Federal Financial Agencies Shift Third Party Risk Management Toward a Tailored Risk Based Approach

On September 11, 2026, the FDIC, Federal Reserve, OCC, and NCUA (together, the “Agencies”) issued proposed third-party risk management guidance¹ (the “TPRM Guidance”) outlining a principles-based approach designed to assist banks and credit unions (together, “institutions”) in tailoring their third-party risk management practices to the risks of individual relationships. The TPRM Guidance reflects the Agencies’ supervisory experiences and lessons learned through examinations of institutions’ practices in this area. Once finalized, the TPRM Guidance will replace existing guidance² published by the three federal banking agencies (the “FBAs”) in 2023. The Agencies acknowledged that institutions have frequently misinterpreted the 2023 guidance as establishing prescriptive requirements, and that they have struggled to tailor the listed examples to their own situations and circumstances.

The Agencies believe the new guidance will assist institutions in prioritizing third-party risk management based on material financial risks and resource allocation, promote consistency across the industry, and engender innovation, each of which have been key objectives of the Agencies’ current leadership. Consistent with the preferred approach articulated in rulemakings, guidance, and internal procedures published by the Agencies during this Administration, the TPRM Guidance is intended to shift institutions’ focus away from check-the-box exercises in the area of third-party risk management.

The TPRM Guidance continues to reiterate the Agencies’ longstanding position that institutions have the ultimate responsibility to establish and maintain sound risk management practices and to comply with applicable laws and regulations. Institutions’ use of third parties — whether they are affiliates, other “highly-regulated entities,” or subcontractors — to meet these requirements does not override this responsibility. As with other issuances that fall under the umbrella of guidance, non-compliance with the TPRM Guidance will not result in supervisory action against a covered institution. However, institutions should understand that third-party risk management failures can lead to violations of law or regulation or to unsafe or unsound practices that warrant further action from their regulators.

Also on September 11, the FDIC, Federal Reserve, and OCC issued a Joint Statement on Community Banks’ Engagement with Core Service Providers³ (the “Joint Statement”) to clarify how the FBAs will address as part of their supervision programs the dynamics of the often-imbalanced relationship between community banks and their core providers. Finally, the Federal Reserve separately issued on September 11 a proposed Third-Party Risk Management Guide for Traditional Community Banking (the “Fed TPRM Guide”),⁴ intended to serve as a companion document to the TPRM Guidance and to provide practical examples for small, non-complex state member banks.

The TPRM Guidance

The TPRM Guidance emphasizes the concepts of risk identification and risk assessment as the foundation of a risk-based approach to third-party risk management. Institutions should tailor the level and detail of oversight to correspond to assessed risk levels to best position themselves to effectively manage third-party risk. The TPRM Guidance confirms the Agencies’ view that there is no one-size-fits-all approach to effective third-party risk management — a position they have regularly repeated in recent issuances — and observes that some third-party relationships will not present the same level of risk across different institutions.  

Leaning into an embrace of deference to management, the TPRM Guidance is replete with affirmations that the Agencies will give “due consideration” to institutions’ “reasonable decisions” in matters of third-party risk management supervision. To drive this home, the Agencies note that institutions that deviate from the TPRM Guidance or the examples provided therein will not face supervisory action. Examiners will not be permitted to prompt such actions if institutions fail to follow industry best practices, either. 

The TPRM Guidance lays out four components of managing third-party risk: (i) identifying and assessing applicable risks; (ii) overseeing risks proportionate to their significance; (iii) making informed decisions about residual risks and risk acceptance; and (iv) establishing appropriate governance practices. Within the first component, the TPRM Guidance covers the process of identifying, categorizing, and inventorying third-party relationships.

Within the second component, the Agencies reinforce the importance of institutions’ tailoring third-party oversight to the institution’s size, complexity, and risk profile, as well as the nature and type of each third-party relationship. The TPRM Guidance outlines relevant considerations for each stage of the third-party relationship life cycle, including due diligence, contract negotiation, ongoing monitoring, and termination. Institutions are reminded that they can benefit from considering third-party risk management holistically rather than utilizing a siloed, “stage-by-stage” analysis. The TPRM Guidance explains the Agencies’ views related to third-parties’ reliance on subcontractors, and the emerging trend of institutions leveraging arrangements like consortiums to collaborate on discrete aspects of third-party risk management, such as the creation of standard contracts.

In discussing the third component, the Agencies affirm that institutions are not expected to “eliminate” third-party risk, and acknowledge that the materiality of some risks will not justify the amount of oversight required to mitigate those risks. For some third-party relationships, institutions cannot practically mitigate the risks if, for example, they lack bargaining power to negotiate contract terms. Finally, within the fourth component, the Agencies stress that there is no single “right way” for institutions to structure their governance practices; decisions in this area will be driven by each institution’s size, complexity, risk profile, and third-party relationships. “Due consideration” will be given to an institution’s “reasonable” governance considerations when the Agencies review the practices employed.

