Federal Banking Agencies Propose New Third-Party Risk Management Guidance and Issue Policy Statement to Traditional Community Banks on Core Service Providers

The Office of the Comptroller of the Currency (OCC), the Board of Governors of the Federal Reserve System (FRB), the Federal Deposit Insurance Corporation (FDIC) and the National Credit Union Administration (NCUA and, together, the Agencies) are proposing to rescind the existing interagency guidance on third-party risk management (TPRM) and replace it with new guidance (the Updated TPRM Guidance).[1] As discussed below, the Updated TPRM Guidance is significantly less prescriptive than current guidance.

Key Takeaways

Providing Banks With More Flexibility to Tailor Their Third-Party Relationships, Including in Identifying and Managing Risks

Although the 2023 TPRM Guidance is framed as not having the force of law, in practice, banking organizations often take a conservative approach, subjecting vendors to heightened diligence or seeking to impose certain rights on third parties even when those activities do not present heightened risk.

The Updated TPRM Guidance is the Agencies’ latest attempt to course-correct. It moves away from the 2023 TPRM Guidance’s approach of providing detailed examples and instead provides broad descriptions of how banking organizations can approach TPRM. The Updated TPRM Guidance commits the Agencies to giving due consideration to a banking organization’s reasonable judgment — a meaningful signal of supervisory restraint. The Agencies also acknowledge that banking organizations cannot avoid risk entirely and that complete elimination of third-party risk is neither expected nor desired. The overarching message: Manage risk and make informed decisions, but there is no requirement to eliminate third-party risk.

Embrace of Innovation

The Agencies acknowledge that the 2023 TPRM Guidance “has been read to discourage engagement with newer and innovative parties.” To address this, the Updated TPRM Guidance seeks to “encourage responsible innovation” by removing “broad-based and overly prescriptive language” that “may unduly impede fintechs from entering partnerships with banking organizations.” The Updated TPRM Guidance also acknowledges that a certain level of “residual risk” from third-party relationships is unavoidable and acceptable.

Acknowledgement of Disparities in Bargaining Power

Throughout the Updated TPRM Guidance, the Agencies acknowledge that banking organizations may lack the negotiating power to fully meet existing TPRM objectives. The Updated TPRM Guidance addresses this by noting that banking organizations may still fulfill their obligations even if they cannot meet all TPRM objectives during due diligence, contract negotiation and ongoing monitoring. Later in this alert, we discuss the Agencies’ community bank-specific guide addressing community banks’ limited leverage with “core” providers.

Principles in the Proposed TPRM Guidance

Risk Identification and Assessment

The Agencies note that the 2023 TPRM Guidance has been criticized for focusing “more on the activity conducted by the third party rather than … the magnitude or likelihood of harm.” The Agencies assert that oversight should be proportionate to the risks presented and warn that failing to “prioritize and tailor [oversight of third party relationships] according to risk” itself creates risk.

The Updated TPRM Guidance would allow banking organizations to determine how to evaluate risks presented by each relationship and would eliminate the concept of “critical activities” — that is, activities that are given heightened importance by the 2023 TPRM Guidance through an illustrative list of examples that highlights applicable risks. Instead, while acknowledging that higher-risk third-party relationships exist (and soliciting comments on the topic),[2] the Updated TPRM Guidance leaves it to banking organizations to make such evaluations.

Flexibility in Governance for Third-Party Risk Management Programs

The Updated TPRM Guidance notes that there is no single correct way for banking organizations to structure their TPRM governance practices. For example, it removes the 2023 TPRM Guidance’s lists detailing how a board of directors may handle TPRM throughout a third-party relationship’s lifecycle. Instead, the Updated TPRM Guidance suggests that banking organizations support TPRM practices by establishing clear roles and responsibilities and an appropriate risk appetite — without prescribing what these processes should look like.

Risk Oversight

The Updated TPRM Guidance addresses at a high level several topics from the 2023 TPRM Guidance: due diligence, contract negotiation, ongoing monitoring and termination. However, unlike the 2023 TPRM Guidance, it provides fewer examples, omits detailed factor descriptions and clearly states that the examples given are illustrative, not prescriptive.

1. Due Diligence

Banking organizations should tailor due diligence to the risk presented by the third-party relationship and individual business needs. The Updated TPRM Guidance suggests considering a third party’s financial condition, business experience and key personnel, staffing capabilities, legal and regulatory compliance, insurance coverage, and information security capabilities and track record as applicable — but provides no further detail on how to review these factors. (The 2023 TPRM Guidance, by contrast, includes detailed descriptions of 14 non-exhaustive factors, including strategies and goals, legal and regulatory compliance, and financial condition.)

2. Contract Negotiation

The Updated TPRM Guidance states that “[t]here are no generally applicable expected contract terms for third-party relationships — even for higher-risk relationships — and banking organizations typically tailor their contract negotiations and provisions to their individual needs and circumstances.” This is the opposite approach from the 2023 TPRM Guidance, which lists 17 factors banking organizations typically consider during contract negotiations.

