OCC Proposes Risk-Tailored Third-Party Risk Management Guidance and Core Provider Clarity for Commun

Key Takeaways

• The OCC issued proposed third-party risk management guidance that would let banks scale oversight to the magnitude and likelihood of harm from each relationship, rather than following broad, process-driven approaches.
• It also clarified its risk-based supervision and enforcement of core service providers to help community banks facing due diligence, monitoring, and contract challenges.
• Compliance teams should assess how their current frameworks would change and consider submitting comments.

Deep Dive

The OCC issued proposed third-party risk management guidance that would let banks scale oversight to the magnitude and likelihood of harm from each relationship, rather than following broad, process-driven approaches. It also clarified its risk-based supervision and enforcement of core service providers to help community banks facing due diligence, monitoring, and contract challenges. Compliance teams should assess how their current frameworks would change and consider submitting comments.

The proposal is a shift from uniform, process-heavy third-party risk management (TPRM) toward a risk-calibrated model. Under the proposed guidance, banks would prioritize resources by the potential harm posed by each relationship and tailor controls to the bank's size, complexity, and risk profile. The OCC states there is no one-size-fits-all approach and that the guidance is intended to encourage responsible innovation, including in bank-fintech arrangements. Because this is a proposal, the guidance is not yet final, and the press release does not state a comment deadline or effective date. Teams should check the full proposed guidance (linked in the release) for these details.

The second element is a Joint Statement on Community Banks' Engagement with Core Service Providers. It describes the OCC's risk-based supervision and enforcement approach for these providers. It is aimed at situations where community banks struggle to obtain adequate due diligence information, perform ongoing monitoring, or negotiate contract terms with dominant core vendors. The release does not specify new enforcement mechanisms, so teams should review the statement for details. It signals that regulators may help improve provider transparency, which could strengthen banks' leverage in negotiations and renewals.

The release also lists broader community bank relief: a distinct supervision line, a higher asset ceiling for the community bank portfolio, tailored exam scope and frequency, and model risk management guidance scaled to size and complexity. It also covers expanded expedited licensing filings, Community Bank Minimum BSA/AML exam procedures, elimination of Money Laundering Risk System data collection, and reduced duplicative data reporting. Further items include a proposed simplified Community Reinvestment Act strategic plan process, a revised community bank leverage ratio compliance guide, and broader eligibility for longer exam cycles. Larger institutions are not the primary beneficiaries, but the risk-based TPRM principles could influence examiner expectations across portfolios.

Recommended actions: (1) Review the proposed guidance and assess gaps against current TPRM policies, vendor tiering, and criticality models. (2) Evaluate whether existing processes are over-engineered for low-risk relationships and where documentation could be right-sized. Do not reduce controls until the guidance is finalized. (3) Document the rationale for risk-based decisions, since flexibility will likely increase examiner focus on the quality of judgment. (4) Inventory core service provider issues, such as information gaps and contract terms, and use the joint statement in vendor discussions. (5) Consider submitting comments through trade groups or directly.

Risk implications: Reduced prescriptiveness lowers compliance cost but raises the risk of under-scoping critical or fintech relationships if tiering is weak. Banks retain accountability for third-party failures, including operational resilience, data security, and consumer harm. Community banks should keep strong controls over critical activities, while larger banks should watch for spillover into supervisory expectations and for any divergence from other agencies' interagency guidance.

Source: Office of the Comptroller of the Currency