Regulatory Examination Readiness for Third-Party Risk Programs

A program is ready for a regulatory exam when it produces continuous, audit-defensible evidence, not when it can assemble documentation under pressure. The September 2026 proposed interagency guidance makes the stakes explicit by rejecting the checklist model that the 2023 guidance inadvertently created. Programs that document risk judgment in proportion to actual exposure will be defensible. Programs that document activity for its own sake already are not.

Why regulators are shifting from prescriptive checklists to principles-based judgment — and what that demands of your program

The September 2026 proposed guidance from the OCC, Federal Reserve Board, FDIC, and NCUA begins from an unusual admission: the agencies' own prior framework misfired. The 2023 guidance, they now state, "frequently has been interpreted in an overly broad manner and with an insufficient focus on tailoring its risk management principles." The result was that it "unintentionally incentivized overly-process-driven approaches." That is a striking concession from regulators about a framework they issued only three years earlier, and it reframes what examination readiness now means.

The proposal's corrective goal is stated in the same document: to "enable banking organizations and examiners to focus on material financial risks and violations of laws and regulations rather than ineffective and counter-productive check-the-box exercises." Three concrete changes follow from that goal. Risk classification now tracks the likelihood and magnitude of harm, not whether a vendor touches a designated critical activity. Contract terms cease to be a generally applicable expected list, and banks "may decide not to maintain extensive inventories" of lower-risk relationships. Most significantly, residual risk acceptance within a stated risk appetite becomes a valid supervisory outcome, because the agencies "do not expect banking organizations to eliminate third-party risk."

The non-enforceable status of the proposal matters as much as its substance. It "does not set forth enforceable standards or prescriptive requirements," and deviation "will not alone be a basis for supervisory action." Regulators have effectively diagnosed their own framework as the disease vector and are prescribing the remedy themselves.

The reach of this correction has hard boundaries. State regulators, the CFPB, and non-U.S. supervisors are not covered by the proposal. Comments on the proposal are due November 16, 2026.

What examiners actually find when they review a third-party risk program

Examiner findings rarely turn on the absence of monitoring tools. The recurring pattern is a gap between capability and documented action: incomplete vendor inventories, missing due diligence for high-risk vendors, inadequate ongoing monitoring, remediation tracking with unclear ownership, stale documentation, and compliance mapping assembled reactively rather than maintained continuously. The evidence that the tooling produced defensible decisions does not.

The structural cause is fragmentation across functions. Procurement owns contract data, IT owns technical assessments, legal owns data processing agreements, and business units own criticality judgments. When those functions operate in silos, there is no single system of record. You see the cost in longer audit timelines, repeated information requests, and findings that a properly maintained repository would have prevented.

Most programs are not yet tracking two focal areas in the 2026 bank exam emphasis. The first is concentration risk in vendor platforms and the underlying AI models that power them, with the expectation that this concentration has been evaluated and communicated to governing bodies. The second is fourth-party AI concentration: examiners are beginning to ask directly whether institutions know what models sit beneath their critical vendor systems. The question lands as a blind spot for most programs, because conventional vendor assessments were never designed to answer it.

The threat landscape that makes these examiner expectations proportionate, not excessive

The examiner pressure above corresponds to observable failure patterns, not regulatory overreach. The most important structural vulnerability is the disclosure window. Vendors often spot a compromise within days, but public disclosure can take months. If you lean on vendor self-reporting as your primary detection signal, you carry a large blind spot between breach and notification, and the exposure is real but invisible.

Concentration risk compounds that blind spot into systemic fragility. A few shared vendors serve most financial institutions at the same time. The predictive monitoring record makes the case concretely: in the weeks before an August 2025 attack on Marquis Software Solutions, the vendor's Black Kite Ransomware Susceptibility Index score was already flagging materially elevated attack likelihood. Institutions running continuous monitoring had a meaningfully different window to act than those waiting on a breach notification that arrived well after initial intrusion.

Non-human identity sprawl represents the newest unreviewed attack surface, and its mechanism is structurally invisible to existing programs. The exposure lived in the token, not in the vendor relationship itself, which means no conventional assessment would have surfaced it. Most vendor inventories do not yet capture this category of risk at all.

Why a complete, tiered vendor inventory is the non-negotiable foundation of exam readiness

Exam readiness begins with knowing who the vendors are. You cannot produce proportionate, documented risk judgment if you don't start with a complete and current vendor registry. The proposed U.S. guidance and DORA both demand that judgment, and you cannot make it from a partial list of relationships.

A defensible inventory carries substantially more than vendor names. It includes the business owner, service description, and contract dates for each relationship. And it now must document AI use by the vendor: where AI is deployed, what data it touches, and whether that data is used to train models. That AI field is a new requirement for most inventories, and it will be treated in detail later.

Tiering is the mechanism by which proportionate oversight becomes operationally real rather than aspirational. Inherent risk factors, including data sensitivity, access level, operational criticality, concentration risk, regulatory compliance, and geography, define the tiers. A program that cannot account for them cannot defend its scope.

DORA anchors the same requirement in one major jurisdiction's law. Article 28(3) requires a Register of Information that is maintained at entity, sub-consolidated, and consolidated levels. The 2024 ESA dry-run exercise exposed how far current practice sits from that standard: only a small fraction of participating firms passed all data quality checks. The most common failures were missing mandatory information and invalid or missing unique identifiers, specifically LEI codes, for ICT third-party service providers.

