Four federal financial regulators moved jointly on September 11, 2026, to reshape how banks and credit unions manage risks from vendors, fintech partners, and other third parties. The Federal Deposit Insurance Corporation, the Federal Reserve Board, the National Credit Union Administration, and the Office of the Comptroller of the Currency requested public comment on proposed guidance intended to help institutions align their third-party risk management practices with the specific risks of individual relationships. The action matters because third-party dependencies have become a defining feature of modern banking, and the agencies are signaling a shift toward a more principles-based, tailored approach rather than a one-size-fits-all compliance checklist.
The proposed guidance reflects the agencies' supervisory experience and lessons learned from examining financial institutions' third-party risk management practices. It is explicitly non-binding, consistent with the status of supervisory guidance, and focuses on a principles-based approach. When finalized, the federal bank regulatory agencies plan to rescind existing third-party risk management guidance and replace it with the finalized guidance to promote consistency and prudent innovation in the banking industry. Comments are due 60 days after publication in the Federal Register. Separately, the Federal Reserve Board requested comment on a proposed third-party risk management guide specifically for Federal Reserve-supervised community banks, which is intended to serve as a companion document to the broader proposed guidance.
The sole primary source for this development is an OCC news release dated September 11, 2026, which carries the joint announcement and includes agency media contacts for the FDIC, Federal Reserve Board, NCUA, and OCC. The release also discloses that the federal bank regulatory agencies are issuing a statement on community banks' engagement with core service providers. That statement discusses certain factors the agencies will consider in making supervisory and enforcement decisions related to these core providers. The announcement does not include the full text of the proposed guidance, the community bank statement, or the Federal Reserve's companion guide, so the specific factors, definitions, and examples remain outside the available evidence.
For the banking and credit union sectors, the proposal has direct operational implications. Institutions that rely on core processors, cloud providers, payment networks, and other third parties would face a consolidated supervisory framework if the guidance is finalized as proposed. The planned rescission of existing guidance suggests a deliberate effort to reduce fragmentation across the federal bank regulatory agencies. Community banks, in particular, are addressed through both the separate statement on core service providers and the Federal Reserve's companion guide, indicating that regulators recognize the distinct concentration and negotiation dynamics smaller institutions face with dominant core providers. The non-binding nature of the guidance means it does not create new legal obligations, but it will likely shape examination expectations and industry practice.
The evidence base is limited to a single primary source read in full, and several material details are not yet available. The proposed guidance's full text, the specific factors in the community bank statement, and the Federal Reserve's companion guide were not included in the announcement. The 60-day comment window begins upon Federal Register publication, not on the announcement date, so the exact deadline is not yet fixed. Market participants should watch for the Federal Register publication, the release of the full proposed guidance and companion documents, and any industry comments that reveal how banks and credit unions interpret the proposed principles-based approach.