Agencies Issue Final Guidance on Third-Party Risk Management — 2023-06-06

Federal bank regulatory agencies today issued final joint guidance designed to help banking organizations manage risks associated with third-party relationships, including relationships with financial technology companies. The final guidance describes principles and considerations for banking organizations’ risk management of third-party relationships. The final guidance covers risk management practices for the stages in the life cycle of third-party relationships: planning, due diligence and third-party selection, contract negotiation, ongoing monitoring, and termination. The final guidance includes illustrative examples to help banking organizations, particularly community banks, align their risk management practices with the nature and risk profile of their third-party relationships. The agencies plan to engage with community banks immediately and develop additional resources in the near future to assist them in managing relevant third-party risks. The final guidance replaces each agency’s existing general third-party guidance and promotes consistency in the agencies’ supervisory approaches toward third-party risk management.