On September 11, 2026, the OCC, Federal Reserve, FDIC, and NCUA announced new proposed interagency guidance for managing risks arising from third-party relationships. The proposal would replace the agencies’ 2023 third-party risk management guidance and related supplemental resources with a framework that places greater emphasis on tailoring oversight to the actual risks presented by each relationship.
The agencies explained that the 2023 guidance has sometimes been interpreted as requiring a broad, process-driven approach that applies heightened risk management practices across third-party relationships without sufficient regard to the magnitude or likelihood of harm. The proposal instead directs banking organizations to focus resources on relationships presenting greater financial, operational, or compliance risk. Specifically, the proposed guidance:
- Centers risk identification and assessment. Banking organizations would assess third-party relationships based on both the magnitude and likelihood of potential harm, rather than treating particular categories of third parties as inherently higher-risk.
- Allows oversight to be tailored to risk. Due diligence, contract negotiations, ongoing monitoring, and termination planning could vary based on the banking organization’s size, complexity, risk profile, and the risks presented by the particular relationship.
- Recognizes residual risk. The agencies expressly state that banking organizations are not expected to eliminate all third-party risk and may accept residual risk when it falls within established risk appetites and tolerances.
- Clarifies the guidance is non-enforceable. Deviation from the guidance or its examples would not, by itself, support supervisory action. The agencies could still act on violations of law, unsafe or unsound practices, or other material risks resulting from inadequate third-party risk management.
The proposal also expressly recognizes that fintech partnerships can provide access to new technologies, products, and markets, and seeks to remove language that the agencies believe may have unnecessarily discouraged relationships with newer or innovative providers.
Putting It Into Practice: The proposal would replace the federal third-party risk framework adopted in 2023 (previously discussed here). The shift toward material risk and away from process-oriented supervision also tracks other recent changes to the federal banking agencies’ supervisory approach. Banks and fintech partners should review existing third-party risk management programs to identify where policies, diligence requirements, monitoring practices, and contractual standards could be recalibrated if the proposal is finalized.