Agencies Propose Principles-Based Third-Party Risk Guidance to Replace Existing Interagency Framewor

Key Takeaways

• The FDIC, Federal Reserve, NCUA, and OCC have jointly requested comment on proposed non-binding third-party risk management guidance that would rescind and replace the current guidance once finalized.
• A companion statement on community bank engagement with core service providers outlines factors the agencies will weigh in supervisory and enforcement decisions.
• Compliance teams should begin gap assessments now and consider submitting comments before the 60-day window closes.

Deep Dive

The FDIC, Federal Reserve, NCUA, and OCC have jointly requested comment on proposed non-binding third-party risk management guidance that would rescind and replace the current guidance once finalized. A companion statement on community bank engagement with core service providers outlines factors the agencies will weigh in supervisory and enforcement decisions. Compliance teams should begin gap assessments now and consider submitting comments before the 60-day window closes.

The proposal reflects the agencies' supervisory experience and lessons learned from examining third-party risk management practices. It takes a principles-based approach intended to help banks and credit unions tailor their practices to the risk of each individual third-party relationship, rather than apply uniform controls. As with all supervisory guidance, it is non-binding. In practice, however, examiners typically use such guidance as the benchmark for assessing safety and soundness, so institutions should treat it as a strong indicator of supervisory expectations.

Key changes: when finalized, the agencies plan to rescind the existing interagency third-party risk management guidance and replace it with the new text, with the stated aims of consistency and prudent innovation. The agencies are also issuing a joint statement on community banks' engagement with core service providers, which describes factors the agencies will consider in supervisory and enforcement decisions involving these providers. The Federal Reserve Board separately requested comment on a companion third-party risk management guide for Federal Reserve-supervised community banks. The summary does not detail the substantive content of these documents, so teams must review the full PDFs to identify specific expectations.

Timeline: comments are due 60 days after publication in the Federal Register. The publication date was not stated in the release, so teams should monitor the Federal Register for it and calculate the deadline. No effective date or transition period has been announced. These will likely be set when the guidance is finalized.

Recommended actions: (1) Obtain and review the proposed guidance, the joint core service provider statement, and, where relevant, the Federal Reserve community bank guide. (2) Map the proposal against current policies, vendor inventories, due diligence, contract standards, and ongoing monitoring to identify gaps. (3) Assess whether the risk-tiering approach is calibrated to the criticality of each relationship, particularly for bank-fintech arrangements and technology service providers. (4) Consider submitting comments directly or through trade associations, especially on areas of operational burden. (5) Brief senior management and the board, and plan for updating policies once the final text is issued. Institutions with concentrated reliance on core providers should review contract terms and escalation paths in light of the joint statement.

Risk implications: the shift toward a tailored, principles-based approach may reduce checklist-style burden but increases the need for documented, defensible risk-based judgment. Weak oversight of critical vendors continues to raise operational resilience, information security, and compliance exposure. Moderate impact is expected for large institutions with mature programs, and potentially greater adjustment for smaller institutions and credit unions that rely heavily on core providers and fintech partners.

Source: Office of the Comptroller of the Currency