On 11 September 2026 the OCC, the Federal Reserve, the FDIC and the NCUA proposed revised interagency guidance on third-party risk management that would rescind the guidance issued in June 2023. According to Skadden’s summary, the agencies acknowledged that the 2023 text had been “interpreted in an overly broad manner”, and the proposal moves away from process-driven examples toward tailored judgment. Comments are due 16 November 2026.
This is a proposal, not final guidance, and it applies to US-supervised institutions. But any bank, NBFC, insurer or fintech partner running vendor oversight should read the direction closely, because supervisors elsewhere are moving the same way. This article is general information, not legal advice.
Crest.Digital’s TPRM platform applies rule-based tiering, due diligence and monitoring to every third party, so the right depth reaches the right relationship.
Explore the PlatformWhat the Agencies Actually Proposed
Drawing on Sullivan & Cromwell’s analysis and the agencies’ published proposal, four themes stand out. Read the primary text for exact wording.
Four Themes in the Proposal
- Risk-based identification: Banks need not identify every conceivable risk, and the same type of relationship may reasonably be rated higher by one bank and lower by another.
- Proportionate oversight: Practices should be commensurate with the bank’s size, complexity and risk profile, with streamlined reviews for lower-risk providers.
- Residual risk acceptance: Agencies would not expect banks to eliminate third-party risk, and a relationship can continue if residual risk is within tolerance.
- Flexible governance: There is no one right way, and examiners are to give due consideration to reasonable, documented bank decisions.
Two companion items matter too: a guide for banks under $30 billion in assets, covering operational resilience, information security, compliance and financial resilience across common provider types, and a joint statement on core service providers describing the transparency, contract features and technology that supervisors will weigh.
The Real Shift: From Proving You Did Everything to Proving You Chose Well
Checklist TPRM asks, “Did we complete the form?” Risk-based TPRM asks, “Was this the right level of scrutiny for this relationship, and can we show why?” The second question is harder. It requires a defensible classification, a diligence package that varies by tier, monitoring that matches, and a record of the reasoning, including any gap that was accepted on purpose.
That is good news for teams drowning in identical questionnaires for call centres and cloud core platforms alike. It is a challenge for teams whose tiering lives in a spreadsheet nobody can audit. Our earlier pieces on vendor classification and tiering and small-supplier risk tiering set out how to build that foundation.
What Differs Between a Low-Risk and a High-Risk Relationship
The proposal gives examples of lower-risk providers, such as call centres, auditors and office security, receiving standard contracts and less frequent monitoring, while higher-risk relationships warrant comprehensive review with dedicated expertise. A practical way to express this in a program:
Vendor → Service → Criticality → Rule-Based Due Diligence → Approval → Monitoring Frequency → Reassessment
- Low tier: Standard contract, lightweight review, public and shared-assessment evidence, periodic monitoring.
- Mid tier: Targeted diligence on the risk areas that matter, defined contract protections, more frequent checks.
- High tier: Deep review, specialist input, subcontractor visibility, exit and resilience testing, continuous monitoring.
- Any tier: A recorded reason for the tier and for every exception.
Concentration and fourth-party exposure sit inside this logic. A low-spend provider that many critical services quietly depend on is not low risk, which is why portfolio-level concentration and the fourth-party chain belong in tiering, not as afterthoughts.
The 7-Step Model for Risk-Based Third-Party Oversight
Each step answers a question a supervisor or auditor is likely to ask, and each leaves evidence. The model is regulation-agnostic, so it works for a US bank, a UK or EU firm under DORA, or an Indian entity applying RBI outsourcing expectations.
Identify the Relationship and Service
Record the provider, what it does for the bank, which business lines depend on it and which data, systems or customers it touches.
Assess Inherent Risk and Criticality
Score the magnitude and likelihood of harm if the service fails, is compromised or is misused, including concentration and substitutability.
Assign the Tier
Place the relationship in a defined tier with documented rules, and let a person approve any override with a recorded reason.
Run Rule-Based Due Diligence
Apply the diligence package for that tier: light and standard for low risk, deep and specialist-led for high risk, using alternative evidence where documents are not available.
Approve and Contract Proportionately
Decide with the right approver, negotiate the terms that matter at that tier, and record any accepted residual risk.
Set Monitoring Frequency
Match monitoring cadence and signals to the tier, from periodic checks to continuous screening and event-driven alerts.
Reassess on Schedule and on Triggers
Re-tier when the service, ownership, performance or threat picture changes, and keep one audit trail from onboarding to exit.
Contract-stage and renewal controls follow the same tiering, as described in reassessing vendors at contract renewal. For sector context see TPRM for banking and financial services and DORA and NIS2 as vendor resilience discipline.
