WASHINGTON — The Federal Deposit Insurance Corporation (FDIC), the Federal Reserve Board, the National Credit Union Administration (NCUA), and the Office of the Comptroller of the Currency (OCC) on November 13, 2026, announced that they will extend, until December 16, the comment period for proposed guidance on managing risks associated with third-party relationships. Comments on the proposal were originally due November 16. The extension moves the deadline back by one month, giving interested parties additional time to submit feedback. The joint announcement was released at 4:15 p.m. EST and published on the Federal Reserve's website.

The proposed guidance reflects the agencies' supervisory experience and lessons learned from examining financial institutions' third-party risk management practices — the arrangements through which banks and credit unions rely on outside providers. It is intended to help banks and credit unions tailor their risk management practices to the risks associated with individual third-party relationships. The proposal takes a principles-based approach and, like all supervisory guidance, is non-binding, meaning it lays out supervisory expectations without imposing binding requirements on institutions.

When finalized, the federal bank regulatory agencies plan to rescind existing third-party risk management guidance and replace it with the finalized guidance in order to promote consistency and prudent innovation in the banking industry. That planned replacement is the practical significance of the current comment window: feedback filed by the December 16 deadline would shape the documents that ultimately supersede the current versions. The NCUA also plans to rescind its existing third-party risk management guidance and will conduct its own reviews to update related guidance as needed.

In a separate announcement issued on the same day, the Federal Reserve Board said it will likewise extend, until December 16, the comment period on a proposed third-party risk management guide designed specifically for Federal Reserve-supervised traditional community banks, putting both comment deadlines on the same closing date.

The proposal was first put out for public comment in September, when the agencies sought feedback on the proposed framework and, at the same time, issued a statement addressing community bank engagement with core service providers — a pairing that connects the framework to the outside providers behind core banking functions at community banks. That announcement accompanied the release of the draft guidance for comment.

The agencies have published two related notices in the Federal Register:

• Federal Register notice: Proposed Third-Party Risk Management Guidance; Extension of Comment Period (PDF)
• Federal Register notice: Proposed Third-Party Risk Management Guide for Traditional Community Banking Organizations (PDF)