Developments on Third-Party Risk Management Guidance and Core Service Provider Oversight

On September 11, 2026, the Agencies (FDIC, OCC, FRB, and NCUA) proposed interagency third-party risk management (TPRM) guidance (Proposed Guidance), which, if finalized, would replace the 2023 Interagency Guidance on Third-Party Relationships: Risk Management (2023 Guidance). Comments are due November 16, 2026.

Separately, the FRB proposed TPRM guide for traditional community banking organizations (FRB Proposal), which is intended to serve as a companion document to the Proposed Guidance. It has the explicit goal of assisting “traditional community banking organizations” (TCBOs) (defined as those with less than $30 billion in assets that focus on serving their local communities) in understanding and conducting TPRM and how the principles in the Proposed Guidance can be applied in practice. Comments on the FRB Proposal are due November 16, 2026.

At the same time, the Banking Agencies (FDIC, OCC, FRB), issued a Joint Statement on Community Banks’ Engagement with Core Service Providers (Joint Statement), to provide clarity on risk-based supervision of certain services provided to community banks.

Proposed Interagency Third-Party Risk Management Guidance

Based on feedback from stakeholders and supervisory experience, the Agencies believe the 2023 Guidance frequently has been interpreted in an overly broad manner and with an insufficient focus on tailoring its risk management principles. Specifically, the Agencies note that the 2023 Guidance's broad scope leaves banks unsure which considerations apply and how to tailor them; that it focuses on the type of activity rather than the magnitude and likelihood of harm a relationship actually poses, leading banks to over-apply heightened practices; that it has been read as imposing prescriptive requirements; and that it discourages arrangements with newer, innovative third parties perceived as higher risk.

The Proposed Guidance would address these concerns by emphasizing risk identification and assessment as the foundation of a risk-based approach. This would allow banks and examiners to focus on material financial risks and violation of laws and regulations, rather than ineffective check-the-box exercises. The Proposed Guidance also is intended to encourage responsible innovation by emphasizing a risk-based and tailored approach to TPRM and removing broad-based and overly prescriptive language from the 2023 Guidance.

Scope

The Proposed Guidance defines “third-party relationship” as a business arrangement between a banking organization and an entity or individual for the provision of one or more products, services, and other activities that support the banking organization. This is potentially narrower than the 2023 Guidance's definition (“any business arrangement between a banking organization and another entity, by contract or otherwise”); notably, a footnote to the Proposed Guidance separately asks whether it should apply only to third parties under a written agreement, suggesting the Agencies may be considering an even narrower, contract-based scope.

Risk Management Components

Rather than focus on “critical activities,” the Proposed Guidance’s organizing concept is a two-factor risk test: magnitude of potential harm and likelihood that harm occurs, assessed per relationship (or per-activity, at the bank’s option). The Proposed Guidance removes the enumerated checklists in the 2023 Guidance, opting for a high-level framework, and illustrative, but not comprehensive, examples.

The Proposed Guidance presents four components that banking organizations may consider when managing third-party risk: (1) identifying and assessing applicable risks; (2) overseeing risks proportionate to their significance; (3) making informed decisions about residual risks and risk acceptance; and (4) establishing appropriate governance practices.

