Proposed Third-Party Risk Management Guidance
The OCC, Board, FDIC, and NCUA (collectively, the agencies) invite comments on this proposed third-party risk management guidance. The proposed guidance would reflect the agencies' supervisory experience and lessons learned through examining banking organizations' third-party risk management practices. In particular, the proposed guidance would discuss the potential benefits that may accrue when a banking organization aligns its third-party risk management practices in relation to the reasonably assessed risk levels specific to each of its third-party relationships. This approach may assist banking organizations in the prioritization of third-party risk management based on material financial risks, compliance with laws and regulations, and resource allocation. The proposed guidance also would help banking organizations consider potential strategies for tailoring their third-party risk management practices according to the banking organization's size, complexity, and risk profile, as well as the nature of its third-party relationships. The agencies plan to rescind and replace existing guidance on third-party risk management to promote consistency and innovation in the banking industry.
What this item does
The short version, using the agency's own summary text.
The OCC, Board, FDIC, and NCUA (collectively, the agencies) invite comments on this proposed third-party risk management guidance. The proposed guidance would reflect the agencies' supervisory experience and lessons learned through examining banking organizations' third-party risk management practices. In particular, the proposed guidance would discuss the potential benefits that may accrue when a banking organization aligns its third-party risk management practices in relation to the reasonably assessed risk levels specific to each of its third-party relationships. This approach may assist banking organizations in the prioritization of third-party risk management based on material financial risks, compliance with laws and regulations, and resource allocation. The proposed guidance also would help banking organizations consider potential strategies for tailoring their third-party risk management practices according to the banking organization's size, complexity, and risk profile, as well as the nature of its third-party relationships. The agencies plan to rescind and replace existing guidance on third-party risk management to promote consistency and innovation in the banking industry.
Proposed interagency guidance and request for comment.
Important dates
The dates that matter most for this item.
Published
September 15, 2026