Agencies Seek Comment on Proposed Third-Party Risk Management Guidance and Issue Statement on Community Bank Engagement with Core Service Providers

Alexandria, VA (September 11, 2026) ― Today the National Credit Union Administration, the Federal Deposit Insurance Corporation, the Federal Reserve Board, and the Office of the Comptroller of the Currency (collectively, the agencies) requested comment on proposed guidance to assist financial institutions with managing risks associated with third-party relationships.

The proposed guidance reflects the agencies' supervisory experience and lessons learned from examining financial institutions' third-party risk management practices. It is intended to assist banks and credit unions to better align and tailor their third-party risk management practices to the risks of individual third-party relationships. The proposed guidance focuses on a principles-based approach and, as with all supervisory guidance, is non-binding.

When finalized, the federal bank regulatory agencies plan to rescind existing third-party risk management guidance and replace it with the finalized guidance to promote consistency and prudent innovation in the banking industry.

Comments on the proposed guidance are due 60 days after publication in the Federal Register.

Separately, the federal bank regulatory agencies are issuing a statement on community banks' engagement with core service providers. The statement discusses certain factors the agencies will consider in making supervisory and enforcement decisions related to these core providers.

Also today, the Federal Reserve Board separately requested comment on a proposed third-party risk management guide specifically for Federal Reserve-supervised community banks, which is intended to serve as a companion document to the proposed guidance.

Related Link
Proposed Third-Party Risk Management Guidance (PDF)

Media Contacts: