U.S. Bank Regulators Propose New Third-Party Risk Rules: What It Means for Banks and Customers
On September 11, 2026, the Office of the Comptroller of the Currency, in coordination with the Federal Reserve, the Federal Deposit Insurance Corporation, and the National Credit Union Administration, issued proposed guidance on how banks and credit unions should manage the risks created by outside companies they rely on. The proposal is not yet final. What it proposes, in plain terms, is that institutions should scale their oversight of a third party to the actual risk that relationship poses, rather than applying the same level of scrutiny to every vendor, technology provider, or partner.
- Federal banking regulators proposed updated third-party risk guidance on September 11, 2026, and are seeking public comment
- If finalized, the proposal would replace the agencies' existing 2023 third-party risk guidance
- The framework emphasizes proportionality: oversight should reflect a bank's size, complexity, and risk profile, and the magnitude and likelihood of potential harm from each relationship
- Community banks and their relationships with core service providers receive particular attention in a companion statement
- This is proposed guidance, not a final rule — comments are due 60 days after publication in the Federal Register
- Consumers may not notice a direct, immediate change, but the framework matters because many everyday banking services run through third parties operating behind the scenes
Third-Party Risk, 2026 Proposal — The Numbers That Matter
Four federal banking agencies acted together. Here's what's actually on the table.
Figures reflect the joint proposal and Federal Register notice as of September 11, 2026. This is educational context, not a summary of every provision — see Sources & Methodology below for the full documents.
Why Are U.S. Regulators Revisiting Third-Party Bank Risk?
Modern banks depend on outside companies for technology, payments, data, software, cloud infrastructure, core processing, and specialized services. Almost every bank uses third parties in some form, so the regulatory question was never really "does a bank use a third party?" The more useful question — and the one this proposal is built around — is "how much risk does this specific relationship actually create?" The agencies said the proposed guidance is intended to help banks and credit unions "better align and tailor their third-party risk management practices to the risks of individual third-party relationships."
What This Article Is Not Saying
This is not a claim that the proposal is already final law, that banking is "becoming deregulated," that FDIC deposit insurance is changing, or that fintech partnerships have become automatically safer or riskier. It is a proposed framework, open for public comment, that would change how third-party risk is supervised if finalized.
What Is Third-Party Risk Management?
Third-party risk management is the process a bank or credit union uses to identify, assess, monitor, and control the risks created by companies that provide services to it. That can include cloud providers, payment processors, core banking providers, fintech companies, software vendors, and other specialized service providers. Importantly, "third party" does not automatically mean "fintech" — a core processor serving a community bank for decades is a third party too, and so is a cloud infrastructure vendor.
What Would the Proposed Framework Actually Change?
Tap through the three defining shifts the agencies described in their September 11, 2026 announcements.
Wording drawn directly from the agencies' own September 11, 2026 announcements. This explainer reflects the proposal as published on that date and is not a comprehensive summary of the full guidance text.
Why Community Banks Matter Here
Community banks often have fewer internal resources than large national institutions, yet they can depend heavily on a single core service provider for critical infrastructure — account processing, payments, and more. The agencies issued a companion statement specifically addressing community banks' relationships with core service providers, including challenges around due diligence, ongoing monitoring, and contract terms. That does not mean community banks are unsafe; it means a small institution's dependence on one critical vendor can be operationally significant, which is exactly the kind of relationship regulators say should get closer attention under a risk-based approach.
Where Fintech Fits Into the New Risk Framework
Bank-fintech partnerships can involve payments, account infrastructure, software, customer onboarding, compliance technology, and transaction processing — much of it running on embedded banking infrastructure that customers never directly see. In discussing the proposal, a Federal Reserve governor's statement specifically raised cybersecurity, consumer protection, record management, and anti-money-laundering considerations in bank-fintech arrangements. The proposal doesn't single out fintech as uniquely risky — it asks banks to evaluate each relationship, fintech or otherwise, based on what could actually go wrong and how likely that is.
What Could Go Wrong When a Bank Depends on a Third Party?
A qualitative look at where concern tends to concentrate, based on the factors the proposal itself lists — not a numerical or regulatory risk rating.
| Risk Area | Typical Concern Level | Why |
|---|---|---|
| Cybersecurity | Higher | Access to sensitive systems or customer data raises the stakes of a breach |
| Operational outage | Higher | Critical services with few alternatives can disrupt customer access if they fail |
| Data management | Moderate | Depends heavily on what data is shared and how it's protected |
| Payment processing | Higher | Directly affects whether transactions complete as expected |
| Compliance | Moderate | Varies by how much regulatory responsibility the relationship touches |
| Business continuity | Moderate | Depends on whether contingency arrangements exist |
| Vendor with limited alternatives | Higher | Little ability to switch providers if something fails |
| Low-sensitivity, easily replaceable vendor | Lower | Limited data access and readily available alternatives |
Educational scenario reflecting the general risk factors described in the September 11, 2026 proposal — not a regulatory assessment of any specific bank or vendor.
