Four US federal financial regulators have proposed revised guidance for banks managing risks arising from third-party relationships. The Office of the Comptroller of the Currency (OCC), Federal Deposit Insurance Corporation (FDIC), Federal Reserve Board (FRB) and National Credit Union Administration (NCUA) are seeking to replace existing guidance issued in 2023 and 2007.
The proposed framework aims to clarify risk-management expectations while reducing compliance burdens on banks. Regulators said the previous guidance could be interpreted too broadly and function as a prescriptive checklist rather than a principles-based framework. The new approach would focus more closely on the magnitude and likelihood of harm, particularly material financial risks and regulatory violations.
The proposed framework identifies four core components: risk identification, risk oversight, residual risk acceptance and governance. Banks would be expected to categorise third-party relationships and tailor due diligence, monitoring and oversight according to the level of risk involved. Lower-risk relationships could receive less extensive oversight, while higher-risk arrangements would receive greater scrutiny.
The proposal also addresses subcontractors, termination, liability limitations and operational resilience. Regulators said they would not prescribe specific contractual terms, allowing banks to tailor arrangements to their circumstances. The proposed guidance is roughly half the length of the 2023 framework and states that noncompliance alone would not automatically result in supervisory action. Comments are due by November 16, 2026.
Want to deepen your expertise beyond today’s news?
Explore practical certification courses designed for banking, risk, insurance, compliance, ESG, AI, and emerging technologies professionals.
Learn from industry experts and earn certifications from RMAI and BFSI Sector Skill Council of India.
#Riskmanagementnews
