Banking Agencies Propose Revisions to Third-Party Risk Management Guidance
The Federal Reserve Board of Governors (Federal Reserve Board), the Federal Deposit Insurance Corporation (FDIC), the Office of the Comptroller of the Currency (OCC), and the National Credit Union Administration1 (NCUA) (collectively the Agencies) have jointly issued proposed revisions (the Revised Guidance) to the 2023 interagency guidance on risk management practices for third-party relationships.2 Comments on the Revised Guidance are due November 16, 2026.
Once finalized, the Revised Guidance is intended to emphasize a tailored approach to third-party risk management while reducing language in the existing guidance that the Agencies view as overly prescriptive or potentially inhibiting responsible innovation. The Revised Guidance is relevant to a broad range of financial institutions supervised by the Agencies, including banks, trust companies and credit unions, as well as their service providers, such as fintechs, banking-as-a-service (BaaS) partners and compliance vendors.
Additionally, the Federal Reserve Board, FDIC and OCC announced the release of a joint statement on community bank organizations' (CBOs) engagement with core service providers. This statement recognizes the unique dynamics that exist between CBOs and their core service providers and highlights factors, including contractual provisions and technology investments, that these agencies will consider when determining the appropriate level of supervisory resources that should be allocated to overseeing core service providers.
Background on Regulatory Development of Third-Party Risk Management Guidance
In recent years, as financial institutions have become increasingly engaged with third parties to facilitate the delivery of innovative products to customers and to manage core compliance functions, third-party risk management has been an area of heightened focus for the Agencies, as demonstrated by an increase in exam findings related to third-party oversight. Operational disruptions and compliance failures linked to third-party service providers and alleged insufficient oversight of third parties by financial institutions have also driven third-party risk management to the forefront of the Agencies' regulatory agendas.
The proposed Revised Guidance is the latest step in an evolving federal interagency approach to third-party risk management, aimed at addressing the complex relationships financial institutions have with various third parties. Prior key third-party risk management federal developments include:
- In June 2023, the Federal Reserve Board, FDIC, and OCC finalized "Interagency Guidance on Third-Party Relationships: Risk Management" (the 2023 Guidance). The 2023 Guidance, which was initially proposed in 2021, replaced earlier agency-specific guidance including OCC Bulletin 2013-29, FDIC FIL-44-2008, and Federal Reserve SR Letter 13-19.
- Federal Reserve Board, FDIC and OCC simultaneously issued "Third-Party Relationships: A Guide for Community Banks" (the 2024 Guide for Community Banks) (OCC Bulletin 2024-11; FDIC FIL-19-2024; Federal Reserve SR Letter 24-2/CA 24-1), which provided considerations for community banks in developing third-party risk management programs, policies, and practices and related examples. Although drafted with community banks in mind, the guidance addressed basic due diligence concepts useful to financial institutions of all sizes.
Rationale for Proposed Revisions and Summary of the Revised Guidance
The proposed Revised Guidance would revise the 2023 Guidance to emphasize risk identification and assessment as the cornerstone to the financial institution's targeted, third-party risk management program, while maintaining the core principles underlying the 2023 Guidance, including that the financial institution remains ultimately responsible for sound risk management and compliance with applicable laws and regulations even when activities are performed by third parties.
According to the Agencies, revisions to the 2023 Guidance were deemed necessary in response to concerns that the guidance has frequently been interpreted in an "overly broad manner and with an insufficient focus on tailoring its risk management principles" causing institutions to take a checklist, "one-size fits all" approach to third-party management, as opposed to a risk-based approach. The Agencies cite as the rationale for the changes, for example, that the prior 2023 Guidance:
- Included overly detailed examples and factual scenarios that may not align with the real-world experiences of financial institutions when dealing with third parties leading to confusion on how to tailor the third-party risk management approach to specific contexts;
- Focused on the activity conducted by the third party when determining whether heightened risk management practices should apply, rather than on either the third-party relationship itself or the magnitude or likelihood of harm related to the risks actually posed by the relationship;
- Used prescriptive language, such as "should", when discussing risk management practices that unintentionally incentivized a process-driven or checklist approach that caused institutions to fail to prioritize and focus resources on higher-risk relationships; and
- Potentially gave the incorrect impression that the goal of third-party risk management was risk elimination, which is infeasible, and accordingly, was misinterpreted by some to discourage arrangements with newer and innovative third parties because they may present elevated risks.
