OCC Proposes Risk-Based Third-Party Risk Management Guidance to Replace Existing Interagency Framewo

Key Takeaways

• The OCC, with the Federal Reserve, FDIC, and NCUA, has issued proposed guidance that would revise and replace existing third-party risk management guidance and ask banks to tailor their practices to the assessed risk of each relationship.
• The guidance is non-enforceable, but it will likely shape examiner expectations and would apply to community banks once final.
• Compliance teams should review current programs and consider submitting comments within 60 days of Federal Register publication.

Deep Dive

The OCC, with the Federal Reserve, FDIC, and NCUA, has issued proposed guidance that would revise and replace existing third-party risk management guidance and ask banks to tailor their practices to the assessed risk of each relationship. The guidance is non-enforceable, but it will likely shape examiner expectations and would apply to community banks once final. Compliance teams should review current programs and consider submitting comments within 60 days of Federal Register publication.

The proposal states that it will not set enforceable standards or prescriptive requirements, and that non-compliance will not result in supervisory action. It is therefore not a new rulemaking, and the bulletin does not specify new control requirements. It does, however, reflect supervisory experience and lessons learned from examinations, so it is a strong indicator of how examiners will evaluate program quality. The bulletin's topic tags (bank-fintech arrangements, third-party technology service providers, and bank information technology) suggest continued supervisory attention to these areas. The proposal would apply to community banks when finalized, so smaller institutions should not assume they are out of scope.

The only deadline in the bulletin is the comment period: comments are due 60 days after the proposal is published in the Federal Register. The publication date was not given, so the exact due date cannot be calculated yet. No effective date or transition period has been announced, and these will depend on finalization. Existing guidance presumably remains operative until it is replaced, so current programs should be maintained in the interim.

Recommended actions:
- Obtain and review the full proposed guidance (PDF) and compare it with the current third-party risk management policy, standards, and procedures.
- Perform a gap analysis focused on how the program tiers relationships by criticality and risk, and whether due diligence, contract provisions, and ongoing monitoring scale accordingly.
- Identify areas where current processes are uniform and resource-heavy for low-risk vendors, as these may be candidates for streamlining. Preserve rigorous controls for critical activities and fintech arrangements.
- Coordinate with legal, procurement, information security, and business lines on whether to submit comments, and monitor the Federal Register for the publication date.
- Document the rationale for risk assessments and tailoring decisions, since examiners will likely expect support for any reduced oversight.

The overall impact is moderate and largely beneficial in terms of burden, with some risk. Greater flexibility could reduce compliance cost, but it places more responsibility on institutions to justify their risk assessments. Weak or poorly documented tiering could lead to under-oversight of critical providers and to examiner criticism, even though the guidance itself is non-binding. Operational resilience, data security, and concentration exposure remain core concerns.

Source: Office of the Comptroller of the Currency