Four federal financial regulators on Friday requested public comment on proposed guidance intended to help banks and credit unions manage risks arising from their relationships with outside vendors and service providers.
The Federal Deposit Insurance Corporation, the Federal Reserve Board, the National Credit Union Administration and the Office of the Comptroller of the Currency issued the proposal jointly. Comments are due 60 days after the proposal is published in the Federal Register.
The agencies said the proposed guidance “reflects the agencies’ supervisory experience and lessons learned from examining financial institutions’ third-party risk management practices,” and that it is intended to help banks and credit unions “better align and tailor their third-party risk management practices to the risks of individual third-party relationships.”
Non-binding and principles-based
According to the release, the proposed guidance “focuses on a principles-based approach and, as with all supervisory guidance, is non-binding.” Supervisory guidance does not carry the force of a regulation; it describes agency expectations rather than imposing legally enforceable requirements.
The agencies said that when the guidance is finalized, the federal bank regulatory agencies plan to rescind their existing third-party risk management guidance and replace it with the final version. The stated purpose of that step, according to the release, is “to promote consistency and prudent innovation in the banking industry.”
Separate statement on core service providers
Separately, the federal bank regulatory agencies issued a statement on community banks’ engagement with core service providers — the vendors that supply the underlying processing systems many smaller institutions rely on for deposit, loan and transaction records.
The statement discusses certain factors the agencies will consider in making supervisory and enforcement decisions related to those providers, according to the release. The release did not describe those factors.
Companion guide for community banks
Also on Friday, the Federal Reserve Board separately requested comment on a proposed third-party risk management guide aimed specifically at community banks it supervises. The release described the document as a companion to the joint proposal.
The Board published the two Federal Register notices, the joint statement on core service providers, a Board memo, and separate statements by Governor Michael Barr and Governor Lisa Cook. The release did not summarize the content of either governor’s statement.
The release was issued for 10:00 a.m. EDT on September 11, 2026.
Source: Federal Reserve Board, Federal Deposit Insurance Corporation, National Credit Union Administration and Office of the Comptroller of the Currency, “Agencies seek comment on proposed third-party risk management guidance and issue statement on community bank engagement with core service providers” (joint press release), released September 11, 2026. The agencies state that the proposed guidance is principles-based and, as with all supervisory guidance, non-binding.