The Fed drafts a vendor risk guide for community banks under $30 billion
Alongside the new interagency third-party guidance, the Federal Reserve has proposed a non-binding guide for "traditional community banking organizations" that walks through eight common vendor types, starting with the core provider. Comments are due 16 November 2026.
On Friday we wrote about the interagency proposal to replace the 2023 third-party risk guidance. The Federal Reserve Board published a second document the same day, 15 September 2026, and it's the one a small bank's vendor manager may actually keep open on a second screen: a Proposed Third-Party Risk Management Guide for Traditional Community Banking Organizations (91 FR 58438).
It's a Board-only document. The OCC, FDIC and NCUA did not join it. The Board calls it "a companion document to the Proposed All-Bank TPRM Guidance." Comments are due 16 November 2026, the same date as the interagency proposal.
Who it's for
The guide is written for "traditional community banking organizations" (TCBOs), defined as "banking organizations with less than $30 billion in assets that focus on serving their local communities." It is "not intended for community banking organizations with more complex business models," which in practice points at banks with complex fintech partnerships. Consumer compliance is out of scope.
The Board is clear that it isn't binding: "It would not be a rule, and banking organizations would not be required to take the actions described in the guide." Supervisory action is still possible for violations of law or unsafe practices.
What's in it
The guide starts with four overarching considerations that it says will generally be the highest priority:
- Operational resilience
- System and information security
- Compliance with rules and regulations
- Financial resilience
On the third, the Board notes that "a TCBO is ultimately responsible for compliance with rules and regulations," whoever does the work.
It then goes vendor by vendor through eight categories: core providers; IT infrastructure providers; cybersecurity providers; payment processing and digital banking providers; loan management system providers; card issuing and processing providers; BSA/AML and financial crime platform providers; and fraud prevention and detection providers.
Core gets the most weight. "Generally, core providers are the most material and complex third-party relationship for TCBOs," the guide says, and it covers core conversions and middleware. Some of the other sections get specific in useful ways. The loan system section flags errors that can go undetected for long periods. The card section covers BIN sponsorship and moving a card program between processors. The BSA/AML section covers alert tuning and contract terms on who owns the data.
What the Board is asking
Among its questions, the Board asks whether tailoring to banks under $30 billion is a good idea, and whether the level of detail is set so as to avoid "de facto standards that TCBOs believe they would be evaluated against." It also asks: "Should 'deposit placement networks' be included as an additional vendor category in Section IV.C?"
What it could mean
We like this document more than most supervisory guidance, because it talks about the vendors community banks actually have. A $600 million bank doesn't have 400 critical relationships. It has a core, a card processor, a digital banking platform, a BSA system and a handful of others, and most of its real third-party risk sits in those few contracts. A guide organized that way is easier to use than an abstract framework.
The de facto standards question is the one we'd answer in a comment letter. Detailed, friendly guidance has a way of turning into an exam checklist, whatever the cover page says. If the guide lists eight things to think about for a core provider, some examiner will eventually ask where your evidence on all eight is. Banks that think the detail is about right should say so; banks that worry about that drift should say that, with an example.
On deposit placement networks, our view is yes. Reciprocal deposit limits went up sharply in September, and banks that lean on those networks for funding have a real concentration in one vendor. That deserves a section.
In the meantime we'd use the eight categories as a quick self-check. List your vendors under each heading. Any category where you can't name the vendor, or can't find the contract, is where to start.