From Process to Principles: Federal Regulators Propose a New Third-Party Risk Management Framework

On September 11, 2026, the OCC, FDIC, Federal Reserve, and NCUA proposed to replace the 2023 Interagency Guidance on Third-Party Relationships with a shorter, principles-based document.¹ Two companion releases complete the package: a final interagency statement on the supervision of the use of core service providers by community banks, effective on issuance,² and a proposed Federal Reserve guide for traditional community banks (the Community Bank Guide).³ Comments are due November 16, 2026.⁴

The scale of the change is hard to overstate. The 2023 guidance is the framework every banking organization’s vendor program is built to,⁵ and it has been the standard behind a series of public enforcement actions brought against banks in fintech partnerships since 2024.⁶ The agencies now propose not to amend the 2023 guidance, but rather to rescind it, together with three related documents.⁷ The plan is to replace the 2023 guidance with a document the agencies say establishes no enforceable standards, and from which a bank may deviate without such deviation alone being a basis for supervisory action. The agencies’ stated rationale is that the 2023 guidance “frequently has been interpreted in an overly broad manner” and “unintentionally incentivized overly-process-driven approaches.”⁸

Under the new proposal, three important changes would be made to a bank’s vendor program. First, oversight would be scaled to the magnitude and likelihood of harm rather than tied to “critical activities;” a relationship would be deemed higher-risk only if (i) its failure could cause a non-trivial violation of law, material financial harm, or significant operational disruption, and (ii) that outcome is materially likely. Second, the prescriptive elements would be eliminated: there would be “no generally applicable expected contract terms.” A bank “may decide not to maintain extensive inventories” of lower-risk relationships, and monitoring and staffing could be scaled down to match. Third, the agencies expressly state that they “do not expect banking organizations to eliminate third-party risk.” Instead, accepting third-party risk within a stated risk appetite would be a valid choice, not a supervisory deficiency. Read with the OCC’s and FDIC’s new rule defining unsafe-or-unsound practice (effective November 2, 2026), which confines formal findings to violations of law and to practices that could reasonably be expected to cause material financial harm, the new interagency proposal narrows the basis for examiner findings and enforcement actions.⁹

The proposed limits matter as much as the relief offered. Finalization of this new proposal is unlikely to occur before 2027 given that comments are not due until November 16, 2026. The agencies will need time to review and consider the comments received before issuing a final document. Until that time, the 2023 guidance remains the operative standard for examiners. The new interagency proposal constitutes supervisory guidance rather than a rule, and it does not reach state regulators, the CFPB, or non-U.S. supervisors, none of whom are party to the proposal. The new proposal leaves underlying statutory compliance obligations unaltered,¹⁰ and it expressly does not address consumer compliance. Finally, the new proposal was not unanimous. Governor Michael Barr dissented from both the proposal and the Community Bank Guide.¹¹

The following summary sets out what would change, who is affected, and what an institution may wish to do while the proposal is pending finalization. Because the package affects each part of the market differently, we will also publish sector-specific analyses on our blog in the coming days.

What Would Change

The principal changes are summarized below.¹²
 

Topic	2023 guidance	Proposed guidance
Organizing concept	Heightened oversight tied to “critical activities”	Oversight scaled to the magnitude and likelihood of harm; a relationship is higher-risk only if its failure could cause a non-trivial violation of law, material financial harm, or significant operational disruption, and that harm is materially likely13
Supervisory consequence	Examples read as expectations; deviation frequently cited by examiners	No enforceable standards; deviation “will not alone be a basis for supervisory action”14
Inventory and contracts	Complete inventory; extensive list of contract provisions to consider	An inventory “may be useful,” and a large or complex organization “may benefit from” a detailed one; but banks “may decide not to maintain extensive inventories” of limited-risk relationships; “no generally applicable expected contract terms”15
Subcontractors	Bank expected to evaluate and monitor a third party’s use of subcontractors	Subcontractor use “does not typically create an independent third-party relationship;” oversight may run through the third party’s contract terms or its own program16
Staffing and monitoring	Uniform expectations across relationships	Scaled to classification; lower-risk relationships justify “less frequent reporting, and commensurately reduced staffing needs”17
Foreign-based providers	OCC Bulletin 2002-16 on country risk and examiner access to records abroad	Would be rescinded with no replacement text; the statutory obligations the bulletin implemented are unchanged18
Governance	Board oversight, independent reviews, and documentation stated as expectations	Six practices a bank “may consider adopting;” “no one right way;” due consideration to “reasonable governance considerations”19
Residual risk	Implied expectation of mitigation	Agencies “do not expect banking organizations to eliminate third-party risk;” acceptance within risk appetite is legitimate20

Who Is Affected

Community banks.The proposal was written in large part for them, but the immediate value is in the core-provider statement, which sets out the commercial practices that the agencies examining core processors will weigh in deciding how much examination attention a provider receives.²¹ In addition, the Federal Reserve’s Community Bank Guide, proposed for Federal Reserve-supervised banks under $30 billion, adds that a community bank “is generally not expected to have the technical expertise”²² to assess a vendor’s resilience or security itself and may rely instead on independent assessments. The Guide sets out, by vendor category, what a bank may consider in diligence, monitoring, and contract terms.