Crest.Digital’s TPRM Agents classify, collect, screen and re-test by tier, with human approval for exceptions and a full activity record. Explore TPRM Agents or see the industries we cover.
Evidence Under a Judgment-Based Model
When examiners are asked to give due consideration to reasonable bank decisions, the decision record becomes the product. The proposal also allows alternative sources, such as peer feedback, public filings, consultant assessments and shared assessments, to fill gaps when a provider will not hand over every document, though the bank remains accountable. That makes provenance important: which evidence, from where, reviewed by whom, and why it was enough for this tier.
What a Defensible Tiering Record Contains
- The classification logic: Rules and inputs, not a bare label.
- The diligence package: What was collected, what was substituted and why.
- The approval: Who accepted the residual risk, against which tolerance.
- The monitoring plan: Cadence, signals and triggers matched to the tier.
- The change history: Every re-tier, exception and reassessment on one timeline.
Internal Audit teams will test exactly this. A consistent trail is far easier to assess than scattered emails, which is the same argument we made in operational resilience and TPRM. Sector regulators such as the RBI take a comparable outcome-focused view of outsourcing, which is why the model travels.
Where Agentic AI Helps, and Where People Decide
Proportionality is expensive to run by hand, because every tier needs a different package and every change can move a vendor between tiers. This is where Agentic AI earns its place: agents classify new relationships against the rules, assemble the right questionnaire and evidence request, chase missing documents, screen ownership, sanctions and adverse media, and trigger reassessment when a signal changes. For evidence follow-up by phone, Voice AI for GRC can handle the repetitive calls, and Agentic GRC extends the same pattern to controls beyond vendor risk.
People stay in charge of the judgment calls: tier overrides, acceptance of residual risk, and decisions on high-risk relationships. Every agent action is logged, which turns flexibility into evidence. See end-to-end vendor risk governance for how the pieces connect.
Your Turn: How Do You Prove Proportionality?
- Same process for all: Every vendor gets the same questionnaire and the same review.
- Tiers on paper: We have tiers, but diligence and monitoring barely differ.
- Tiers that drive work: Tier sets diligence, approval, monitoring and reassessment, with a recorded reason.
Not every vendor needs the same diligence. Every vendor needs the right diligence. Tell us in the comments where your program sits when you share this on LinkedIn.
Crest Perspective
Banking regulators globally have moved from principles-based guidance to prescriptive expectations on third-party risk. DORA in Europe, OSFI B-10 in Canada, the 2023 US Interagency Guidance, and the RBI Master Directions each specify what a board-level third-party risk programme must contain. For regulated institutions, the question is no longer whether to have a TPRM programme but whether the programme’s documentation is sufficient to withstand a regulatory examination.
Frequently Asked Questions
On 11 September 2026 the OCC, Federal Reserve, FDIC and NCUA proposed revised interagency third-party risk management guidance that would rescind the June 2023 guidance. According to law-firm summaries from Skadden and Sullivan & Cromwell, the proposal stresses risk-based, proportionate oversight, flexible due diligence and more deference to a bank's reasoned judgment. A companion guide for banks under $30 billion in assets and a joint statement on core service providers were issued alongside. Comments are due 16 November 2026. It is a proposal, so final text may change.
Not in the sense of accountability. The agencies say they do not expect banks to eliminate third-party risk and that a bank may continue a relationship if residual risk falls within its tolerance, but the bank remains accountable for its decisions. What changes is the shape of the work: less uniform process for low-risk vendors, more depth where the magnitude and likelihood of harm are higher. A bank that cannot show why it chose a given level of diligence will be in a weaker position than before, not a stronger one.
It starts by classifying the relationship by the service provided and the harm that could result, then applying a defined due diligence package to that tier: a lighter standard review for low-risk providers and a deeper review, specialist input and tighter contract terms for high-risk ones. Monitoring frequency and reassessment triggers follow the same tier. Each decision, including any gap accepted and why, is recorded so it can be explained to a supervisor, an auditor or a board committee.
The proposal applies to US-supervised institutions, but the direction matters more widely. Supervisors in the EU, UK, India and elsewhere also expect proportionate, outcome-focused oversight of outsourcing and third parties, for example under DORA and RBI outsourcing rules. Global banks and their technology and service providers should expect clients to ask for tier-aware evidence rather than one standard questionnaire. Check the rules that apply to your own entity.
Agents can classify new relationships against rules, assemble the right due diligence package for each tier, chase documents, screen ownership, sanctions and adverse media, and trigger reassessment when something changes. People approve tiering exceptions, accept residual risk and decide on high-risk relationships, and every step is logged. That combination gives a bank proportionality it can evidence, which is exactly what a risk-based supervisory model rewards.