U.S. agencies propose tailored guidance on banks’ outside providers

Reported Sep 11, 2026Quickanomics write-up updated Oct 12, 2026, version 61 min read

Follow the developing story

Correction

Replaced a recently reused photograph with a different reviewed, licensed image and checked reference links. Reporting text and original source dates are unchanged.

A risk-based approach

The Federal Reserve, FDIC, NCUA and OCC have proposed principles for , intended to replace existing guidance when finalised.

The September 11, 2026 proposal would tailor risk management to each relationship, taking account of what a provider does and the exposures associated with its work.

The principles remain proposed guidance.

Separate support

The agencies also issued a statement on ’ core service providers, addressing factors considered in supervision and enforcement. The Federal Reserve supplied a companion guide for .

The statement addresses supervision and enforcement for core providers, alongside the broader relationship-level principles.

Consultation and responsibility

Comments on the principles are due 60 days after Federal Register publication.

Institutions retain responsibility for managing the risks of outsourced activities.

The final form of the replacement guidance remains subject to the consultation process.

What the sources support

Reports from the same original source are not independent confirmation.

Claims and evidence

Passages come from the stored source packet. Original factual notes are not quotations from the publisher’s report.

The Federal Reserve, FDIC, NCUA and OCC proposed principles on September 11, 2026, tailored to the risk of the relationship and intended to replace existing guidance when finalised.

The Federal Reserve, FDIC, NCUA and OCC proposed nonbinding third-party risk-management principles on September 11, 2026, tailored to the risk of the relationship and intended to replace existing guidance when finalised.

Federal Reserve Board: Agencies seek comment on proposed third-party risk management guidance and issue statement on community bank engagement with core service providers

The agencies also issued a separate statement about ’ core service providers and the factors considered in supervision and enforcement. The Federal Reserve supplied a companion guide.

The agencies also issued a separate statement about community banks’ core service providers and the factors considered in supervision and enforcement. The Federal Reserve supplied a companion community-bank guide.

Federal Reserve Board: Agencies seek comment on proposed third-party risk management guidance and issue statement on community bank engagement with core service providers

Comments on the proposed principles are due 60 days after Federal Register publication. The proposal is guidance rather than a new mandatory rule, and does not remove institutions’ responsibility to manage .

Comments on the proposed principles are due 60 days after Federal Register publication. The proposal is guidance rather than a new mandatory rule, and does not remove institutions’ responsibility to manage third-party risk.

Federal Reserve Board: Agencies seek comment on proposed third-party risk management guidance and issue statement on community bank engagement with core service providers

Still unknown

The final form of the guidance remains unsettled.

U.S. agencies propose tailored guidance on banks’ outside providers

The short version

A risk-based approach

Separate support

Consultation and responsibility

Original sources

The short version

A risk-based approach

Separate community-bank support

Consultation and responsibility

Original sources

Separate support