Banking Agencies Propose an Overhaul of Third-Party Risk Management Guidance

On Friday, September 11, 2026, the Office of the Comptroller of the Currency (“OCC”), the Board of Governors of the Federal Reserve System (“FRB”), the Federal Deposit Insurance Corporation (“FDIC”), and the National Credit Union Administration (“NCUA”) (collectively, the “Agencies”) jointly requested comment on proposed interagency third-party risk management (“TPRM”) guidance (“Proposal”). Comments on the Proposal are due on November 16, 2026. That same day, the OCC, FRB, and FDIC also issued a joint statement on community banks’ engagement with core service providers, and the FRB proposed a companion TPRM guide for the traditional community banking organizations that it supervises.  

The Agencies describe the Proposal as a principles-based framework that would rescind and replace the existing TPRM guidance (“Existing Guidance”), which has been in effect since 2023. Compared to the Existing Guidance, the Proposal would: (1) reduce or clarify elements that the Agencies say have been treated as prescriptive; and (2) provide banks with greater flexibility to exercise risk-based judgment and responsible innovation in their dealings with service providers. 

The Proposal drew differing views from FRB leaders, with Governor Lisa Cook supporting its principles-based and risk-focused direction while requesting comment on several areas where she believes greater specificity may be warranted, including cybersecurity, consumer protection, record management, and anti-money laundering in bank-fintech partnerships. Governor Michael Barr dissented based on concerns that the Proposal could create supervisory gaps and make early corrective action less likely.

In this post, we discuss key features of the Proposal and highlight certain differences between it and the Existing Guidance.

What the Proposal would do. 

If finalized, the Proposal would effectuate a complete revision of the Existing Guidance, superseding it in its entirety. It also would replace OCC Bulletin 2002-16 on foreign-based third-party service providers, the July 2024 Joint Statement on Banks’ Arrangements with Third Parties to Deliver Bank Deposit Products and Services, and the May 2024 TPRM Guide for Community Banks. The Agencies also have invited comment on whether any additional guidance or interpretive materials should be rescinded. 

Why is new guidance necessary? 

The Agencies explain that they are proposing to update the TPRM framework because, in their view, the Existing Guidance has been interpreted too broadly and without sufficient attention to tailoring its risk-management principles. The Proposal’s preamble attributes this outcome to four key issues with the Existing Guidance:

• First, the Agencies contend that the breadth of the Existing Guidance, together with its detailed examples and idealized factual scenarios, makes it difficult for banking organizations to implement the TPRM framework, and particularly to tailor its application to particular types of vendor relationships.
• Second, although the Existing Guidance calls for more comprehensive and rigorous oversight of third-party relationships supporting “critical activities,” the Agencies suggest the Existing Guidance places too much emphasis on the activity being performed by the third party and too little on the relationship itself and the magnitude and likelihood of potential risk it presents.
• Third, according to the Agencies, the Existing Guidance unintentionally encourages “overly process-driven approaches”— in other words, check-the-box compliance—that do not sufficiently prioritize higher-risk relationships or concentrate resources where they are most needed.
• Fourth, the Agencies acknowledge that the Existing Guidance has been interpreted to discourage arrangements with newer and more innovative service providers because those firms may present elevated risks.

Importantly, the Agencies also state that the Proposal is intended to encourage responsible innovation consistent with Executive Order 14405, which directs federal financial agencies to identify opportunities to lower barriers for fintech companies. The Agencies note that the Proposal would advance the Executive Order’s objective by removing broad and overly prescriptive language from the Existing Guidance that could impede fintechs from entering into partnerships with banking organizations. The Proposal notes that “newer and innovative third parties” may provide innovative services that can improve access to financial products and services and “create economic opportunities for banking organizations and their customers.” However, the Proposal does not discuss specific innovations, such as artificial intelligence, or provide specific guidance that would apply to relationships with innovative third parties. 

Key differences from the Existing Guidance.

The Proposal differs from the Existing Guidance in several important ways:

• Scope: The Existing Guidance applies broadly to “any business arrangement” between a banking organization and another entity, “by contract or otherwise,” and provides that a third-party relationship may exist without a contract or remuneration. The Proposal appears to narrow that scope to arrangements involving products, services, or activities that “support the banking organization.” The Proposal notes that an activity without a written agreement or clear consideration is unlikely to constitute a third-party relationship under the revised TPRM framework and clarifies that a third party’s use of a subcontractor does not, by itself, ordinarily create a separate third-party relationship between the banking organization and that subcontractor, nor does it create a presumption that the banking organization has direct oversight over a subcontractor. 
• Risk tiering: The Proposal eliminates the concept of “critical activities.” In its place, the Proposal provides high-level guidance for riskier third-party relationships, which may include those where (1) a disruption or breach could cause the banking organization to incur an actual non-trivial legal or regulatory violation, material harm to its financial condition, or significant operational or customer disruption, and (2) there is a material likelihood of that harm occurring under current or reasonably foreseeable conditions. 
• Contracting: The Existing Guidance’s lists of sample contract provisions are replaced with a short, non-exhaustive list of considerations that may guide banks’ contracting practices. The Proposal states that there are “no generally applicable expected contract terms,” even for higher-risk relationships. It also provides that the presence or absence of a particular term that an examiner regards as inconsistent with best practices would not, on its own, be a sufficient basis for an examiner to communicate an adverse finding concerning a banking organization’s TPRM practices.
• Tailoring: While the Existing Guidance says that banking organizations should calibrate their risk management practices and exercise discretion in applying the guidance, the Proposal goes a step further. It states that there is “no one-size-fits-all approach,” makes each banking organization responsible for selecting practices appropriate to its circumstances, and provides that the Agencies will give due consideration to a banking organization’s reasonable decisions. Governor Barr expressed concern that this approach could cause the Agencies to defer to a banking organization’s views on TPRM rather than the Agencies’ own, independent judgment. 
• Inventories: The Existing Guidance states that sound TPRM practices include maintaining a complete inventory of third-party relationships. The Proposal, on the other hand, acknowledges that the appropriate level of detail of an inventory may vary—larger or more complex organizations may benefit from detailed, periodically updated inventories, while a simpler format may be better suited to community banks. Banking organizations may also decide not to maintain extensive inventories for limited-risk relationships, such as those involving administrative or clerical tasks, professional support services, or office support services.
• Acknowledgement of residual risk: Although the Existing Guidance recognizes that a banking organization may determine whether residual risks that cannot be mitigated are acceptable, the Proposal substantially expands on this point, explaining that the Agencies do not expect banking organizations to entirely eliminate third-party risk and acknowledging that “[s]ome residual risk is unavoidable.” The Proposal provides that a banking organization may determine, based on the particular facts and circumstances, that residual risk is acceptable within its risk appetite and tolerances, including where further mitigation is not practicable.
• No automatic supervisory action for deviation from the TPRM guidance: The Existing Guidance clearly articulates that it does not have the force and effect of law and does not impose new requirements on banking organizations. The Proposal goes further by stating that deviation from the guidance—including a deviation an examiner believes is inconsistent with best practices—will not, by itself, provide a basis for a supervisory action. The Agencies could nevertheless act in response to violations of law or regulation, unsafe or unsound practices, or material risks arising from insufficient management of third-party relationships

* * *

We will continue to monitor developments in this area and provide updates as warranted. 

To receive the latest insights on US legal developments, subscribe to the Freshfields A Fresh Take Blog.