The Federal Deposit Insurance Corporation, the Federal Reserve Board, the National Credit Union Administration and the Office of the Comptroller of the Currency have jointly proposed new interagency guidance designed to strengthen third party risk management across the banking sector. The proposed guidance, once finalized, would revise and replace existing interagency third party risk management frameworks that have guided banking organizations for over a decade.
It is important to note that the proposal remains guidance rather than a final rule. The OCC has specifically stated that the framework is principles-based, risk-focused and non-binding, and that it will not establish enforceable standards or prescriptive requirements. Comments on the proposed interagency guidance are due November 16, 2026, giving industry participants significant time to review and respond before any finalization takes place.
Proposed Guidance Covers Full Lifecycle of Third Party Relationships
The proposed third party risk management framework addresses the complete lifecycle of relationships between banking organizations and external service providers. Among the principal areas covered are board-approved third party risk management policies, governance and management responsibilities, risk identification and assessment, due diligence procedures, contracting standards, ongoing monitoring practices, documentation and reporting requirements, escalation and remediation protocols, and the termination of relationships.
A central theme running through the proposal is the expectation that banking organizations tailor their risk management practices to the reasonably assessed risk of each third party relationship. The agencies expect institutions to consider their own size, complexity and risk profile alongside the nature and criticality of the relationship itself. Smaller institutions with straightforward operations are not expected to maintain the same infrastructure as the largest banks, but the underlying responsibility remains the same. Banks cannot outsource their regulatory responsibilities regardless of how many functions a third party performs on their behalf.
The banking agencies guidance makes clear that financial institutions bear full accountability for activities conducted by third parties acting on their behalf. This principle reinforces the long-standing regulatory expectation that outsourcing operational tasks does not transfer the associated compliance and safety obligations.
Community Banks and Fintech Providers Face Practical Challenges
Alongside the proposed framework, the agencies issued a separate interagency statement addressing the particular circumstances facing community banks and their relationships with core service providers. Community banks oversight presents unique challenges because these institutions often have limited negotiating leverage when dealing with large technology vendors. Obtaining meaningful audit rights, accessing detailed operational information and switching core providers without significant cost and disruption remain persistent difficulties for smaller institutions.
The due diligence framework outlined in the proposal could place additional demands on community banks that already operate with constrained resources. The FDIC has separately discussed the concept of a Banking Industry Standards Development Organization, known as BISDO, which could potentially introduce standardized assessments or certifications for service providers. According to reporting by Consumer Finance Monitor, such an initiative could reduce duplicative vendor due diligence efforts across the industry. However, BISDO has not been formally established as a functioning body at this stage.
The proposed guidance carries significant implications for banks, fintechs and technology service providers alike. Third party risk management obligations affect how financial institutions select, monitor and maintain relationships with external technology partners. For fintech firms and other vendors, the evolving expectations around fintech risk compliance, transparency and reporting could reshape how they engage with regulated banking clients. As the comment period proceeds, the financial services industry will be closely watching how the agencies balance comprehensive third party risk management principles with practical considerations for institutions of all sizes.
