New Federal Third-Party Risk Framework: What Banks and Credit Unions Must Know Now

Washington, United States, Source:

The landscape of financial oversight is shifting once again. On September 11, 2026, four major federal agencies including the FDIC, the Federal Reserve Board, the NCUA, and the OCC announced a joint request for public comment on proposed guidance regarding third-party risk management. This initiative marks a pivotal moment in how regulators view the complex web of vendor relationships that support modern financial institutions.

Why now? The digital age has brought unprecedented reliance on external providers for critical functions like cloud computing and data analytics. The new framework aims to help banks and credit unions align their risk management practices with the specific risks associated with each third-party relationship. By drawing on extensive supervisory experience, the agencies are promoting a principles-based approach that encourages prudent innovation while maintaining industry consistency.

One of the most significant aspects of this update is the plan to rescind existing third-party risk management guidance once the new rules are finalized. This replacement strategy seeks to eliminate outdated standards and replace them with robust, forward-looking requirements. The potential for systemic risk grows if these relationships are not managed rigorously, making this transition essential for long-term stability.

For community banks, there is good news. The regulators issued a specific statement addressing engagement with core service providers, outlining factors considered in supervisory and enforcement decisions. Additionally, the Federal Reserve Board released a companion document tailored specifically for smaller institutions. This resource provides targeted advice to help smaller entities navigate third-party risks without being overwhelmed by the same burdens placed on larger global systemically important banks.

The proposed guidance is non-binding, allowing institutions the flexibility to tailor their compliance strategies to their unique operational landscapes. Public comments are due 60 days after publication in the Federal Register. This period allows stakeholders, including technology vendors and consumer advocacy groups, to provide feedback that could shape the final regulations. As the banking sector continues to digitize, effective third-party risk management remains a cornerstone of financial stability, protecting both institutions and consumers from cascading failures in the supply chain.