The Federal Deposit Insurance Corporation, the Federal Reserve Board, the National Credit Union Administration, and the Office of the Comptroller of the Currency have requested public comment on proposed guidance for managing risks associated with third-party relationships. This principles-based, non-binding framework aims to help banks and credit unions tailor their practices to specific relationship risks, reflecting supervisory experience and lessons learned from examinations. Upon finalization, the agencies plan to rescind existing guidance to promote consistency and prudent innovation in the banking industry.
Concurrently, the agencies issued a joint statement addressing how they will consider factors related to community banks' engagement with core service providers in supervisory and enforcement decisions. The Federal Reserve Board also separately requested comment on a companion guide specifically for Federal Reserve-supervised community banks. Comments on the main proposed guidance are due 60 days after its publication in the Federal Register.
This regulatory update signals a shift toward more flexible, risk-aligned supervision for financial institutions relying on external vendors. By replacing older directives with a principles-based approach, the agencies aim to reduce compliance friction while maintaining oversight standards. The simultaneous focus on core service providers highlights growing regulatory attention to the operational dependencies that underpin traditional banking infrastructure.
For market participants, the distinction between general guidance and the specific companion document for community banks suggests a tiered supervisory strategy. Institutions should monitor the comment period closely, as feedback may shape the final rules governing vendor risk assessments. The emphasis on "prudent innovation" indicates regulators are seeking to balance security requirements with the adoption of new technologies and services.
