On September 11, the OCC, Federal Reserve, FDIC, and NCUA proposed new interagency guidance on third-party risk management. If it’s finalized, it replaces the June 2023 interagency guidance that most of us spent the last three years mapping our programs to.
The early read in a lot of circles is “relief.” Fewer “shoulds.” No more “critical activities.” Explicit language that examiners won’t cite you just for departing from the guidance.
Some of that relief is real. But if you run or oversee a sponsor bank program, read it again. The proposal moves the weight from following a framework to defending your own judgment. That’s a harder standard to meet with a thin file.
What actually changed
The proposal, published at 91 FR 58536 on September 15, does three things worth your attention.
It drops “critical activities” as the organizing idea. The agencies say the 2023 guidance was “focused more on the activity conducted by the third party rather than either the third-party relationship or the magnitude or likelihood of harm.” In its place is a two-part test. A relationship is higher risk if a disruption or breach could cause a non-trivial violation of law, material financial harm, or a significant disruption to the bank’s operations or customers, and there’s a material likelihood of that happening under current or reasonably foreseeable conditions.
It boils the framework down to four components. Identify and assess the risks. Oversee them in proportion to their significance. Make informed decisions about residual risk. Set up governance that fits. The agencies say plainly: “There is no one-size-fits-all approach to effective risk management.”
It would rescind the supplemental resources. That includes the July 25, 2024 Joint Statement on Banks’ Arrangements with Third Parties to Deliver Bank Deposit Products and Services and the May 2024 community bank guide. The preamble ties this to Executive Order 14405 and says the 2023 language “may unduly impede fintechs from entering partnerships with banking organizations.”
Comments are due November 16, 2026.
What didn’t change
One sentence carries over, and it’s the one that matters most for BaaS: “A banking organization’s use of third parties does not diminish its responsibility to meet these requirements to the same extent as if the activities were performed by the banking organization internally.”
Read the two-part test with a deposit program or card program in mind. If your fintech partner’s ledger breaks, can you tell which end user owns which dollars? If its complaint handling falls apart, are you missing Regulation E error resolution deadlines? If its onboarding slips, are you onboarding customers you haven’t actually verified?
Each of those is a non-trivial violation of law or a significant disruption to customers. And for most sponsor banks, the likelihood isn’t theoretical. It’s why enforcement actions like the Federal Reserve’s June 2024 order against Evolve Bank & Trust called out fintech partner risk management, BSA/AML, and consumer compliance in the same breath.
So retiring the Joint Statement doesn’t retire the problems behind it: end-user ledgers that don’t tie out, slow reconciliation, and banks that can’t get to customer-level records when they need them. Those concerns now sit inside the higher-risk definition instead of in a separate document. You still have to manage them. You just won’t have a supplemental statement to point to when you explain why.
Why “less prescriptive” cuts both ways
The 2023 guidance gave you a long list of considerations. Some banks treated it as a checklist, which the agencies now call a misreading. But a checklist had one advantage: when an examiner asked why you did something, “the guidance lists it” was a reasonable answer.
Under a principles-based approach, the answer is your own analysis. Why is this partner higher risk and that one isn’t? Why did you accept the residual risk on a program with known control gaps? Why is annual monitoring enough for one relationship and monthly reporting required for another?
The proposal gives you room. It says lower-risk relationships can rely on “less-detailed due diligence information or on public or alternative sources.” It says standard-form contracts can be fine for lower-risk relationships, and that “there are no generally applicable expected contract terms,” even for higher-risk ones. That flexibility is useful, especially for community banks with lean teams.
But flexibility only holds up in an exam if the reasoning is written down. Judgment you can’t show is just an opinion.
What I’d do now
1. Re-tier your third-party inventory against the two-part test. Don’t wait for the final guidance. Take your current list and ask both questions for each relationship: what’s the realistic harm if this goes sideways, and how likely is it today? You’ll probably find some vendors you over-tiered under “critical activities” and at least one fintech program you under-tiered because the activity looked routine.
2. Write down your residual-risk decisions. The third component, making informed decisions about residual risk, is new as a stand-alone expectation. The agencies say they “do not expect banking organizations to eliminate third-party risk.” Fine. But when you accept it, document who accepted it, what you knew, and what would make you revisit it. For sponsor banks, this is where board and committee minutes start carrying real weight.
3. Keep your deposit-program controls, and map them to the new language. If you built daily reconciliation, end-user ledger access, and a records protocol after the Joint Statement, don’t let any of it lapse because the statement is going away. Re-label it in your program documents as controls over a higher-risk relationship under the new test. Same work, new anchor.
If you have a view on how the higher-risk test should work for bank-fintech programs, the agencies asked whether a list of “characteristics that generally indicate that a third-party relationship is high risk” would help. That’s a question sponsor banks and fintechs are well placed to answer before November 16.
The bottom line
This proposal gives banks more room to tailor TPRM. For community banks managing a core provider and a handful of vendors, that’s welcome. For sponsor banks, the room comes with a trade: fewer prescribed steps and more scrutiny of whether your judgment holds up.
The banks that do well under this guidance will be the ones that can show their work. That was always the job. Now there’s less cover if you skip it.
I’ve worked on both sides of these programs, at banks and with the fintechs that partner with them. The re-tiering exercise is usually where the real conversation starts, because it forces the bank and the partner to agree on what could actually go wrong. If you start that work before the guidance is final, you’ll be ready either way.
Sources
- Federal Reserve press release: Agencies seek comment on proposed third-party risk management guidance (Sept. 11, 2026)
- Proposed Third-Party Risk Management Guidance, 91 FR 58536 (Sept. 15, 2026)
- Interagency Guidance on Third-Party Relationships: Risk Management, 88 FR 37920 (June 9, 2023)
- SR 24-5, FDIC FIL-45-2024, OCC Bulletin 2024-20: Joint Statement on Banks’ Arrangements with Third Parties to Deliver Bank Deposit Products and Services (July 25, 2024)
- Federal Reserve: Enforcement action against Evolve Bancorp, Inc. and Evolve Bank & Trust (June 14, 2024)
