November 13, 2026

Agencies extend comment period for proposed third-party risk management guidance

WASHINGTON—Federal financial regulators announced on Friday an extension of the public comment period for a closely watched proposal aimed at updating how banks and credit unions oversee and manage risks stemming from relationships with outside vendors, service providers, and other external partners.

In a joint statement released late Friday afternoon at 4:15 p.m. EST, the Federal Deposit Insurance Corporation (FDIC), the Federal Reserve Board, the National Credit Union Administration (NCUA), and the Office of the Comptroller of the Currency (OCC) stated that stakeholders will now have until December 16 to submit their feedback. The public comment window had originally been scheduled to close a few days earlier, on November 16, giving industry participants, trade associations, and consumer advocates an additional month to evaluate the sweeping regulatory framework.

The proposed guidance, which was initially unveiled earlier in the autumn, is designed to reflect the collective supervisory experience of the federal regulatory agencies. It draws heavily upon valuable lessons learned from ongoing examinations of financial institutions and their evolving third-party risk management practices. As the modern banking sector grows increasingly reliant on outside technology firms, fintech partnerships, cloud computing providers, and specialized service contractors, federal regulators have placed heightened emphasis on ensuring that institutions maintain robust oversight over these critical business arrangements.

According to the regulatory agencies, the proposed framework is intended to help banks, savings associations, and credit unions effectively tailor their individual risk management practices to match the specific and unique risks associated with each distinct third-party relationship. Rather than imposing a rigid, one-size-fits-all mandate, the proposal is structured around a flexible, principles-based approach. Like all standard supervisory guidance issued by these regulatory bodies, the document is non-binding, meaning it outlines supervisory expectations and sound practices rather than establishing enforceable legal mandates.

When the federal bank regulatory agencies ultimately move to finalize the guidance, they plan to systematically rescind existing supervisory guidance concerning third-party risk management. The newly finalized framework will then replace these legacy documents to promote greater regulatory consistency across the financial sector while simultaneously fostering prudent, safe innovation within the banking industry.

Similarly, the National Credit Union Administration announced its intention to rescind its own existing third-party risk management guidance once the broader initiative reaches completion. The NCUA plans to conduct comprehensive internal reviews to update its related guidance framework as needed, ensuring that credit unions operate under clear and modern oversight standards that align with the realities of modern financial service delivery.

In a related announcement issued concurrently on Friday, the Federal Reserve Board stated that it is also independently extending the public comment period until December 16 for a separate, companion proposal. This companion document consists of a proposed third-party risk management guide tailored specifically for traditional community banks supervised directly by the Federal Reserve. By offering a dedicated comment timeline for this specialized community bank guide, regulators aim to ensure that smaller financial institutions have ample opportunity to weigh in on how the overarching risk management principles apply to institutions with more localized footprints and more limited operational resources.

The extension provides a welcome window for financial institutions of all sizes to review the intricate details of the proposals, assess their current vendor management systems, and prepare constructive feedback for the regulatory agencies ahead of the mid-December deadline.