The Federal Deposit Insurance Corporation, Federal Reserve Board, National Credit Union Administration and Office of the Comptroller of the Currency have proposed nonbinding guidance that would allow banks and insured credit unions to tailor third-party risk management to the assessed risk of each relationship. The framework responds to concerns that the 2023 guidance has encouraged broad, process-driven oversight rather than prioritization of relationships that pose material financial, operational or compliance risks. Final guidance would replace the 2023 guidance and related supplemental resources. The proposal centers on four components: risk identification and assessment, proportionate oversight, residual risk acceptance and governance. Institutions would assess both the magnitude and likelihood of harm, apply more rigorous due diligence, contracting and monitoring to higher-risk relationships, and use streamlined practices where risks are lower. Deviation from the guidance or its examples alone would not support supervisory action, although agencies could act against legal or regulatory violations, unsafe or unsound practices, or other material risks caused by inadequate third-party risk management. Separately, the Federal Deposit Insurance Corporation, Federal Reserve Board and Office of the Comptroller of the Currency clarified how they will supervise core service providers to community banking organizations. Supervisory allocation decisions will consider providers’ transparency, contract terms, pricing and billing practices, technology investment, security incidents and operational resilience. The agencies may also pursue providers that cause unsafe or unsound practices or legal violations, including where a provider qualifies as an institution-affiliated party. The Federal Reserve Board has also proposed a companion third-party risk management guide for community banks under its supervision.
2026-09-11Federal Deposit Insurance Corporation
Federal Deposit Insurance Corporation, Federal Reserve Board, National Credit Union Administration and Office of the Comptroller of the Currency propose tailored third-party risk guidance
Four federal regulators have proposed replacing existing third-party risk guidance with a nonbinding framework that tailors oversight to the magnitude and likelihood of risks posed by each relationship. The proposal emphasizes proportionate due diligence, contracting, monitoring, residual risk acceptance and governance. Separate guidance sharpens scrutiny of core providers serving community banks, including their transparency, contract practices, technology and operational resilience.