Regulators Propose Overhaul of Third-Party Risk Management Framework for Banks

The US Federal Reserve and other regulatory agencies have proposed a new framework for managing third-party risk in banks. The proposal, which was released on September 11, 2026, aims to replace the existing guidance issued in 2023. According to the regulators, the current framework has been interpreted too broadly and has led to an overly process-driven approach.

The new framework would scale oversight based on the magnitude and likelihood of harm, rather than tying it to 'critical activities'. This means that banks would no longer be required to maintain extensive inventories of contract provisions or monitor all relationships equally. Instead, they could tailor their approach to match the level of risk associated with each relationship.

The regulators also propose to eliminate prescriptive elements from the framework, such as expected contract terms. Banks would have more flexibility to decide how to manage third-party risk within their own risk appetite.

The proposal has been met with some dissenting views, however. Federal Reserve Governor Michael Barr dissented from both the proposal and the Community Bank Guide. The regulators expect to finalize the new framework in 2027, pending comments from stakeholders.