Loading the context…
Loading the context…
Reported Sep 11, 2026Quickanomics write-up updated Oct 11, 2026, version 42 min read
Follow the developing storyExpanded original Quickanomics reporting with the source’s material findings, comparisons and qualifications at all three reading depths.
The proposed principles emphasise the risk of each relationship, with separate guidance addressing community-bank core providers.
The Federal Reserve, FDIC, NCUA and OCC have proposed nonbinding principles for third-party risk management, intended to replace existing guidance when finalised.
The September 11 proposal emphasises tailoring the approach to the risk of the relationship. Third-party relationships differ in what a provider does for the institution and in the exposures associated with that work. The proposed principles describe a risk-based approach rather than an identical treatment for every outside provider.
The document is proposed guidance. That status matters when assessing its effect: it is neither a new mandatory rule nor a final replacement already operating in place of the existing guidance.
The agencies also issued a statement on community banks’ core service providers, addressing factors considered in supervision and enforcement. The Federal Reserve supplied a companion guide for community banks.
The statement, guide and proposed principles are related but distinct. Combining them into a single newly enacted requirement would obscure both their different functions and the consultation stage of the principles.
The community-bank material provides a more specific setting for institutions dealing with core providers, while the proposed principles address management of third-party relationships according to their risks.
Comments on the proposed principles are due 60 days after publication in the Federal Register. The announcement identifies that publication as the starting point for the period, without itself supplying the resulting calendar date.
The principles’ nonbinding status does not imply that institutions can disregard the risks of outsourced activities. The proposal describes guidance for managing those relationships, while institutions retain responsibility for their third-party risk.
The final form of the replacement guidance remains subject to the consultation process.
Reports from the same original source are not independent confirmation.
The Federal Reserve, FDIC, NCUA and OCC proposed nonbinding third-party risk-management principles on September 11, 2026, tailored to the risk of the relationship and intended to replace existing guidance when finalised.
The Federal Reserve, FDIC, NCUA and OCC proposed nonbinding third-party risk-management principles on September 11, 2026, tailored to the risk of the relationship and intended to replace existing guidance when finalised.Federal Reserve Board: Agencies seek comment on proposed third-party risk management guidance and issue statement on community bank engagement with core service providers
The agencies also issued a separate statement about community banks’ core service providers and the factors considered in supervision and enforcement. The Federal Reserve supplied a companion community-bank guide.
The agencies also issued a separate statement about community banks’ core service providers and the factors considered in supervision and enforcement. The Federal Reserve supplied a companion community-bank guide.Federal Reserve Board: Agencies seek comment on proposed third-party risk management guidance and issue statement on community bank engagement with core service providers
Comments on the proposed principles are due 60 days after Federal Register publication. The proposal is guidance rather than a new mandatory rule, and does not remove institutions’ responsibility to manage third-party risk.
Comments on the proposed principles are due 60 days after Federal Register publication. The proposal is guidance rather than a new mandatory rule, and does not remove institutions’ responsibility to manage third-party risk.Federal Reserve Board: Agencies seek comment on proposed third-party risk management guidance and issue statement on community bank engagement with core service providers
The final form of the guidance remains unsettled.
Answers use this article’s sources. They can explain what is known and what is missing.
Sign in to ask a question