Federal Banking Agencies Propose Overhaul of Third-Party Risk Guidance
Federal banking agencies propose new guidance to replace 2023 third-party risk rules.
Why it matters: Legal and compliance teams in banks and fintech firms must adjust to evolving regulatory expectations affecting risk management frameworks and contracts.
- On September 11, 2026, OCC, Federal Reserve, FDIC, and NCUA proposed new third-party risk management guidance.
- The 2026 proposal aims to replace the detailed 2023 guidance released on June 6, 2023.
- New guidance promotes a flexible, risk-based approach over the previous prescriptive, process-driven model.
- A companion guide is included, tailored for community banks; public comments are open until November 16, 2026.
On September 11, 2026, the Office of the Comptroller of the Currency (OCC), the Federal Reserve Board, the Federal Deposit Insurance Corporation (FDIC), and the National Credit Union Administration (NCUA) jointly proposed new interagency guidance on third-party risk management. This proposal seeks to replace the Interagency Guidance on Third-Party Relationships: Risk Management originally issued on June 6, 2023.
The 2023 guidance faced criticism for being overly detailed and prescriptive, which led banking organizations to adopt an "overly-process-driven" approach. According to legal analysis from Skadden, Arps, Slate, Meagher & Flom LLP, the detailed examples and idealized scenarios in the 2023 guidance created de facto checklists, limiting tailored, risk-based judgment.
The newly proposed 2026 guidance emphasizes a more flexible, risk-based approach. This allows institutions to focus on the actual risks posed by each specific third-party relationship, including partnerships with fintech firms. Importantly, the agencies included a companion guide designed for traditional community banking organizations to better tailor guidance by institution type.
The proposal also signals a move to rescind the earlier bank-fintech joint statement, reflecting a broader regulatory shift.
The agencies have opened a public comment period on the new guidance, with submissions accepted until November 16, 2026. Legal and compliance teams in banks and fintech companies should monitor this process closely, as the final guidance will impact contractual frameworks and risk management practices.
By the numbers:
- September 11, 2026 — Date of the new interagency guidance proposal
- June 6, 2023 — Date the original third-party risk guidance was issued
- November 16, 2026 — Deadline for public comments on the proposed guidance
Yes, but: Specific practical differences and the impact on existing third-party contracts remain unclear pending finalization of the guidance.
What's next: Public comments on the proposed guidance are due by November 16, 2026, after which the agencies will review feedback before finalizing rules.