The NCUA, FDIC, Federal Reserve Board, and OCC just dropped proposed guidance on how financial institutions should manage risks when partnering with third parties. Think of it as a playbook for keeping your vendor relationships healthy and your regulators happy.
What’s Different This Time?
This isn’t just bureaucrats shuffling papers around. The proposed guidance comes from real-world experience—specifically, what regulators have seen during actual examinations of how banks and credit unions handle their third-party relationships. The goal? Help you match your risk management approach to the actual level of risk each vendor relationship presents.
Here’s the refreshing part: it’s principles-based rather than a rigid checklist. Translation? You get flexibility to tailor your approach instead of following a one-size-fits-all rulebook. And because it’s supervisory guidance, it’s non-binding—think helpful suggestions from people who’ve seen what works and what doesn’t, not commandments carved in stone.
Out With the Old, In With the New
Once this guidance gets finalized, the federal bank regulators plan to retire their existing third-party risk management guidance and swap it out for this new version. The idea is to create consistency across the industry while still leaving room for innovation. (Yes, regulators and innovation in the same sentence—wild, right?)
You’ve got 60 days after it hits the Federal Register to submit your comments, so mark your calendars if you’ve got thoughts to share.
Community Banks: There’s Something Extra for You
The agencies also released a separate statement specifically about community banks working with core service providers. This one lays out what factors regulators will consider when making supervisory and enforcement decisions related to these essential partnerships.
And if you’re a Federal Reserve-supervised community bank, there’s even more. The Fed put out its own proposed guidance document designed to work hand-in-hand with the main proposal—think of it as the community banking edition.
Bottom line? Regulators are trying to update the rules of the road for vendor management, and they’re giving you a chance to weigh in before anything becomes official. If third-party relationships are part of your operation (spoiler: they definitely are), this is worth paying attention to.