The agencies propose to replace the 2023 third-party risk guidance
The OCC, Federal Reserve, FDIC and NCUA have proposed new third-party risk management guidance that would replace the 2023 interagency guidance, drop expected contract terms and tie oversight more closely to each relationship's assessed risk. Comments are due 16 November 2026.
Most compliance officers at small banks have spent time since 2023 mapping their vendor program to the Interagency Guidance on Third-Party Relationships: Risk Management (88 FR 37920). On 15 September 2026 the OCC, the Federal Reserve Board, the FDIC and the NCUA proposed to replace it (91 FR 58536).
Comments are due 16 November 2026.
Why they want to change it
The agencies are blunt about the 2023 document. Based on stakeholder feedback and their own exams, they say it "frequently has been interpreted in an overly broad manner and with an insufficient focus on tailoring its risk management principles."
The proposal would make "risk identification and assessment" the foundation, and tailor oversight "to correspond with assessed risk levels." The agencies write that "there is no one-size-fits-all approach to effective risk management." They also say community and mid-size banks "may be particularly reliant on such relationships."
"Any finalized guidance would replace the 2023 Guidance and the Supplemental TPRM Resources." Those resources include the 2024 Third-Party Risk Management: A Guide for Community Banks.
What would change
The 2023 guidance called for "more comprehensive and rigorous oversight of third-party relationships supporting" critical activities. The proposal faults that approach for focusing on the activity rather than the relationship, and builds instead on the magnitude and likelihood of harm from each relationship. The phrase "critical activities" does not appear to survive as a working concept.
For lower-risk relationships, due diligence could be lighter, with a bank "relying either on less-detailed due diligence information or on public or alternative sources."
Then there's the line many vendor managers will read twice: "There are no generally applicable expected contract terms for third-party relationships," and the proposal says that holds even for higher-risk relationships. A term an examiner considers contrary to best practice "would not alone be a sufficient basis for an examiner to communicate an adverse finding."
Ongoing monitoring can happen "on a periodic or continuous basis" depending on assessed risk, and lower-risk relationships may get "relatively less extensive, less detailed, or less frequent reporting."
On exit planning, the text is mild: "As the complexity and materiality of a third-party relationship increases," a bank "may benefit from advanced planning."
Finally, the agencies state that "non-compliance with this guidance will not result in supervisory action against a banking organization." They can still act on violations of law, unsafe or unsound practices or other material risks.
The proposal also aims to remove language that may "unduly impede fintechs" from partnering with banks.
Who it reaches
It would apply to banks and credit unions supervised by any of the four agencies. On the same day the Federal Reserve also proposed a separate guide for community banks under $30 billion, which we'll cover on its own.
What it could mean
We think this will lower the cost of vendor management at most community banks and credit unions, once it's final. The 2023 guidance, read cautiously, pushed many small institutions to run the same heavy process for the company that shreds paper as for the core provider. A framework built on assessed risk lets a small team put its hours where the harm would actually be.
The contract language is the change we'd watch most closely. Small banks rarely win negotiations with large vendors. If examiners stop treating a missing audit right or termination clause as a finding in itself, that removes a source of friction that small banks couldn't fix anyway. It doesn't remove the business risk. A core contract without decent exit terms is still a problem when the vendor is acquired, whatever the guidance says.
Two cautions. First, "tailoring" only helps if you can show your reasoning. A one-page risk assessment for each relationship, with a rating and a sentence on why, will probably be what examiners ask for. Banks that skipped that step and simply did less will be worse off. Second, nothing changes yet. We wouldn't strip steps from your program until the final guidance is out; the best use of the next two months is to note where the 2023 guidance forced work you think added nothing, and say so in a comment letter.