A lighter-touch, expressly non-enforceable framework would recenter third-party risk management on relationship-specific risk assessment, potentially ease the path for bank-fintech partnerships, and retire the post-Synapse supplemental guidance.

On September 11, 2026, the Office of the Comptroller of the Currency (OCC), the Federal Reserve Board (Fed), the Federal Deposit Insurance Corporation (FDIC), and—for the first time on this subject—the National Credit Union Administration (NCUA) jointly proposed new “Interagency Guidance on Third-Party Risk Management” (the 2026 Proposed Guidance).

If finalized, the proposal would rescind and replace the June 2023 Interagency Guidance on Third-Party Relationships: Risk Management (the 2023 Guidance), along with rescinding (and at this point not replacing) the “Supplemental TPRM Resources: Joint Statement on Banks’ Arrangements With Third Parties to Deliver Deposit Products” (Joint Statement) issued June 25, 2024, and the “Third-Party Risk Management: A Guide for Community Banks” that was jointly issued by the FDIC, the Fed and the OCC in May 2024. Comments on the new 2026 Proposed Guidance are due 60 days after publication in the Federal Register (which is a comment deadline of November 10, 2026).

The agencies’ diagnosis is blunt: despite disclaiming any prescriptive intent, the 2023 Guidance was applied as a checklist, drove heightened oversight of relationships without regard to the magnitude or likelihood of the risks they actually posed, and discouraged arrangements with newer and innovative providers. The proposal, framed as a deregulatory action and expressly aligned with President Trump’s Executive Order 14405 on integrating financial technology innovation into regulatory frameworks, responds by making risk identification and assessment the foundation of the framework, committing bank examiners to defer to reasonable bank judgments, and stating in terms that the 2026 Proposed Guidance is not enforceable. Until a final version is adopted, the 2023 Guidance remains in effect.

A New Architecture: Risk Assessment First

The proposal abandons the 2023 Guidance’s five-stage “life cycle” (planning, due diligence, contract negotiation, ongoing monitoring, termination) in favor of four components: (1) risk identification and assessment; (2) risk oversight; (3) residual risk acceptance; and (4) governance. Planning disappears as a discrete stage, and the risk assessment becomes the document that drives, and justifies, the depth of everything downstream. Under the new higher-risk test, a relationship warrants heightened oversight only where a disruption, attack, breach, or other non-business-as-usual event could cause an actual non-trivial violation of law, material financial harm, or significant operational or customer disruption, and there is a material likelihood of that outcome under current or reasonably foreseeable conditions. Banks that escalated broad categories of vendors by activity type would be able to de-tier relationships that present a low likelihood of harm and redeploy oversight resources accordingly should the 2026 Proposed Guidance be finalized.

The scope of TPRM would also narrow under the 2026 Proposed Guidance. A third-party relationship is a business arrangement for the provision of products, services, or activities supporting the bank—and where there is no written agreement or no clear consideration, the proposal says the activity is “unlikely” to qualify. The bank agencies request comments on limiting the 2026 Proposed Guidance to written agreements outright. Subcontractor use alone would not create an independent third-party relationship or any presumption of direct bank oversight of subcontractors; oversight runs through the prime relationship and the vendor’s own vendor-management program. That change would arguably eliminate “4^th Party Due Diligence” due diligence “sprawl” from banks’ TPRM due diligence, monitoring, and oversight where banks manage subcontractor risk through the prime contract with the vendor and by vetting the vendor’s own TPRM program, not by papering direct oversight of nth-tier providers. Relationship inventories become optional for limited-risk categories such as professional services, clerical functions, and office support.

