meta_id 3487396

On September 11, 2026, the Office of the Comptroller of the Currency (OCC), in coordination with the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation (FDIC), and the National Credit Union Administration (NCUA), issued proposed guidance revising and replacing existing third-party risk management guidance for banking organizations. The proposed guidance aims to help banking organizations better align their third-party risk management practices in relation to the reasonably assessed risk levels specific to each third-party relationship. The guidance emphasizes tailoring risk management practices to each banking organization's size, complexity, and risk profile, as well as the nature of individual third-party relationships. The agencies developed the guidance based on supervisory experience and lessons learned through examining banking organizations' existing third-party risk management practices. The proposed guidance prioritizes risk-based approaches over process-driven strategies that treat all third-party relationships as inherently higher-risk. It is intended to help banking organizations prioritize third-party risk management based on the magnitude and likelihood of potential harm arising from specific third-party relationships. Importantly, the guidance will not set forth enforceable standards or prescriptive requirements; accordingly, non-compliance with the guidance will not result in supervisory action against a banking organization. The guidance will apply to community banks when finalized. The comment period closes 60 days from publication of the proposed guidance in the Federal Register. Banking organizations and other interested parties should submit comments during this period. For further information, contact Graham Bannon, Counsel, Chief Counsel's Office, at (202) 649-5490.