OCC Third-Party Risk Guidance for US Banks in 2026

What Is OCC Third-Party Risk Guidance?

The Office of the Comptroller of the Currency (OCC) sets supervisory expectations for how national banks and federal savings associations manage risk from third-party relationships. The 2023 interagency guidance — issued jointly by the OCC, FDIC, and Federal Reserve — replaced OCC Bulletin 2013-29 with a single, principles-based framework that applies across all OCC-regulated institutions regardless of size.

Who Must Comply?

Every OCC-regulated institution is subject to the guidance. Community banks with simpler vendor portfolios face proportionally lighter scrutiny than large multi-charter institutions, but no bank is exempt. Examination intensity scales with the complexity and criticality of a bank's third-party relationships.

What Is a Critical Activity?

A critical activity is a third-party relationship that could significantly impact a bank's operations, expose it to material risk, or affect a large number of customers if the relationship fails. Core banking platforms, payment processors, and cloud infrastructure providers typically fall into this category and attract the closest supervisory attention.

Key Lifecycle Requirements

• Planning: Risk assessment before engaging a third party, proportionate to the activity's criticality.
• Due Diligence & Selection: Independent evaluation — a vendor SOC 2 report cannot substitute for the bank's own risk assessment.
• Contract Negotiation: Audit rights, data security requirements, exit provisions, and performance standards must be contractually documented.
• Ongoing Monitoring: Continuous, evidence-based monitoring for critical relationships rather than calendar-driven annual reviews.
• Termination: Documented exit plans for critical vendors, tested before they are needed.

What Changed in the 2023 Interagency Guidance?

OCC Bulletin 2013-29 was an OCC-specific document. The 2023 guidance harmonises standards across the OCC, FDIC, and Federal Reserve under one framework, giving banks operating under multiple charters or holding structures a single consistent standard. The principles-based approach gives institutions flexibility on implementation while maintaining clear expectations around risk management outcomes.

Frequently Asked Questions

What OCC Examiners Actually Look For

When OCC examiners assess a bank’s third-party risk programme, they look for evidence of ongoing management, not a one-time compliance exercise. Examination teams start by requesting the bank’s third-party inventory and risk ratings, then test whether documentation reflects independent analysis or simply acceptance of vendor-supplied materials.

The most common finding is a gap between stated policy and actual practice. A bank may have a policy requiring annual reassessment of critical vendors, but examination evidence reveals the policy is not being executed consistently. Examiners document this as a deficiency in programme effectiveness.

Key areas that attract closest scrutiny:

• Due diligence quality for critical activities. Examiners pull original due diligence files for a sample of critical vendors and assess whether the bank formed its own risk conclusions or simply collected questionnaire responses and SOC 2 reports without independent analysis.
• Contract completeness. For critical activities, examiners verify that contracts include audit rights, breach notification timelines, business continuity requirements, data security standards, and exit provisions.
• Escalation and board reporting. Examiners ask for evidence that material vendor issues are escalated appropriately and that the board receives regular reporting on third-party risk concentration.
• Exit planning. For the most critical activities, examiners expect documented, tested exit plans — not theoretical contingency plans written at onboarding and never revisited.

How the 2023 Guidance Changed Examination Practice

The interagency nature of the 2023 guidance has direct examination implications. Under OCC Bulletin 2013-29, OCC-supervised banks were examined against one standard, while Fed-supervised bank holding companies faced a slightly different framework. The 2023 guidance creates a single examination baseline across all three agencies, which matters most for large banking organizations operating under multiple regulatory charters.

The principles-based approach shifts examination methodology. Rather than checking a list of required programme elements, examiners now assess whether a bank’s third-party risk management activities are proportionate to the risk and complexity of its third-party relationships. A community bank with three critical vendor relationships and a large regional bank with 200 are both expected to have effective programmes — but what an effective programme looks like differs substantially.

Examiners are also placing greater emphasis on concentration risk. Banks with material concentration in a single cloud provider, core banking platform vendor, or payment network are expected to understand and document that concentration at the board level.

Integration With the FFIEC IT Examination Handbook

The FFIEC IT Examination Handbook provides supplemental guidance that examination teams use alongside the 2023 interagency guidance. The Outsourcing Technology Services booklet specifies supervisory expectations for technology service provider (TSP) risk management directly relevant to how banks should structure their critical vendor oversight programmes.

Banks that have aligned their third-party risk frameworks to both the FFIEC IT Handbook and the 2023 interagency guidance are better positioned for technology-focused examinations. The FFIEC handbook covers areas the interagency guidance leaves to institutional discretion, including specific requirements for service level agreements with TSPs and requirements around on-site examinations of TSPs.

Fintech and Non-Bank Third-Party Relationships

The 2023 guidance explicitly addresses relationships with fintech companies, marketplace lenders, and other non-bank entities that have become significant partners for regulated banks. These relationships present distinct challenges because fintechs often lack the compliance infrastructure of traditional enterprise software vendors — they may not have SOC 2 reports, may not have undergone regulatory examination, and may operate in jurisdictions with different data protection requirements.

OCC guidance expects banks to apply the same lifecycle management framework to fintech partnerships as to any other critical third-party relationship. For banks entering Banking-as-a-Service (BaaS) arrangements, the guidance is particularly relevant: the OCC has made clear that regulated banks bear full responsibility for their fintech partners’ compliance with federal consumer protection laws and anti-money laundering requirements.

Building an OCC-Aligned TPRM Programme: Practical Steps

Banks building or remediating their third-party risk programmes to align with OCC expectations should address five structural areas:

• Inventory completeness. The inventory must capture all third-party relationships, not just IT vendors. Arrangements with staffing agencies, professional services firms, and marketing partners that touch customer data or operational processes belong in the inventory.
• Risk classification methodology. Critical activity determinations should be documented and defensible. The methodology should distinguish between vendors that support critical activities and vendors that are themselves critical to an activity.
• Ongoing monitoring evidence. For critical relationships, continuous monitoring should generate dated, evidence-based documentation — Not attestations. Examiners want to see what monitoring was performed, what it found, and how findings were addressed.
• Contract standards enforcement. Contracts with existing critical vendors that lack required provisions should be identified as gap items with remediation timelines. New critical vendor contracts should be reviewed against a standard term checklist before execution.
• Board reporting cadence. The board or a board committee should receive at minimum annual reporting on programme performance, concentration risk, and any material third-party incidents.

OCC Third-Party Risk and Operational Resilience

The 2023 guidance aligns OCC third-party risk expectations with broader operational resilience frameworks that US and international banking regulators have been developing since 2019. The Basel Committee’s Principles for Operational Resilience (2021) and the FFIEC’s Business Continuity Management booklet both treat third-party relationships as a material operational resilience risk requiring active board-level oversight.

For US banks with international operations, aligning third-party risk programmes to both the 2023 interagency guidance and international frameworks — including DORA for EU operations, OSFI B-10 for Canadian operations, and the MAS TRM guidelines for Singapore — reduces the compliance overhead of maintaining separate programmes for each jurisdiction and demonstrates regulatory maturity to all supervisors.