US Banking Agencies Propose Flexible Third-Party Risk Guidance
Federal banking regulators have proposed new guidance that would replace a more prescriptive 2023 framework, giving banks greater flexibility to manage third-party relationships and encouraging partnerships with fintechs.
U.S. federal banking agencies have jointly proposed new guidance intended to give banking organizations more flexibility in managing third-party risk. The proposal, which would replace a more prescriptive 2023 framework, moves away from detailed checklists toward broader, principles-based standards for due diligence, contract negotiation, and ongoing monitoring. Sophisticated counsel should note the agencies' explicit goal of encouraging responsible innovation and removing potential impediments to bank-fintech partnerships. The proposed guidance acknowledges the disparities in bargaining power between banks and their vendors and removes the formal concept of "critical activities," leaving it to institutions to assess risk. This signals a significant shift in supervisory posture, which may make it more difficult for examiners to issue adverse findings based on rigid interpretations. While many banks may wait for a final rule to overhaul their TPRM programs, the proposal suggests a more accommodating regulatory environment for new vendor relationships. Comments are due by November 16, 2026.