The Federal Deposit Insurance Corporation, Federal Reserve Board, National Credit Union Administration (NCUA) and Office of the Comptroller of the Currency have extended consultation on proposed guidance for managing risks from banks’ and credit unions’ third-party relationships. The nonbinding proposal, first issued in September, would align oversight with each relationship’s assessed risks and the institution’s size, complexity and risk profile. The Federal Reserve separately extended consultation on its proposed companion guide for traditional community banks under its supervision.
The proposed framework addresses concerns that the 2023 guidance has often been interpreted as a prescriptive checklist, rather than applied proportionately to risk. Due diligence, contract negotiations and monitoring would be tailored to the magnitude and likelihood of harm, with greater attention directed toward relationships posing greater risks. Institutions could accept residual risks within their risk appetite and tolerances while continuing to operate safely and comply with applicable laws and regulations. Once finalized, the guidance would replace existing third-party risk management guidance. NCUA also plans to review related guidance for updates as needed.