Risk Identification and Assessment: The Proposed Guidance states that maintaining an inventory of third-party relationships may be useful for managing third-party risks, and the level of detail in that list may depend on the bank’s size and complexity. A bank is expected to identify relevant risks, which vary based on the type of relationship and services provided. The Proposed Guidance recognizes that a bank is not expected to identify all possible risks, but identifying the most relevant risks is generally part of effective TPRM. Risk assessments take into account both the magnitude of harm the third-party relationship could cause the bank or its customers and the likelihood that the harm will occur. While core processing service provider relationships are likely to be assessed by most banks as higher risk, other relationships may be assessed as higher risk by one bank but not by another. Certain relationships may be less likely to be assessed as higher risk. For example, many banks contract with affiliated entities that operate within an enterprise-wide risk management framework to perform various services and thus may be lower risk. Additionally, certain third parties may themselves be entities that are heavily regulated and supervised by one or more state or federal regulators, and in certain circumstances, a bank may consider a third party’s regulatory status and regulatory obligations as part of its risk assessment.
Risk Oversight: Effective risk management involves overseeing third-party relationships in a manner proportionate to the risks they present and consistent with the bank’s risk appetite and tolerances. The bank may tailor its oversight based on the bank’s size, complexity, and risk profile, as well as with the nature of the third-party relationship. Oversight includes:
- Due Diligence and Third Party Selection: The amount of due diligence that is warranted depends on the risks presented by the relationship and the bank’s individual business needs. The Proposed Guidance gives examples of relevant due diligence factors (e.g., financial condition, business experience, and compliance) and notes that banks may supplement due diligence with outside information sources.
- Contract Negotiation: Again, this is tailored to the risks in the relationship and the bank’s profile. The Proposed Guidance includes typical terms, but notes it depends on the circumstances. When a bank has limited negotiating power, the bank may still be able to proceed with the relationship if it understands the risks and residual risks, especially if there are limited alternative options.
- Ongoing monitoring: This includes reporting to the board and senior management, as appropriate. Examples include reviews of performance updates, periodic meetings, testing, and review of customer complaints. The level and frequency of the monitoring depends on the bank’s assessment of the risk of the third-party relationship.
- Termination: The Proposed Guidance discusses the reasons for termination and the process for such. It also discusses transitioning to another third party.
- Cross-Cutting Oversight Topics: The Proposed Guidance recognizes that banks may benefit from considering TPRM on a holistic, rather than a siloed basis. The discussion includes certain factors that cut across different stages, including the use of subcontractors; use of standard-setting organizations; insurance, indemnification and other limitations on liability; and operational resilience planning.
Residual Risk Acceptance: The Agencies do not expect banks to eliminate third-party risk, and they recognize that some residual risk is unavoidable. Risk acceptance is a fact- and circumstance-specific consideration, commensurate with a bank’s size, complexity, and risk profile and with the nature of its third-party relationships.
Governance: Banking organizations may consider adopting governance practices that (1) establish clear roles and responsibilities; (2) set an appropriate risk appetite and tolerances; (3) ensure the bank can identify, assess, and prioritize third-party risks; (4) establish reporting to senior management and the board; (5) document key risk management elements; and (6) provide for periodic independent reviews of program effectiveness.

FRB Proposal

The FRB is issuing the FRB Proposal to respond to community banks’ need for additional resources to support their TPRM efforts. The FRB seeks comment on whether such guidance is useful and how it could be improved. In drafting the FRB Proposal, the FRB has endeavored to distill the key risks and risk management considerations associated with third-party relationships most engaged in by TCBOs. The guide is divided into two main sections. The first section discusses four overarching TPRM topics: operational resilience; system and information security; compliance with rules and regulations; and financial resilience. The second section identifies eight categories of third parties that TCBOs often engage with: core providers; IT infrastructure providers; cybersecurity providers; payment processing and digital banking providers; loan management system providers; card issuing and processing providers; BSA/AML and financial crime platform providers; and fraud prevention and detection providers. For each third-party type, the guide discusses how the overarching considerations in the first section apply and additional risk management considerations specific to the third-party category. The FRB acknowledges that there is no one-size-fits-all approach to effective risk management and the guide is meant to support TCBOs without imposing enforceable standards or prescriptive requirements.

