OCC's 2026 Third-Party Risk Guidance Rewrite: What Banks Should Change Now

TL;DR

• On September 11, 2026, the OCC, Federal Reserve, FDIC, and NCUA proposed replacing the 2023 interagency third-party risk management guidance with a more explicitly risk-based framework.
• The practical shift is from treating a broad set of “critical activities” as automatically requiring maximum process to assessing the magnitude and likelihood of harm in each relationship.
• A separate OCC-Fed-FDIC statement puts core providers on notice: transparency gaps, opaque pricing, back billing, deconversion fees, weak technology investment, and poor resilience can influence provider supervision and enforcement.
• Do not dismantle the vendor program. Rebuild the tiering rationale, record residual-risk decisions, and show why each control is proportionate to the relationship.

The 2026 third-party risk management guidance proposal is a direct challenge to vendor programs that confuse diligence volume with risk management.

The four agencies say the 2023 framework has often been read too broadly, applied like a checklist, and used to impose heightened work on relationships without asking how likely they are to cause meaningful harm. Their proposed replacement still covers due diligence, contracts, monitoring, termination, subcontractors, resilience, residual risk, and governance. What changes is the decision rule underneath those activities.

That matters to the practitioner who has 300 vendors in an inventory, two analysts, a core processor that will not negotiate, and an examiner asking why every annual review is late. The defensible answer is no longer “we apply the same package to everybody.” It is a documented explanation of where harm can arise, how likely it is, and why the selected oversight is enough.

What did the agencies actually issue?

The joint September 11 release contains three related actions:

1. The OCC, Federal Reserve, FDIC, and NCUA proposed new all-bank and credit-union TPRM guidance.
2. The OCC, Federal Reserve, and FDIC issued a separate statement on community banks’ dealings with core service providers.
3. The Federal Reserve proposed a companion guide for traditional community banking organizations.

The agencies intend the 35-page proposed interagency guidance to replace the 2023 guidance and supplemental TPRM resources when finalized. The proposal is non-binding. Comments are due 60 days after publication in the Federal Register, so the release date itself is not the comment deadline.

That distinction is important. This is not permission to close findings against the current framework by writing “new guidance pending” in the issue log. It is a strong signal about supervisory direction and an opportunity to fix the parts of a TPRM program that generate work without generating assurance.

The 2026 third-party risk guidance changes the tiering question

Under the proposal, risk assessment should consider both magnitude of harm and likelihood of harm. A higher-risk relationship is one capable of producing a non-trivial legal violation, material financial harm, or significant operational or customer disruption—and where that outcome is materially likely under current or reasonably foreseeable conditions.

This is more useful than letting one attribute decide the tier. An API connection does not automatically make a vendor high risk if it reaches no critical data, is strongly segmented, and presents limited operational exposure. A regulated vendor does not automatically become low risk merely because another agency supervises it. A core processor serving one limited business segment can present less risk than a processor supporting most of the bank.

The shift can be summarized this way:

The proposal says a bank may maintain a simpler inventory for lower-risk relationships and may decide not to maintain an extensive record for limited-risk administrative, professional, or office-support services. It also says lower-risk relationships may justify less-detailed information or public and alternative sources.

That is not the same as “low risk means no file.” The practical file can be short: service description, risk rationale, business owner, data and system access, legal or customer impact, decision, and reassessment trigger. If the only record is a low-risk label with no reason behind it, the bank cannot demonstrate that it exercised the judgment the proposal emphasizes.

Core providers just became a two-sided control problem

The separate Joint Statement on Community Banks’ Engagement with Core Service Providers is the sharper document.

The agencies acknowledge what community-bank vendor managers already know: a few large providers represent a significant share of the core market, which can limit a bank’s bargaining power. Banks may struggle to get timely diligence materials, negotiate workable terms, reconcile complex invoices, or exit without punitive cost and disruption.

The statement says the agencies will consider these provider behaviors when deciding the nature, frequency, and extent of provider supervision:

• willingness to provide relevant and timely diligence and monitoring information;
• contract restrictions that interfere with comparing providers;
• measurable service levels and the bank’s ability to monitor and enforce them;
• timely disclosure of operational problems and security incidents;
• complex or opaque pricing and billing, including long back-billing windows;
• unsupported or undefined deconversion fees;
• limits on integrating unaffiliated providers;
• security-incident history, end-of-support and end-of-life asset management, and demonstrated operational resilience.

The statement goes further. It says a core provider may qualify as an institution-affiliated party under the Federal Deposit Insurance Act when it participates in the conduct of an insured institution’s affairs. The agencies cite 12 U.S.C. 1813(u) and say providers may be held liable where applicable. They also preserve the bank’s responsibility: outsourcing does not transfer compliance or safety-and-soundness accountability.

That creates a better evidence strategy for a community bank. When the provider refuses a SOC report section, rejects an incident-notice clause, or inserts an undefined exit fee, preserve the request, response, escalation, alternatives considered, compensating controls, and formal acceptance. “Vendor would not agree” is weak. A dated negotiation record that shows the bank identified the exposure and made an authorized decision is evidence.

