Four U.S. financial regulators have proposed new third-party risk management guidance that would allow banks and credit unions to tailor oversight to each outside relationship while replacing existing guidance. According to reports from Investing.com, the Federal Reserve, Office of the Comptroller of the Currency, Federal Deposit Insurance Corporation, and National Credit Union Administration announced the proposal on Friday, stating that the guidance is intended to assist banks and credit unions to 'better align and tailor their third-party risk management practices to the risks of individual third-party relationships'. The framework would replace third-party risk management guidance issued in 2023 and 2024 and is open to public comment for 60 days after appearing in the Federal Register. As reported by Federal Reserve staff, banks are increasingly outsourcing certain roles to cut costs and improve efficiency, making regulators look to give institutions a clearer framework for sizing oversight to actual risk.
The latest proposal specifically addresses the unique challenges posed by core service providers, which handle many of the most important and technically complex back-end functions for small- to medium-size community banks and credit unions. According to the agencies, these providers typically handle account management, transaction processing and loan servicing functions that are critical to bank operations. The guidance notes that many small banks and credit unions have relied on these firms to remain competitive in a fast-evolving market, but highlights that the core services sector is highly concentrated, giving banks few options to choose from. The proposal calls for additional supervisory scrutiny of core services arrangements that provide limited transparency to community banks as well as those that unreasonably limit banks' ability to conduct due diligence and ongoing monitoring or negotiate contract terms that address their business needs. The agencies also emphasize closer oversight of servicers' technology investments and capabilities due to their unique role in providing technology to community banks.
Under the proposed guidance, banks and credit unions would consider both the possible harm from an outside provider and the likelihood of the harm occurring. As reported by Investing.com, the proposed guidance focuses on a principles-based approach and, as with all supervisory guidance, is non-binding. Institutions could use less detailed checks, standard contracts, or less frequent monitoring when a relationship carries limited risk. The framework would also allow a financial institution to accept some residual risk after considering its risk appetite, tolerance, and ability to operate safely. According to the agencies, the principles would not impose enforceable requirements, and a bank would not face supervisory action solely for failing to follow the guidance.
Alongside the main proposal, the Federal Reserve has requested comments on a companion guide for traditional community banking organizations under its supervision. According to reports from Investing.com, the Federal Reserve Board separately requested comment on a proposed third-party risk management guide specifically for Federal Reserve-supervised community banks, which is intended to serve as a companion document to the proposed guidance. The proposed guide would discuss the key risks faced by traditional community banking organizations in their third-party relationships. The Federal Reserve defines eligible institutions as locally focused banks with less than $30 billion in assets. The proposed guide covers four main areas: operational resilience, information security, legal compliance, and financial resilience. It explains how banks could assess eight common vendor groups, including core service providers, payment processors, digital banking companies, cybersecurity firms, and financial-crime platforms.
The Office of the Comptroller of the Currency has announced comprehensive measures to empower community banks and reduce regulatory burden, complementing the broader third-party risk management framework. As reported by the OCC, the agency is creating a distinct line of supervision focused on community banks and removing examination activities previously required by OCC policy. The OCC is increasing the upper asset range of the community bank supervision portfolio to give banks room to grow organically or through acquisition without facing increased supervision scrutiny. The agency is also updating model risk management guidance to clarify that model risk management should be risk-based, tailored, and commensurate with a bank's size, complexity, and extent of model use, excluding community banks from unnecessary requirements. Additionally, the OCC is simplifying licensing requirements and expanding community banks' access to expedited or reduced filing procedures, while establishing Community Bank Minimum Bank Secrecy Act and Anti-Money Laundering examination procedures tailored to community banks' generally low money laundering risk levels.
Federal Reserve Governor Michael Barr opposed both proposals, arguing that their wording could weaken oversight rather than help institutions manage vendor risks. As reported by Federal Reserve, Barr objected to a proposed 'material financial risk' standard for supervisory action, stating the threshold could make banks less likely to correct problems before they become material to the institution. He also questioned language saying regulators would give due consideration to a bank's reasonable decisions, expressing concern that institutions could interpret this as requiring supervisors to defer to bank judgment instead of making independent assessments. The move highlights that supervisors are sharpening their focus on third-party relationships as outsourcing grows, while still seeking feedback before locking anything in. Barr was the lone dissent to the proposal from the Fed Board of Governors, which voted 6-1 to issue the proposed guidance. Fed Gov. Lisa Cook issued a statement supporting the proposals as a needed step to facilitate responsible innovation within the community banking sector.
