Banking Agencies Propose More Prescriptive Third-Party Risk Management Framework

Proposed guidance would require specific elements in bank policies and programs and could give added significance to FDIC’s proposed industry standard-setting organization

Executive Summary

The federal banking agencies have proposed new third-party risk management guidance that is more prescriptive than its emphasis on a “risk-based” approach might suggest. In addition to calling for risk-based oversight, the proposal identifies specific elements that banks should address in board-approved policies and throughout the life cycle of third-party relationships, including due diligence, contracting, ongoing monitoring, documentation, remediation, and termination.

The proposal is particularly significant when considered alongside the agencies’ separate statement acknowledging the difficulties community banks face in dealing with core service providers. It also sheds new light on the FDIC’s recently reported consideration of an industry standard-setting organization for third-party