Fed, FDIC, FDIC, OCC and NCUA Seek Comment on Proposed Third-Party Risk Management Guidance
Key Takeaways
- •Four federal banking agencies jointly opened a public comment period on September 11, 2026, for proposed guidance on managing risks tied to financial institutions' third-party relationships.
- •The proposal follows a principles-based, non-binding approach and, once finalized, would rescind and replace the existing third-party risk management guidance.
- •Stakeholders have 60 days from the guidance's publication in the Federal Register to submit comments.
- •In a separate action, the agencies issued a statement describing factors they will consider in supervisory and enforcement decisions involving community banks' core service providers.
- •The Federal Reserve Board also requested comment on a companion third-party risk management guide designed specifically for Federal Reserve-supervised community banks.
The Federal Deposit Insurance Corporation (FDIC), the Federal Reserve Board, the National Credit Union Administration (NCUA), and the Office of the Comptroller of the Currency (OCC) on September 11, 2026 jointly requested public comment on proposed guidance designed to help financial institutions manage the risks associated with third-party relationships. The joint announcement was released by the Board of Governors of the Federal Reserve System at 10:00 a.m. EDT.
According to the agencies, the proposed guidance reflects their supervisory experience and the lessons learned from examining the third-party risk management practices of financial institutions. It is intended to assist banks and credit unions in better aligning and tailoring their third-party risk management practices to the risks presented by individual third-party relationships. Third-party relationships in banking typically cover the vendors, service providers, and other outside firms that institutions rely on for functions they do not handle in-house, meaning institutions are exposed to risks that originate outside their own operations.
The proposal takes a principles-based approach and, like all supervisory guidance, is non-binding, the agencies said. Once finalized, the federal bank regulatory agencies plan to rescind the existing third-party risk management guidance and replace it with the finalized version in order to promote consistency and prudent innovation across the banking industry.
Comments on the proposed guidance are due 60 days after publication in the Federal Register. The comment window gives banks, credit unions, and other interested parties the opportunity to weigh in before the agencies move toward a final version, which they have said would replace the existing guidance.
Statement on Core Service Providers
In a separate action announced the same day, the agencies issued a statement addressing community banks' engagement with core service providers. The statement discusses certain factors the agencies will consider when making supervisory and enforcement decisions related to these core providers. Core service providers supply systems and services that community banks rely on for fundamental banking operations.
Companion Guide for Community Banks
Also on September 11, the Federal Reserve Board separately requested comment on a proposed third-party risk management guide aimed specifically at Federal Reserve-supervised community banks. The guide is intended to serve as a companion document to the proposed guidance.
Related Documents
- Source press release: Agencies seek comment on proposed third-party risk management guidance and issue statement on community bank engagement with core service providers
- Federal Register notice, Proposed Third-Party Risk Management Guidance: HTML | PDF
- Federal Register notice, Proposed Third-Party Risk Management Guide for Traditional Community Banking Organizations: HTML | PDF
- Joint Statement on Community Banks' Engagement with Core Service Providers (PDF)
- Board memo (PDF)
- Statement by Governor Barr
- Statement by Governor Cook
- Board Votes
