On September 10, 2026, the OCC, Federal Reserve Board, FDIC, and NCUA jointly proposed guidance that would rescind and fully replace the 2023 Interagency Guidance on Third-Party Relationships: Risk Management (88 FR 37920) and its three supplemental resources. Comments are due 60 days after Federal Register publication, submitted separately to each agency’s docket.
The headline is accurate as far as it goes: This is a deregulatory rewrite, expressly tied to Executive Order 14192’s deregulation mandate and Executive Order 14405’s fintech integration priorities, designed to correct what the agencies themselves describe as a widespread tendency to read the 2023 guidance too broadly as a prescriptive checklist. Banking organizations will have more latitude to argue that a given relationship does not warrant heightened oversight, and examiners will be expected to defer more visibly to institutions’ own risk assessments.
What the trade press coverage is likely to miss is that this proposal did not arrive alone. One day later, three of the four agencies (notably, without NCUA) issued a separate Joint Statement on Community Banks’ Engagement with Core Service Providers that moves in the opposite direction for a specific, concentrated slice of the third-party universe: bank core processors. Read together, the two documents describe a bifurcated supervisory strategy. The agencies are loosening expectations on banks generally, while building a more assertive, potentially direct enforcement lever against the handful of dominant core processing vendors banks cannot easily avoid. Section IV below addresses why that matters more than either document read in isolation.
Link to What the Proposal Actually Does What the Proposal Actually Does
The proposal restructures third-party risk management around four components: (1) risk identification and assessment; (2) risk oversight (due diligence and selection, contract negotiation, ongoing monitoring, termination, and a set of cross-cutting topics); (3) residual risk acceptance; and (4) governance.
Two structural features recur across nearly every subsection and are worth addressing in detail.
A magnitude and likelihood risk framework replaces the 2023 guidance’s “critical activities” concept. Under the proposal, a relationship is “higher risk” based on the magnitude of potential harm and the likelihood it will occur, not based on the category of activity the third party performs. This is not a cosmetic change. Under the 2023 framework, a bank could reasonably read certain activity categories (for example, anything touching core processing, payments, or data) as automatically triggering enhanced oversight regardless of actual exposure. Under the proposal, an institution has a stronger textual basis to argue, for example, that a core provider supporting only a limited business line, or a vendor with segmented, noncritical system access, does not warrant the same oversight tier as a vendor supporting the institution’s full operations (see proposal footnotes 11 and 12).
Repeated deference language. Phrases along the lines of “the agencies will give due consideration to a banking organization’s reasonable judgment or determination” appear in the risk assessment, contract negotiation, termination, and governance discussions. This is the proposal’s primary mechanism for preventing the problem the agencies identified in the 2023 guidance — guidance being read as prescriptive — from recurring. It remains guidance rather than a safe harbor, however, and its practical value will depend heavily on how consistently examiners actually apply it in practice, which the document itself cannot guarantee.
The proposal also formally elevates several concepts that existed informally or only implicitly under the 2023 regime:
- Residual risk acceptance as its own governance component, rather than an afterthought. The agencies now state directly that some risk is expected to go unmitigated, including in cases where an institution simply lacks negotiating leverage, and that this can be an acceptable outcome if consistent with the institution’s risk appetite.
- Affiliate relationships operating within an enterprise-wide risk framework are flagged as generally lower risk, potentially justifying reliance on staff overlap rather than full third-party oversight mechanics.
- Coventures, consortia, and organizations that provide standard setting or certification services are explicitly endorsed as tools institutions can rely on for due diligence, particularly useful for community banks seeking leverage or expertise they could not obtain individually, subject to an antitrust caveat and the caution that risk management still must reflect the institution’s own circumstances.
- A third party’s own regulatory status may be considered as a factor that mitigates risk, though the proposal cautions that differing supervisory regimes mean this cannot be treated as a substitute for the institution’s own diligence (footnote 14 is explicit that no other agency is “responsible” for an institution’s third-party risk).
The “Non-Enforceable Guidance” section is also worth flagging on its own terms, separate from the substantive changes. The proposal states directly that noncompliance will not result in supervisory action, and that deviation from the guidance or its examples, even where an examiner views the deviation as inconsistent with best practices, will not alone support a supervisory finding. That is a stronger and more explicit disclaimer than the 2023 guidance’s comparable language, and institutions should expect it to be cited defensively during examinations once finalized.
Link to Where the Proposal Departs From, and Preserves, the 2023 Guidance Where the Proposal Departs From, and Preserves, the 2023 Guidance
Full rescission, not amendment. The proposal rescinds the 2023 guidance outright, along with the OCC’s foreign-based third-party bulletin, the 2024 bank-fintech deposit product joint statement, and the 2024 community bank TPRM guide. Notably, the agencies also invite comment on whether additional unnamed guidance documents or interpretive letters should be rescinded. Institutions with legacy examination findings or exam guidance tied to any of the superseded documents should treat this as an open scope question, not a settled one, and consider commenting if other document-specific reliance is at stake.
A diagnosed failure mode with an explicit fix. The proposal’s introduction is unusually candid about why the 2023 guidance is being replaced: Institutions reportedly struggled to map its extensive considerations to specific relationship types, its detailed illustrative examples were read as a checklist despite disclaimers to the contrary, its “critical activities” framing focused on the wrong unit of analysis (activity rather than relationship-specific risk), and its prescriptive tone (particularly use of “should” in examples) drove process-heavy compliance that did not correlate with actual risk. Each of the structural features described in Section II is a direct response to one of these named failure modes, which means institutions and commenters have a rare, explicit roadmap for testing whether the proposed fixes actually solve the diagnosed problem, rather than having to infer intent.