Overarching Third-Party Risk Management Considerations

Operational Resilience: A TCBO’s operational resilience depends to a large degree on the operational resiliency of the third party, and therefore assessing the operational resilience of such third parties may be a high priority for the TCBO. A TCBO may rely on a review of reasonably conducted independent assessments, such as SSAE 18 SOC Reports; technology service provider reports from the Federal banking agencies; audit reports; penetration testing reports; industry standard assessments (e.g., PCI DSS, NIST, ISO). Additionally, a TCBO may consider the third party’s historical system uptime performance, service availability metrics, and whether performance capabilities align with the TCBO’s needs. A TCBO may review the results of business continuity/disaster recovery tests, and it is useful for contracts to address a TCBO’s right to access these reports, or the right to audit directly if reports are unavailable. A TCBO may also seek to negotiate service level agreements for operational resilience in contracts with third parties, but the FRB recognizes that a TCBO may lack leverage in contract negotiations with certain third parties.
System and Information Security: Effective due diligence and ongoing monitoring of third parties with access to sensitive banking organization systems may include reviewing audit reports and other independent assessments that identify the design and operating effectiveness of controls that protect banking organization information. Independent assessments often include information on the type of sensitive data protected and the access controls, encryption, incident response, backup and disaster recovery processes and associated operational effectiveness. Independent assessments may also evaluate the third party's ability to identify unauthorized activity and suspicious patterns indicative of a party seeking to access sensitive information and the effectiveness of remediation activities if information is compromised. Contracts may address access to audits and a third party’s responsibility for notifying the TCBO of cybersecurity incidents and remediation. A TCBO may also consider negotiating for liability provisions for security breaches, data loss, and regulatory violations resulting from vendor security failures, and requirements that the third party maintain related insurance coverage.
Compliance with Rules and Regulations: Due diligence and ongoing monitoring of third parties that provide services that support a TCBO's compliance efforts may include a review of negative news screens, compliance attestations, certifications of good standing from relevant entities, and independent audit reports to understand the third party's historical record of regulatory and rules compliance; quality and consistency of alerts, errors and exception reporting; and the third party's ability to incorporate regulatory changes into services. A TCBO may consider contractually identifying the third party's roles and responsibilities for supporting the TCBO's compliance with rules and regulations, including implementing timely regulatory changes, notification requirements, and responding to regulatory or TCBO customer inquiries, where applicable. Contracts may consider liability or indemnification provisions for network rules or regulatory violations caused by the third party, as well as access to audits or attestations that validate the third party's ability to comply with such rules and regulations. Where relevant, contracts can establish clear data retention obligations aligned with regulatory requirements. Finally, a TCBO is ultimately responsible for compliance with rules and regulations and may benefit from tracking regulator or network rule changes that may have implications for the provider's services; and confirming the vendor makes any changes necessary to ensure compliance.
Financial Resilience: During due diligence and ongoing monitoring, a TCBO may approach evaluating the financial resilience of a third party in a manner consistent with the third party's risk profile. For example, a TCBO may limit a review of the third party's financial standing to publicly available information such as credit ratings, SEC filings, and market intelligence when the third party is a publicly-registered entity with established operating history. Conversely, when the third party is a private company or newer market entrant, a TCBO may benefit from a more concentrated assessment of the third party's financial standing. This may include reliance on funding sources, cash outlay, and pro forma financial statements, among other factors. A TCBO may experience challenges in acquiring reliable or independently validated financial information from privately-owned third parties, including third parties in the startup phase. In such cases, the TCBO may choose to accept higher inherent risk or even be willing to contribute financially to the third party, depending on the distinct advantages it may offer. The TCBO may consider establishing contractual commitments for the third party to provide financial information at a future point in time, hold adequate levels of insurance, or limit growth of its services to the TCBO until financial performance can be adequately assessed.

