Fiserv shows up in bank SEC filings more than every other named core-processing vendor combined — but "shows up" needed a lot of cleaning up first

Direct answer

BPI has warned in general terms that a small number of technology vendors support a large share of the financial sector, without naming which ones or how many banks share them. [C01] Testing that directly against SEC filings for 58 public bank holding companies with a reviewed link to OptimaYield's $10B+ Call Report population, an unrestricted search across all filing types initially suggested broad, multi-vendor overlap — until a spot-check found the top hits were institutional-holdings reports (13F filings), not vendor disclosures at all. [C02, C03] Restricting to filing types that can actually carry an operational disclosure cut the "any vendor mention" population by nearly half, to 14 of 58 institutions, and eliminated every case of an institution appearing to use 3 or more of the named vendors. [C04] Within that cleaner set, Fiserv stands out clearly: 10 of 58 institutions name it, more than the other three vendors with any mentions combined. [C05] Even that narrower count is not fully clean — a direct spot-check of 5 examples found 3 genuine vendor disclosures, 1 unrelated peer-benchmarking mention, and 1 mention of a one-time transaction rather than an ongoing vendor relationship. [C06]

Key findings

A first pass that looked concerning — and wasn't

The first version of this test searched all SEC filing types for seven major core-banking and payments vendor names, filtered by each institution's own CIK. It initially returned an alarming pattern: State Street, Truist, Regions Financial, Capital One, and several other large, diversified banks each appeared to mention four or five different vendors — Fiserv, Jack Henry, FIS, Q2, and NCR Voyix all at once. That would suggest either extreme multi-sourcing or a data problem.

It was a data problem. Pulling the actual filing behind two of the highest hit counts — Associated Banc-Corp's and State Street's top "Fiserv" results — found both were Form 13F-HR filings: quarterly institutional-holdings reports in which the bank's own asset-management or trust arm discloses FISERV, INC. common stock as a position held in client portfolios. That has nothing to do with which company processes the bank's core accounts. [C03]

A "mention" of a vendor's name in an SEC filing can mean the bank uses that vendor, competes with it, benchmarks executive pay against it, or simply holds its stock for a client. Sorting those apart matters more than the raw count.

Restricting to filings that can actually carry a vendor disclosure

Repeating the search restricted to Forms 10-K, 10-Q, 8-K, and DEF 14A — the filing types most likely to contain an actual operational disclosure, rather than a routine holdings report — changed the picture substantially. The population with at least one vendor mention fell from 27 of 58 institutions (46.6%) to 14 of 58 (24.1%), and no institution mentioned three or more of the seven named vendors at all. [C04]

Fiserv alone accounts for more institution-level mentions than the other three vendors with any presence combined. [C05] That is directionally consistent with Fiserv's well-known scale in bank core processing — but this dataset, on its own, cannot say whether the other three vendors are genuinely less concentrated among $10B+ public banks, or simply less often named in these specific filing types.

Even the cleaner count needed a spot-check

Restricting to relevant filing types is not the same as confirming every hit is a real vendor relationship. Pulling the actual text behind 5 example hits found:

• Genuine, ongoing vendor disclosures (3 of 5): Associated Banc-Corp's 10-K states plainly that it outsources "certain information system and data management and processing functions to third party providers, including, among others, Fiserv, Inc." Fulton Financial's 10-K exhibit index names a specific, dated contract: "Agreement between Fulton Financial Corporation and Fiserv Solutions, LLC dated July 11, 2016." Amerant Bancorp's 8-K earnings release references a staffing change tied to "the new agreement with Fidelity National Information Services, Inc." — as clean a set of vendor-relationship disclosures as this kind of search can produce. [C06]
• A false positive from an unrelated context (1 of 5): Capital One's DEF 14A mentions Fiserv only as a newly added company in its executive-compensation peer-comparator group — a size-and-complexity benchmark for pay decisions, not a vendor. [C06]
• A genuine mention that isn't a vendor relationship either (1 of 5): Live Oak Bancshares' 8-K mentions Fiserv only in the context of Fiserv's 2022 acquisition of Live Oak's ownership stake in Finxact, Inc. — a real, on-topic mention of the company, but a one-time investment transaction, not an ongoing outsourcing dependency. [C06]

In this small sample, 3 of 5 "clean" hits were genuinely what the concentration index intends to measure. That is informative about the ceiling of precision for this kind of metadata-only screen, not a reason to discard the Fiserv signal — which, unlike the DEF 14A and 13F artifacts, showed up specifically in outsourcing risk-factor and material-contract language.

Methodology

Population: 58 of 159 institutions in OptimaYield's $10B+ detailed Call Report layer with a reviewed SEC_CIK link in registry.external_identifier_links, resolved from the holding company to its bank charter via registry.nic_relationships (the same parent/child bridge already used by sec-narrative-query.ts). Built a new, reusable EDGAR full-text-search client (src/data-platform/edgar-fulltext-search.ts, with unit tests) against SEC's efts.sec.gov search-index API — hit metadata only, no filing document downloaded or parsed at scale. Queried each institution's CIK against each of 7 disclosed vendor names, first with no form restriction, then restricted to Forms 10-K, 10-Q, 8-K, and DEF 14A, for filings dated 2023-01-01 through 2026-09-09. Example hits behind the headline counts were spot-checked by fetching the actual filing document directly. Live query: scripts/analysis-vendor-concentration-edgar.ts.

Limitations and counter-evidence

• This is not the population BPI's framing, or the original backlog theme, envisioned. [C07] Sub-$10B community banks — plausibly more reliant on shared, off-the-shelf core processors than large, diversified $10B+ holding companies — are entirely out of scope; no CIK-linked population exists for that tier yet.
• Only 36.5% of the eligible $10B+ population is covered, by a reviewed public-holding-company link. [C02, C07] Institutions without one are invisible here, not confirmed vendor-free.
• The vendor vocabulary is a disclosed, non-exhaustive list of 7 names, chosen for distinctiveness rather than completeness. [C08] A broader list, or different name variants, could change every count in this report.
• This is a hit-metadata screen, not a verified-relationship census. [C09] The 5-hit spot-check in this report is not a claim that 60% of all hits are genuine — it is a disclosed check on how much confidence a metadata-only proxy like this can support, which is limited.
• No systemic-risk or supervisory conclusion is drawn. A vendor being named more often in filings is not, by itself, evidence of higher outage or breach risk — only of more visible disclosure.

Related on OptimaYield

• We tried to rebuild S&P's "best-performing bank" ranking — the same discipline of testing a real, published claim against independently gathered data and disclosing exactly where the test falls short of certainty.

Official sources

• Bank Policy Institute (Kristin Royster), "The Growing Faultline in Cyber Defenses: Third-Party Service Providers in the Era of Frontier AI," September 1, 2026.