What is genuinely preserved. The core definitional architecture is substantively unchanged: The definition of a third-party relationship, the treatment of subcontractors (no independent relationship created by subcontractor use alone), and the substance of due diligence, contract negotiation, ongoing monitoring, and termination practices track the 2023 guidance closely. Institutions should not read this proposal as license to dismantle existing TPRM programs. The shift is in tailoring and prioritization, not in the underlying substantive expectations.
An administrative posture worth flagging for counsel. OIRA determined the proposal is not a “significant regulatory action” under Executive Order 12866, yet the agencies simultaneously characterize it as an expected “deregulatory action” under Executive Order 14192’s 10-for-one repeal framework. That combination is not unprecedented, but it is a point worth tracking for institutions or trade groups considering administrative law arguments in a comment letter, since the deregulatory characterization already made in the proposing release will constrain how much the tailoring language can be walked back in a final rule without inviting inconsistency.
Link to Read the Joint Statement Alongside the Core Provider Statement Read the Joint Statement Alongside the Core Provider Statement
The Joint Statement on Community Banks’ Engagement with Core Service Providers, issued by the board, FDIC, and OCC (but not NCUA) on September 11, the day after this proposal, deserves to be read as a companion document, not a separate development. It responds to the same underlying record (including the OCC’s November 2025 request for information on community banks’ engagement with core providers, 90 FR 54882) and addresses the exact category of relationship, core processors, that the proposal itself repeatedly cites as the paradigm case of a “higher risk” third party.
The Core Provider Statement, however, moves in the opposite direction from the proposal’s general deregulatory thrust. It commits the agencies to weighing three factors — transparency, contract features, and technology investment — when making supervisory resource allocation decisions specifically about core providers, including decisions on exam frequency, what goes into exam reports shared with client institutions, and whether to add a provider to the agencies’ service provider examination program. The factors are granular and adversarial in tone relative to the proposal’s general posture. Opaque billing and back billing practices, unsupported deconversion fees (especially following a provider’s own breach), contractual limits on integration with unaffiliated vendors, and inadequate end-of-life technology management are all called out as practices that will draw heightened supervisory attention to the provider, not just the bank.
Most consequentially, the statement raises the prospect that certain core providers could be treated as “institution affiliated parties” under 12 U.S.C. § 1813(u), a designation that would let the agencies pursue enforcement action directly against a core provider, notwithstanding that it is not itself a depository institution and is today reachable only indirectly through the Bank Service Company Act examination authority (12 U.S.C. §§ 1464(d)(7)(D), 1867(c)). This is a materially different enforcement posture than anything found in the 2023 guidance, its supplements, or the proposal itself.
The result is a bifurcated strategy worth naming plainly for boards and counsel. Examiners are being told to tailor and defer more on the bank side of third-party relationships generally, while the agencies are simultaneously building a more direct supervisory and enforcement lever aimed specifically at the concentrated core processing market. The statement notes this market is dominated by “just a few large providers,” which is precisely the leverage imbalance the agencies cite as justifying the new approach.
There is also a live internal tension worth flagging for a comment letter. The proposal tells institutions that risk should be assessed on a per relationship basis and that even core processor risk can vary (for example, based on the share of business the provider supports, per footnote 11), while the Core Provider Statement treats core processors categorically as a community bank’s “most material, complex, and highest risk” relationships. An institution, or a core provider itself, reading only the proposal could reasonably conclude it has more room to argue a particular core relationship down the risk scale than the companion statement’s categorical framing would actually support in examination practice.
Link to Recommendations Recommendations
- Do not treat this as license to reduce TPRM program rigor. The deregulatory framing applies to tailoring and prioritization, not to the underlying substantive expectations, which remain largely intact. Banks will need to document why a relationship-specific risk assessment supports the selected oversight tier and preserve evidence that residual risks were consciously accepted.
- Inventory core provider and affiliate contracts now against both documents, specifically for provisions the Core Provider Statement flags (billing transparency, deconversion fee structures, integration restrictions, and end-of-life technology management), since these will likely surface in examinations even before the guidance is finalized.
- Conduct a transition-contract gap analysis. For each incumbent provider, map transition-assistance commitments, data-return and deletion obligations, retrieval formats and timelines, deconversion fee caps or waivers, stranded obligations, and cooperation duties owed to the replacement provider. Identify terms that could make the act of exiting a material operational or legal risk, and address those gaps before the transition becomes time sensitive.
- Track the open-scope questions the agencies posed directly (for example, whether to limit the guidance’s scope to written agreements, or whether to enumerate specific high-risk characteristics) and consider commenting, particularly if your institution has relied on now rescinded supplemental resources.
- Confirm submission mechanics per agency. Comments must go to four separate dockets with different preferred methods (OCC and NCUA via Regulations.gov; the board via its own proposals portal; the FDIC via website or email), and a single combined submission to one agency will not reach the others. Coordinate a common factual and legal record across the submissions rather than assuming one filing will circulate to all four agencies.
- If your institution is a community bank or credit union reliant on a small number of core providers, evaluate now whether your current contracts and monitoring practices would hold up against factors from the Core Provider Statement independent of how the proposal is finalized. Large banks should use the same factors as an internal benchmark for enterprise technology providers. That statement is effective as guidance immediately and is not contingent on the rulemaking process described above.