US Regulators Propose Revised Third-Party Risk Management Guidance
Federal banking agencies are seeking comment on a new principles-based approach to third-party risk management for financial institutions, intended to replace the 2023 framework and encourage responsible innovation.
US prudential regulators, including the Federal Reserve, FDIC, and OCC, have proposed revised guidance for how banks and credit unions manage risks associated with third-party relationships. The proposal would replace the 2023 framework with a more flexible, "principles-based" approach, moving away from what regulators saw as an overly prescriptive, "check-the-box" exercise. This change is intended to encourage responsible innovation and partnerships with fintech companies by allowing institutions to tailor their oversight based on the specific risk level of each relationship.
Sophisticated clients care because this signals a significant shift in supervisory expectations. Separately, the agencies issued a statement clarifying that core service providers—those offering critical infrastructure—may be treated as "institution-affiliated parties," potentially exposing them to direct liability for a bank's violations. Counsel should advise financial institution clients and their vendors to review the proposed guidance and consider submitting comments by the November 16 deadline, as the final version will shape future compliance programs, due diligence, and contract negotiations.