Federal Banking Agencies and NCUA Propose Comprehensive Overhaul to Third-Party Risk Management Guidance

The Federal Reserve, FDIC, OCC, and NCUA have jointly proposed a risk-tailored, third-party risk management framework to replace the 2023 interagency guidance, formally incorporating credit unions for the first time and introducing dedicated relief for community institutions.

A. Executive Summary

On September 11, 2026, the Federal Reserve Board, the Federal Deposit Insurance Corporation (FDIC), the Office of the Comptroller of the Currency (OCC), and, for the first time on this subject, the National Credit Union Administration (NCUA) jointly issued proposed interagency guidance on third-party risk management (TPRM). If finalized, the proposal would rescind and replace the June 2023 Interagency Guidance on Third-Party Relationships: Risk Management, as well as related supplemental resources issued after the 2024 Synapse fintech partnership collapse.

The proposed framework represents a supervisory pivot away from rigid, one-size-fits-all expectations toward a proportional, risk-tailored regime that explicitly acknowledges financial institutions cannot eliminate third-party risk and may accept residual risk aligned with their board-approved risk appetite. Notably, the agencies have also clarified the guidance would be non-enforceable in itself: a departure from it, even one an examiner views as inconsistent with best practices, would not alone support supervisory action, though agencies retain authority to act on actual violations of law, unsafe or unsound practices, or other material risk. Accompanied by a dedicated compliance guide for community banking organizations and a joint statement on core service provider relationships, the proposal would redefine governance standards across bank-fintech partnerships, core banking platforms, and credit union operations, if adopted as proposed.

Want weekly regulatory updates delivered straight to your inbox? Subscribe to the Reg Compliance Hub here.

B. What Happened

On September 11, 2026, the federal banking agencies and the NCUA published a notice of proposed interagency guidance designed to overhaul supervisory expectations for managing third-party relationships. The proposal addresses long-standing industry criticism that the 2023 guidance fostered an inflexible supervisory environment that penalized institutions for routine vendor relationships and disincentivized technological innovation.

The proposed overhaul would introduce several structural shifts:

• Explicit Recognition of Residual Risk: The proposal formally states that depository institutions and credit unions are not expected to eliminate third-party risk entirely, but rather must manage and may accept residual risk within their established risk appetite parameters.

  In practice: this is a real change in supervisory posture, not just softer language. Under the 2023 guidance, examiners often operated as though any acknowledged gap in vendor oversight was itself a problem. This proposal explicitly tells institutions that documenting and accepting a manageable risk, rather than eliminating it entirely, can be the right call.
  
  

• Non-Enforceable Framework: The agencies have clarified that the guidance itself would carry no direct enforcement weight. Departures from it, even ones an examiner might view as inconsistent with best practices, would not alone support supervisory action.

  In practice: this matters for how much weight compliance teams should give the guidance's specific examples and recommendations. The guidance describes a reasonable approach, not a checklist where every deviation is a violation. That said, agencies can still act if a third-party relationship actually results in a violation of law, an unsafe or unsound practice, or other material risk, so this is relief from process-based scrutiny, not a green light to ignore genuine risk.
  
  

• Reoriented Risk Assessment: Rather than treating particular categories of third parties as inherently higher-risk, the proposal would center risk identification and assessment on the actual magnitude and likelihood of potential harm from each relationship, replacing the more prescriptive, scenario-driven approach of the 2023 text.

  In practice: a vendor doing routine clerical work, like a call center operator, would generally warrant lighter oversight under this framework than a vendor plugged directly into customer authentication or core processing, even if both were treated similarly under the old guidance's more categorical approach.
  
  

• Expansion to Credit Unions: By including the NCUA as a co-issuing agency, the proposal would harmonize the federal regulatory perimeter for TPRM across federally chartered and insured credit unions for the first time, bringing thousands of credit unions within a uniform supervisory standard if finalized.
  
  

• Tailored Community Bank Guidance: Recognizing the resource constraints of smaller institutions, the Federal Reserve separately proposed a companion Third-Party Risk Management Guide for Traditional Community Banking Organizations, defined as institutions with less than $30 billion in total consolidated assets that focus primarily on serving local communities. This guide is organized around four overarching risk management considerations, operational resilience, system and information security, compliance with rules and regulations, and financial resilience, addressed across eight common vendor categories such as core providers, payment processing, and fraud prevention services. Notably, this community bank guide is expressly not intended for institutions with more complex business models or third-party relationships, such as complex bank-fintech partnerships.

  In practice: a small community bank shouldn't assume this simplified guide applies to every vendor relationship it has. If a smaller institution has entered into a genuinely complex fintech partnership, it likely needs to look to the main interagency guidance rather than the streamlined community bank version.
  
  

• Core Service Provider Joint Statement: The FDIC, Federal Reserve, and OCC separately issued a joint policy statement addressing community banks' reliance on major core banking service providers, tackling vendor concentration, negotiation leverage, and contract inflexibility. Notably, the statement also raises a significant enforcement question: the agencies suggest that core providers may qualify as "institution-affiliated parties" under the Federal Deposit Insurance Act, on the theory that they participate in the conduct of an insured depository institution's affairs, potentially exposing core providers themselves to liability for a community bank's practices or violations.

  In practice: this is a notable shift in who could be held directly accountable. Historically, enforcement risk from a vendor relationship has fallen almost entirely on the bank itself. If this view is adopted, a core processing provider could face its own direct regulatory exposure, not just contractual consequences from the bank it serves.

