Four US banking agencies propose updated third-party risk management guidance

On September 11, 2026, the Federal Reserve Board, the FDIC, the OCC and the NCUA issued proposed updated third-party risk management guidance, according to a Morrison & Foerster client alert. The joint proposal revisits the interagency TPRM framework that banks, savings associations and credit unions have applied since 2023, replacing or amending a document that reshaped vendor oversight after the 2023 bank failures and enforcement actions over fintech and bank-facility service providers.

Why counsel should care: TPRM expectations typically become the yardstick for examination findings and federal banking enforcement, and they flow down contractually. Institutions will need to reassess vendor inventory, due diligence, contracting standards, ongoing monitoring and exit planning; large service providers, including core processing, payments and compliance-automation vendors, face corresponding pressure to evidence their control environments to clients. The proposal is not final, so nothing is binding yet, but comment letters and any final text will shape remediation timelines.

What to watch: the comment deadline and any request for information, which the available summary does not confirm; comment letters on scoping, tailoring for smaller banks and nonbank third parties; and integration with rules on bank-facility arrangements.

Caveat: the alert reviewed here is truncated to issuance and participating agencies, so specific substantive changes and dates were not verifiable.