Federal Banking Agencies Release Proposed Update to Guidance on Third-Party Risk Management

The Office of the Comptroller of the Currency (OCC), Federal Deposit Insurance Corporation (FDIC), Board of Governors of the Federal Reserve System (FRB), and National Credit Union Administration (NCUA) recently proposed revised third-party risk management guidance. The proposal would replace the joint OCC, FDIC, and FRB guidance issued in 2023 and NCUA guidance issued in 2007.

Reason for Changes

The agencies aim to clarify third-party risk management principles while reducing burdens on banks. They believe the 2023 guidance was interpreted too broadly, did not sufficiently emphasize tailoring third-party risk management to a bank’s actual risk, and read more like a prescriptive checklist than a principles-based framework. In their view, the previous approach also discouraged partnerships with new and innovative entities.

More broadly, the agencies seek to refocus risk management on the magnitude and likelihood of harm, focusing examiners and banks on material financial risks and statutory or regulatory violations arising from third-party relationships.

Overview of Proposed Guidance

The proposal would apply only to business arrangements in which a bank engages another entity to provide products, services, or other activities, generally under a written agreement.

It identifies four components of third-party risk management: (1) risk identification, (2) risk oversight, (3) residual risk acceptance, and (4) governance.

Risk identification involves categorizing third-party relationships, identifying relevant risks, and conducting risk assessments. Those assessments may be tailored to each party or activity and updated as information or circumstances change. To reduce burden, banks may choose not to maintain extensive inventories of relationships that pose limited risk.

Risk oversight makes up the bulk of the proposal. Banks should prioritize higher-risk relationships and calibrate due diligence accordingly. The agencies provide examples of information to obtain and steps to consider when information is unavailable. They do not prescribe contractual terms and state that banks should tailor contracts to their needs. Ongoing monitoring, including its cadence and depth, should likewise be commensurate with each bank’s circumstances. The section also addresses termination, subcontractors, co-ventures, liability limitations, and operational resilience planning.

Residual risk is the risk that remains after mitigation. Whether to accept it depends on the bank and the circumstances of the risk.

The governance discussion is brief and emphasizes that no single structure fits every bank.

Takeaways from Proposed Guidance

The proposed guidance is largely deregulatory and bank friendly. It would replace the detailed 2023 framework with a document roughly half as long. It states that noncompliance will not, by itself, result in supervisory action. It also gives banks greater flexibility and notes agencies will give due consideration to reasonable third-party risk management decisions.

The changes could also benefit entities seeking bank partnerships. Once finalized, the streamlined framework may reduce friction by narrowing the considerations banks should evaluate before entering a relationship. Banks following the updated approach may impose fewer requirements and show greater flexibility, making partnerships easier to form.

Open Questions and Next Steps

Comments on the proposal are due on November 16.

Banks and prospective partners should monitor the proposal’s development. Industry comments and reactions may signal whether further changes are likely.

Clark Hill’s Financial Services Regulatory & Compliance group helps clients navigate regulatory change through legal guidance and fractional compliance services. Our lawyers and government and regulatory advisors have extensive experience with the laws governing financial products and services, including the development and implementation of compliance programs. For more information, contact Joann Needleman at jneedleman@clarkhill.com.

This publication is intended for general informational purposes only and does not constitute legal advice or a solicitation to provide legal services. The information in this publication is not intended to create, and receipt of it does not constitute, a lawyer-client relationship. Readers should not act upon this information without seeking professional legal counsel. The views and opinions expressed herein represent those of the individual author only and are not necessarily the views of Clark Hill PLC. Although we attempt to ensure that postings on our website are complete, accurate, and up to date, we assume no responsibility for their completeness, accuracy, or timeliness.