By This Hour Finance Desk
Four U.S. financial regulators have opened a consultation on proposed guidance intended to help banks and credit unions manage risk in their relationships with outside providers. The proposal carries no force of law, but it could shape how institutions frame their controls and how supervisors assess them once a final version is issued.
The Federal Deposit Insurance Corporation, Federal Reserve Board, National Credit Union Administration and Office of the Comptroller of the Currency announced the request for comment on September 11, 2026. On the same day, the federal bank regulatory agencies issued a separate statement concerning community banks’ dealings with core service providers, while the Federal Reserve sought views on a companion guide for community banks it supervises.
The package matters because it combines a broad proposed supervisory framework with a narrower discussion of core providers used by community banks. The agencies say the proposed framework is meant to help institutions calibrate their third-party risk-management practices to the risk posed by each relationship, rather than treating every relationship identically.
A principles-based proposal rather than a new rule
The agencies describe the proposal as supervisory guidance, not a binding regulation. That distinction is central to understanding the announcement. The release presents the document as an aid to financial institutions, rather than a rule that itself creates enforceable legal obligations.
Even so, non-binding status does not make the consultation inconsequential. Supervisory guidance sets out an agency view of sound practices and can influence the questions institutions encounter in examinations. Here, the agencies say their proposal reflects supervisory experience and lessons from reviews of financial institutions’ third-party risk-management practices. That stated basis places the proposal within the agencies’ supervisory work rather than in a legislative or rulemaking mandate described in the material.
The proposal is also expressly principles-based. The release says that approach is intended to help banks and credit unions align and tailor risk-management practices to individual third-party relationships. In practical terms, the announced objective is a risk-sensitive framework, not an assertion that each vendor, provider or contractual arrangement requires an identical response. The material does not specify the proposed principles or prescribe particular operational steps, so the available record does not establish how detailed the final guidance might become.
That limitation is important for financial institutions assessing the announcement. The release supports the conclusion that the agencies want comments on a proposed approach to third-party risk, and that they favor tailoring practices to the relationship involved. It does not, on its own, establish the full set of expectations that institutions would face under a finalized document. Those details would rest in the Federal Register notices and associated materials identified by the agencies.
Existing guidance could be replaced if the proposal is finalized
The agencies have linked the consultation to a potential consolidation of existing guidance. If the proposal is finalized, the federal bank regulatory agencies plan to rescind current third-party risk-management guidance and replace it with the final document. Their stated aim is greater consistency and prudent innovation in banking.
That is a prospective plan, not a completed replacement. Existing guidance has not been described in the supplied material as rescinded, and no final version has been announced. The conditional language matters: the agencies are soliciting input before deciding whether and how to complete the proposed transition.
A replacement could carry significance beyond the wording of any one supervisory document. A common final framework may affect how institutions organize their own assessment of outside relationships, particularly where practices have been informed by earlier agency guidance. But the release does not say whether every existing document would be withdrawn on the same timetable, whether any provisions would be retained, or how institutions would be expected to move from old material to a final framework. Those are among the practical questions that public comments could address, although the agencies have not set them out in the supplied announcement.
The announcement does make clear that the agencies view consistency and prudent innovation as paired objectives. There is no further explanation in the available source of how the draft balances those objectives. It would therefore be premature to characterize the proposal as either a tightening or a loosening of supervisory expectations. The source supports neither conclusion.
Community banks and core providers receive separate attention
Alongside the proposed guidance, the federal bank regulatory agencies issued a statement on community banks’ engagement with core service providers. The statement discusses factors the agencies will consider when making supervisory and enforcement decisions related to those providers.
The separate statement gives community-bank relationships with core providers a distinct place in the announcement. However, the release does not enumerate the factors that will be considered, define the relevant provider relationships in greater detail, or describe particular supervisory or enforcement outcomes. It should not be read from this announcement alone as a finding against any bank or provider, nor as a statement that a particular kind of relationship has failed to meet regulatory expectations.
Its significance lies instead in the agencies’ decision to address those relationships directly while consulting on the broader framework. Community banks and the firms that provide core services may look to the statement for the agencies’ treatment of supervisory and enforcement considerations, but the supplied record does not allow a fuller characterization of its content.
The Federal Reserve also separately requested comment on a proposed third-party risk-management guide for community banks under its supervision. The Board described that guide as a companion to the broader proposal. This separate consultation means the September 11 package contains both a shared, cross-agency proposed framework and a Federal Reserve-specific proposed guide focused on the community banks it supervises.
That division should not be collapsed into a single new requirement. The broader proposed guidance was requested jointly by the FDIC, Federal Reserve Board, NCUA and OCC. The companion guide was a separate Federal Reserve request. The materials supplied do not indicate that the companion guide applies to institutions supervised by the other agencies.
The comment window starts with Federal Register publication
Comments are due 60 days after publication of the proposed guidance in the Federal Register. The September 11 announcement does not provide the resulting calendar deadline because the supplied evidence does not state a publication date. Readers should therefore distinguish the date of the joint announcement from the start of the stated comment period.
The release identifies Federal Register notices for both the proposed third-party risk-management guidance and the proposed guide for traditional community banking organizations. It also identifies the joint statement on community banks’ engagement with core service providers, a Board memorandum, and statements by Federal Reserve Governors Barr and Cook. The supplied context establishes that these documents were listed with the announcement, but does not provide their contents. No conclusions about their reasoning, recommendations or individual viewpoints can responsibly be drawn here.
For institutions, the immediate confirmed event is the opening of a request-for-comment process, not the imposition of a final regime. For regulators, the consultation supplies a formal channel to receive input before a possible replacement of existing guidance. For the broader financial-services market, the notice concerns supervisory expectations around outside relationships; the available material reports no market-price move, earnings consequence or company-specific financial effect. It offers no basis for investment conclusions or predictions of returns.
What the announcement leaves open
Several consequential questions remain unanswered by the release. It does not state when either proposal will appear in the Federal Register, when the 60-day clock will expire, how many comments the agencies expect, or whether the final text will differ from the proposal. Nor does it set a date for any rescission of existing guidance, which is contingent on finalization.
It also does not detail the relationship-specific risk factors that institutions would be asked to weigh, the factors addressed in the community-bank core-provider statement, or the interaction between the joint guidance and the Federal Reserve’s companion guide. Those omissions are not evidence that such detail is absent from the underlying notices; they are limits of the source material available for this report.
The announcement is published as a joint release on the Federal Reserve Board’s official website and identifies the four participating agencies. That is primary agency documentation for the fact of the request and the related statement. Nonetheless, this report has not been independently corroborated beyond the supplied agency release and its accessible page context. Readers should treat descriptions of the underlying documents as limited to what that release states until the full notices and materials can be separately reviewed.
For further context on this subject, see US sanctions Turkish bank over alleged Iran links as lender plans legal challenge.
Reporting notes
What is confirmed: Comments are due 60 days after Federal Register publication; the available material gives no calendar deadline.
Why this matters: The proposal could replace existing supervisory guidance if finalized, while remaining non-binding.
What remains unclear: The final text, publication date, transition timing and detailed supervisory factors are not established by the supplied release. This report is based on one source and has not been independently corroborated.