A Different Examination Posture

Perhaps the most consequential language for day-to-day supervision is the proposal’s “Non-Enforceable Guidance” section. Non-compliance with the 2026 Proposed Guidance will not result in supervisory action; deviation from the 2026 Proposed Guidance or its examples, even where a bank examiner believes the deviation is contrary to best practices, will not alone support an adverse finding; and any supervisory criticism must be tied to the institution’s operations, financial condition, or other relevant factors under applicable legal standards. Parallel commitments to give “due consideration” to a bank’s “reasonable judgments” appear throughout: in risk assessments; contracting decisions; termination and transition determinations; and governance design. The 2023 Guidance’s dedicated supervisory-review section, with its description of transaction testing and rating implications, is removed entirely.

Financial institutions should read the limits alongside the headline. The bank agencies expressly reserve action for violations of laws or regulations, unsafe or unsound practices, and material risks resulting from insufficient third-party risk management. BSA/AML, consumer protection, and safety-and-soundness exposure arising through third parties remains unchanged. The practical effect is a shift in examination style, and a set of citations counsel can use in responding to findings grounded in “best practice” deviations, rather than a reduction in underlying legal responsibility, which the proposal reiterates is undiminished by outsourcing.

A note on durability of the 2026 Proposed Guidance is also warranted. The proposal is anchored to Executive Orders 14405 and 14192 and reflects the current administration’s deregulatory posture; like the 2023 Guidance it would replace, it is supervisory guidance, adopted without the procedural entrenchment of formal agency rulemaking, and could be revised or rescinded by future agency leadership with comparable ease. Financial institutions that build third-party risk management programs to the proposal’s minimums only may find themselves rebuilding anew if supervisory expectations swing back to be more aligned to the 2023 Guidance framework. The prudent course is to treat the 2026 Proposed Guidance as defining the regulatory floor while documenting risk-based decisions, particularly de-tiering of vendors, due diligence changes or reductions, and residual risk acceptances, with enough rigor to withstand review under a more demanding standard.

Due Diligence, Contracting, and Monitoring: Scaled in Both Directions

Due diligence is expressly risk-scaled. For lower-risk relationships, less-detailed information or public and alternative sources of information may suffice, and further diligence “may not provide appreciable benefits.” For third parties with limited operating histories, such as early-stage fintechs or start-up technology companies, banks may rely on the qualifications and experience of management, trade-group feedback, public sources, and external industry experts. The counterweight is significant: where a third party is unable or unwilling to provide information or cooperation reasonably necessary for diligence, monitoring, and risk assessment, the proposal states that alternative sources may not be sufficient for the relationship to fit within the bank’s risk appetite. Therefore, information-access and cooperation covenants accordingly become more valuable in contract negotiation, including with dominant vendors and service providers.

On contracting, the 2026 Proposed Guidance states that there are no generally applicable expected contract terms for third-party relationships, and that the presence or absence of any specific term an examiner considers a best practice is not alone a basis for an adverse finding. Standard forms may suffice for lower-risk relationships, and negotiations may concentrate on the narrow subset of provisions most relevant to assessed risk. Ongoing monitoring may be expanded or contracted in scope, detail, frequency, and staffing as assessed risk changes, and banks may leverage third-party audits, certifications, public filings, and agency examination reports of significant service providers (with the caveat that agency reports are not a substitute for independent analysis).

Three further reversals of the 2023 Guidance under the 2026 Proposed Guidance are worth noting.

• Affiliate arrangements conducted within a familiar enterprise-wide risk management framework may be treated as lower-risk, with alternative oversight mechanics such as staff overlap. This may present an opportunity for bank holding companies to substantially streamline intercompany service agreement oversight where an enterprise-wide ERM framework applies (but Regulation W and intercompany-pricing requirements remain unaffected).
• A third party’s own status as a regulated entity (such as an entity that is a registered money services business with FinCEN and holds state-level money transmission licenses) may be credited in the risk assessment as one factor, not a proxy.
• Credible indemnification, limitations of liability, insurance, and parent guarantees are reframed from contract checklist items into “affirmative mitigants” that can lower the assessed risk of the relationship itself, as can demonstrated operational resilience such as back-up providers and separately maintained data backups.

