Agencies seek comment on proposed third-party risk management guidance and issue statement on community bank engagement with core service providers
On September 11, 2026, the FDIC, Federal Reserve Board, NCUA and OCC asked for public comment on proposed guidance to help financial institutions manage risks from third-party relationships. The agencies also issued a statement on how they will approach community banks' dealings with core service providers, and the Fed separately sought comment on a companion guide for Federal Reserve‑supervised community banks.
Why It Matters
The agencies intend the proposed guidance to replace existing third‑party risk management guidance when finalized, aiming to foster consistent supervision and support prudent innovation across the banking sector. The separate statement and companion guide signal renewed attention to how community banks interact with core providers and how those relationships factor into supervisory and enforcement decisions.
Key Facts
- Date of release: September 11, 2026
- Agencies involved: Federal Deposit Insurance Corporation (FDIC); Board of Governors of the Federal Reserve System; National Credit Union Administration (NCUA); Office of the Comptroller of the Currency (OCC)
- Action requested: Comment on proposed third‑party risk management guidance
- Guidance approach: Principles‑based and non‑binding
- Purpose of proposed guidance: Help banks and credit unions align and tailor third‑party risk management to risks of individual relationships, reflecting supervisory experience and lessons learned
The FDIC, Federal Reserve Board, NCUA and OCC on September 11, 2026 asked for public comment on a proposed set of third‑party risk management guidance intended for banks and credit unions. The agencies said the proposals draw on supervisory experience and lessons from examinations of institutions' third‑party risk practices and are designed to help firms tailor controls and oversight to the risk profiles of individual third‑party relationships.
The proposed guidance is principles‑based and non‑binding, and the agencies indicated that, once finalized, it would replace existing third‑party risk management guidance. The agencies stated that rescinding earlier guidance and issuing a unified final version is meant to promote consistency in supervision and support prudent innovation across the banking industry.
Comments on the proposed guidance are due within 60 days after the notice is published in the Federal Register. In a related action, the agencies issued a statement addressing community banks' engagement with core service providers; that statement outlines certain factors the agencies will consider when making supervisory and enforcement decisions related to those providers.
Separately, the Federal Reserve Board requested comment on a proposed third‑party risk management guide specifically for Federal Reserve‑supervised community banks, characterizing that draft as a companion document to the agencies' joint proposal. Together, the documents aim to clarify supervisory expectations for third‑party relationships and for community bank interactions with core service vendors.
Keep Reading
Core CPI rose a faster-than-forecast 0.3% in August, setting up possible Fed rate hike
