Third-party risk management guidance 2026: what changes for banks

The third-party risk management guidance that banks have followed since June 2023 is about to be rewritten. On September 11, 2026 the OCC, the Federal Reserve Board, the FDIC and the NCUA published a proposed replacement and asked for comments by November 16, 2026. The proposal says the 2023 text "frequently has been interpreted in an overly broad manner" and with too little tailoring, and that once the new guidance is final the agencies plan to rescind the 2023 guidance and the resources that supplemented it.

For most vendor relationships this is relief. For a bank that has handed a provider the technology behind its bitcoin custody or its tokenized money, the practical effect is different, and this article works through it: what the agencies propose, what stays the same for a custody relationship, and what a risk committee can do before the comment period closes.

What the agencies say went wrong

The Federal Register notice is unusually candid about the 2023 guidance. Four problems are named.

• It tried to cover every kind of relationship with one list of considerations, so banks struggled to tell which items applied to a core provider, which to a fintech partner and which to a facilities vendor.
• Its concept of "critical activities" looked at the activity performed rather than at the size and likelihood of the harm a relationship could cause, so heightened procedures were applied to a wide range of vendors regardless of the risk they posed.
• Its examples, written with the word "should", were read as requirements, which the agencies say "unintentionally incentivized overly-process-driven approaches" that failed to prioritize higher-risk relationships.
• It was read to discourage arrangements with newer firms, even where those firms offered services that benefit the bank and its customers.

The remedy proposed is a shorter, principles-based document with risk identification and assessment as its foundation, so that banks and examiners "focus on material financial risks and violations of laws and regulations rather than ineffective and counter-productive check-the-box exercises."

How the proposed guidance is organized

The structure is simpler than the 2023 life cycle, and the order matters because it tells a bank where to spend its effort.

1. Risk identification and assessment. Identify the relationships, identify the risks each one carries, and assess them. A bank may decide not to keep detailed inventories of relationships that pose limited risk, such as clerical or office support services.
2. Risk oversight. Due diligence and selection, contract negotiation, ongoing monitoring and termination, each scaled to the assessed risk. The proposal states that there are "no generally applicable expected contract terms", even for higher-risk relationships.
3. Residual risk acceptance. After controls, some risk remains. The bank decides whether that remainder fits its appetite and documents the decision.
4. Governance. Clear roles, a stated risk appetite, reporting to senior management and the board, documentation of the key elements and periodic independent review of the program.

Two companion documents came out the same day. The Federal Reserve proposed a separate guide for the community banks it supervises, and the four agencies issued a joint statement on the factors they will weigh in supervisory and enforcement decisions involving core service providers.

What does not change for a custody relationship

A provider that generates keys, signs transactions or holds customer assets will sit at the top of any honest risk assessment. The magnitude of harm is the loss of customer property; the likelihood depends on controls the bank does not operate itself. Under the proposed guidance that assessment drives the oversight, so the due diligence, contract and monitoring work does not get lighter. The bank simply has to show why it is as deep as it is.

Three things the proposal leaves untouched are worth saying out loud to a board.

• Responsibility stays with the bank. The July 2025 joint statement on crypto-asset safekeeping, which the OCC, the Federal Reserve and the FDIC issued together, says a bank that uses a sub-custodian remains responsible for the activity. Nothing in the proposal revisits that.
• Permission to outsource is unchanged. OCC Interpretive Letter 1184 allows a national bank to outsource custody, including through a sub-custodian, subject to appropriate third-party risk management. The proposal changes what "appropriate" looks like, not whether it is required.
• Operational resilience is still expected for higher-risk relationships. The proposal names reviews of the provider's resilience plan, alternative providers that allow an easy transition, and critical data backed up at a physically and logically separate site.

Our 25 due diligence questions for a custody provider and the monitoring calendar were written against the 2023 life cycle. Both still apply. Under the new text they become the evidence behind a risk assessment rather than items on an agency list.

What does change, and how to use it

The proposal gives a bank room to put effort where the risk is. For a custody program that means four adjustments.

• Write the risk assessment first. State what the provider can do to customer assets, what the bank can do to stop it, and what would happen if the provider disappeared. A provider whose every material action requires a key the bank holds presents a different residual risk from one that can move assets alone, and the assessment should say so.
• Document residual risk acceptance. The new section is an invitation to record a decision that boards often make implicitly. Which risks remain after the bank's key, the transaction policies and the exit plan are in place, and who accepted them.
• Prune the rest of the inventory. Time saved on low-risk vendors is time available for the relationships that hold customer property.
• Keep contract terms tied to the assessment. With no standard list to point to, the terms a bank negotiates on audit rights, data return, incident notice and termination have to be justified by its own analysis. That is a stronger position in an examination, provided the analysis is written down.

The design of the custody arrangement feeds directly into the assessment. Our Bitcoin Custody product keeps the bank's own key in FIPS 140-3 Level 3 validated hardware and requires it for every transfer, and the security and compliance overview is organized so a risk team can map each control to the residual risk it reduces.

Before November 16

The comment period is the moment to raise what the proposal does not say. Three questions a bank with a digital asset program might put to the agencies: whether the "possession or control" language used in custody rules should be referenced in the guidance, how the agencies will treat a provider that is itself supervised, and what evidence they expect for residual risk acceptance at a community bank. The Federal Reserve's community bank guide will shape the answer for state member banks in particular.

Until final text arrives, the 2023 guidance remains in force. A bank that already runs a risk-based program has little to change. A bank that has been applying the same questionnaire to every vendor has a reason to start. Talk to us if you want to walk through the assessment for a custody relationship.

Frequently asked questions

Is the 2023 third-party risk management guidance still in effect?

Yes. The September 2026 document is a proposal. The agencies say that once the new guidance is finalized they plan to rescind the June 2023 interagency guidance and the supplemental resources issued in 2024, including the community bank guide and the joint statement on deposit arrangements with third parties. Until then, examiners continue to use the 2023 text.

What is the comment deadline for the proposed guidance?

Comments must be received by November 16, 2026. The notice was published in the Federal Register on September 15, 2026 by the OCC, the Federal Reserve Board, the FDIC and the NCUA. Each agency lists its own docket and submission method, and the Federal Reserve separately requested comment on a companion guide for the community banks it supervises.

Does the proposal reduce due diligence for a crypto custody provider?

Not in practice. The proposal scales oversight to the assessed risk of each relationship, and a provider that holds customer assets or controls signing keys will be assessed as high risk. The bank still verifies key management, segregation, financial condition and exit terms. What changes is that the depth is justified by the bank's own risk assessment rather than by a list in the guidance.

What is residual risk acceptance?

It is the step the proposal adds after controls are in place: the bank identifies the risk that remains, decides whether it fits the bank's appetite and tolerances, and documents who accepted it. For a custody relationship, that means recording which risks the bank's own key, transaction policies and exit plan do not eliminate, and confirming that management and the board accept them.

Does the proposal change whether a bank may outsource custody?

No. Authority to use a sub-custodian comes from OCC Interpretive Letter 1184 and comparable positions of the other agencies, subject to appropriate third-party risk management. The July 2025 joint statement on crypto-asset safekeeping confirms the bank remains responsible for the activity. The proposal changes how the risk management is scaled, not whether it is required.

This article is general information, not legal advice. The guidance discussed here is a proposal and may change before it is final. Consult your counsel and your primary regulator.