Comments Close November 16 on the Rewrite of Interagency Third-Party Risk Guidance. Here Is What Would Change for Your Vendor Program
The OCC, Federal Reserve, FDIC, and NCUA published proposed third-party risk management guidance on September 15, 2026. It would replace the 2023 Interagency Guidance on Third-Party Relationships. Comments are due November 16.
Three facts frame everything else. It is a proposal. It is non-binding, and it says so. And NCUA is a signatory, with insured credit unions expressly in scope.
The preamble is unusually direct. The agencies write that the 2023 Guidance was frequently interpreted in an overly broad manner, read as a checklist despite its disclaimers, and focused on the activity rather than on the magnitude or likelihood of harm. They also say it was read to discourage relationships with newer firms, including fintechs.
The proposal cites Executive Order 14405, "Integrating Financial Technology Innovation into Regulatory Frameworks." It says it aims to remove language that may unduly impede fintechs from partnering with banking organizations.
What would change
The higher-risk test gets a definition
The proposal describes higher-risk relationships as those meeting two conditions. First, disruption, attack, contract breach, or other non-business-as-usual performance could cause a non-trivial violation of law, material harm to financial condition, or significant disruption to operations or customers. Second, there is a material likelihood that the violation, harm, or disruption may occur under current or reasonably foreseeable conditions.
Both conditions apply. That is a narrower test than "supports a critical activity."
Lower-risk vendors get lighter diligence
For lower-risk relationships, the proposal says less detailed diligence, or public and alternative sources, may be sufficient. It also says institutions may decide not to keep extensive inventories of relationships posing limited risk, such as clerical, professional, or office support services.
That gives a Low Risk Vendors tier a direct textual anchor.
Fourth parties lose the presumption
The proposal states that use of subcontractors alone does not typically create an independent third-party relationship or a presumption of direct oversight of those subcontractors. Oversight of fourth parties can run through contract terms or through assessing the third party's own program.
No expected contract terms
The agencies write that there are no generally applicable expected contract terms, even for higher-risk relationships. The absence of a specific term an examiner considers best practice would not, alone, support an adverse finding.
API access is not automatically higher risk
A footnote addresses connectivity. A third party with access through APIs or portals to systems that hold no critical data and are appropriately segmented is not necessarily higher risk. The proposal suggests those risks may be managed mainly through cybersecurity controls.
Outside assessments may carry weight
The proposal says credible summaries, certifications, or assessment results from consortia or standard-setting organizations may be adequate for due diligence, depending on facts and circumstances.
What stays the same
The institution remains responsible. The proposal says use of third parties does not reduce that responsibility, including when the third party is itself highly regulated. A footnote adds that no agency is responsible for an institution's third-party risk management.
Incident notification rules still apply. The proposal cites 12 CFR Part 53 for banks and their service providers, and 12 CFR 748.1 for credit unions, as inputs to ongoing monitoring.
For credit unions, the change in scope may matter more than any single provision. A footnote defines banking organizations to include insured credit unions under 12 U.S.C. 1752(7), and NCUA signed the document. If finalized, this would be third-party guidance your examiner formally joined.
What else would be replaced
Beyond the 2023 Guidance, the proposal would replace three supplemental resources from the Federal Reserve, FDIC, and OCC.
One is the July 25, 2024 joint statement on arrangements with third parties to deliver bank deposit products. If your fintech offers deposits through a sponsor bank, your sponsor bank's program may have been built with that statement in view. The others are the May 2024 community bank guide and OCC Bulletin 2002-16 on foreign-based service providers.
The proposal does not list any NCUA-specific third-party letters for rescission. It invites comment on what else should go.
Separately, on September 11 the Federal Reserve, FDIC, and OCC issued a joint statement on community banks' engagement with core service providers. NCUA is not a party. It is an issued statement, not a proposal. It says the agencies may have a reasonable basis to treat certain core providers as institution-affiliated parties under the Federal Deposit Insurance Act. It also names SOC reports, penetration testing reports, and PCI DSS, NIST, and ISO assessments as examples of the due diligence information community banks should be able to obtain.
The statement lists three areas the agencies will weigh when deciding how closely to supervise a core provider. The first is transparency, including timely disclosure of operational issues and security incidents. The second is contract features, such as opaque pricing, extensive back-billing windows, undefined deconversion fees, and limits on integrating with other providers. The third is technology, including the number and severity of security incidents, management of end-of-life assets, and demonstrated operational resilience.
If you sell technology to community banks, those factors describe what your clients' regulators may now ask about you.
What to do
Read the proposal before November 16.
Comment if your experience is relevant. Credit unions may want to say whether NCUA's existing third-party letters should be addressed. Fintechs may want to say how retiring the deposit products statement would change how sponsor banks treat them.
Map your vendor tiers to the proposed two-part higher-risk test. Note which vendors would move.
Write down your fourth-party approach. If you assess vendors' own programs instead of each subcontractor, document that choice now.
Review how you accept residual risk. The proposal says the agencies do not expect third-party risk to be eliminated. If your program has no documented way to accept risk you cannot mitigate, such as when you lack negotiating power with a large vendor, build one.
Keep running your current program. Nothing has been rescinded. The 2023 Guidance remains in place until final guidance replaces it.
SOURCE: OCC, Federal Reserve, FDIC, and NCUA, "Proposed Third-Party Risk Management Guidance," 91 FR 58536 (September 15, 2026), FR Doc. 2026-18859; Dockets OCC-2026-0793, OP-1881, and NCUA-2026-1684; RINs 1557-ZA18, 3064-ZA58, and 3133-ZA54. Federal Reserve, FDIC, and OCC, "Joint Statement on Community Banks' Engagement with Core Service Providers," September 11, 2026, distributed by the Federal Reserve as SR 26-7, October 5, 2026.
This article is provided for general information and does not constitute legal advice. Regulatory requirements, compliance dates, examiner priorities, and enforcement posture change frequently. Verify current requirements against primary agency sources and your legal counsel before acting on anything described here.