# Federal Agencies Propose Third-Party Risk Guidance

Federal banking regulators—the Office of the Comptroller of the Currency (OCC), Federal Reserve, Federal Deposit Insurance Corporation (FDIC), and National Credit Union Administration (NCUA)—have jointly proposed updated guidance on third-party risk management for banking organizations and credit unions. This proposal, replacing the 2023 guidance, shifts the supervisory focus from categorizing third-party activities to assessing risk based on the potential magnitude of harm and likelihood, emphasizing risk management rather than risk elimination. It introduces the concept of residual risk acceptance aligned with an institution’s risk appetite. The guidance is nonenforceable but will inform supervisory considerations, particularly impacting community banks and core service providers. Stakeholders have until November 16, 2026, to submit comments.

- **Why this matters:** Procurement professionals supporting financial institutions should anticipate evolving supervisory expectations that prioritize risk management frameworks over strict risk avoidance in third-party engagements.
- The shift to residual risk acceptance may influence contract terms, vendor risk assessments, and compliance strategies for service providers to banking organizations.
- Organizations providing third-party services to community banks and credit unions should align their risk management practices with the updated guidance to remain competitive and compliant with supervisory expectations.
- Procurement teams should prepare for potential adjustments in due diligence processes and contract negotiations reflecting the new supervisory emphasis on risk appetite and tolerance.

**Jurisdictions:** federal
**Industries:** Professional Services
**Topics:** Regulatory Compliance
**Published:** September 25, 2026

### Government Entities
- Office of the Comptroller of the Currency (OCC)
- Board of Governors of the Federal Reserve System (Federal Reserve)
- Federal Deposit Insurance Corporation (FDIC)
- National Credit Union Administration (NCUA)

### Key Quotes
> The updated guidance is designed to be less prescriptive and to encourage relationships with innovative third parties by moving from risk elimination to risk management.
> — Michael J. Hsu, Acting Comptroller of the Currency

> Institutions are not expected to eliminate all third-party risk and may accept risk that remains after mitigation, consistent with the institution’s risk appetite and tolerances.
> — Jerome Powell, Chairman, Board of Governors of the Federal Reserve System

### Sources
- [Federal Agencies Propose New Guidance for Third-Party Risk Management – Cooley Finsights](https://finsights.cooley.com/federal-agencies-propose-new-guidance-for-third-party-risk-management) - Cooley Finsights