Today, September 11, 2026, a consortium of the nation’s principal financial regulatory bodies—the Federal Deposit Insurance Corporation (FDIC), the Federal Reserve Board (the Fed), the National Credit Union Administration (NCUA), and the Office of the Comptroller of the Currency (OCC), collectively referred to as "the agencies"—unveiled a significant initiative aimed at bolstering the resilience of the financial sector. This morning, at 10:00 a.m. EDT, these agencies formally requested public comment on proposed guidance designed to assist financial institutions in effectively managing the multifaceted risks inherent in their third-party relationships. This comprehensive proposal signifies a concerted effort to update and harmonize regulatory expectations in an increasingly complex and interconnected financial ecosystem.

Concurrently with the release of the proposed guidance, the federal bank regulatory agencies—the FDIC, Fed, and OCC—also issued a distinct statement concerning community banks’ engagement with core service providers. This accompanying statement delineates specific factors that the agencies will consider when making supervisory and enforcement decisions related to these crucial providers, offering clarity and support to a vital segment of the banking industry. Furthermore, the Federal Reserve Board independently released a separate request for comment on a proposed third-party risk management guide tailored specifically for Federal Reserve-supervised community banks, intending it to serve as a practical companion document to the broader interagency guidance.

The Evolving Landscape of Third-Party Risk in Finance

The move by the agencies comes at a critical juncture, reflecting the dramatic transformation of the financial services industry over the past decade. Financial institutions, ranging from the largest global banks to the smallest community credit unions, have increasingly outsourced or partnered with third-party vendors for a wide array of services. These relationships span core banking functions like payment processing, IT infrastructure management, cloud computing, data analytics, and customer support, to specialized services such as cybersecurity, compliance software, and even marketing. This reliance, while offering significant benefits in terms of efficiency, innovation, and cost reduction, simultaneously introduces a complex web of risks that, if not managed diligently, can threaten an institution’s operational stability, data security, compliance standing, and ultimately, its financial health.

The proliferation of digital technologies and the rapid expansion of fintech partnerships have only accelerated this trend. Cloud service providers, in particular, have become indispensable, hosting vast amounts of sensitive financial and customer data. While these technologies offer scalability and advanced capabilities, they also concentrate risk. A single vulnerability in a widely used third-party platform can expose numerous financial institutions to significant threats, as evidenced by high-profile supply chain attacks and data breaches in recent years. For instance, reports from industry analysts like the Ponemon Institute and IBM X-Force consistently highlight that third-party breaches account for a substantial percentage of all cyber incidents, often leading to higher costs and longer recovery times compared to internal breaches. Data from various cybersecurity reports frequently indicates that over 60% of organizations have experienced a data breach caused by a third party or fourth party, underscoring the urgency of robust risk management frameworks. The average cost of a data breach involving a third party can run into millions of dollars, not including the immeasurable reputational damage and loss of customer trust.

Core Tenets of the Proposed Interagency Guidance

The proposed guidance is a direct response to the lessons learned from the agencies’ supervisory experiences and their ongoing examination of financial institutions’ third-party risk management practices. It is explicitly designed to assist banks and credit unions in developing and implementing risk management practices that are not only robust but also appropriately tailored to the specific risks presented by individual third-party relationships. This emphasis on tailoring is crucial, recognizing that a small community bank engaging a local IT vendor faces a different risk profile and requires a different level of due diligence than a large multinational bank utilizing a global cloud provider for its core processing.

A foundational element of the proposed guidance is its principles-based approach. Unlike prescriptive, rule-heavy regulations, a principles-based framework provides overarching objectives and expectations, allowing institutions the flexibility to design risk management programs that are best suited to their unique business models, risk appetites, and the nature and criticality of their third-party engagements. This approach fosters "prudent innovation," encouraging institutions to adopt new technologies and partnerships while ensuring that the associated risks are systematically identified, assessed, monitored, and controlled. The guidance is non-binding, as is typical for supervisory guidance, meaning it articulates the agencies’ expectations rather than imposing legally enforceable rules, though institutions are expected to adhere to its principles for sound and safe operations. Key areas addressed within the proposed guidance are expected to include:

• Planning: Strategies for identifying and assessing the need for third-party relationships.
• Due Diligence and Selection: Rigorous evaluation of potential third parties, including their financial health, operational capabilities, information security posture, and compliance frameworks.
• Contract Negotiation: Ensuring contracts clearly define roles, responsibilities, performance standards, audit rights, and termination clauses.
• Ongoing Monitoring: Continuous oversight of third-party performance, risk posture, and adherence to contractual obligations.
• Termination: Plans for the orderly exit from third-party relationships, including data retrieval and destruction protocols.

