Interagency guidance on third-party relationships
Also called 2023 third-party risk guidance, interagency TPRM guidance
The interagency guidance on third-party relationships is joint guidance from the Federal Reserve, FDIC and OCC, issued in June 2023, on how US banks should manage risks from vendors, fintech partners and other third parties. It sets expectations across the relationship lifecycle, scaled to the bank's size and the activity's risk.
How it works
The guidance replaced each agency's earlier vendor guidance with one framework. A bank's board and management stay responsible for activities handed to third parties, as if the bank did them itself. Oversight is risk-based: relationships supporting critical activities get deeper due diligence, stronger contract terms and closer monitoring. The guidance covers vendors, fintech partners, affiliates and other business arrangements, not only outsourcing.
It describes five lifecycle stages: planning, due diligence and selection, contract negotiation, ongoing monitoring and termination. Banks are expected to document each stage, report to the board and keep oversight proportionate to risk. In September 2026 the agencies and the NCUA proposed replacing it with shorter, more flexible guidance, but the 2023 guidance stays in effect until a final version is issued.
The rules
Sets risk-based expectations for managing third-party relationships across the lifecycle and replaced the agencies' separate earlier vendor guidance.
Banking organisations supervised by the Federal Reserve, FDIC and OCCGives practical resources for applying the 2023 guidance at smaller banks, with examples for each lifecycle stage.
Community banksWould rescind and replace the 2023 guidance and the 2024 community bank guide with more flexible, tailored guidance; not yet final.
Banks and credit unionsMakes services performed for a bank subject to examination by its regulator, and requires the bank to notify its regulator of service contracts.
Insured banks and their service providersCommon questions
Is the interagency guidance legally binding?
No. It is supervisory guidance, not a rule. Examiners use it to judge whether a bank manages third-party risk safely, and weaknesses can lead to findings or enforcement for unsafe practices.
Does the guidance apply to fintech partnerships?
Yes. It covers any business arrangement between a bank and another entity, including fintech and banking as a service partners, not only traditional outsourcing and vendors.
Is the 2023 guidance being replaced?
The agencies proposed replacement guidance in September 2026, with comments due in November 2026. Until a final version is issued, the 2023 guidance remains the current standard.