3. Ongoing Monitoring

The Updated TPRM Guidance defines “monitoring” as assessing third-party performance and changes in risk, with examples including updates to due diligence information, periodic visits, testing, review of public filings or examination reports and customer complaints. It also increases flexibility in how banking organizations tailor ongoing monitoring to risk. By contrast, the 2023 TPRM Guidance includes a detailed discussion of monitoring activities and a long list of monitoring factors (strategic alignment, financial condition changes, insurance lapses, audit results, compliance, subcontractor reliance, training, incident response, customer complaints, etc.).

4. Termination

The Updated TPRM Guidance discusses termination through the lens of cost-benefit analysis. Banking organizations should weigh positive factors (e.g., cost reductions, improved services, better data access, innovative technology) against negative factors (e.g., termination costs, transition complications, service disruptions).

5. Cross-Cutting Oversight Topics

The Updated TPRM Guidance includes a new section on “Cross-Cutting Oversight Topics,” intended to promote a “holistic, rather than a siloed, stage-by-stage” approach to TPRM. It highlights areas where banking organizations may benefit from considering TPRM as a multifactor process across the stages of a third-party relationship:

• Subcontractors. The use of subcontractors could increase third-party risk, and the banking organization may want to negotiate specific contractual terms or confirm the adequacy of the third party’s risk management programs. The 2023 TPRM Guidance broadly covers any third-party relationship regardless of whether a contract exists between the banking organization and the entity, recommending close oversight of a third party’s subcontractors, including potential monitoring of conformance with performance measures, periodic audit results and compliance with laws and regulations. The Updated TPRM Guidance, however, would cover only relationships with written agreements and gives banking organizations more flexibility to address third-party subcontracting — for example, stating that assessment and monitoring of a third party’s own TPRM program may be sufficient to demonstrate effective risk oversight in some relationships.
• Use of Co-Ventures, Consortia and Standard-Setting Organizations. The Updated TPRM Guidance recognizes that leveraging arrangements enabling collaboration on due diligence or standard setting could create efficiencies and benefit banking organizations with less bargaining power.
• Insurance, Indemnification and Other Limitations on Liability. The Updated TPRM Guidance states that negotiating credible indemnification provisions, limitations on liability, insurance or guarantees may lower the risk associated with a third-party relationship.
• Operational Resilience Planning. The Updated TPRM Guidance states that contract obligations related to a third party’s operational resilience plan, planning for alternative service providers and maintaining a back-up of critical information can demonstrate a banking organization’s mitigation of risks associated with a third party.

Additional Guidance for Community Banks

Complementing the Updated TPRM Guidance, the OCC, FRB and FDIC also released a joint statement on community banks’ engagement with core service providers (the Joint Statement). The Joint Statement addresses third parties providing the critical systems, applications and infrastructure supporting community banks’ essential functions, such as transaction processing, payments processing or compliance and reporting (Core Providers). The Joint Statement acknowledges that, given the limited pool of Core Providers, community banks have limited negotiating power and may struggle to hold Core Providers accountable for quality services. It also addresses how the OCC, FRB and FDIC will consider these dynamics when determining supervisory oversight levels for Core Provider services.

Along with the Proposed TPRM Guidance and Joint Statement, the FRB issued a proposed guide for traditional community banking organizations (TCBOs) that would assist TCBOs in determining how the Proposed TPRM Guidance would apply to relationships between TCBOs and third parties (the TCBO TPRM Guide).

Impact on Banking Organizations and Their Service Providers, Including Fintechs

Banking organizations may choose to hold off on wholesale changes to their TPRM programs until the Updated TPRM Guidance is finalized, in case regulators later revert to a more prescriptive approach.[3] Notably, the Federal Reserve’s participation suggests this guidance will be more durable than other actions taken that involved only one or two of the agencies. Even banking organizations that do not overhaul their TPRM programs should benefit: The Updated TPRM Guidance should make it harder for the Agencies to issue adverse findings or take enforcement actions, given its clear acknowledgment that the Agencies will consider a banking organization’s “reasonable” discretion in managing third-party relationships.

That said, implementation will be where the rubber meets the road. The risk is that current practices based on the 2023 TPRM Guidance may come to be viewed as “best practices.” While the preamble to the recently finalized joint rulemaking on Unsafe or Unsound Practices, Matters Requiring Attention notes that “generally accepted standards of prudent operation do not require an institution to adopt what the agencies consider to be best practices, including those practices identified in horizontal reviews of peer institutions,” supervisors have often used such “horizontal reviews” to criticize banks’ TPRM programs.

For third parties, including fintechs, the Updated TPRM Guidance sends another clear signal that the Agencies view innovation as a feature of prudent banking, not strictly a downside risk. For newer fintechs with shorter operational histories, engaging with banking partners on due diligence may be simplified because banking organizations may no longer expect the same level of information as they would from more established counterparties. Finally, the Updated TPRM Guidance notes that co-ventures, consortia, standard-setting organizations and consultants could prove useful — statements particularly relevant given the FDIC’s plans to create a public-private standard-setting body to evaluate third parties.

Comments on the Updated TPRM Guidance and TCBO TPRM Guide are due on Nov. 16, 2026. Paul Hastings attorneys are actively advising clients on the proposal.