US agencies propose to replace interagency third-party risk guidance with a risk-tailored approach

Four US banking agencies have jointly proposed guidance that would revise and replace their existing third-party risk management expectations. The pitch is calibration: align oversight to the risk of each relationship rather than treating every vendor as high-risk. This segment covers what the proposal changes, who it would bind, the comment window, and why the non-enforceable framing matters for examiners and banks alike.

• Proposed interagency guidance would revise and replace existing third-party risk management guidance across the OCC, Federal Reserve, FDIC and NCUA.
• The guidance would not set enforceable standards or prescriptive requirements, and non-compliance would not result in supervisory action.
• Comments are due 60 days from publication in the Federal Register; the guidance would apply to community banks when final.

Executive summary

The Office of the Comptroller of the Currency, acting in coordination with the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation and the National Credit Union Administration, has issued proposed guidance that would revise and…

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.