Collaboration, Certification, and the Fintech Opening

The proposal encourages what the 2023 Guidance merely tolerated: consortia and co-ventures for shared due diligence and standard contract development, standard-setting and certification organizations whose assessments may be adequate for a bank’s diligence needs, group contract negotiation (subject to antitrust law), and reliance on consultants, auditors, and law firms for risk management and compliance purposes. For community banks, this may provide a sanctioned route to pooled leverage against core processor providers. For fintechs, a recognized certification may become a meaningful onboarding credential, and the removal of language treating innovative firms as presumptively elevated-risk lowers a structural barrier that has shaped sponsor-bank diligence since the mini-bank crisis of 2023 (and post the Synapse collapse).

The Quiet Headline: Rescission of the Bank-Fintech Joint Statement

Finalization as proposed of the 2026 Proposed Guidance would rescind the July 2024 Joint Statement on Banks’ Arrangements with Third Parties to Deliver Deposit Products, the issuance that crystallized post-Synapse supervisory expectations around account titling, ledgering responsibility, reconciliation, and access to customer-level records in the event of a program partner failure. The 2026 Proposed Guidance offers no successor text, and the bank agencies separately invite comments on whether additional agency guidance documents and interpretive letters should be rescinded. Institutions running bank-fintech partnerships on the deposit side (including BaaS and embedded banking) should not assume the underlying concerns disappear with the document: ledger continuity and data access in a failure scenario map directly onto the proposal’s magnitude-of-harm and operational-resilience concepts, and FDIC recordkeeping rulemaking and receivership realities are unchanged. Partner banks and program managers with views on whether the Joint Statement’s substance should be preserved, modified, or codified have a 60-day window to say so.

What Banks and Financial Institutions Should Do Now

• Keep Operating Under the 2023 Guidance. The 2026 Proposed Guidance changes nothing until finalized; examiners will apply the current framework in the interim.
• Map the Delta. Inventory TPRM policies, risk-tiering methodologies, board reporting, and contract playbooks against the proposed framework, and identify where program requirements exist only because the 2023 Guidance (or the Joint Statement) put them there.
• Invest in the Risk Assessment. The magnitude-and-likelihood analysis becomes the document that justifies every downstream choice and the record that earns examiner deference. Build the methodology and documentation discipline now.
• Design a Residual-Risk-Acceptance Procedure. Defined approval authority, periodic revalidation, and board visibility for material acceptances will convert the 2026 Proposed Guidance’s flexibility into a defensible record rather than an unmanaged exposure.
• Revisit Contracting Playbooks Carefully. Retire checklist mandates in favor of risk-driven term selection, but retain core protections (audit and information access, confidentiality and data rights, compliance obligations, business continuity/disaster recovery, insurance, indemnification, liability, termination assistance/deconversion costs/wind-down, subcontractor flow-down issues such as service level applicability to subcontractors and notification/consent to material subcontracting) for higher-risk and program-critical relationships, justified by the risk assessment rather than by 2026 Proposed Guidance citation. The 17 enumerated contract considerations from the 2023 Guidance are still relevant to the bank’s business negotiation considerations, and those should still be analyzed and tied to the bank’s risk assessment and residual risk assessment procedures.
• Build for Durability, Not Just the Current Cycle. Because the 2026 Proposed Guidance rests on executive-order policy that a future administration could reverse as easily as this one is replacing the 2023 Guidance, banks need to document risk-based reductions in bank oversight with the rigor a stricter framework could demand later.
• Consider a Comment Letter. The bank agencies pose direct questions on limiting scope to written agreements, publishing high-risk indicia, and rescinding additional agency prior issuances, including, implicitly, the fate of the Joint Statement. Comments are due 60 days after Federal Register publication (November 10, 2026).

If you have any questions or concerns regarding the current 2023 Guidance, the 2026 Proposed Guidance, third-party risk management programs, policies, procedures, or vendor contract negotiations, please do not hesitate to reach out to the authors of this legal update.