The FDIC, the Federal Reserve, the NCUA and the OCC on September 11, 2026 proposed new third-party risk management guidance for banks. Once final, it would replace the June 2023 Interagency Guidance on Third-Party Relationships and rescind related documents, including the July 25, 2024 joint statement on bank-fintech deposit arrangements. The proposal was published at 91 FR 58536 on September 15; comments are due November 16, 2026.
What the proposal says
- Principles instead of detail. The proposal is principles-based and non-binding. It is organized around risk identification and assessment, risk oversight (due diligence and selection, contract negotiation, ongoing monitoring, termination), residual risk acceptance and governance.
- Fintech partnerships named. The agencies say the proposal would remove “broad-based and overly prescriptive language from the 2023 Guidance that may unduly impede fintechs from entering partnerships with banking organizations,” and cite Executive Order 14405 of May 19, 2026.
- Bank decisions respected. The agencies “will give due consideration to a banking organization’s reasonable decisions in matters of third-party risk management supervision.”
- Responsibility unchanged. The FDIC’s letter says the proposal “continues to reflect that use of third parties does not diminish banks’ responsibility to manage risks and comply with applicable laws and regulations.”
The documents to be rescinded are defined as “Supplemental TPRM Resources”: the July 2024 joint statement (Federal Reserve SR 24-5, FDIC FIL-45-2024, OCC Bulletin 2024-20), the May 2024 community bank guide and OCC Bulletin 2002-16. The same day the Fed, the FDIC and the OCC issued a joint statement on community banks’ engagement with core service providers, and the Fed proposed a separate guide for traditional community banking organizations with under $30 billion in assets.
Reactions on the record
Comptroller of the Currency Jonathan V. Gould said the agencies are “cutting unnecessary regulatory friction, tailoring supervision to actual risk, and strengthening community banks’ ability to manage critical third-party relationships.”
Federal Reserve Governor Michael S. Barr dissented. He wrote that “many banks with complex business models are especially in need of guidance that better addresses their particular third-party risk management issues, which is not addressed in these proposals.”
What it means for fintech programs
Until the agencies finalize the guidance, the 2023 guidance and the 2024 joint statement remain in effect. Enforcement orders already in place are not changed by the proposal; our sponsor bank enforcement actions tracker lists them. For the checks a sponsor bank runs on its partners today, see how to choose a sponsor bank.
