Interagency proposal tailors third-party risk management

The proposed guidance from the Office of the Comptroller of the Currency, Federal Reserve Board, Federal Deposit Insurance Corporation, and National Credit Union Administration shifts supervisory expectations toward proportionate risk assessment.

Under the updated framework, institutions assess vendor engagements by evaluating the magnitude and likelihood of potential harm rather than categorizing all third-party relationships as critical activities.

The proposal explicitly affirms that supervisory guidance does not establish enforceable legal standards, ensuring that deviations from illustrative examples cannot serve as the sole basis for adverse examination findings.

The agencies also clarify that institutions can accept residual risks when mitigation is unfeasible.

The interagency revision addresses banking sector feedback that the 2023 guidance unintentionally fostered rigid, process-driven oversight and hindered partnerships with innovative technology providers.

Community and mid-size banks struggled with excessive compliance burdens when engaging core processors or fintechs.

To ease implementation hurdles, the proposal recognizes collaborative arrangements, allowing institutions to use consortium due diligence and standard-setting certifications.