U.S. agencies propose tailored guidance on banks’ outside providers

The Federal Reserve, FDIC, NCUA and OCC have proposed nonbinding principles for third-party risk management, intended to replace existing guidance when finalised.

The September 11, 2026 proposal would tailor risk management to each relationship, taking account of what a provider does and the exposures associated with its work.

The principles remain proposed nonbinding guidance.

The agencies also issued a statement on community banks’ core service providers, addressing factors considered in supervision and enforcement. The Federal Reserve supplied a companion guide for community banks.

The statement addresses supervision and enforcement for core providers, alongside the broader relationship-level principles.

Comments on the principles are due 60 days after Federal Register publication.

Institutions retain responsibility for managing the risks of outsourced activities.

The final form of the replacement guidance remains subject to the consultation process.