U.S. banking agencies seek comment on third-party risk guidance

Traders Union
All News
Regulators
Third-party risk guidance comment

Highlights

The National Credit Union Administration, FDIC, Federal Reserve Board, and OCC seek comment on proposed principles-based third-party risk guidance for financial institutions.
The proposed guidance is non-binding, aims to standardize third-party oversight industry-wide, and will replace existing frameworks once finalized, with comments due within 60 days of Federal Register publication.
Federal regulators issued a separate statement on community banks’ core service provider relationships and the Federal Reserve Board requests comment on a companion risk management guide focused on community banks.

Proposed guidance and comment timeline

According to National Credit Union Administration, the National Credit Union Administration, the Federal Deposit Insurance Corporation, the Federal Reserve Board and the Office of the Comptroller of the Currency are requesting comment on proposed guidance for financial institutions' third-party relationships.

The proposal draws on the agencies' supervisory experience and lessons from examinations of third-party risk management practices. It is designed to help banks and credit unions better align and tailor their risk management practices to the specific risks of individual third-party relationships, using a principles-based approach.

The agencies say the guidance is non-binding, in line with supervisory guidance more broadly. Once finalized, the federal bank regulatory agencies plan to rescind existing third-party risk management guidance and replace it with the new framework to promote consistency and prudent innovation in the banking industry.

Comments on the proposed guidance are due 60 days after publication in the Federal Register.

Community bank oversight and sector impact

Separately, the federal bank regulatory agencies are issuing a statement on community banks' engagement with core service providers. The statement outlines certain factors the agencies will consider when making supervisory and enforcement decisions involving those providers.

The move signals continued regulatory attention on operational, compliance and outsourcing risks across the banking sector, particularly for smaller institutions that rely heavily on third-party firms for core services. It also suggests regulators are trying to standardize expectations across agencies while preserving flexibility for institutions with different risk profiles.

Also on Friday, the Federal Reserve Board separately requests comment on a proposed third-party risk management guide for Federal Reserve-supervised community banks. That document is intended to serve as a companion to the broader proposed guidance.

U.S. plans for a new bank-related sanction tied to “Operation Economic Outcast” were outlined in our earlier coverage, with Treasury indicating a large, unnamed bank would be targeted on a set Monday timeline. We noted the broader campaign’s aim to tighten pressure on Iran-linked networks, raising compliance and secondary-sanctions risk for banks and cross-border firms engaged with designated entities.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.