OCC Proposes Risk-Based Third-Party Rules for U.S. Community Banks
Key Takeaways
- •The OCC has proposed shifting third-party risk oversight for U.S. community banks from uniform requirements to a risk-based framework tied to each relationship's potential harm.
- •Under the proposal, a bank's size, complexity, and risk profile would determine the level of scrutiny applied to each vendor relationship.
- •The guidance would also clarify how the OCC supervises core service providers that supply community banks with essential technology and back-office functions.
- •The OCC did not provide a timeline for implementation, and the proposal is expected to proceed through a public-comment process.
- •A risk-based approach could allow banks to evaluate cryptocurrency exchanges and stablecoin issuers by their specific risk profiles, potentially improving crypto companies' access to traditional banking services.

The Office of the Comptroller of the Currency (OCC) has proposed new guidance that would shift third-party risk oversight for U.S. community banks from broad, uniform requirements to standards based on each relationship’s actual risk.
Comptroller of the Currency Jonathan V. Gould said the proposal is intended to reduce regulatory friction for community banks while preserving appropriate supervision. The guidance would also clarify how the OCC supervises core service providers that supply smaller banks with technology and back-office systems.
OCC Proposal Targets Third-Party Risk Management
The OCC published the proposal on its website as part of a broader effort to reduce unnecessary regulatory burdens. Under the proposed approach, banks would scale their oversight of vendors according to the potential harm a relationship could cause.
A bank’s size, complexity and risk profile would help determine the level of scrutiny applied to each vendor relationship. The OCC said the current approach relies too heavily on rigid, process-oriented checklists that can treat every vendor in the same way. As a result, small banks may have to devote similar resources to low-risk contracts and higher-risk relationships.
The proposed guidance would replace that uniform standard with a risk-based framework. It would give banks more flexibility to tailor vendor risk-management programs to their own size and complexity.
The OCC also addressed its supervision of core service providers, which provide many banks with essential technology and back-office functions. Many community banks depend on a relatively small group of providers for core banking services. The agency said clearer supervisory standards could help banks conduct due diligence and negotiate contracts with those providers.
Gould linked the proposal to a broader policy agenda, saying it would reduce unnecessary friction while aligning supervision with actual risk. He added that the changes are intended to strengthen banks’ ability to manage vendor relationships without creating additional burdens.
The OCC’s official account posted the following statement on X on September 11, 2026:
. @USComptroller : @POTUS & @SecScottBessent understand that strong community banks mean stronger communities, greater opportunity for American families & businesses & a stronger American economy. The OCC is proud to turn their vision into action. pic.twitter.com/mtiLiaHt3W — OCC (@USOCC) September 11, 2026
Proposal Would Give Community Banks More Flexibility
Gould connected the announcement with remarks from the U.S. Comptroller’s account crediting President Trump and Treasury Secretary Scott Bessent with prioritizing community banks. The account said both officials view strong community banks as important to stronger communities, greater opportunity for American families and businesses, and a stronger U.S. economy.
The OCC said the combined changes would give banks more room to manage risk while developing new products and services. Community banks often serve as primary lenders to small businesses and local residents, while smaller institutions have repeatedly cited vendor oversight costs as a burden. Larger competitors may be better positioned to absorb those costs because they typically have larger compliance staffs.
The agency described the proposal as part of an ongoing effort rather than a single solution. It said it has already taken a series of actions intended to right-size the supervisory burden on community banks.
The OCC did not provide a specific timeline for when the guidance might take effect. The proposal is expected to proceed through a public-comment process. Third-party risk management has received increased attention across the banking sector following several high-profile vendor failures in recent years. The final form of the guidance will depend in part on how the OCC balances greater flexibility with adequate oversight.
A less prescriptive framework could also affect banks’ relationships with cryptocurrency companies. Exchanges and stablecoin issuers have often faced difficulty finding banking partners because of strict vendor-risk reviews. Under a risk-based approach, banks could evaluate those relationships according to their specific risk profiles rather than applying blanket restrictions, potentially addressing a longstanding obstacle to crypto companies’ access to traditional banking services.
The proposal is available through the OCC’s official website. The original report was published by Blockonomi.