Hello {{first name | there}},

Well, a few weeks back it was a “Happy Friday” for our Third-Party Risk Family. On September 11, the OCC, Federal Reserve, FDIC, and NCUA proposed new third-party risk management guidance for all of us to enjoy over the weekend. If finalized, it would rescind and replace the 2023 Interagency Guidance and its supplemental resources.

The agencies were refreshingly candid about why. The proposal notes “the agencies believe the 2023 Guidance frequently has been interpreted in an overly broad manner and with an insufficient focus on tailoring its risk management principles.” We think everyone can agree on the spirit of that one: principles, not checklists. Here’s what changed, what didn’t, and what we’d do about it. Let’s dive in. 🌊

Fewer Shoulds, More Judgment

The checklist era is winding down. The “show your reasoning” era is starting.

The biggest shift in the proposal isn’t a new requirement. It’s the removal of a lot of language that made old ones feel like requirements. The agencies say words like “should” didn’t convey tailoring well and pushed programs toward process over priority. So the “shoulds” in the previous guidance tend to disappear.

What changed:
Two things. First, deviation from the guidance, or from any of its examples, will not alone be a basis for supervisory action. That idea used to sit in a footnote. Now it has its own section. Second, the long lists are gone. The 2023 guidance gave us fourteen due diligence factors, seventeen contract provisions, and fourteen monitoring factors. Those become short examples, and the focus moves to tailoring risk to the relationship. The proposal even says no contract term is generally expected across all relationships, including higher-risk ones.

What didn’t change:
Accountability. Using a third party still doesn’t reduce your responsibility, and the proposal spells that out for affiliates, highly regulated providers, subcontractors, and outsourced risk functions. Non-enforceable also doesn’t mean unexamined. The agencies can still act on violations of law, unsafe or unsound practices, and material risks from weak TPRM. A vendor-caused breach that harms customers will still get a hard look. The question will be whether your tiering and oversight decisions were reasonable.

What it means for business:
Fewer prescribed items put more weight on your rationale. The proposal commits examiners to giving “due consideration” to reasonable judgment, which is great, as long as the judgment is written down. Now is a good time to look at the work your program does and ask one question: can we connect this to a material risk? If yes, keep it and document why. If not, it’s a candidate to retire once the guidance is final. One caution: keep right-to-audit, regulatory access, and data return terms on your higher-risk contract menu. The proposal stopped naming them, but they’re still how you get evidence.

Translation:
The checklist isn’t the standard anymore. Your reasoning is. Make sure it’s on paper.

Four Components, New Front End

Planning loses its stage, critical activities get a makeover, and residual risk acceptance finally gets its own seat at the table.

The proposal stops organizing TPRM around the lifecycle we’ve all drawn on whiteboards for years. In its place are four components: Risk Identification and Assessment, Risk Oversight, Residual Risk Acceptance, and Governance. Due diligence, contract negotiation, ongoing monitoring, and termination are still here, now as subsections of Risk Oversight. Planning is the stage that doesn’t make the trip. Risk Identification and Assessment isn’t a renamed planning phase. It starts with inventorying and categorizing your relationships, then identifying and assessing their risks. The old planning stage asked a different question: should we take this on at all, and is it worth the cost and risk?

What changed:
Critical activities now sound a lot more like higher-risk relationships. Instead of labeling an activity “critical,” the proposal focuses on the magnitude of harm a relationship could cause and the likelihood that it occurs. You can assess the overall relationship or individual activities, and there’s no prescribed formula. The other big change: residual risk acceptance becomes part of the process as its own component. The agencies say outright that eliminating risk is not expected, and that accepting it can be reasonable when information, bargaining power, or alternatives are limited. If you’ve ever tried to negotiate audit rights with your core processor, you know exactly who that sentence was written for.

What didn’t change:
Most of the work. You still need to know who your third parties are, understand the risk, conduct due diligence, negotiate contracts, monitor, and plan your exits. Board and senior management reporting, documentation, independent review, and reassessing when circumstances change all carry forward. This is a new structure, not a demolition.

What it means for business:
Map, don’t rebuild, but check the front end. Most of your current lifecycle maps to the four components with modest rework. Planning is the exception: it no longer has a named home, so decide where your business case and strategic-fit review lives. We’d keep it as the gate before a relationship enters Risk Identification and Assessment, because the cheapest risk to manage is the relationship you decide not to start. Next, add magnitude and likelihood to your inherent risk assessment, but keep operational criticality as its own attribute. It still matters for resilience when something breaks. Then make risk acceptance a real deliverable: who can accept at each level, what the decision record includes, and when it gets revisited. The proposal doesn’t prescribe a form, so it’s yours to design.

Translation:
New structure, mostly familiar work. Planning loses its stage, so don’t let it lose its place in your program. And “we accepted that risk” becomes a legitimate answer, as long as you can show who accepted it and why.