Federal financial regulators announced a joint proposal on September 11, 2026, to replace existing third-party risk management guidance with a flexible framework that eases requirements for bank-fintech partnerships. The Federal Reserve Board, the Federal Deposit Insurance Corporation, the Office of the Comptroller of the Currency, and the National Credit Union Administration stated the updated approach moves away from process-driven checklists and gives banks greater deference in evaluating vendor risks.
Federal Agencies Propose Rescinding 2023 Guidance
The proposed interagency guidance would formally rescind the rules established in June 2023. The earlier framework was frequently interpreted in an overly broad manner, creating de facto checklists that pushed banking organizations toward process-driven approaches rather than tailored, risk-based judgments. The new proposal aims to correct that trajectory by focusing supervisory attention on material financial risks and potential violations of laws and regulations. The Agencies describe the updated guidance as an attempt to course-correct.
The agencies identified several deficiencies in the 2023 rules, noting that the use of the word “should” failed to emphasize the need to tailor practices to specific risk profiles. The previous focus on "critical activities" was deemed to lack a nuanced basis for assessing risk because it ignored the magnitude and likelihood of potential harm. The 2023 Guidance was also seen as implying “an impossible goal of risk elimination, rather than risk management.”
Comments on the proposed guidance remain open to the public through November 16, 2026. While the framework is non-binding and does not carry the force of law, it signals a distinct shift in regulatory posture across all four participating agencies.
Removing Barriers to Financial Technology Partnerships
The updated guidance acknowledges that the 2023 Guidance “has been read to discourage engagement with newer and innovative parties.”
The proposal recognizes that banks may find offsetting factors for fintech partners that lack long operational histories, cannot permit onsite visits, or cannot share certain requested information.
Replacing the life-cycle framework with four streamlined components
The proposal replaces the detailed life-cycle components and critical activities framework of the 2023 rules with four streamlined risk management components: identifying and assessing applicable risks, overseeing risks proportionate to their significance, making informed decisions about residual risks and risk acceptance, and establishing appropriate governance practices. The concept of "critical activities" is eliminated in favor of evaluating the magnitude and likelihood of potential harm.
In practice, some relationships previously labeled as critical may now be defined as “higher risk.”
Banks also gain flexibility regarding third-party inventories. Under the 2023 Guidance, the Agencies expected banking organizations to complete and maintain an inventory of all third-party relationships, but the Proposed Guidance takes a more flexible approach.
Did you know?
The National Credit Union Administration is included in the 2026 proposed guidance, extending these third-party risk management principles to federally insured credit unions alongside traditional commercial banks.
Supervisory Scrutiny and Community Bank Guidance
Alongside the interagency proposal, the Federal Reserve released a companion guide tailored specifically to traditional community banking organizations, and several agencies issued a joint statement highlighting ongoing concerns regarding core service providers. The joint statement from the OCC, FDIC, and Federal Reserve highlights concerns about the adverse impacts core providers may have on community banks due to a highly concentrated market.
At the same time, the agencies noted that banking organizations cannot completely eliminate risk and that deviation or inconsistency from the Proposed Guidance alone should not serve as the basis for supervisory action, provided their risk management decisions reflect reasonable judgment.
Frequently Asked Questions
What is the deadline for submitting public comments on the proposed guidance?
Public comments on the proposed interagency guidance and the companion community bank guide must be submitted by November 16, 2026.
Do credit unions fall under the scope of the new regulatory proposal?
Yes. The National Credit Union Administration joined the Federal Reserve, FDIC, and OCC in issuing the 2026 guidance, meaning it applies to credit unions as well as banks.
What happens to the existing third-party risk management framework if the proposal is finalized?
The Agencies plan to formally rescind the 2023 interagency guidance on third-party relationships and replace it entirely once the proposed guidance is finalized.
Related reading