On September 11, 2026, the Federal Deposit Insurance Corporation (FDIC), the Federal Reserve Board, the National Credit Union Administration (NCUA), and the Office of the Comptroller of the Currency (OCC) jointly requested public comment on proposed guidance regarding third-party risk management.
The proposed guidance is intended to assist financial institutions in managing risks associated with third-party relationships. The agencies stated that the proposed guidance reflects their supervisory experience and lessons learned from examining financial institutions' third-party risk management practices. The goal is to help banks and credit unions better align and tailor their risk management practices to the specific risks of individual third-party relationships.
The proposed guidance utilizes a principles-based approach. The agencies noted that, like all supervisory guidance, the proposed guidance is non-binding. When finalized, the federal bank regulatory agencies plan to rescind existing third-party risk management guidance and replace it with the finalized guidance to promote consistency and prudent innovation in the banking industry.
Comments on the proposed guidance are due 60 days after its publication in the Federal Register.
Separately, the agencies issued a statement on community banks' engagement with core service providers. The statement discusses factors the agencies will consider when making supervisory and enforcement decisions related to these core providers.
The Federal Reserve Board also requested comment on a proposed third-party risk management guide specifically for Federal Reserve-supervised community banks. This proposed guide is intended to serve as a companion document to the broader proposed guidance.
