OCC and FFIEC Third-Party Risk Guidance for Banks

On September 11, 2026, the Federal Reserve Board, the FDIC, the OCC, and the NCUA issued proposed interagency guidance that would fully replace the 2023 interagency third-party risk management guidance. Comments are due November 16, 2026. The agencies describe their intent in plain terms: to move away from overly broad, process-driven approaches, to make clear that there is no one-size-fits-all approach to third-party risk management, and to encourage responsible innovation. That framing matters because it signals something stronger than a periodic refresh. When the proposal is finalized, the agencies plan to rescind the 2023 guidance entirely, along with certain supplemental third-party risk management resources tied to it, and they will not amend it section by section. A full rescission and replacement is a different kind of regulatory act than an update, signaling to banks that the agencies view the current approach as flawed at its foundation. The proposal also names its policy driver directly: it references the May 2026 Executive Order, "Integrating Financial Technology Innovation Into Regulatory Frameworks," which directs the federal government to reduce regulatory and supervisory barriers to entry for fintechs. That reference ties this guidance to a broader deregulatory posture in the current administration's financial policy, so compliance teams should read the September proposal as one piece of a coordinated effort to lower the cost of fintech-bank partnerships, not as an isolated correction.

What the agencies said was broken about the 2023 guidance

The agencies' diagnosis of the 2023 guidance is specific and unflattering: it produced the opposite of what risk-based oversight is supposed to achieve. The guidance was meant to help institutions prioritize the relationships that actually posed material risk, but many institutions instead treated it as a checklist to complete, so completion itself stood in for risk management. The agencies stated that the 2023 guidance had been frequently interpreted in an overly broad manner and with an insufficient focus on tailoring its risk management principles to individual circumstances.

Four failure modes drove that conclusion. The guidance also implied that the goal was to eliminate risk altogether, but no third-party program can actually deliver that, so some institutions avoided fintech partnerships entirely because newer vendors read as elevated-risk under a literal application of the standard.

The practical result was a misallocation of effort across the board: banks applied the same paperwork-heavy scrutiny to low-risk vendors and to relationships carrying real financial or legal exposure, with no meaningful differentiation between the two. The proposed guidance is built specifically to correct that chilling effect.

Four components replacing the lifecycle model

The proposed guidance replaces the 2023 guidance's detailed lifecycle model, the familiar planning, due diligence, contract negotiation, ongoing monitoring, and termination sequence that practitioners have worked within for years, with four broader components that banking organizations may consider. The shift from a mandated sequence to a set of components a bank "may consider" is itself a deliberate signal: the agencies are moving the guidance from prescription toward principles. OCC Bulletin 2026-46 lists the four components as identifying and assessing applicable risks, overseeing risks proportionate to their significance, making informed decisions about residual risks and risk acceptance, and establishing appropriate governance practices.

Risk identification and assessment sits at the center of this structure. The agencies elevated it so that banks and examiners can concentrate on material financial risks and actual violations of law, rather than on whether a program documented every procedural step correctly. That shift changes how heightened scrutiny gets triggered. The 2023 guidance's "critical activities" framework, which flagged relationships based on the type of activity a vendor performed, is eliminated. In its place, the proposed guidance defines a "higher-risk" relationship as one whose disruption could cause a non-trivial violation of law or regulation, or material harm to the banking organization's financial condition, where there is a material likelihood that such disruption could actually occur. The trigger has moved from what a vendor does to what would happen if the relationship failed.

Two further changes narrow the compliance burden directly. The prescriptive contract negotiation provisions in the 2023 guidance, including the list of generally applicable expected contract terms, are removed, and the proposed guidance does not replace them with a new standard list. And the inventory requirement used to expect banks to keep a comprehensive catalogue of all third-party relationships, but the proposed framework narrows it. Taken together, these four components describe a program that concentrates effort where harm is plausible, so it does not document every relationship to the same standard.

What "non-binding" means when read alongside the new unsafe-or-unsound rule

The proposed guidance states that it is non-binding: a banking organization that fails to comply will not face supervisory action on that basis alone. Read in isolation, that statement might suggest banks can treat the guidance as optional. That reading misses how the guidance interacts with a second, separate instrument moving through the same agencies at the same time.

The OCC and the FDIC have finalized a new rule defining unsafe-or-unsound practice, effective November 2, 2026, that confines formal findings to violations of law and to practices that could reasonably be expected to cause material financial harm. So that rule narrows the enforcement basis examiners can use when they bring a formal finding against a bank. Placing the two documents side by side clarifies the shape of the new supervisory environment: examiners lose much of the room they once had to ground findings in process non-compliance, the kind of gap a checklist-style review would have caught under the 2023 guidance, while they retain full authority to act where a bank's third-party practices produce actual material harm or a genuine legal violation. The guidance does not bind banks to follow its four components, but it does define the lens examiners will use when they decide whether a bank's third-party practices created the kind of harm the unsafe-or-unsound rule reaches.

The proposed guidance also introduces a form of examiner deference absent from the 2023 framework: examiners will give due consideration to a bank's "reasonable judgment" in its risk assessments. That deference depends on conditions the bank must meet. It depends on a bank being able to demonstrate and document the reasoning behind its risk assessments, not simply assert that a judgment call was reasonable after the fact. Component three of the new framework, informed decisions about residual risks and risk acceptance, raises the bar accordingly: the documentation supporting a decision to accept a given risk needs to be stronger under the proposed guidance, not weaker. Fintechs and BaaS partners should not read any of this as a softening of the scrutiny they will face from bank partners. A bank's accountability for the conduct and risk of its third-party relationships remains fully intact regardless of how the guidance governing that accountability is structured.

