Agencies extend comment period for proposed third-party risk management guidance
WASHINGTON — In a joint regulatory announcement issued late Friday afternoon, federal financial institution regulatory agencies formally announced an extension of the public comment period for proposed supervisory guidance regarding the management of risks stemming from third-party relationships. The decision provides banking organizations, credit unions, industry trade associations, and other interested stakeholders additional time to evaluate the regulatory text and submit comprehensive feedback to the governing bodies.
According to the official release issued at 4:15 p.m. EST on November 13, 2026, the Federal Deposit Insurance Corporation (FDIC), the Federal Reserve Board, the National Credit Union Administration (NCUA), and the Office of the Comptroller of the Currency (OCC) have collectively pushed back the deadline for public submissions. The comment period is now extended until December 16, offering the industry an additional month beyond the original November 16 deadline to formulate and file their perspectives on the regulatory initiative.
The underlying proposal, which initially caught the attention of compliance officers, risk managers, and legal counsel across the financial sector when it was introduced, is designed to modernize and clarify supervisory expectations surrounding how banks and credit unions oversee their external vendors and service providers. Regulators have emphasized that the proposed framework stems directly from their collective supervisory experience and the valuable lessons learned through routine examinations of financial institutions’ ongoing third-party risk management practices.
As the banking and financial services sector becomes increasingly reliant on outside vendors, technology providers, and fintech partnerships, the management of third-party relationships has evolved into a central focus for federal supervisors. The proposed guidance is intended to serve as a practical resource, helping individual banks and credit unions appropriately tailor their risk management frameworks to match the unique characteristics, scale, and complexity of each specific third-party relationship they maintain.
Rather than imposing a rigid, one-size-fits-all mandate, the proposed framework deliberately adopts a principles-based approach. Like all formal supervisory guidance issued by these federal agencies, the document is inherently non-binding, meaning it does not carry the force of law in the same manner as a formal regulation, but rather outlines supervisory expectations and safe practices that examiners will look for during routine institutional assessments.
A significant structural shift accompanies the long-term roadmap for this initiative. When the federal bank regulatory agencies eventually review the public comments, refine the text, and publish a finalized version of the guidance, they plan to systematically rescind existing third-party risk management guidance currently in place. This move is intended to establish a unified, cohesive standard across the industry, promoting greater consistency among examiners and fostering prudent, secure innovation within the modern banking sector.
Similarly, the National Credit Union Administration intends to rescind its own existing third-party risk management guidance once the broader process concludes. The NCUA has indicated that it will conduct its own internal reviews following the finalization of the interagency document to update related credit union guidance as necessary, ensuring that cooperative financial institutions are held to appropriate standards that reflect their unique cooperative structure and operational scope.
In a related and concurrent announcement on the same afternoon, the Federal Reserve Board declared that it would separately extend the comment period for a specialized companion initiative. The comment window for a proposed third-party risk management guide tailored specifically for Federal Reserve-supervised traditional community banks has also been extended through December 16. This parallel extension ensures that smaller, community-focused institutions—which often face distinct operational challenges and resource constraints when vetting and monitoring third-party vendors—have ample opportunity to provide tailored feedback on how the supervisory expectations apply to their specific business models.
The original proposal, published earlier in the autumn on September 11, 2026, set off a wave of review across institutional compliance departments. With the new December 16 deadline now in effect, industry stakeholders have a renewed window to engage with the regulatory agencies, ensuring that the final framework effectively balances robust safety and soundness principles with operational flexibility.
