Agencies Propose New Third-Party Risk Management Guidance
The Office of the Comptroller of the Currency (OCC), Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation (FDIC), and National Credit Union Administration (NCUA) have jointly proposed new guidance for third-party risk management practices in banking organizations and credit unions.
The current 2023 Interagency Guidance on Third-Party Relationships: Risk Management has been criticized for being overly broad and focusing too much on the type of activity involved, rather than risk identification and assessment.
The proposed guidance would rescind and replace the existing 2023 guidance, introducing a 'residual risk acceptance' concept that allows institutions to accept some level of risk in third-party relationships, consistent with their risk appetite and tolerances.