Third-Party Risk Management: Proposed Guidance and Request for Comment

Summary

The Office of the Comptroller of the Currency (OCC), in coordination with the Board of Governors of the Federal Reserve System (the Board), the Federal Deposit Insurance Corporation (the FDIC), and the National Credit Union Administration (the NCUA, and collectively, the agencies), is issuing proposed guidance revising and replacing existing guidance on third-party risk management. The proposed guidance draws on the agencies' supervisory experience and lessons learned through examining banking organizations' third-party risk management practices and seeks to assist banking organizations in better aligning and tailoring these practices in relation to reasonably assessed risk levels specific to each of their third-party relationships.¹

Comments are due 60 days from the publication of the proposed guidance in the Federal Register.

Highlights

The proposed guidance

• emphasizes the importance to banking organizations of aligning their third-party risk management practices in relation to the reasonably assessed risk levels specific to each of their third-party relationships, tailored to the banking organization's size, complexity, and risk profile, as well as the nature of their third-party relationships.
• is intended to help banking organizations prioritize third-party risk management based on the magnitude and likelihood of potential harm that could arise from their third-party relationships, while avoiding overly process-driven strategies that treat all third-party relationships as inherently higher-risk.
• will not set forth enforceable standards or prescriptive requirements; accordingly, non-compliance with the guidance will not result in supervisory action against a banking organization.

Further Information

Please contact Graham Bannon, Counsel, Chief Counsel's Office at (202) 649-5490.

Adam J. Cohen
Senior Deputy Comptroller and Chief Counsel

Related Link

• Proposed Third-Party Risk Management Guidance (PDF)