The proposal was not adopted unanimously. Federal Reserve Governor Lisa Cook issued a statement supporting the changes, describing them as a needed "fresh look" that enables innovation, while Governor Michael Barr dissented, warning the proposals could "reduce safe and sound operations, increase financial and other risk, create undue confusion, and leave gaps in supervisory coverage."

In practice: this isn't a settled, uncontested policy direction internally. A dissent from a sitting governor is a signal that the framework's substance, and potentially its durability, could remain a live debate even after the comment period closes.

The public comment period for the proposed guidance, the community bank guide, and the core service provider statement runs through November 16, 2026. Nothing changes until the guidance is finalized; examiners continue to apply the existing 2023 framework in the interim.

(Official Source: Interagency Notice of Proposed Guidance, September 11, 2026)

Want weekly regulatory updates delivered straight to your inbox? Subscribe to the Reg Compliance Hub here.

C. Why It Matters for Legal & Compliance

This rulemaking package would directly impact Chief Risk Officers (CROs), General Counsel, and vendor management offices (VMOs) across commercial banks, credit unions, and fintech partners, if finalized as proposed. Three points stand out:

1. Examiners would gain, and lose, specific latitude.
For the past three years, examiners frequently treated the 2023 guidance as a rigid checklist, issuing Matters Requiring Attention (MRAs) for minor procedural documentation gaps in low-risk vendor arrangements. The proposed pivot toward proportionality would give compliance officers a clearer basis to scale oversight controls to the actual criticality of the activity, while the guidance's own non-enforceable status would limit how much weight examiners could place on a mere departure from its specific examples.

In practice: if this is finalized as proposed, an examiner citing a low-risk vendor for a documentation gap that has no real connection to actual harm would have a harder time justifying that finding purely by reference to the guidance itself.

2. Fintech and BaaS partnerships would remain closely watched, just differently structured.
The guidance would not loosen standards for high-risk activities; complex Banking-as-a-Service (BaaS) and deposit-gathering fintech arrangements would remain subject to intensive ongoing monitoring. The shift is toward letting institutions design governance workflows suited to the actual relationship, rather than forcing every third-party arrangement into the same procurement-style process regardless of its risk profile.

In practice: a high-risk fintech partnership isn't getting easier oversight under this proposal. What's changing is that a low-risk vendor relationship would no longer need to go through the same heavy process just because the rules didn't previously distinguish between the two.

3. Credit unions would face a real transition, but not an immediate one.
Credit union compliance officers should begin preparing to eventually move away from NCUA-specific supervisory letters toward the broader interagency framework, but that transition would only take effect once the guidance is finalized, not now, while the proposal remains open for comment.

In practice: credit unions don't need to overhaul their vendor management programs today. The prudent step right now is understanding the gap between current NCUA-specific practices and the proposed interagency framework, so the organization is ready to act once, and if, this is finalized.

Compliance & Risk Insight: The "Residual Risk Acceptance" Operational Shift

The most strategic element of this proposal is the formal supervisory endorsement of residual risk acceptance. Under the 2023 guidance, examiners often operated under a de facto expectation of risk elimination, leading risk departments to impose disproportionate, unscalable due diligence on non-critical vendors.

Under the proposed framework, institutions would be given supervisory latitude to document and accept residual risk, provided that:

1. The acceptance sits within clearly articulated, board-approved risk tolerance limits;
2. Compensating internal controls are formally identified and tested; and
3. A defensible audit trail explains why exhaustive third-party verification was unnecessary given the arrangement's limited systemic impact.

If finalized, this shift would let compliance teams redeploy finite technical and auditing resources away from benign service providers and concentrate oversight on mission-critical technologies, cloud infrastructure, and customer-facing fintech integrations.

In practice: none of this needs to wait for finalization to start as an internal exercise. Even now, risk teams can begin identifying which vendors are currently receiving disproportionate scrutiny relative to their actual risk, so the organization is positioned to act quickly once, and if, the framework is adopted.

Want weekly regulatory updates delivered straight to your inbox? Subscribe to the Reg Compliance Hub here.

D. Action Items for Organizations

• Review Vendor Tiering Frameworks: Audit internal third-party inventories to ensure vendor risk classifications accurately differentiate between critical activities (e.g., core processing, customer authentication, cloud hosting) and low-risk operational suppliers, in preparation for a possible shift toward proportional oversight.
  
  
• Formalize Residual Risk Protocols: Begin drafting Enterprise Risk Management (ERM) policy language for evaluating, approving, and logging residual risk acceptances within board-approved risk limits, so the organization is ready to adopt this formally if the guidance is finalized.
  
  
• Audit Credit Union Programs (NCUA Supervised): Credit union compliance officers should perform a gap analysis comparing current vendor management programs against the proposed interagency framework's approach, without assuming an implementation timeline.
  
  
• Benchmark Against Community Bank Guidance: Community depository institutions should review the Federal Reserve's proposed community bank guide to identify areas where procurement, ongoing monitoring, and audit expectations could be streamlined, while confirming the guide's scope excludes any complex bank-fintech partnerships the institution maintains.
  
  
• Evaluate Core Service Provider Contracts: Review existing master service agreements with dominant core IT and processing vendors against the agencies' joint statement, including the potential enforcement implications of treating core providers as institution-affiliated parties, and assess whether contractual exit terms, data access rights, and subcontracting disclosures warrant renegotiation.
  
  
• Prepare Public Feedback: Legal and risk departments should evaluate the proposed guidance against internal operational realities and consider submitting formal comments prior to the November 16, 2026 deadline.

Want weekly regulatory updates delivered straight to your inbox? Subscribe to the Reg Compliance Hub here.

Disclaimer: This article does not constitute legal advice. Readers should seek legal or tax advice from their professional advisers regarding their specific regulatory and legal obligations.