The Banking Agencies Just Proposed to Throw Out the TPRM Checklist. Here's What the New Risk-Based Framework Actually Expects.

TL;DR

• On September 11, 2026, the OCC, Fed, FDIC, and NCUA jointly proposed new interagency TPRM guidance to replace the June 2023 version — comment period closes November 16, 2026
• The most significant change: the proposal states there are no generally applicable expected contract terms for any third-party relationship, even high-risk ones
• The framework shifts from prescriptive process checklists to a risk-based approach where oversight intensity scales with the magnitude and likelihood of harm
• Lower-risk relationships qualify for simplified oversight; institutions can explicitly accept third-party risk within their risk appetite without supervisory criticism
• The July 2024 joint statement on bank deposit arrangements with third parties and the May 2024 community bank guide would also be rescinded if the guidance is finalized; the core service provider joint statement issued simultaneously remains in effect

For the last three years, the compliance industry has been building TPRM programs to a checklist. Lifecycle stages — due diligence, contract negotiation, ongoing monitoring, exit — with expected contract provisions at each stage. Performance metrics. Audit rights. Incident notification timelines. Subcontracting approval rights. The 2023 interagency guidance was the source document, and examination findings cited gaps against it.

The agencies just proposed to take the checklist away.

On September 11, 2026, the OCC, Federal Reserve Board, FDIC, and NCUA — joining as a co-issuer for the first time — published proposed interagency guidance on third-party risk management. The proposal would rescind and replace the June 2023 guidance with a framework that is explicitly non-prescriptive, risk-based, and designed to be proportionate to the actual risk of each vendor relationship.

The comment period closes November 16, 2026.

What the 2023 Guidance Created

The June 2023 interagency guidance gave third-party risk programs a framework that was comprehensive in coverage and specific in expectations. The lifecycle it described — planning, due diligence, contract negotiation, ongoing monitoring, termination — became the standard structure. The recommended contract provisions became a de facto checklist: service-level agreements, data security requirements, incident notification requirements, subcontracting restrictions, audit rights, and exit and transition provisions.

Examiners applied those provisions as floor requirements. Institutions that lacked them in contracts with higher-risk vendors received findings. The practical effect was that contract negotiation with vendors became a compliance exercise as much as a commercial one: compliance teams verified that agreements hit the expected provision list before sign-off.

The 2023 guidance also introduced tiering — critical activities got heightened scrutiny — but the tiering didn’t change what was expected for high-risk relationships, it mostly determined who did the due diligence and how frequently.

Industry criticism was consistent: the guidance was applied as if it were a rule. Examiners cited gaps against specific guidance elements, which had the effect of converting non-enforceable supervisory guidance into effective compliance requirements.

The Core Shift: Risk-Based, Not Process-Based

The September 2026 proposed guidance is organized differently. Rather than defining a lifecycle with expected steps at each stage, the proposal centers on a risk assessment methodology.

The two-factor risk assessment. Under the proposed framework, institutions assess each third-party relationship based on two factors: the magnitude of potential harm and the likelihood of that harm materializing. This is a shift from the 2023 approach, which weighted relationships primarily by function category (critical activities, higher-risk activities, lower-risk activities) without explicitly incorporating likelihood. A vendor relationship with low harm potential gets lighter oversight regardless of the vendor category. A vendor relationship with high harm potential and high failure likelihood gets intensive oversight — defined by the institution, not by a regulatory template.

No mandatory contract terms. The proposal states explicitly that there are “no generally applicable expected contract terms for third-party relationships — even for higher-risk relationships.” This is a direct reversal of the 2023 approach. Contract terms are now determined by the institution’s risk assessment. A lower-risk vendor relationship may need nothing beyond a standard commercial contract with basic confidentiality provisions. A higher-risk relationship may need extensive SLAs, exit rights, and oversight mechanisms — but the institution determines what is appropriate, not a checklist.

Simplified oversight for lower-risk relationships. The proposed guidance describes practical tailoring for lower-risk vendor relationships: streamlined inventories, reduced due diligence that relies on publicly available information, standard contracts without customized negotiation, and less frequent ongoing monitoring. This is a meaningful operational change for institutions with large vendor populations. Many TPRM programs have applied full lifecycle requirements to vendors that pose limited actual risk, consuming compliance resources that would be better directed at material third-party exposures.

Risk acceptance is explicitly legitimate. The 2026 proposed guidance states that institutions can accept third-party risk within their stated risk appetite without supervisory criticism. Acceptance is a valid risk response — documented in a risk assessment, subject to management sign-off, consistent with board-approved risk appetite — not a finding. This is a significant departure from an examination culture where any identified vendor risk triggered a remediation expectation.

What Doesn’t Change

Several fundamental obligations are unchanged:

The third-party oversight requirement is not eliminated. The proposed guidance reduces prescription, not expectation. Institutions remain responsible for identifying, assessing, and managing risks from third-party relationships. The shift is from mandatory steps to institution-defined controls proportionate to risk. An institution that uses the loosened standards to underinvest in oversight of genuinely high-risk relationships is not compliant — it has simply failed to adequately assess risk.

Higher-risk relationships still require robust oversight. A core processor, a cloud infrastructure provider, a model vendor, a payment processor with direct access to customer funds: these are high-harm, high-likelihood relationships. The proposed framework still expects institutions to have commensurate controls. The difference is that those controls are now defined by the institution’s risk assessment rather than specified in guidance. For most well-run TPRM programs, this doesn’t change much. It gives more flexibility in how you structure oversight, but the oversight expectation remains.