The Joint Statement

Coinciding with the publication of the TPRM Guidance, the FBAs issued the Joint Statement to confront the reality that the business practices of core service providers — the “most material, complex, and highest-risk third-party relationships” for community banks — pose obstacles to these banks’ ability to effectively identify, assess, and address the risks posed. Because a “significant percentage” of the core provider market is comprised of only a few large companies, community banks’ negotiating powers are severely curtailed. Relying on stakeholders’ input and collecting intel gained through its supervisory activities, the FBAs concluded that the market dynamics and corresponding impact to community banks’ ability to address risks require additional considerations for conducting risk-based supervision of core providers going forward. These will include: (i) the level of a core provider’s transparency with community banks; (ii) the use by core providers of contract terms that make it difficult for banks to manage these relationships; and (iii) the extent of core providers’ technology investments and capabilities.

After outlining these considerations, the Agencies pivot to outlining how they can bring supervisory and enforcement actions against core providers. They conclude that because of the “operational reality” of the relationship between community banks and core providers, the latter “participate[] in the conduct of the affairs” of the banks, as the services provided are integral to the banks’ functioning and to their ability to provide products and services. Therefore, core providers can be deemed “institution affiliated parties,” or IAPs, exposing them to potential enforcement liability if their community bank customers engage in unsafe or unsound practices or violate the law.

The Fed TPRM Guide

In issuing the Fed TPRM Guide, the Federal Reserve sought to provide further assistance to certain community banks and to articulate how the principles of the TPRM Guidance can be applied in practice and operationalized. The Federal Reserve relied on information from its own supervisory experience, as well as observations of sound risk management practices at banks in its portfolio, which included reviews of risk assessment methodologies, sample contracts, and due diligence files.  

The Fed TPRM Guide is intended to apply to “traditional” state member banks with less than $30 billion in assets that are focused on serving their local communities; it is not intended for those smaller banks with more complex business models or third-party relationship profiles, such as complex bank-fintech partnerships. As with the TPRM Guidance, the Fed TPRM Guide does not set forth enforceable standards. Non-compliance with the Fed TPRM Guide will not result in supervisory criticism against any state member bank.  

The Fed TPRM Guide covers four overarching third-party risk management topics common to traditional community bank third-party relationships: operational resilience; system and information security; compliance with laws and regulations; and financial resilience. The Fed TPRM Guide also provides specific considerations for common third-party relationships for community banks, including providers of, core services, IT infrastructure, cybersecurity, payment processing and digital banking, loan management systems, card issuing and processing, BSA/AML and financial crime platforms, and fraud prevention and detection.

Takeaways

• With these three complementary publications, the Agencies have demonstrated their willingness to continue to refine even recently-issued guidance to eliminate remaining prescriptive requirements, and to emphasize the supervisory principles most important to Agency leadership, such as tailoring. Consistent with the focus on tailoring, the Agencies stress that third-party relationships some institutions assess as higher risk may not fit that label at other institutions.
• Among other rationales for rescinding the recently issued 2023 guidance was industry feedback that broad language used in that earlier document may have impeded development of fintech-bank partnerships. This signals the Agencies’ renewed embrace of these relationships, and likely portends a return to a lighter-touch regime, turning away from the stringent enforcement regime employed during the early Biden years.
• The TPRM Guidance is another concrete example of the Agency leadership’s refrain that risk management is not about risk elimination.⁵ This mindset carries over to third-party risk management, as reflected in the Agencies’ statement that it is unlikely institutions can identify all possible risks, and they are not expected to do so. The Agencies acknowledge the “rapidly evolving marketplace” for third-party services and recognize that some relationships may still be beneficial and even necessary for institutions to operate competitively, even if the institutions cannot significantly mitigate the risks posed by those relationships.
• As the Agencies have underscored in other recent rules, examiners are to give more deference to management’s judgment. In the TPRM Guidance, examiners are directed to “give due consideration” to management, including regarding assessments of risk for individual third-party relationships.  
• Despite the more industry-friendly positioning, however, institutions must still be mindful of a number of well-worn guardrails. The Agencies continue to stress the importance of continued monitoring and recalibration of third-party risk assessments when warranted. Adjustments may be prompted by due diligence, contract negotiations, or changing circumstances — including an institution’s own experience with a given third-party.
• By issuing the Joint Statement, the FBAs clearly indicated they have heard community banks’ complaints regarding their relationships with their core providers. The relative imbalance has constricted community banks’ ability to modify contractual terms and to terminate existing agreements without significant financial penalties. The FBAs have put the core providers on notice that they are willing to flex their enforcement muscles if those relationships lead to banks engaging in unsafe or unsound practices or violations of law, to the same extent as if those core providers are parts of the banks themselves. Even a single use of this authority by the FBAs could meaningfully impact the dynamics of this market.

Please contact the authors of this Advisory or your regular Arnold & Porter contact if you have questions or would like to discuss how these issuances may impact your institution.

© Arnold & Porter Kaye Scholer LLP 2026 All Rights Reserved. This Advisory is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.