Agencies Propose Third-Party Risk Guidance

• The proposed guidance takes a principles-based approach, according to the agencies.
• Comments on the proposed guidance are due 60 days after publication in the Federal Register.
• The Federal Reserve Board separately requested comment on a companion guide for Fed-supervised community banks.
• The agencies plan to rescind existing third-party risk management guidance once the new guidance is finalized.

Proposed Guidance

Federal bank regulatory agencies requested comment on proposed guidance to assist financial institutions with managing third-party relationship risks. The agencies released the request via press release at 10:00 a.m. EDT on September 11, 2026. Comments are due 60 days after publication in the Federal Register.

Approach and Purpose

The proposed guidance follows a principles-based approach. It is intended to help banks and credit unions align and tailor their third-party risk management practices to the risks of individual third-party relationships. The agencies said the guidance reflects their supervisory experience and lessons learned from examining institutions' third-party risk management practices. The guidance is non-binding.

Companion Guide for Community Banks

The Federal Reserve Board separately requested comment on a proposed third-party risk management guide specifically for Federal Reserve-supervised community banks. The guide is intended to serve as a companion document to the proposed guidance.

Core Service Providers

The agencies also issued a statement on community banks' engagement with core service providers. The statement discusses factors the agencies will consider in making supervisory and enforcement decisions related to these core providers.

Next Steps

The agencies plan to rescind existing third-party risk management guidance and replace it with the finalized guidance.