TPRM Considerations on a Vendor-by-Vendor Basis

Core Providers: Because integration failures between the core and other systems (e.g., BSA/AML, fraud detection, card, or loan processing) can cause significant operational breakdowns, TCBOs may test integrations in a separate environment before going live, put contractual service agreements in place to maintain their security and availability, and monitor established connections after material business or regulatory changes and through periodic continuity testing. Day-to-day monitoring may rely on system-generated alerts for failed transactions and daily ledger-reconciliation exceptions, with particular attention to reconciliation issues in the period immediately following a core conversion. Before deciding whether to convert and which provider to select, TCBOs may weigh the full direct and indirect cost picture (licensing/subscription fees, implementation and conversion services, the incumbent provider’s early-termination fees, third-party consulting, and internal staff time diverted from normal responsibilities), the prospective provider’s ability to meet the TCBO’s evolving strategic needs, ease and cost of integration with other systems, historical error and exception reports, and references from institutions that have already converted. Contract negotiation may address a reasonable and transparent pricing structure (including the cost of upgrades, variable charges tied to account count, asset size, or transaction volume, and the length of the provider’s “back billing” window for retroactive invoice corrections), reasonable initial term and renewal conditions, measurable SLAs the TCBO can monitor and enforce, liability and indemnification provisions matched to the criticality of core services, and clear, cost-bounded termination rights. As an alternative to a full conversion, TCBOs facing integration gaps with a legacy core may also consider an integration platform, often called a middleware provider, which passes data between the core and other systems without a full changeover—though it adds another layer to the vendor value chain and its own inherent risks.
IT Infrastructure Providers: Diligence may confirm the provider’s uptime history, redundancy and failover architecture, and recent business continuity/disaster recovery testing, with contract rights to access these reports or audit directly if they are unavailable. For a cloud migration specifically, TCBOs may work through the decision with the cloud service provider rather than treat it as a single choice: whether to pursue a minimalist migration (already cloud-optimized applications), an application-by-application migration, or a full infrastructure migration, and for each application, whether to simply replicate it in the cloud or modify it to take advantage of cloud capabilities—each carries different cost, complexity, and in-house-expertise tradeoffs. TCBOs may also discuss the categories of data being migrated and any risk to data accuracy or integrity, how disruptions during the transition will be minimized and communicated, and may plan for disposal of displaced physical equipment and cancellation of superseded software licenses. On an ongoing basis, TCBOs may use the provider’s dashboard reporting to monitor compliance with contracted standards rather than waiting for periodic reviews.
Cybersecurity Providers: Diligence and ongoing monitoring may draw on independent assessment reports (e.g., SOC 2 and ISO reports), consultation with peer institutions, publicly available reviews of the provider’s products, and the provider’s own performance data—including false-positive/negative error rates, mean time to detect threats, and results of simulated-attack testing. Where the TCBO has specific requirements (incident-notification timelines, periodic audits or reviews, state privacy law compliance, data retention timelines, encryption standards, system availability, multi-factor authentication), those may be written into the contract as enforceable SLAs rather than left as informal expectations. TCBOs may also negotiate the contractual right to adjust threat-detection sensitivity to match their own risk tolerance and to receive periodic output reports confirming the vendor is meeting those thresholds.
Payment Processing and Digital Banking Providers: Because outages directly prevent customers from accessing accounts or making payments, TCBOs may develop and test backup processing methods—such as an alternate processing rail or manual handling of time-sensitive transactions—rather than assume single-path resilience. Diligence may confirm the processor is in good standing with the relevant payment network (e.g., current NACHA audits or FedLine Solutions Security self-assessments, as applicable) and that its data-processing capabilities match the payment channels the TCBO intends to offer; requesting a product demonstration against the TCBO’s own specifications is more reliable than relying on marketing materials. Ongoing monitoring may include the accuracy of system-generated alerts for posting or reconciliation issues between the processor and the core, analysis of customer complaints for recurring issues, and review of failed transactions to confirm the system flagged them correctly.
Loan Management System Providers: Where the provider uses automated credit decisioning or risk scoring, diligence and implementation testing may confirm the system correctly applies the TCBO’s own credit policies and any loan-type-specific requirements (e.g., required structures, covenants, or collateral for specialized loan types)—configuration errors here are the primary source of the miscalculated debt ratios, incorrect past-due dates, and erroneous fees that can go undetected far longer than payment-processing errors and accumulate into backlogs. TCBOs may review independent audits or SOC reports, past regulatory violations, and the CFPB Consumer Complaint Database for signs a provider’s systems are error-prone, and may periodically sample booked loan files for accuracy, required disclosures, and timely, proper documentation. Contracts may require the provider to indemnify the TCBO for losses caused by third-party errors, maintain adequate insurance, and give the TCBO access to system documentation and audit rights. TCBOs may also confirm the provider can scale with portfolio growth and identify manual workarounds to sustain lending operations during an extended outage.
Card Issuing and Processing Providers: Diligence may include the processor’s network compliance certification and current PCI DSS attestations, and ongoing monitoring may track network security bulletins alongside customer complaints and system alerts for authorization failures, fraud, and disputes. Where a co-branded program involves a merchant partner, TCBOs may consider their exposure to unpaid rewards obligations if the partner becomes insolvent. If the TCBO relies on BIN sponsorship, diligence and contract negotiation may address the sponsor’s financial condition, advance notice before termination, and a workable transition process, since a compressed transition can force a rushed reissuance of the entire card program. When transitioning card processors, TCBOs may plan to keep the outgoing processor active until the new one is fully online, build a customer communication plan covering card replacement and any changes to payment arrangements, validate cardholder data (active/inactive status, fraud blocks, holds) before reissuing cards, and coordinate directly with outgoing and incoming BIN sponsors on data migration and network testing.
BSA/AML and Financial Crime Platform Providers: Diligence may confirm the provider’s detection rules, logic, thresholds, and scenario coverage align with the TCBO’s actual risk profile—most TCBOs need only basic tools, but a TCBO with higher-risk customers (e.g., marijuana-related businesses) may confirm the provider offers more advanced capability. Ongoing monitoring may track false-positive and false-negative trends as tuning indicators and verify the provider delivers timely sanctions-list and regulatory updates; the TCBO may be able to rely on manual workarounds if the platform is temporarily unavailable. Contract negotiation may secure the TCBO’s right to tune alert thresholds, modify monitoring scenarios, and adjust risk-scoring parameters (with associated costs and timeframes specified), clear allocation of responsibility for keeping the system current with BSA/AML and FinCEN requirements, and—importantly—the TCBO’s ownership of, and ability to access and extract, its own customer data, alert histories, investigation records, and SAR filings both during and after the contract term.
Fraud Prevention and Detection Providers: Diligence may assess the provider’s ability to integrate multiple data sources—including other third-party systems and threat-intelligence feeds such as dark web monitoring and shared fraud databases—into its identity-verification and transaction-authorization controls, since a detection tool’s effectiveness depends on how quickly it can act on that intelligence. As with BSA/AML platforms, ongoing monitoring may track fraud-alert trends, customer complaints, and false-positive/negative rates as tuning signals, and TCBOs may confirm they can calibrate the provider’s model to their own risk appetite rather than accept a fixed default. Where the provider handles customer communication or dispute investigation directly, contracts may require tracking of investigation and resolution timelines to confirm compliance with both contractual commitments and regulatory requirements.

