Overview
- The Federal Reserve, FDIC, NCUA and OCC published a joint, nonbinding proposal and opened a 60‑day public comment period; they say the final guidance will replace prior third‑party rules.
- The draft sets a principles‑based approach that tells banks to match the depth of vendor checks to the specific risk of each relationship instead of applying one standard to all providers.
- Regulators allow banks to accept limited residual risk and to rely on shared due diligence through consortia, standard contracts, certification bodies or consultants to cut repeated vendor work.
- The Fed released a companion guide for Reserve‑supervised community banks under $30 billion that gives practical steps on resilience, information security, legal compliance and vendor assessment.
- The package drew internal disagreement at the Fed: Governor Michael Barr formally dissented, warning a proposed “material financial risk” threshold and deference language could weaken oversight, while Governor Lisa Cook supported revision but asked for clearer rules on cybersecurity, records, consumer protection and anti‑money‑laundering duties.