Sponsor banks and fintechs.The agencies noted that the proposal removes language from the 2023 guidance that “may unduly impede fintechs from entering partnerships with banking organizations.”²³ The proposal achieves that aim for fintechs that sell software or services to banks, which gain onboarding and contracting flexibility; however, a fintech that delivers a bank’s deposit, card, or credit products to consumers, with the bank as sponsor, arguably gains less because the consumer- protection, anti-money-laundering, and deposit-insurance laws that govern the program will likely make it higher-risk under the proposal’s own test. The proposal would also withdraw the agencies’ 2024 statement on those programs without replacing it, and Federal Reserve Governor Lisa Cook’s separate statement invites comments on whether the agencies should say more about cybersecurity and about how consumer-protection, recordkeeping, and anti-money-laundering responsibilities are allocated in bank-fintech partnerships.²⁴

Large and internationally active institutions.Direct relief is modest: heightened standards, CFPB supervision, and the EU and UK regimes that govern global vendor programs are unchanged, and the new test will capture most of what these institutions already treat as critical. What matters more to them than to any other group is what the proposal leaves open: how the new tiers relate to the critical- operations designations maintained for resilience and resolution planning, whether concentration across a shared cloud or infrastructure platform is addressed, what survives the withdrawal of the only federal guidance on foreign-based providers, and how intragroup affiliate services are treated. These institutions are the ones best positioned to put those questions to the agencies during the comment period.

State-chartered and New York institutions.State banking regulators have not joined the federal agencies’ turn toward less prescriptive third-party supervision, and New York has moved in the opposite direction. State-chartered institutions will realize little practical relief, because their state examiners’ expectations are unchanged by a federal proposal to which the states are not parties.²⁵ New York exemplifies the divergence: NYDFS Part 500 is a binding cybersecurity regulation with specific vendor requirements, sharpened by the department’s September 10 guidance naming third-party dependencies and concentration risk among the areas in which it finds risk assessments deficient.²⁶

During the Proposal Phase

The interim period is best used for three purposes: the comment period, time-sensitive commercial engagements, and the contemporaneous evidentiary record to which any future regulatory deference will attach, together with a small number of constituency-specific steps.

The comment period.The first decision to be made by affected parties is whether to comment, and how. Most institutions comment through their trade associations, whose letters are in progress. Institutions that do not comment themselves inherit the framing their associations choose. Because the final document will be guidance rather than a rule, the agencies’ response to comments will be the only interpretive record examiners have, so an institution may wish to decide early on whether it has a question it needs the agencies to answer, and whether its association’s letter is sufficient.

Time-sensitive commercial engagements.A community bank with a core processing agreement subject to renewal, extension, or amendment within the next 18 months may wish to bring the final core- provider statement to that negotiation, putting pricing transparency, deconversion fees, the back-billing window, and platform end-of-life management on the agenda. The statement creates no contractual entitlement, and the Board itself recognizes that a community bank “may lack leverage” with its core provider; what has changed is that these are now practices the provider’s own examiners have said they will weigh, which is a reason to raise them, and to record that they were raised, whatever the immediate outcome.

The evidentiary record.An institution that built its program to the 2023 guidance already has the governance the proposal describes.²⁷ What most programs do not have is a record of judgment, because the 2023 guidance rewarded documentation of process rather than of reasoning. The proposal’s deference would run to the reasoning: why a relationship sits in the tier it does under the magnitude-and-likelihood test, why residual risk was accepted, why monitoring was scaled as it was. An institution may wish to begin recording those decisions, in the form the proposal would credit, and to identify which of its policies cite the documents slated for withdrawal, among them OCC Bulletin 2002- 16 and the 2024 deposit-products statement, so that the statutory obligations beneath them are anchored independently.

Constituency-specific calibration.There may be short-term steps that each constituency may wish to take during the proposal stage. A large institution may wish to run its critical and high-risk relationships through the proposed magnitude-and-likelihood test and document where and why the result differs from its operational-resilience and resolution-planning classifications, in order to begin an impact assessment to determine where the proposal may make the most difference for them, including with respect to staffing. A sponsor bank may wish to confirm that its program agreements and monitoring records show a clear allocation of day-to-day responsibility for consumer compliance, recordkeeping, and the Bank Secrecy Act.

