Federal Register #OP1880

Federal Reserve System Requests Public Comment on Third-Party Risk Management Guide for Community Banks

The Board of Governors of the Federal Reserve System is seeking public comment on a proposed Third-Party Risk Management Guide for traditional community banking organizations: - Government buyer: Board of Governors of the Federal Reserve System - The guide is tailored for Traditional Community Banking Organizations (TCBOs) with less than $30 billion in assets - Addresses risks from third-party relationships across eight vendor categories: - Core service providers - IT infrastructure - Cybersecurity - Payment processing - Loan management - Card processing - BSA/AML platforms - Fraud detection - Focuses on operational resilience, system and information security, regulatory compliance, and financial resilience - References industry standards such as SSAE 18 SOC Reports, PCI DSS, NIST, and ISO - Covers contract negotiation, due diligence, ongoing monitoring, and transitioning to new vendors - No specific OEMs or vendors are named; the guide is intended to be broadly applicable - The opportunity is a request for information to improve the guide's usefulness and clarity for managing third-party risks

Description

The Federal Reserve System has proposed a guide aimed at traditional community banking organizations to help manage risks associated with third-party relationships. The guide reflects supervisory experience and lessons learned from examining third-party risk management practices in community banking. It discusses key risks faced by these organizations in general and in relation to specific categories of third-party relationships common to them. The Board invites public comment on the guide by November 16, 2026, to improve its usefulness and clarity for managing third-party risks.

View original listing