To address these concerns and ensure that financial institutions are appropriately prioritizing their third party risk management efforts, the proposed Revised Guidance:
- Includes additional sections on risk identification and assessment. The Revised Guidance emphasizes that third-party relationships present different levels of risk.
- It also notes that there is no one correct way to properly conduct risk assessments, and such assessments commonly consider both a) the magnitude of harm the third-party relationship could cause the financial institution or its customers and b) the likelihood that the harm will occur.
- Further, the Revised Guidance notes that in certain circumstances, a financial institution may consider a third party's regulatory status and regulatory obligations as part of its risk assessment of such third party.
Summary of Joint Statement on Supervision of Community Bank Organizations' Engagement with Core Service Providers
To align with ongoing efforts to reduce the supervisory and regulatory impact on CBOs and recognizing the unique market dynamics that exist between CBOs and their core service providers, the Federal Reserve Board, FDIC, and OCC have issued a joint statement to clarify factors that those agencies will consider when determining the appropriate level of supervisory resources that should be allocated to the oversight of core service providers. The joint statement follows a November 2025 request for information issued by the OCC regarding the various challenges community banks face with third-party service providers.
The joint statement broadly refers to core service providers as third parties that provide critical systems and infrastructure for the operation and essential functions of a CBO's business, including among other things, account management, compliance and reporting, payment and transaction processing, and customer relationship management.
Specifically, these agencies will consider the following factors when determining the appropriate nature, extent, and frequency of supervisory oversight for core service providers to CBOs, among others:
- Transparency. The core service provider's willingness to timely provide relevant due diligence data, clear service level agreements with measurable performance standards reflective of the CBO's individual needs and risk profile, prompt disclosure of operational issues and security incidents, and clear billing practices.
- Contractual Features. Whether the agreement contains clear pricing structures and practices, readily understandable explanations of fees, and permits unaffiliated service providers to integrate with the core platform.
- Technology. Investments by the core service provider in up-to-date technological solutions, demonstrated operational resilience, prompt resolution of security incidents, and effective management of end-of-life technological assets.
The joint statement further emphasizes that, while CBOs remain ultimately responsible for maintaining safe and sound practices regardless of outsourcing, when safety and soundness issues are identified related to the practices of core service providers, the agencies may take action against core service providers and/or the CBO pursuant to their statutory authorities.
Takeaways To Consider
- As financial institutions continue to partner with fintechs, technology vendors, and other third-party service providers to provide novel financial products to their customers, the interdependencies between these entities have made the identification, assessment, and ongoing monitoring of third-party relationships an increasingly critical component of financial institutions' overall risk management framework. Institutions should begin re-evaluating their current third-party risk management policies in light of the proposed changes.
- Institutions may wish to evaluate how the shift from "activity-based" to "relationship-based" risk assessment might change their risk-management practices and consider submitting feedback to the Agencies on the Revised Guidance.
For more information on the proposed revisions and their potential impact on third-party risk management practices, contact Heidi Wicker, McGregor Johnson, Audrey Carroll, Matthew Grimaldi, Evan Murlette, or the Stinson LLP contact with whom you regularly work.
1. The Revised Guidance is the first proposed interagency third-party risk management guidance that includes the NCUA as a participating agency. Feedback on the prior third-party risk management guidance urged the NCUA's inclusion.
2. The Revised Guidance defines "third-party relationship" as a business arrangement between a banking organization and an entity or individual for the provision of one or more products, services, and other activities that support the financial institution. In general, third-party relationships may include relationships with vendors, fintech companies, affiliates, and the institution's holding company. The Revised Guidance specifies that such relationships typically involve written agreements, and the use of subcontractors alone does not typically create an independent third-party relationship or create a presumption of direct financial institution oversight of any subcontractors.
