Interagency Guidance on Third-Party Relationships: Risk Management (Board, FDIC, OCC, June 2023)

Why it Matters

Banks now depend on third parties for core processing, cloud infrastructure, payments, lending partnerships, and fintech products, and the agencies are clear that using a third party does not diminish a banking organization's responsibility to operate in a safe and sound manner and in compliance with applicable laws. The 2023 guidance is the single supervisory reference examiners apply to that responsibility, replacing three different agency documents.

Key benefits include:

• One standard across three regulators

The guidance promotes consistency in the agencies' supervisory approach, so a banking organization supervised by more than one agency builds one program rather than three.

• A life cycle to organize the program

Planning, due diligence and selection, contract negotiation, ongoing monitoring, and termination give third-party risk management a structure that maps directly to policies, workflows, and evidence.

• Risk-based tailoring

The guidance recognizes that not all relationships carry the same risk and directs more rigorous practices to those supporting critical activities.

• Clear governance expectations

Oversight and accountability, independent reviews, and documentation and reporting are named as the governance elements the board and examiners look for.

• Coverage of fintech and non-contractual arrangements

The definition of a business arrangement is intentionally broad and includes relationships without a written contract or remuneration, closing a gap in earlier guidance.

How it Works

The guidance describes third-party risk management in stages. In planning, a banking organization evaluates the risks of a prospective activity and how it will manage them. In due diligence and third-party selection, it assesses the third party's ability to perform the activity as expected, comply with laws, and operate in a safe and sound manner, with the depth of review scaled to the risk. In contract negotiation, it addresses matters such as the nature and scope of the arrangement, performance measures, responsibilities for compliance, information security, audit and remediation rights, subcontracting, business resumption, and termination. In ongoing monitoring, it tracks the third party's performance, condition, and changes over the life of the relationship. In termination, it manages the transition of the activity to another provider, in-house, or discontinuation.

Governance runs across all stages. The board of directors is responsible for oversight and holds management accountable; management establishes the policies, processes, and staffing; independent reviews, typically by internal audit, assess whether the program achieves its objectives; and documentation and reporting record the program's decisions and give the board a view of the risks. The agencies note that banking organizations may use collaborative arrangements, external experts, and shared assessments, and that examiners review third-party risk management as part of supervisory reviews, focusing on relationships that support critical activities.

Within SmartSuite, banking organizations run the life cycle as a managed workflow: each third party carries its inherent and residual risk rating and its critical-activity flag, planning and due diligence records hold the assessments and evidence, contract records hold the negotiated terms and their review dates, monitoring records capture performance, condition, and issues, and termination plans are tracked to completion, with board and examiner reporting drawn from the same records.

Key Elements

• Broad definition of a third-party relationship

Any business arrangement between a banking organization and another entity, by contract or otherwise, including fintech partnerships and relationships without remuneration.

• Critical activities

Activities that could cause significant risk if the third party fails to meet expectations, have significant customer impacts, or have a significant impact on the banking organization's financial condition or operations receive more comprehensive oversight.

• Planning

Assessment of the risks of a prospective activity and how the organization will manage them before selecting a third party.

• Due diligence and third-party selection

Evaluation of the third party's strategies, financial condition, legal and regulatory compliance, risk management, information security, operational resilience, subcontracting, and other factors scaled to risk.

• Contract negotiation

Contract terms covering scope, performance, compliance, security, audit rights, subcontracting, business resumption, and termination.

• Ongoing monitoring

Continued review of the third party's performance and condition and of changes in the relationship's risk.

• Governance

Board oversight and accountability, independent reviews, and documentation and reporting.

Framework Scope

The guidance applies to all banking organizations supervised by the Federal Reserve Board, the FDIC, and the OCC, including national banks, federal savings associations, federal branches and agencies, state member and nonmember banks, and bank holding companies, and to every business arrangement they have with another entity. It does not address direct relationships with customers for traditional banking products, though third-party lending, payment, and deposit arrangements fall within it. It is supervisory guidance, not a rule, and each organization tailors its practices to its size, complexity, risk profile, and the criticality of the activity.

Framework Objectives

The agencies issued the guidance so that banking organizations manage third-party risk consistently and in proportion to the risk each relationship presents.

Promote consistency in the agencies' supervisory approach to third-party risk management.

Set sound risk management principles for every stage of the third-party relationship life cycle.

Direct the most rigorous practices to relationships that support critical activities.

Make clear that responsibility for safety, soundness, and compliance stays with the banking organization.

Establish board oversight, independent review, and documentation as the governance backbone of the program.

Replace the agencies' separate 2008, 2013, and 2020 guidance with one document.

Framework in Context

The 2023 guidance sits alongside the FFIEC IT Examination Handbook, whose Outsourcing Technology Services booklet examiners use for technology relationships, the OCC's Cybersecurity Supervision Work Program, and the interagency paper on sound practices to strengthen operational resilience. Its life cycle parallels the supply chain requirements of NIST SP 800-161 Rev. 1 and ISO/IEC 27036, and its due diligence expectations are commonly satisfied with SOC 2 reports and the Shared Assessments SIG questionnaire. Internationally it is the U.S. counterpart of the EBA guidelines on outsourcing and third-party risk and the ICT third-party provisions of the EU Digital Operational Resilience Act.

Common Framework Mappings

The guidance is commonly mapped to the U.S. supervisory materials examiners apply with it and to the supply chain and assurance frameworks used to satisfy its due diligence and monitoring expectations.

Mapped frameworks include:

FFIEC IT Handbook

OCC CSWP

GLBA Safeguards Rule (16 CFR Part 314)

NIST SP 800-161 Rev.1

ISO/IEC 27036

NIST CSF 2.0

SOC 2

SIG v2024

EU DORA

EBA GL/2019/02

BCBS Operational Resilience Principles