What audit-defensible evidence actually looks like across the vendor lifecycle

Examiners do not evaluate effort. They evaluate whether documented controls matched documented risk. The operative question is not whether due diligence was conducted but whether the evidence of it is current, complete, and tied to the risk classification that justified its scope. That distinction reorganizes what evidence means at each stage of the vendor lifecycle.

Onboarding evidence starts with the risk tier classification and the methodology behind it. Ongoing monitoring evidence requires a defined short list of conditions that demand attention: breach disclosures, ransomware activity, sanctions exposure, financial distress, critical vulnerability exposure, and major control changes. Each trigger needs documented ownership, and every alert needs a documented disposition, whether reviewed, escalated, or closed, with the basis recorded.

Remediation evidence is where most programs fail. AI governance in vendor contracts is now an explicit examiner expectation: programs must ask vendors where AI is used, what data it touches, whether that data is used to train models, and must require contract language on data use, transparency, and notification when AI-related practices change. Familiarity with the CRI Financial Services AI Risk Management Framework, published February 2026, is an explicit 2026 exam readiness item.

The failure of point-in-time audits is not that they happened but that organizations treat them as the primary assurance mechanism. A program that produces continuous monitoring signals but cannot produce a dated, owned, dispositioned record of what it did with those signals has not solved the evidence problem. The evidence problem is solved only when the record exists independently of any single audit event.

How continuous monitoring feeds defensible evidence rather than just more alerts

Continuous monitoring can become its own check-the-box exercise. The strongest objection to monitoring-led programs is that they surface volume without prioritization and replicate the same failure mode as the questionnaire-based approach they were meant to replace: a gap between capability and action. Examiners can see that gap as readily in a monitoring dashboard as in a due diligence binder.

The structural answer is to define a short list of conditions that require attention, tied to risk tier and criticality, with thresholds documented in advance. Not everything that can be measured, but the specific things that, when crossed, require a dated and owned response. Every alert must produce a documented disposition stating who reviewed it, on what date, and on what basis. That disposition record is the evidence, not the alert itself.

Monitoring must feed back into assessments and contract management rather than sitting in a separate dashboard. A monitoring system that does not close this loop is a parallel track, not integrated risk management. The Marquis Software case demonstrates the point in both directions: the predictive RSI signal offered a window to act, but only a program with a defined disposition path could convert that signal into documented action.

Nth-party and subcontractor monitoring remains the largest structural blind spot. For critical third parties, sub-service provider data maps should be requested as a matter of course. Sub-service provider exposure typically becomes visible only after an issue has arisen, which is precisely the sequencing that continuous evidence architecture is meant to reverse.

Non-human identities and AI agents as third-party risk: the inventory gap examiners will reach next

Most vendor inventories track the organizations an institution does business with. They do not track the persistent non-human identities those relationships create. Those identities sit outside every questionnaire, contract, and monitoring cadence now in use, so they are an attack surface.

The mechanism is straightforward and largely unmanaged. When an AI assistant reads a calendar, a coding agent opens a pull request, or an MCP server queries a SaaS platform, OAuth is almost always the mechanism underneath, and the identity outlasts the context that created it. The Salesloft-Drift incident in 2025 showed the consequence at scale. No conventional vendor assessment would have surfaced that exposure, because the risk lived in the token, not in the vendor relationship.

The documentation gap compounds the technical exposure. Most non-human identities carry more permissions than they need. The surface area is therefore both undocumented and over-privileged, which is the worst possible combination for an examiner facing questions about fourth-party AI concentration.

What examiners are beginning to require points toward what programs should build now. If multiple critical vendors run on the same underlying AI model, examiners want to see that concentration has been evaluated and communicated to governing bodies. The gap between current inventories and that expectation is where the next round of findings will be written.

How proportionate program design — not uniform maximum scrutiny — satisfies both the new regulatory direction and examiner expectations

If you apply uniform maximum scrutiny to every vendor, you allocate risk badly. It consumes analyst time that should protect Tier 1 relationships, produces documentation volume without risk signal, and reproduces the process-driven approach the agencies' new proposal is designed to correct. The corrective is not less oversight but better-distributed oversight.

Proportionate program design operates through three elements working together. The second is deep, continuous, and AI-assisted analysis for complex and high-risk vendors, including concentration risk evaluation, downstream dependency mapping, AI use documentation, and performance monitoring with clear ownership. The third is an evidence architecture that makes proportionality visible, so that auditors and examiners can see not only what was done but why a given level of scrutiny was applied to a given vendor.

An incident readiness layer sits alongside the program. It requires a third-party incident and continuity playbook that brings together cyber, legal, privacy, procurement, business owners, and business continuity stakeholders. Run tabletop exercises with at least one critical third party as the case study. Round-the-clock contacts, notification SLAs, and continuity commitments for critical third parties must be confirmed in advance. This preparedness is operational and exam-relevant, because examiners are increasingly reviewing incident response documentation alongside risk assessment records.

A well-designed program, seen from the examiner's side, is therefore legible in six features: a complete, tiered vendor inventory with documented methodology; risk-proportionate due diligence with evidence retained in a single system of record; continuous monitoring with defined thresholds, documented ownership, and closed-loop disposition records; contract terms reviewed against actual performance; AI and non-human identity exposure documented and evaluated; and concentration risk communicated to governing bodies. Each feature is individually achievable. Together they constitute the difference between a program that withstands scrutiny and one that performs it.