Written for whoever owns vendor tiering at a community bank or credit union.
- The OCC, the Federal Reserve, the FDIC and the NCUA want to replace the 2023 third-party risk guidance.
- You would be able to scale diligence and inventory to each vendor’s risk.
- The relief is scoped to lower-risk vendors, which for most institutions will not include the core provider.
- The proposal is not in force. Banks are examined against the 2023 interagency guidance; credit unions against NCUA’s own letters.
- When it lands, what you defend is your tiering rationale.
What would change
Under a heading “Non-Enforceable Guidance” the agencies write that the guidance “does not set forth enforceable standards or prescriptive requirements” and that “non-compliance with this guidance will not result in supervisory action.” A separate sentence says deviation from the guidance or its examples “will not alone be a basis for supervisory action.”
“Non-Enforceable” has limits. The same paragraph preserves action for violations of law, unsafe or unsound practices, and material risk from insufficient management. An institution that reads the heading and thins out its vendor oversight has read it as a permission it does not give.
That is not a new posture. It is the agencies conceding an old one failed. They write that the 2023 guidance “frequently has been interpreted in an overly broad manner” and was read as prescriptive “notwithstanding language disclaiming any prescriptive intent or checklist approach.”
So this is mostly about what you are allowed to stop doing. The agencies say institutions applied heightened practices “without regard to the magnitude and likelihood of the risks actually posed by each relationship.”
If you have ever run a full due-diligence package on your shredding vendor, that sentence is about you.
What it means for you
The proposal defines “banking organization” to include insured credit unions under the Federal Credit Union Act. If you have spent three years being told the guidance did not technically apply to you, finalization ends that argument.
Until then you are examined against NCUA Letters 01-CU-20 (2001) and 07-CU-13 (2007), both still listed active. That gap is why the NCUA joining this is not a formality.
The inventory line speaks to banking organizations, so it reaches you: “Banking organizations may decide not to maintain extensive inventories of relationships posing limited risk,” naming administrative, clerical, legal and office-support vendors. The lighter-format line — a “simpler or streamlined format” of inventory, one that lets management “quickly assess relevant third-party relationships at a higher level” — is offered to “a community bank.” The proposal supplies an express definition for “banking organization” and none for that phrase, so whether it reaches a credit union is open — worth raising in a comment rather than assuming either way.
Where the relief stops
On core providers the two documents say the same thing. A separate Fed, FDIC and OCC joint statement calls them community banking organizations’ “most material, complex, and highest-risk third-party relationships” and notes a few large providers limit those institutions’ negotiating power. The proposal agrees: core processing relationships are “likely to be assessed by most banking organizations as higher risk.” So your leverage there is limited to begin with, and the latitude to “focus negotiations on a narrow subset of contractual provisions” helps with the long tail rather than with the relationship you could least afford to lose.
Dates that bite
Comments close Monday, November 16. The agencies give no target date for finalizing, and none for rescinding the 2023 guidance. After the record closes you can still raise tiering with your examiner; it just will not be on the docket.
Sources
- Proposed Interagency Third-Party Risk Management Guidance — 91 FR 58536, published September 15, 2026; comments close November 16, 2026. Dockets OCC-2026-0793, FRB OP-1881, FDIC RIN 3064-ZA58, NCUA-2026-1684.
- FDIC FIL-58-2026 — the FDIC’s letter announcing the proposal.
- Joint Statement on Community Banks’ Engagement with Core Service Providers — Federal Reserve, FDIC and OCC, September 11, 2026 (OCC Bulletin 2026-47; SR 26-7).
- Interagency Guidance on Third-Party Relationships: Risk Management — 88 FR 37920, published June 9, 2023.
- NCUA Letter 01-CU-20, November 2001, and NCUA Letter 07-CU-13, December 2007 — both listed active.
- Credit-union inclusion — Federal Credit Union Act, 12 U.S.C. 1752(7), as cited in the proposal.
The Watch goes out weekly. Forward it to whoever signs off on your tiering.