We will follow the comment process and report when the guidance is final. Please contact any of the authors or your usual firm contact with questions.

---

¹ OCC, FDIC, Bd. of Governors of the Fed. Reserve Sys. & NCUA, Proposed Third-Party Risk Management Guidance, 91 Fed. Reg. 58536 (Sept. 15, 2026) (“Proposal”). The Proposal would replace the 2023 Guidance, 88 Fed. Reg. 37920 (June 9, 2023).

² OCC, FDIC & Bd. of Governors of the Fed. Reserve Sys., Joint Statement on Community Banks’ Engagement with Core Service Providers (Sept. 11, 2026) (“Core Provider Statement”).

³ Bd. of Governors of the Fed. Reserve Sys., Proposed Third-Party Risk Management Guide for Traditional Community Banking Organizations, 91 Fed. Reg. 58438 (Sept. 15, 2026) (“Community Bank Guide”).

⁴ Proposal, 91 Fed. Reg. at 58536; Community Bank Guide, 91 Fed. Reg. at 58438.

⁵ Proposal, 91 Fed. Reg. at 58537–38 & n.2; 2023 Guidance, 88 Fed. Reg. 37920 (consolidating OCC Bulletin 2013-29, FDIC FIL-44-2008, and SR 13-19); 86 Fed. Reg. 38182 (July 19, 2021) (proposal).

⁶ See, e.g., Banking Dive, A Running List of BaaS Banks Hit with Consent Orders in 2024 (Dec. 18, 2024).

⁷ OCC Bulletin 2002-16 (May 15, 2002) (foreign-based service providers; OCC-supervised institutions only); OCC Bulletin 2024-20, SR 24-5, FIL-45-2024 (July 25, 2024) (bank-fintech deposit arrangements); and OCC Bulletin 2024-11, SR 24-2/CA 24-1, FIL-19-2024 (May 3, 2024) (community bank guide). Proposal, 91 Fed. Reg. at 58537 n.2, 58538.

⁸ Proposal, 91 Fed. Reg. at 58537-38.

⁹ Proposal, 91 Fed. Reg. at 58539–40; Unsafe or Unsound Practices, Matters Requiring Attention, 91 Fed. Reg. 56004 (Sept. 1, 2026); OCC Bulletin 2026-40; Fed. Reserve Bd., Updated Statement of Supervisory Operating Principles (Sept. 24, 2026).

¹⁰ E.g., the Bank Service Company Act (third-party services examinable as if performed by the bank; notice of service relationships), 12 U.S.C. § 1867(c); GLBA and the interagency security guidelines (oversight of service providers; contractual safeguards for customer information), 15 U.S.C. § 6801(b), 12 C.F.R. pt. 30, app. B, § III.D; the Bank Secrecy Act (the bank’s own AML program; records within 120 hours), 31 U.S.C. § 5318(h), (k)(2); UDAP and UDAAP (a bank’s products however delivered), 15 U.S.C. § 45, 12 U.S.C. §§ 5531, 5536; and the FDIC’s deposit-insurance rules (pass-through coverage; misrepresentation of insured status), 12 C.F.R. pts. 328, 330.

¹¹ Gov. Michael S. Barr, Statement (Sept. 11, 2026) (dissenting).

¹² Proposal, 91 Fed. Reg. at 58537–38.

¹³ Proposal, 91 Fed. Reg. at 58540.

¹⁴ Proposal, 91 Fed. Reg. at 58540.

¹⁵ Proposal, 91 Fed. Reg. at 58540–41.

¹⁶ Proposal, 91 Fed. Reg. at 58539, 58543.

¹⁷ Proposal, 91 Fed. Reg. at 58542.

¹⁸ Proposal, 91 Fed. Reg. at 58537 n.2, 58538; see supra note 10.

¹⁹ Proposal, 91 Fed. Reg. at 58544.

²⁰ Proposal, 91 Fed. Reg. at 58544.

²¹ Core Provider Statement at 4–6.

²² Community Bank Guide, 91 Fed. Reg. at 58439-40.

²³ Proposal, 91 Fed. Reg. at 58538.

²⁴ Gov. Lisa D. Cook, Statement (Sept. 11, 2026).

²⁵ See Conference of State Bank Supervisors, Comment Letter (Dec. 29, 2025) (urging the FDIC to coordinate with state regulators to avoid supervisory divergence for state non-member banks, and urging the agencies to align with the Federal Reserve so that state member and state nonmember banks are not subject to different standards).

²⁶ NYDFS, Guidance on Risk Assessments Under the DFS Cybersecurity Regulation (Sept. 10, 2026).

²⁷ Proposal, 91 Fed. Reg. at 58544; 2023 Guidance, 88 Fed. Reg. at 37935–36 (governance).