The Office of the Comptroller of the Currency (OCC), the Board of Governors of the Federal Reserve System, the Federal Deposit Insurance Corporation (FDIC), and the National Credit Union Administration (NCUA) are seeking comments on proposed third-party risk management guidance. The proposed guidance aims to provide a principles-based approach to managing risks associated with third-party relationships, emphasizing risk identification and assessment as the foundation of a risk-based approach. This approach would enable banking organizations and examiners to focus on material financial risks and violations of laws and regulations, rather than ineffective and counter-productive check-the-box exercises. The proposed guidance would replace the 2023 Interagency Guidance on Third-Party Relationships: Risk Management and the Supplemental TPRM Resources.
The agencies invite comments on all aspects of the proposed guidance, which includes four components: risk identification and assessment, risk oversight, residual risk acceptance, and governance. The proposed guidance emphasizes that banking organizations are responsible for operating in a safe and sound manner and adopting risk management practices that are best suited to managing the specific risks they face.
Comments on the proposed guidance must be received on or before the date that is 60 days after the date of publication in the Federal Register. Comments can be submitted through various methods, including the Federal eRulemaking Portal, mail, hand delivery, or courier.
The proposed guidance does not set forth enforceable standards or prescriptive requirements, and non-compliance with this guidance will not result in supervisory action against a banking organization. Any supervisory criticism will be specific to a banking organization's operations, financial condition, or other relevant factors, consistent with applicable legal standards.