Sept. 1, 2023, and noted that the reporting requirement deadline would also be effective on that date. The Department is now taking comments on the new guidance until March 28, 2023. In the meantime, IHEs are encouraged to review all vendor contracts that may be subject to regulation as third-party servicer relationships under the new guidance.

If you have any questions about the DCL on Third-Party Servicers, contact any attorney in Bond’s higher education practice or the attorney at the firm with whom you regularly work.

[1] 34 CFR §668.25
[2] 20 USC §1088(c)(1)
[3] 34 CFR §668.2
[4] Id.
[5] https://www.gao.gov/products/gao-22-104463