{"id":584,"date":"2026-09-17T13:01:13","date_gmt":"2026-09-17T17:01:13","guid":{"rendered":"https:\/\/blogs.duanemorris.com\/bankinglaw\/?p=584"},"modified":"2026-09-17T13:01:14","modified_gmt":"2026-09-17T17:01:14","slug":"overhauled-third-party-risk-management-guidance-what-banks-and-their-vendors-need-to-do-now","status":"publish","type":"post","link":"https:\/\/blogs.duanemorris.com\/bankinglaw\/2026\/09\/17\/overhauled-third-party-risk-management-guidance-what-banks-and-their-vendors-need-to-do-now\/","title":{"rendered":"Overhauled Third-Party Risk Management Guidance: What Banks and Their Vendors Need to Do Now"},"content":{"rendered":"\n

On September 11, 2026, the FDIC, Federal Reserve Board, OCC, and NCUA jointly proposed a package of three documents that would reshape third-party risk management<\/a> (“TPRM”) oversight for banks and credit unions: (1) new interagency guidance replacing the 2023 TPRM framework, (2) a practical companion guide for community banks, and (3) a joint statement putting core service providers on notice. Comments are due November 16, 2026<\/strong> \u2014 here is what your institution needs to know.\u00a0<\/p>\n\n\n\n

What Went Wrong With the 2023 Guidance<\/span><\/h3>\n\n\n\n

The agencies acknowledge the 2023 framework failed on four fronts: it was interpreted too broadly, drove checklist compliance instead of risk-proportionate oversight, incentivized process over substance, and chilled engagement with fintechs and innovative providers. The bottom line for institutions: disproportionate compliance spending on low-risk relationships and lock-in with legacy vendors.\u00a0<\/p>\n\n\n\n

How the New All-Bank Framework Changes Day-to-Day TPRM<\/span><\/h3>\n\n\n\n

The proposed guidance would replace the 2023 Guidance and 2024 community bank resources.<\/p>\n\n\n\n

Three shifts matter most for compliance teams:<\/p>\n\n\n\n

Risk-Based Prioritization.<\/strong> TPRM practices should be calibrated to the magnitude and likelihood of harm of each relationship \u2014 not merely whether it supports a “critical activity.” Lower-risk relationships may warrant less detailed due diligence, standard-form contracts, or less frequent monitoring.<\/p>\n\n\n\n

Principles, Not Prescriptions.<\/strong> The guidance is expressly non-binding; non-compliance alone will not trigger supervisory criticism. The framework is organized into four components:<\/p>\n\n\n\n

    \n
  1. Risk Identification and Assessment<\/strong> \u2014 identifying third-party relationships, cataloguing associated risks, and assessing their severity.<\/li>\n\n\n\n
  2. Risk Oversight<\/strong> \u2014 covering due diligence, contract negotiation, ongoing monitoring, termination planning, and cross-cutting topics such as subcontractor oversight, operational resilience, and insurance\/indemnification.<\/li>\n\n\n\n
  3. Residual Risk Acceptance<\/strong> \u2014 recognizing that institutions may reasonably accept some amount of residual risk based on their risk appetite.<\/li>\n\n\n\n
  4. Governance<\/strong> \u2014 establishing appropriate board and management oversight structures.<\/li>\n<\/ol>\n\n\n\n

    Encouraging Innovation.<\/strong> The guidance recognizes co-ventures, consortia for joint due diligence, standard-setting organizations, and third-party consultants as legitimate TPRM strategies \u2014 a clear signal that engaging with fintechs and newer providers should not be treated as inherently higher risk.<\/p>\n\n\n\n

    New Playbook for Community Banks Under $30 Billion<\/span><\/h3>\n\n\n\n

    The Federal Reserve separately proposed a Third-Party Risk Management Guide for Traditional Community Banking Organizations<\/em> (“TCBOs”) \u2014 institutions under $30 billion focused on serving local communities. Banks with complex bank-fintech partnership models are excluded. The guide gives TCBOs an operational roadmap organized in two parts:<\/p>\n\n\n\n

    Overarching Risk Management Topics.<\/strong> Four cross-cutting themes applicable to most TCBO third-party relationships:<\/p>\n\n\n\n