A Unified Front: The Agencies’ Collaborative Approach

The collaborative nature of this initiative, involving the FDIC, Federal Reserve, NCUA, and OCC, is particularly noteworthy. Each agency plays a distinct yet complementary role in regulating and supervising financial institutions. The FDIC insures deposits and supervises state-chartered banks that are not members of the Federal Reserve System. The Federal Reserve supervises state-chartered member banks, bank holding companies, and foreign banks operating in the U.S. The NCUA oversees federal credit unions and insures deposits at federal and state-chartered credit unions. The OCC charters, regulates, and supervises all national banks and federal savings associations. By issuing joint guidance, these agencies aim to promote consistency in supervisory expectations across different types of financial institutions, thereby reducing regulatory arbitrage and ensuring a level playing field. This unified approach is essential for addressing systemic risks that can transcend individual institutional types or regulatory jurisdictions. The agencies’ collective experience ensures a broad perspective, incorporating insights from diverse segments of the financial industry.

Rescinding and Replacing: Streamlining the Regulatory Framework

When finalized, the federal bank regulatory agencies (FDIC, Fed, and OCC) plan to rescind their existing third-party risk management guidance documents and replace them with this new, comprehensive framework. This streamlining effort is crucial for several reasons. Firstly, existing guidance may be fragmented, having been issued at different times by individual agencies in response to evolving threats or specific legislative mandates. Consolidating these into a single, updated document will provide greater clarity and reduce potential inconsistencies. Secondly, the pace of technological change often outstrips the speed of regulatory updates. Rescinding older guidance allows the agencies to incorporate the latest best practices, address emerging risks (such as advanced persistent threats, supply chain attacks, and complex cloud computing models), and reflect current supervisory priorities. The goal is to create a more coherent, relevant, and forward-looking regulatory framework that can adapt to future innovations while maintaining robust risk controls. This consolidation is anticipated to ease the compliance burden for financial institutions by providing a single, authoritative source of guidance on this critical topic.

Spotlight on Community Banks: Tailored Support and Oversight

Recognizing the unique operational realities and resource constraints faced by community banks, the federal bank regulatory agencies have taken a targeted approach to address their specific needs regarding core service providers. The separate statement issued today on community banks’ engagement with these providers is a testament to this understanding. Core service providers are those critical vendors that provide essential services, such as core processing systems, which are fundamental to a bank’s operations. Any disruption or compromise of these services can have immediate and severe consequences for a community bank, impacting its ability to serve customers and maintain compliance.

Community banks, while generally having simpler operational structures than larger institutions, often rely heavily on a limited number of third-party vendors for their technological infrastructure and specialized services. Unlike larger banks with dedicated risk management departments and extensive internal resources, community banks may have fewer personnel with expertise in vendor risk management, cybersecurity, or complex contract negotiation. The statement from the agencies aims to provide clarity on the factors that will guide their supervisory and enforcement decisions related to these core providers. This could include aspects such as the bank’s due diligence in selecting the provider, the robustness of the contract, the bank’s ongoing monitoring capabilities, and the provider’s own resilience and security posture. This targeted guidance is expected to help community banks navigate these critical relationships more effectively, ensuring they can leverage technological advancements without exposing themselves to undue risk.

Further reinforcing this focus, the Federal Reserve Board’s separate request for comment on a proposed third-party risk management guide specifically for Fed-supervised community banks underscores the commitment to providing practical, actionable advice. This companion document is likely to offer more granular, perhaps templated, approaches and best practices that are scalable and implementable for institutions with fewer resources. It aims to demystify complex risk management concepts and translate them into practical steps that community banks can integrate into their daily operations. This dual approach – broad interagency guidance and specific community bank resources – reflects a nuanced understanding of the diverse landscape within the U.S. financial system.

Historical Context: A Growing Regulatory Focus

The emphasis on third-party risk management is not a new phenomenon, but rather an area of evolving regulatory scrutiny. Initial guidance on vendor management emerged in the early 2000s, primarily driven by concerns around operational outsourcing and business continuity. However, with the rapid digitization of banking services, the rise of cloud computing, and the increasing sophistication of cyber threats, the scope and complexity of third-party risks have expanded exponentially. Major data breaches and operational outages attributed to third-party vulnerabilities, such as those impacting global financial service providers or critical infrastructure components, have repeatedly underscored the systemic importance of robust vendor oversight. These incidents have served as catalysts for regulators to continuously refine and strengthen their expectations.

