In September 2026, the OCC, the Federal Reserve, the FDIC and the NCUA proposed new third-party risk management guidance. It was published in the Federal Register on September 15. If it is finalized, it replaces the 2023 interagency guidance.
I'm writing this as the founder of Third Party Threat Hunting (TPTH), and I'll keep it practical: what changed, why I don't think it means less work, and what I'd do in the next few weeks.
What changed
The biggest change is what is missing. The 2023 guidance listed 17 contract considerations. The proposal removes those lists. It says there are no generally applicable expected contract terms, even for higher-risk relationships.
In their place are examples: who is responsible for what, service levels, confidentiality, information security, subcontractors, resilience plans and termination. Negotiation depth should follow risk, business needs and your negotiating power. And the absence of a specific term, on its own, is not a sufficient basis for an adverse supervisory finding.
Why this is not "less work"
I expect some teams to read that and relax. I'd read it the other way.
A checklist is easy to defend. Either the clause is in the contract or it isn't. Without one, the question changes from "is the term there?" to "why did you decide what you decided?"
The proposal says examiners will give due consideration to a bank's reasonable judgment on its risk assessments, and to its reasonable governance decisions. That is a real benefit. But it only helps if the judgment is visible. It is hard to give due consideration to a decision nobody wrote down.
So the work moves from collecting documents to showing your reasoning. The file has to show the decision, not just the paperwork.
Harm, not labels
The proposal also changes how risk is framed. It criticizes the 2023 "critical activities" approach for focusing on the activity rather than the likelihood of harm. Risk assessments should weigh how severe the harm could be and how likely it is. No single method is required, and oversight should be proportionate to the risk and to your size and complexity.
The agencies also say they don't expect banks to eliminate risk. Some relationships can stay worthwhile despite residual risk, as long as the decision is informed and the risk is accepted on purpose.
That matters most for core providers, where community banks often have little leverage. A joint statement from the Fed, FDIC and OCC, issued September 11, acknowledges that limit. If you accepted a term you wouldn't normally accept, the file should say what you asked for, what you got and why you went ahead.
What a good file looks like
A vendor file that holds up under this standard is not necessarily thicker. It answers a few plain questions:
- What could go wrong with this vendor, and how bad would it be for customers and the bank?
- How likely is it?
- What did we decide to do: monitor, negotiate, add a control, accept the risk or exit?
- Who made that call, and when?
- What would make us look at it again?
A short, dated note that answers those questions beats a binder of reports nobody has interpreted. If a contract lacks a term you would normally want, the file says so and says why that was acceptable.
What I'd do before Nov 16
Comments are due on or before November 16, 2026. The Federal Register notice says so, and a Mayer Brown summary of the proposal says the same. This is a proposal, so the final wording may change. Three things I'd do before then:
- Re-tier your top 25 vendors by harm. Sort them by how much damage a failure could do and how likely it is, not by the type of service. Write down the reason for each tier in a sentence.
- Check that your five riskiest vendor files show a real decision. Open each one and look for the choice: what you decided, who decided it and why. If the file is only documents, add the missing note now.
- Decide whether you're commenting. The notice lists how to file with each agency, and credit unions can send comments to the NCUA. If the missing checklist helps or hurts your program, the agencies want to hear it. Even a short comment counts, and if you decide not to comment, write down why.
Where TPTH fits
At TPTH, we help teams show their reasoning: tiering vendors by harm, and turning the documents you already have into a clear record of each decision. If you'd like to compare notes on your own approach, I'm glad to talk.