Agencies seek comment on proposed third-party risk management guidance and issue statement on community bank engagement with core service providers

The four agencies are asking financial institutions and the public to comment on proposed guidance for managing risks tied to third-party relationships. The guidance is meant for banks and credit unions. It would help them match their oversight to the risks of each outside provider. The proposal is non-binding supervisory guidance.

For example, a bank could review a technology company, payment processor, or other provider based on the services it performs and the risks involved. The key mechanism is a principles-based approach. It gives institutions a framework for assessing and managing relationships without treating every provider identically. The article does not list specific consultation questions.

Comments are due 60 days after the proposed guidance is published in the Federal Register. The agencies may consider those comments before finalizing the guidance. If finalized, it would replace existing third-party risk guidance issued by the federal bank regulatory agencies. A separate Federal Reserve proposal targets supervised community banks.

Third-party risk management means identifying, assessing, controlling, and monitoring risks linked to outside companies that support a bank or credit union. These relationships can involve important technology, operations, or services. The goal is to ensure that using an outside provider does not undermine safe operations, customer service, compliance, or resilience. The article presents this as a responsibility for both banks and credit unions.

For example, an institution might assess a provider before engaging it, set expectations in a contract, and monitor performance afterward. The key mechanism is alignment: oversight should match the risks of the individual relationship. A provider supporting a critical function may require more attention than one supplying a minor service. The proposed guidance uses principles rather than one fixed checklist.

The agencies say their proposal reflects supervisory experience and lessons from examinations. They want institutions to better tailor their practices. The guidance would remain non-binding, but it could shape supervisory expectations. If finalized, it would replace existing federal bank regulatory guidance.

Four federal agencies are coordinating the proposed third-party risk management guidance. They are the Federal Deposit Insurance Corporation, the Board of Governors of the Federal Reserve System, the National Credit Union Administration, and the Office of the Comptroller of the Currency. Together, they are referred to as the agencies in the announcement.

This coordination matters because banks and credit unions can fall under different federal regulators. A shared proposal can create a more consistent framework for managing relationships with outside providers. The mechanism is joint agency action: the agencies issued one proposed guidance document and plan to replace existing federal bank regulatory guidance with the final version.

The agencies are also taking related steps. Separately, the federal bank regulatory agencies issued a statement about community banks and core service providers. The Federal Reserve Board separately requested comments on a companion guide for Federal Reserve-supervised community banks. Comments on the main proposal are due 60 days after Federal Register publication.

Core service providers are outside companies that supply essential banking capabilities to community banks. The announcement discusses these providers but does not define them or list their services. In established industry usage, such providers may support account processing, payments, information technology, online banking, or other core operations. These services can be central to a bank’s daily work.

For example, a community bank might rely on an outside company to process customer accounts or support digital transactions. The key mechanism is dependence: a provider’s systems or performance can affect the bank’s ability to serve customers. That is why the relationship may require careful oversight, contracts, monitoring, and contingency planning. These examples are general industry knowledge, not details stated in the article.

The agencies issued a separate statement on community banks’ engagement with core service providers. It identifies factors the agencies will consider in supervisory and enforcement decisions related to those providers. The statement does not announce a specific service list or a new binding requirement.

If finalized, the proposed guidance would change how banks and credit unions organize third-party risk management. The agencies want institutions to align their practices with the risks of individual relationships. This could encourage more proportionate oversight instead of applying identical processes to every outside provider. The proposal remains non-binding supervisory guidance, not a regulation.

For example, an institution could use stronger review and monitoring for a provider supporting a critical function, while using simpler controls for a lower-risk relationship. The key mechanism is principles-based tailoring. Institutions would apply the guidance to their circumstances and the risks they identify. The article does not prescribe specific controls, thresholds, or procedures.

When finalized, the federal bank regulatory agencies plan to rescind existing third-party risk management guidance and replace it with the new guidance. They say this is intended to promote consistency and prudent innovation in banking. A separate Federal Reserve guide may also provide a companion framework for supervised community banks.

The agencies say the proposed guidance reflects supervisory experience and lessons learned from examining financial institutions’ third-party risk management practices. That experience provides the stated reason for updating the existing framework. The agencies want banks and credit unions to manage outside relationships in a way that better matches the risks involved.

The proposed approach is principles-based rather than a single detailed set of identical requirements. For example, an institution could tailor its risk management practices to the importance and risk profile of a particular provider. The key mechanism is proportional alignment. The article does not give a specific example of an examination failure or identify individual provisions that would be removed.

The guidance would also be non-binding, consistent with the agencies’ description of supervisory guidance. When finalized, the federal bank regulatory agencies plan to rescind existing third-party risk guidance and replace it. They say the replacement should promote consistency and prudent innovation across the banking industry.

A bank can hire another company to perform a function, but outsourcing does not erase the bank’s responsibility for operating safely and meeting its obligations. The outside provider may control systems, processes, staff, or data that affect the bank. If those activities fail, the bank can still face operational, customer, legal, or supervisory consequences. This explanation draws on established financial-risk principles; the article does not spell out the legal rule.

For example, if a provider supports account processing and its systems fail, customers may be unable to access accurate information or complete transactions. The key mechanism is dependency. The bank must understand the provider’s capabilities, set expectations, monitor performance, and prepare for problems. The proposed guidance is intended to help institutions manage risks according to each relationship.

The agencies’ supervisory experience and examination lessons prompted the proposal. Their principles-based approach would help banks and credit unions tailor oversight rather than treat every provider alike. If finalized, it would replace existing guidance and aim to promote consistency and prudent innovation.