The core service provider joint statement is still in effect. The September 2026 joint statement on core service providers — issued simultaneously with the proposed TPRM guidance and addressed in detail last week — is not being rescinded. That statement specifically addresses the risks institutions face with their core system providers (deconversion fees, audit right limitations, long contract terms, concentration risk) and the examiner scrutiny those contracts will receive. It operates alongside the proposed TPRM guidance.

What Is Being Rescinded

If finalized, the proposed guidance would replace the 2023 guidance and what the agencies call the “Supplemental TPRM Resources” (91 FR 58536):

The June 9, 2023 interagency guidance on third-party risk management. This is the primary document the proposed guidance replaces. All institutions currently using the 2023 lifecycle and contract provision frameworks should map their programs against the proposed replacement and identify what changes.

The Supplemental TPRM Resources. These are the OCC’s guidance on foreign-based third-party service providers (OCC Bulletin 2002-16), the July 25, 2024 joint statement on banks’ arrangements with third parties to deliver bank deposit products and services (OCC Bulletin 2024-20, Federal Reserve SR 24-5, FDIC FIL-45-2024), and the May 2024 “Third-Party Risk Management: A Guide for Community Banks” (OCC Bulletin 2024-11). The deposit-arrangements statement is the one BaaS banks know best: it addressed the risks of delivering deposit products through fintech partners. Institutions with active BaaS programs should read the current enforcement landscape for context on how regulators continue to approach bank-fintech supervision.

The Practical Compliance Implication: Risk Assessment Quality Is Now the Control

Under the 2023 guidance, a TPRM program that followed the lifecycle steps and hit the contract provision checklist was defensible in examination. Under the proposed 2026 framework, the defenses shifts: the quality of your risk assessment is what justifies your oversight choices.

This is harder, not easier.

If you have a vendor relationship where you’ve accepted risk within risk appetite, the examiner’s question is not “did you hit the contract provision list?” — it is “is your risk assessment accurate, and is your accepted exposure appropriate?” If your risk assessment failed to identify a material harm vector, or if you accepted risk that exceeded your documented risk appetite, you have a problem. The checklist at least gave you a deterministic test. A risk-based framework requires judgment, and judgment requires documentation.

For TPRM programs built around the 2023 checklist model, the transition to a risk-based framework means building the underlying risk assessment capability. That means:

• Documented risk assessment methodology: How does the institution determine magnitude and likelihood? What inputs go into the assessment? Who approves the risk tier assignment?
• Tiered vendor inventories: Lower-risk vendors get a lighter inventory entry. Higher-risk vendors get full documentation. The tiering criteria need to be explicit.
• Risk acceptance procedures: If the institution is explicitly accepting third-party risk within risk appetite, that acceptance needs to be documented — who assessed it, what the risk is, what the exposure is, who approved, when it’s reviewed.
• Contract strategy by risk tier: Contract terms are now institution-defined for each tier. The TPRM policy needs to specify what baseline contract requirements apply at each risk level, how exceptions are managed, and how the contract review intersects with the risk assessment.

The vendor concentration risk framework is a companion consideration: understanding not just individual vendor risk but portfolio-level concentration in critical infrastructure is part of the risk assessment quality that the proposed framework implicitly expects.

NCUA’s Addition

The 2026 proposed guidance marks the first time NCUA has co-issued interagency TPRM guidance. This brings federally insured credit unions under the same proposed framework as federally supervised banks. Credit unions that have managed vendor risk under NCUA Letter 01-CU-20 and subsequent NCUA guidance will need to assess how the proposed interagency framework aligns with current NCUA expectations once final guidance is issued.

So What? What to Do Before November 16

The comment period closes November 16, 2026. That is also when your compliance team should have completed its gap assessment.

Step one: Map current program to the 2023 guidance. Document where your TPRM program relies on 2023 guidance-specific requirements — the contract provision checklist, the lifecycle stages, the due diligence templates. These are the areas that will need to be rebuilt or reframed under a risk-based approach.

Step two: Assess your risk assessment maturity. The proposed framework shifts the burden from following a checklist to making defensible risk judgments. If your current program doesn’t have an explicit risk assessment methodology with documented criteria for magnitude and likelihood, you need to build one before the guidance finalizes.

Step three: Identify your higher-risk relationships. Under the proposed framework, higher-risk relationships still require robust oversight — but the oversight is institution-defined. Review your material vendors and confirm that your oversight of each is commensurate with actual risk, not just compliant with checklist steps.

Step four: Consider commenting. If your institution has specific concerns about the proposed framework — how it applies to community banks with limited resources to conduct sophisticated risk assessments, how core service provider oversight interacts with the general framework, or how the NCUA integration affects credit union programs — the comment period is the opportunity to make that record. Comments are submitted to all four agencies by November 16.

The proposed guidance is not finalized. When finalized, it is guidance — not a rule — and explicitly non-enforceable as a standalone basis for supervisory action. But it will shape examination expectations when it is final, and programs that have invested in the 2023 checklist model will need to transition.

The Third-Party Risk Management (TPRM) Kit follows the 2023 guidance in effect today and labels this proposal “Proposed only” on its Regulatory Reference tab. As you plan for the change, the guide summarizes what the proposal would change, and the Contract Provisions tab shows which of today’s 17 contract topics your contracts already cover.