Agencies Propose Tailored Risk-Based Guidance on Third Parties

The OCC, the FDIC, the Federal Reserve Board ("FRB"), and the National Credit Union Administration proposed guidance to help banking organizations tailor their oversight of third-party relationships to the reasonably assessed risk level of each relationship.

In the proposal, the agencies stated that the 2023 interagency guidance on third-party risk management (see prior coverage) issued by the FRB, the FDIC, and the OCC had frequently been interpreted in an overly broad manner. Banking organizations reported applying heightened oversight to third-party relationships without regard to the magnitude and likelihood of the risks each relationship actually posed. The proposal would rescind and replace the 2023 guidance. It encourages banking organizations to move away from uniform, process-driven controls and to prioritize oversight according to the magnitude and likelihood of the harm a relationship could cause.

The proposed guidance organizes risk management around four components: risk identification and assessment, risk oversight, residual risk acceptance, and governance. The four agencies explicitly noted that the proposal does not set forth enforceable standards or prescriptive requirements, and that non-compliance with the guidance will not result in supervisory action.

Comments on the proposed guidance are due 60 days after its publication in the Federal Register.