The Office of the Comptroller of the Currency (OCC), the Federal Reserve, the Federal Deposit Insurance Corporation (FDIC), and the National Credit Union Administration (NCUA) published the proposal in the Federal Register, opening it for public comment. The agencies are seeking to replace the Interagency Guidance on Third-Party Relationships: Risk Management, which the OCC, Federal Reserve, and FDIC issued in 2023. Comments on the new proposal are due by 16 November 2026, and submissions can be made through Regulations.gov or directly to each agency.
Rationale for revising the 2023 framework
According to the notice, the agencies continue to support the principles-based approach set out in the 2023 guidance but have found, based on supervisory experience and stakeholder feedback, that it has often been applied too broadly and without sufficient tailoring. Banking organisations reportedly struggled to determine which considerations applied to specific types of relationships, such as core service providers compared with fintech partners or facilities vendors, and to adapt the guidance's examples to their own circumstances. The agencies also noted that supervisory language in the 2023 document was frequently interpreted as prescriptive, leading some institutions to apply heightened oversight uniformly rather than according to actual risk levels. The proposal further states that the earlier guidance discouraged arrangements with newer and innovative third parties by implying they carry elevated risk.
Structure of the proposed guidance
The proposed text organises third-party risk management into four components: risk identification and assessment, risk oversight, residual risk acceptance, and governance. It emphasises that banking organisations should align the intensity of due diligence, contract negotiation, and ongoing monitoring with the reasonably assessed risk level of each third-party relationship, taking into account the organisation's size, complexity, and risk profile. In addition, the document also addresses subcontractor oversight, use of consortia and standard-setting organisations, insurance and indemnification provisions, and operational resilience planning. The agencies state that residual risk is not expected to be eliminated entirely and that institutions may accept some residual risk where mitigation is impractical or where alternatives are limited.
Regulatory context
The agencies describe the proposal as consistent with Executive Order 14405, which concerns responsible innovation, and expect it to qualify as a deregulatory action under Executive Order 14192 by reducing prescriptive requirements. The Office of Information and Regulatory Affairs has determined that the proposal does not constitute a `significant regulatory action` under Executive Order 12866, meaning it is not expected to have an annual economic effect of USD 100 million or more. If finalised, the new guidance would formally rescind and replace the 2023 guidance and related supplemental resources. The agencies have stated that non-compliance with the guidance, once finalised, would not itself trigger supervisory action, as it does not establish enforceable standards.