Does This Mean Banks Are Becoming Less Regulated?
Not necessarily. The proposal changes how risk management and supervisory expectations are structured — it is not a blanket removal of bank safety, consumer protection, or legal obligations. A bank's use of a third party does not reduce its responsibility to operate safely and in compliance with applicable law, a principle carried over from the existing interagency guidance. Risk-based regulation is not the same thing as no regulation; it's a statement about where supervisory attention is concentrated.
How Much Might a Bank Depend on This Type of Service?
Select a service type to see a general educational read on typical dependency level. This is not a regulatory assessment of any bank.
Educational scenario — not a regulatory assessment. Actual dependency and risk depend on the specific bank, provider, contract, and available alternatives.
What Does This Mean for Bank Customers?
Customers should not assume their deposit insurance changed, that their bank became less regulated, that fintech partnerships are automatically unsafe, or that every third-party provider represents a problem. What is worth understanding is that many banking services depend on outside providers, that operational resilience and cybersecurity matter regardless of who ultimately built the technology, and that regulators are trying to clarify — not eliminate — how that risk should be managed.
Visual Illustration: Bank, Fintech, and the Risk Chain
This original illustration is based on the themes discussed in this article and is for educational purposes only.
Illustrative graphic created for educational purposes. Not an official graphic from the OCC, Federal Reserve, FDIC, or NCUA.
A Service Fails. Who's Actually Responsible for What?
Click a link in the chain — Bank → Fintech → Payment Processor → Cloud Provider — to see, in general educational terms, what that layer is typically responsible for.
General educational framing, not a legal conclusion about liability. Actual responsibility depends on contracts, applicable law, and the specific facts of any failure. As a customer, you are not expected to understand the full infrastructure chain behind your bank.
This checklist is educational. It is not a regulatory compliance test and does not evaluate any specific bank.
What Happens Next?
The proposal is subject to public comment, with comments due 60 days after publication in the Federal Register. It is not the final framework — the agencies may modify it based on feedback before issuing final guidance. Only once final guidance is issued should the language be treated as authoritative. No finalization date has been set, and this article does not predict the exact final outcome.
Related Regulatory Context
This proposal sits alongside other recent U.S. banking developments, including recent U.S. banking compliance changes and cases that illustrate how bank risk can affect customers and depositors. It also comes as the growing role of fintech-bank partnerships continues to shape how everyday banking products actually get built and delivered.
Frequently Asked Questions
What is third-party risk management in banking?
It's the process a bank or credit union uses to identify, assess, monitor, and control risks created by outside companies that provide it services, such as payment processors, cloud providers, or core banking systems.
Why are U.S. regulators changing the guidance?
The OCC, Federal Reserve, FDIC, and NCUA said the proposal is meant to help banks better tailor their third-party risk practices to the actual risk of each relationship, rather than applying broad, uniform process requirements.
Does the proposal affect fintech companies?
It affects how banks manage relationships with all third parties, fintech included. A Federal Reserve governor's statement specifically raised cybersecurity, consumer protection, and AML considerations in bank-fintech partnerships.
Does this change FDIC deposit insurance?
No. This proposal is about third-party risk management guidance for banks; nothing in the September 11, 2026 announcements changes FDIC deposit insurance.
Does this mean banks are becoming less regulated?
Not necessarily. The proposal changes how risk management is structured and prioritized — it does not remove banks' underlying safety, soundness, or compliance obligations.
Why are community banks specifically mentioned?
Community banks often depend heavily on a small number of core service providers, so the agencies issued a companion statement addressing due diligence, monitoring, and contract terms specific to those relationships.
Could third-party failures affect bank customers?
Potentially, since many banking services run through third parties behind the scenes — which is part of why regulators are focused on how banks manage those relationships.
When would the new guidance take effect?
Not yet. The proposal is open for public comment, due 60 days after Federal Register publication, and could be modified before any final guidance is issued. No finalization date has been announced.
Can You Read Past the Regulatory Headline?
Answer 6 quick questions about how you'd interpret a story like this one. This is a reflection tool, not a rating of any bank, regulator, or provider.
This tool reflects your own reasoning back to you for educational purposes only. It does not represent the OCC, Federal Reserve, FDIC, NCUA, or any bank.