The Community Bank Companion Guidance and Core Provider Joint Statement

The September 11 release was not a single document. It was a package of three: the proposed all-bank guidance described above, a proposed companion guide written specifically for community banking organizations, and a Joint Statement on Community Banks' Engagement with Core Service Providers. Each serves a distinct audience and a distinct purpose.

The Joint Statement on Community Banks' Engagement with Core Service Providers, issued jointly by the FDIC, OCC, and FRB, addresses a relationship dynamic the main guidance does not cover in the same depth: the dependency community banks have on the handful of core technology providers that run their payment processing, loan origination, and deposit management systems. For a community bank, the core provider relationship is often the least substitutable and most concentrated dependency in its entire vendor portfolio: a single provider's systems frequently sit underneath several critical functions at once. If you are a community bank evaluating this package, start with the companion guide and the joint statement, because those two documents speak directly to the risk concentration you actually carry.

How a risk-tailored approach changes day-to-day program operations

The move from the activity-based "critical activities" test to a magnitude-and-likelihood harm model changes what a risk team must now determine. The question a risk team must answer is no longer whether a vendor touches a critical activity, but what the realistic probability and severity of harm would be if that relationship failed.

That reframing reshapes how a vendor population gets segmented. Most financial institutions classify only a fraction of their vendor portfolio as critical or high-risk in the first place, and the harm-based model is likely to concentrate oversight further onto a smaller set of relationships identified with more precision than the activity-based test allowed.

A real-world incident at a single disrupted vendor illustrates exactly the gap this reframing is meant to close. Paperwork confirming that a relationship had been reviewed did not mean the actual risk of that relationship had been understood or managed. That is the exact failure mode the proposed guidance is built to correct: a bank can satisfy every procedural requirement in a checklist and still miss the relationship that matters most.

The removal of generally applicable expected contract terms pushes contract strategy in the same direction. Contracts now need to be negotiated against the specific risk profile of each relationship, not built to satisfy a standard list of provisions that applied uniformly across the portfolio. And the deference examiners will give to "reasonable judgment" raises, rather than lowers, the bar for the underlying risk assessment work, since a bank now has to be able to document and defend the logic behind every risk acceptance decision an examiner might question. Point-in-time assessments and annual questionnaires become harder to defend under this model, because a vendor's financial health, security posture, and subcontractor exposure all shift over the life of a relationship, and a program that only checks in periodically will miss the shifts that matter most.

Non-human identities as the third-party risk surface that current programs are not built to see

The harm-based risk model in the proposed guidance applies fully to AI agents, SaaS integrations, and OAuth-connected tools, just as it applies to a traditional vendor contract. Most bank third-party risk programs do not yet inventory or assess non-human identities as part of their third-party risk surface. A large and growing category of exposure sits outside the scope of what these programs currently measure.

The 2025 Salesloft-Drift incident shows how far that exposure can spread. Attackers who compromised OAuth tokens connecting Drift, Salesloft's chatbot product, to customer Salesforce environments found those tokens granted access across more than 700 downstream organizations. None of those 700 organizations had a direct vendor relationship with the attacker. Their exposure ran through a connection most of their third-party risk programs never inventoried in the first place: an OAuth token linking two other companies' systems together.

Governing first-party credentials does not close this gap, because the exposure originates in a third-party connection, not in the bank's own identity systems. A 2026 SANS Institute survey found that a large majority of organizations report growth in non-human identities tied to agentic AI, a Cloud Security Alliance survey found that most organizations cannot reliably tell an AI agent's activity apart from a person's, and the harm-based model the proposed guidance establishes gives examiners a basis to treat this exposure as material risk.

What banks need to do before the comment deadline and after finalization

November 16, 2026 is the deadline for comments, and it carries more weight than a routine procedural cutoff. It is the window in which banks and their third-party vendors can still influence which elements of the proposed guidance survive into the final version, and the institutions with the most relevant input are the ones that lived through the specific failure modes the 2023 guidance produced: the checklist compliance, the activity-based triggers, the chilling effect on fintech partnerships. Comment submissions grounded in that direct experience carry more weight with the agencies than generic support or opposition.

Ahead of finalization, banks should run a gap assessment against the proposed framework's four components, not to rebuild a program preemptively before the guidance is even final, but to understand where the current program would already satisfy a harm-based model and where it would not. That assessment should identify which relationships currently classified as "critical" under the old activity-based framework would fall below the proposed harm threshold, since those are the relationships where oversight resources could be redirected. It should also surface relationships currently treated as routine that a magnitude-and-likelihood analysis would flag as higher-risk, because those are the blind spots a harm-based review is designed to catch. And it should test whether existing risk acceptance documentation is strong enough to hold up against the "reasonable judgment" deference standard, since that deference only protects a bank that can show its work.

Contract strategy needs revisiting alongside that assessment. With generally applicable expected contract terms eliminated, you should derive contract language from each relationship's actual risk profile rather than a standard template, and you should treat contracts as living risk controls that get reviewed against real performance data over the life of the relationship, not as static documents filed away after signing. Continuous monitoring infrastructure becomes a genuine differentiator under this framework, because the program that can show ongoing, evidence-based awareness of vendor risk, rather than a record of completed annual questionnaires, is the one positioned to defend its residual risk decisions when an examiner applies the new deference standard. Non-human identity governance belongs inside the third-party risk program now, while the guidance is still a proposal and before a breach forces the issue, because the harm-based model already gives examiners grounds to cite material risk from NHI exposure even in the absence of a rule that names it explicitly.