On September 11, 2026, the FDIC, Federal Reserve, NCUA, and OCC issued a proposed guidance to assist financial institutions with managing risks associated with third-party relationships. The proposed, non-binding guidance promotes a principles-based approach to help banks and credit unions tailor third-party risk management to the risks of individual relationships.
When finalized, the federal bank regulatory agencies plan to rescind existing third-party risk management guidance and replace it with the finalized guidance to promote supervisory consistency and support responsible innovation across the financial sector. Public comments are being accepted through November 16, 2026.
In addition, the agencies released a statement on community banks’ engagement with core service providers, which discusses certain factors the agencies will consider in making supervisory and enforcement decisions related to these core providers. The agencies believe that there is a need for additional clarification regarding a subset of community banking organizations’ (CBOs) third-party relationships. Therefore, the agencies are issued the statement to address the following:
Select aspects of how CBOs engage with core providers;
The extent to which the agencies will take these aspects into consideration when determining the level of supervisory oversight of core provider services; and
The agencies’ supervisory and enforcement authorities where a core provider engages or causes a CBO to engage in unsafe or unsound practices or violations of law or regulation.
Read the OCC’s press release here.
The proposed guidance can be found here.
The joining statement can be found here.