This builds on the concentration problem discussed in the core-provider risk analysis. The new statement adds regulatory leverage, but it does not create commercial leverage overnight. Procurement and Legal still need a clean record of what they requested and where the contract left the bank exposed.

What should stay in the TPRM program?

The lifecycle did not disappear. The proposal retains four connected components:

• risk identification and assessment;
• oversight proportionate to risk, including diligence, contracting, monitoring, and termination;
• informed residual-risk acceptance; and
• governance, including roles, appetite, reporting, documentation, and independent review.

It also keeps substantive control areas that weak programs sometimes try to classify away. These include financial condition, staffing capability, legal compliance, information security, cybersecurity history, service levels, subcontractors, operational resilience, incidents, complaints, audit findings, insurance, termination cost, transition complexity, and data return or destruction.

For subcontractors, the proposal clarifies that their use does not normally create a separate direct third-party relationship or a presumption of direct bank oversight. The bank can instead scale oversight through the primary vendor—for example, by setting contract terms for subcontractor use and testing the vendor’s own TPRM program. That is a useful correction for teams trying to put every fourth party into the same workflow as a direct vendor.

The operational model in the TPRM lifecycle RACI still works. The change is that each handoff needs to inherit the risk hypothesis rather than run a generic checklist in isolation.

A five-file test for Monday morning

Do not start by rewriting the policy. Pull five actual relationships:

1. the core processor;
2. a fintech delivering a customer-facing banking product;
3. a cloud or managed security provider;
4. a professional-services firm with limited system access; and
5. an office-services vendor with no customer-data access.

For each file, ask the same six questions:

If the low-risk office vendor has a 90-page diligence file while the core provider has an unexplained contract exception and no tested exit assumptions, the program is allocating effort backward.

For evidence gaps, use the same discipline described in the vendor due diligence alternatives guide: identify the control conclusion, decide whether substitute evidence actually supports it, and document the remaining uncertainty. The proposal permits judgment. It does not bless wishful thinking.

A 30/60/90-day response plan

Days 1–30: diagnose the operating model

TPRM: Compare the current tiering factors to magnitude and likelihood of legal, financial, operational, and customer harm. Identify attributes that automatically trigger a tier without a documented risk rationale.

Legal and Procurement: Create a core-provider friction register. Include diligence refusals, opaque pricing, back billing, deconversion charges, integration restrictions, incident-notice gaps, and non-measurable service levels.

Compliance and Internal Audit: Keep current requirements intact while the proposal is pending. Record where policies cite the 2023 guidance so those references can be updated after a final action.

Days 31–60: run the sample and design changes

TPRM and business owners: Reassess a sample across all tiers. Compare the old result with the harm-based result and document why they differ.

Information Security, Business Continuity, and Compliance: Map diligence and monitoring evidence to the risks it tests. Eliminate duplicate artifacts only when the control conclusion remains supported.

CRO or approved risk committee: Define who can accept residual risk by severity, for how long, and with what escalation. The proposal expressly recognizes that not every risk can be eliminated, especially where bargaining power or alternatives are limited.

Days 61–90: make the program defensible

Policy owner: Draft—but do not yet mislabel as final—revisions that distinguish proposed changes from current requirements. Add decision standards for reduced diligence, alternative evidence, monitoring frequency, and reassessment triggers.

Vendor governance committee: Review the core-provider friction register and decide which items require renewal negotiation, supplemental controls, a consortium approach, an exit feasibility study, or formal acceptance.

Internal Audit: Test whether the new methodology produces consistent explanations, not merely fewer tasks. Sample an override, a low-risk classification, a missing-artifact decision, and a high-risk monitoring plan.

The Federal Reserve’s proposed community-bank guide is also worth assigning by vendor category. It addresses core, IT infrastructure, cybersecurity, payments and digital banking, loan systems, cards, BSA/AML platforms, and fraud providers. But its proposed scope is narrower: traditional community banking organizations under $30 billion that do not have more complex models such as fintech-led distribution arrangements.

The judgment standard got clearer, not easier

A checklist can be audited by counting blanks. A risk-based program has to explain its decisions.

That is the real consequence of the 2026 proposal. Banks may get room to reduce low-value diligence and monitoring, but only if the saved effort moves toward the relationships that can actually hurt customers, interrupt operations, create legal violations, or trap the institution in an unworkable core contract.

The first useful deliverable is not a new policy. It is the five-file comparison, the core-provider friction register, and a residual-risk decision record that a CRO, examiner, and auditor can follow without oral translation.

If your current vendor process cannot show that chain of judgment, the Third-Party Risk Management Kit provides the inventory, tiering, diligence, contract-review, monitoring, and offboarding structure to rebuild it.

Sources

• OCC Joint Release 2026-77, September 11, 2026
• Proposed Third-Party Risk Management Guidance, Docket OCC-2026-0793 / OP-1881
• Joint Statement on Community Banks’ Engagement with Core Service Providers
• Federal Reserve release and proposed community-bank companion guide
• FDIC joint release