Joint Statement on Community Banks’ Engagement with Core Service Providers

The Banking Agencies believe there is a need for clarification regarding a subset of community banking organizations’ (CBOs) third-party relationships, based on their supervisory experience and outreach to CBOs and other stakeholders (including the OCC’s 2025 RFI). The Statement focuses on third parties that provide the critical systems applications and infrastructure that support the operation and essential function of CBOs (core providers). The Banking Agencies recognize that core providers represent CBOs’ most material, complex, and highest-risk third-party relationships.

The Joint Statement addresses three areas of CBOs’ relationship with core providers.

(1) Select aspects of how CBOs engage with core providers

While the Banking Agencies recognize the significant benefits these relationships offer, they are also aware that a significant percentage of the core provider market is represented by just a few large providers, which limits CBOs’ negotiating power. “Given these constraints, CBOs report they often experience challenges obtaining reasonable due diligence information, negotiating contract terms, or conducting effective ongoing monitoring. These challenges may make it difficult for CBOs to hold core providers accountable for delivering quality services.”

(2) The extent to which the Banking Agencies will take these aspects into consideration when determining the level of supervisory oversight of core provider services

The Banking Agencies have determined that core provider business practices that “unreasonably limit CBOs’ ability to conduct due diligence and ongoing monitoring or to negotiate contract terms that address their business needs are associated with greater risks to the CBOs and a reduced ability of CBOs to identify, assess, and address such risks.”

Accordingly, the Banking Agencies will consider the following factors when making supervisory allocation decisions relevant to core providers who provide services to CBOs (e.g., decisions regarding the nature, extent and frequency of supervisory activities applicable to core providers; the content of exam reports provided to core providers’ client financial institutions; and whether to add a core provider to the agencies’ service provider examination program):

Transparency: The Banking Agencies will take into consideration the level of a core provider’s transparency with CBOs, by assessing: willingness to provide reasonably relevant and timely due diligence information; contractual provisions that limit a CBO’s reasonable attempts to compare offerings; use of, transparency regarding, and compliance with service level agreements using measurable performance standards; transparency and timely disclosure regarding operational issues and security incidents; and use of complex billing practices.
Contract Features: The Banking Agencies will take into consideration a core provider’s business practices and use of contract terms that make it difficult for CBOs to manage their core provider relationships in a manner that aligns with the CBO’s business needs, such as by seeking an alternative core provider or supplementary services. Such contract terms and practices include, for example, opaque pricing structures and practices; opaque billing practices; unsupported or contractually undefined deconversion fees; and excessive limitations on the ability of unaffiliated service providers to integrate with the core platform.
Technology: The Banking Agencies will take into consideration a core provider’s technology investments and capabilities in making supervisory allocation decisions. This includes, for example, the number and severity of computer security incidents; appropriate management of end-of-support and end-of-life assets that enable client CBOs to transition to updated platforms; and lack of demonstrated operational resilience capabilities.

(3) The Banking Agencies’ supervisory and enforcement authorities where a core provider engages or causes a CBO to engage in unsafe or unsound practices or violations of law or regulation.

The Banking Agencies monitor services that core providers deliver to CBOs to identify issues related to safety and soundness or violations of law. “When such issues are identified, the agencies may bring the appropriate actions against core providers and/or the CBO pursuant to their statutory authorities.” This does “not eliminate or reduce a CBO’s responsibility for ensuring activities are consistent with safe and sound banking practices and in compliance with applicable laws and regulations, regardless of whether they are outsourced to a third party.”

Among other bases for bringing appropriate actions against core providers, the agencies may have a reasonable basis to determine that certain core providers qualify as “institution-affiliated parties” (IAP) under the Federal Deposit Insurance Act (FDIA)—specifically, as “person[s] . . . who participate[] in the conduct of the affairs of an insured depository institution.” “This determination reflects the operational reality of the CBO-core provider relationship. While CBOs contract with core providers for services, many of the services provided by core providers address unique features of a CBO, are integral to the functioning of the institution and its delivery of banking products and services, and directly impact the customer banking experience. Many CBOs are wholly reliant on core providers for their back-end operations, as well as some of their customer interfaces and other functions.” Because core providers are integral to carrying out the business of banking and the functions of CBOs—undertaking “the most central operational aspects of banking” for the CBO, which “CBOs often could not provide . . . otherwise”—they may be held liable for the practices or violations of a CBO as an IAP.