Over the past decade, regulatory bodies have issued various pronouncements and advisories, including interagency papers on sound practices for managing third-party risk, guidance on cloud computing, and specific cybersecurity frameworks. However, these often developed somewhat independently or in response to specific, isolated events. The current initiative to rescind existing guidance and replace it with a unified, principles-based framework represents a maturation of regulatory thought. It acknowledges that third-party risk is no longer an isolated operational concern but a pervasive strategic risk that requires a holistic and integrated management approach across all critical functions of a financial institution. This latest proposed guidance builds upon this rich history, consolidating best practices and adapting them to the realities of the mid-2020s.

Industry Implications and Anticipated Reactions

The release of this proposed guidance is expected to elicit a wide range of reactions across the financial industry. For larger financial institutions, much of the proposed guidance may codify practices they have already begun to implement, given their greater exposure to complex third-party ecosystems and stricter internal governance requirements. However, even these institutions will likely review the guidance closely for any new or heightened expectations, particularly concerning areas like continuous monitoring, exit strategies, and the management of "fourth-party" risks (i.e., the subcontractors of their third parties). There may be an initial pushback regarding potential increases in compliance costs, requiring investments in new technologies, personnel training, and more rigorous audit processes.

Community banks and credit unions, while benefiting from the tailored support, may find the initial adjustment challenging. The increased clarity, however, should ultimately empower them to make more informed decisions about their vendor relationships, potentially leading to safer and more resilient operations in the long run. Industry associations, such as the American Bankers Association, the Independent Community Bankers of America, and the Credit Union National Association, are expected to play a crucial role in gathering feedback from their members and submitting consolidated comments to the agencies. Their input will likely focus on ensuring the guidance remains practical, scalable, and avoids imposing undue burdens on smaller institutions while still achieving the desired risk reduction objectives.

For third-party service providers themselves, particularly those serving the financial sector, the guidance will undoubtedly lead to increased scrutiny from their financial institution clients. Vendors will need to demonstrate even greater transparency, robust internal controls, comprehensive cybersecurity programs, and clear incident response capabilities to meet the heightened expectations. This could drive innovation among vendors to offer more secure and compliant services, ultimately raising the bar for the entire supply chain serving the financial industry.

Protecting the Consumer and Ensuring Financial Stability

Ultimately, the overarching goal of this regulatory initiative is twofold: to protect consumers and to ensure the stability and integrity of the broader financial system. By requiring financial institutions to implement more rigorous third-party risk management practices, the agencies aim to safeguard sensitive customer data from breaches, protect against service disruptions that could impact access to funds, and maintain trust in the banking system. When a financial institution’s third-party vendor experiences an outage or a cyberattack, it is often the end consumer who suffers, either through direct financial loss, identity theft, or simply the inconvenience of disrupted services.

From a systemic perspective, the interconnectedness of the financial system means that a failure at one critical third-party provider could have ripple effects across multiple institutions, potentially threatening financial stability. The guidance seeks to mitigate this systemic risk by promoting a more resilient and secure financial infrastructure. It represents a proactive measure to address the inherent vulnerabilities introduced by increasing reliance on external partners, ensuring that the benefits of technological innovation do not come at the expense of safety and soundness.

The Road Ahead: Comment Period and Finalization

The release of this proposed guidance marks the beginning of an important public comment period. Comments on the proposed interagency guidance are due 60 days after its publication in the Federal Register. This timeframe provides financial institutions, industry associations, technology providers, cybersecurity experts, and consumer advocacy groups with an opportunity to review the proposal in detail and provide constructive feedback. The agencies will meticulously review all submitted comments, which will inform any revisions before the guidance is finalized. The finalization process typically involves addressing public concerns, clarifying ambiguous language, and making adjustments to ensure the guidance is both effective and implementable. Once finalized, the guidance will represent the authoritative supervisory expectations for third-party risk management across a significant portion of the U.S. financial sector, effective from its publication date.

The September 11, 2026, announcement, with its dual focus on comprehensive interagency guidance and specific support for community banks, underscores the agencies’ commitment to adapting regulatory frameworks to the realities of modern finance. As the financial industry continues its rapid evolution, particularly through digital transformation and increased reliance on specialized vendors, robust and adaptable risk management practices will be paramount for maintaining the safety, soundness, and resilience of the financial system for years to come. The process now moves to the industry, whose active participation in the comment period will be crucial in shaping the final form of these critical regulatory expectations.