Third-party risk management guidance proposed by four agencies

Four federal regulators have asked for comment on new third-party risk management guidance that would replace the framework banks and credit unions use to oversee vendors, fintech partners and other outside providers. The proposal, released September 11 by the Fed, FDIC, National Credit Union Administration and OCC, comes with a joint statement from the Fed, FDIC and OCC on how community banks deal with core service providers.

Key takeaways

• The proposed guidance is principles-based and, like all supervisory guidance, non-binding.
• When finalized, it would replace the existing interagency third-party risk management guidance.
• Comments are due 60 days after Federal Register publication.
• A separate joint statement from the three federal bank regulators explains factors they will weigh in supervisory and enforcement decisions involving core service providers.

The news

The agencies said the proposal reflects their supervisory experience and lessons from examining how institutions manage third-party relationships. It is meant to help banks and credit unions align and tailor their practices to the risks of each relationship, rather than apply one standard to every vendor. The federal bank regulatory agencies plan to rescind the existing guidance once the new text is final, which they say will promote consistency and prudent innovation.

The Federal Reserve Board separately requested comment on a proposed third-party risk management guide for Fed-supervised community banks, designed as a companion to the main proposal. Governors Barr and Cook each issued statements, and the Federal Register notices cover both the interagency guidance and the community banking guide.

The joint statement on core service providers, issued by the Fed, FDIC and OCC without the NCUA, concerns community bank engagement with core providers, the companies that typically run central systems for deposits, loans and account records. According to the release, the statement discusses certain factors they will consider when making supervisory and enforcement decisions related to these core providers.

Our analysis

The central phrase is “tailor.” A uniform standard would treat a payroll vendor and a core processor alike, even though the consequences of failure differ sharply. A principles-based framework puts the work of sorting relationships by risk on the institution and asks examiners to judge the result, not count the paperwork.

That matters for AML compliance and other regulatory functions that banks increasingly outsource. A transaction monitoring tool, a customer onboarding platform or a fraud referral service is a third party like any other, and a bank remains responsible for the outcome. The same logic applies to fintech partnerships, where the bank is the regulated party and the outside company runs much of the customer experience. Guidance that is clear about which relationships carry the most risk helps both sides decide where diligence should go.

The core provider statement addresses the other side of the relationship. A small bank may have limited bargaining power over the vendor that runs its systems. By describing how supervisors will weigh factors involving those providers, the agencies signal that responsibility is not meant to fall only on the bank.

Room for disagreement

Non-binding guidance can still shape examinations in practice, and some banks worry that a flexible standard leaves too much to examiner judgment. Others may welcome flexibility but want specifics on what a proportionate program looks like. Vendors may press for clarity on how supervisors will treat them directly. The release does not describe the content of the Barr and Cook statements, and it does not say whether there were differences among the agencies.

What to watch

The comment period will close 60 days after the Federal Register notices are published. Look for bank trade groups to comment on proportionality and on how much of a bank’s diligence can be shared across institutions that use the same provider. The agencies will then decide whether to finalize the text and withdraw the current guidance, which remains in force until they do.