US Regulators Propose Tailored Third-Party Risk Guidelines for Banks
The US government has proposed new guidelines for banks to manage third-party risks, which will allow them to tailor their oversight to each external relationship. The proposal, released on September 11 by four federal regulators, would replace existing guidance issued in 2023 and 2024.
Under the proposed framework, banks and credit unions would evaluate both the potential harm from an outside provider and the likelihood of that harm occurring. This risk-based approach would allow institutions to use less detailed checks or standard contracts for relationships with lower risks.
The proposal also acknowledges that financial institutions may accept some residual risk after considering their own risk appetite, tolerance, and ability to operate safely.
Community banks with less than $30 billion in assets will receive a separate practical guide, which covers operational resilience, information security, legal compliance, and financial resilience. The Federal Reserve has requested comments on this companion guide, which aims to provide more detailed guidance for smaller institutions.