U.S. Banking Regulators Extend Comment Period on Proposed Third-Party Risk Management Guidance to Dec. 16

U.S. banking regulators are giving the public more time to weigh in on a major update to expectations for how financial institutions oversee outside vendors and partners.

The Federal Deposit Insurance Corporation (FDIC), Federal Reserve Board, National Credit Union Administration (NCUA), and Office of the Comptroller of the Currency (OCC) said they are extending the comment window on their proposed guidance for managing risks tied to third-party relationships. The deadline is now December 16, pushing back the original closing date of November 16.

The draft guidance is designed to reflect what regulators say they have learned through supervisory work, including insights gathered from examinations of banks’ and credit unions’ current third-party risk management programs. Rather than prescribing a single checklist, the proposal aims to help institutions calibrate oversight to the specific risks posed by each outside relationship—whether that relationship involves a core service provider, a technology vendor, or another external party supporting operations.

Regulators emphasized that the document uses a principles-based framework and, as with other supervisory guidance, it would be non-binding. Still, such guidance often shapes examination priorities and industry norms by setting out regulators’ expectations for governance, risk controls, and monitoring.

If adopted in final form, the federal banking agencies said they intend to withdraw existing third-party risk management guidance and replace it with the updated version. The goal, they said, is to improve consistency across the banking sector while supporting “prudent innovation” as institutions increasingly rely on specialized external providers.

The NCUA, which oversees federally insured credit unions, said it also plans to rescind its current third-party risk management guidance. In addition, the agency will carry out its own assessments to determine whether other related guidance should be revised.

Separately, the Federal Reserve Board announced another deadline extension to December 16—this one for a related proposal tailored specifically to traditional community banking organizations supervised by the Fed. That companion document focuses on third-party risk management for smaller, more traditional banks, where vendor reliance can still be significant but internal compliance resources may be more limited.

The announcements were accompanied by Federal Register notices covering both the broader interagency proposal and the Federal Reserve’s community-bank-focused guide.

Why it matters

Banks and credit unions are increasingly dependent on outside firms for critical functions—from payments and data processing to cloud services—making third-party risk a central safety-and-soundness issue. Extending the comment period gives institutions, vendors, and consumer advocates more time to influence guidance that could shape examinations and oversight expectations. Stakeholders will be watching whether the final version tightens expectations in areas like due diligence and ongoing monitoring, and how regulators balance risk control with innovation.