The Interagency Guidance on Third-Party Relationships: Risk Management is supervisory guidance issued in June 2023 by the Federal Reserve, the FDIC and the OCC. It describes how banking organizations should manage the risks of any third-party relationship across a five-stage life cycle, with more rigorous oversight for relationships that support critical activities.
This post explains who the guidance covers, how its risk-based approach works, what each life-cycle stage involves, what examiners look at and where credit unions fit. It also covers the replacement the agencies proposed in September 2026. The 2023 guidance remains the current text as of October 2026.
What is the interagency guidance, and who does it apply to?
The three agencies published the final guidance in the Federal Register on June 9, 2023 (88 FR 37920). Each agency also issued it to its own institutions: OCC Bulletin 2023-17 for national banks and federal savings associations, Federal Reserve SR 23-4 for Fed-supervised banking organizations, and FDIC FIL-29-2023 for FDIC-supervised banks. It replaced each agency's earlier third-party guidance; the OCC, for example, rescinded Bulletins 2013-29 and 2020-10.
Two points shape how to read it. First, a third-party relationship is any business arrangement, by contract or otherwise, even without a contract or payment. That includes consultants, referral arrangements, affiliates and fintech partnerships. Second, it is supervisory guidance: it does not have the force of law and creates no new requirements. The underlying duty to operate safely and soundly, and to comply with the law, applies whether an activity is done in-house or by a third party.
How does the risk-based approach work?
Not every relationship needs the same oversight. The guidance asks banks to analyze each relationship and tailor their practices to their own size, complexity and risk profile, and to the nature of the relationship. A complete inventory and periodic risk assessments are what make that tailoring defensible.
Relationships that support higher-risk activities, including critical activities, get more comprehensive and rigorous oversight. The guidance describes critical activities as those that could:
- cause significant risk to the bank if the third party fails to meet expectations;
- have significant customer impacts; or
- significantly affect the bank's financial condition or operations.
Each bank identifies its own critical activities, and an activity critical for one bank may not be for another. Some banks assign a criticality or risk level to every relationship; others flag critical activities and the third parties behind them. Either way, the guidance expects a sound methodology for deciding which relationships get deeper oversight. A criticality tier recorded with its rationale is a common way to show it.
What are the five stages of the third-party life cycle?
The guidance describes a continuous life cycle, supported throughout by governance. The table summarizes each stage and the kind of evidence a bank typically keeps.
| Stage | What the guidance focuses on | Evidence a bank typically keeps |
|---|---|---|
| Planning | Strategic purpose, benefits and risks, costs, customer and information security impact, how the bank will oversee the relationship, contingency plans | Business case and risk assessment; board or committee review of plans where critical activities are involved |
| Due diligence and selection | Business strategy, legal and regulatory compliance, financial condition, management and staffing, risk management and information security, operational resilience, incident reporting, subcontracting, insurance | Due diligence results and recommendation, with any gaps and how they were handled |
| Contract negotiation | Performance measures, data access and ownership, notification of significant changes and incidents, audit rights, subcontracting, foreign-law issues, termination and transition terms | Executed contract and record of how required provisions were negotiated |
| Ongoing monitoring | Performance, changes in strategy, finances, insurance, key staff and subcontractors, control testing results, incidents, customer complaints | Monitoring reports, remediation plans, periodic reassessments |
| Termination | Transition options, time and resources, costs, data retention and destruction, joint intellectual property, risk to the bank during exit | Exit plan and record of data return or destruction and access removal |
Depth at every stage scales with risk: a low-risk supplier needs far less than a core processor.
Who is accountable, and what do examiners look for?
The board of directors has ultimate responsibility for overseeing third-party risk management and holding management accountable. It sets risk appetite, approves policies and receives periodic reporting on planning, due diligence, contracts and monitoring. Management builds and runs the program: it directs the life cycle, staffs it, escalates significant issues and terminates relationships that no longer meet expectations. Periodic independent reviews test whether the process works.
The guidance lists documentation it has seen support effective programs, including a current inventory that flags critical activities (and, where the risk warrants, related subcontractors), due diligence results, executed contracts, monitoring reports, incident reports from third parties and board reporting that shows dependency on a single provider.
Examiners review third-party risk management as part of normal supervision, scaled to the bank's risk and complexity. According to the guidance, they typically:
- assess management's ability to oversee third-party relationships;
- assess how those relationships affect the bank's risk profile, performance and legal compliance;
- perform or review transaction testing of activities the third party carries out;
- raise material risks and deficiencies with senior management and the board;
- review remediation plans, especially for critical activities; and
- reflect findings in ratings and the Report of Examination.
When circumstances warrant, an agency may also examine functions a third party performs on the bank's behalf.
How does this apply to credit unions?
The NCUA did not issue the 2023 guidance, so it does not formally apply to credit unions. Credit unions follow the NCUA's own expectations, including Letter to Credit Unions 07-CU-13, Evaluating Third Party Relationships (December 2007), and 12 CFR Part 748, whose Appendix A expects due diligence in selecting service providers, contracts that require safeguards for member information and risk-based monitoring. Many credit unions use the interagency life cycle as a benchmark.
That may change. On September 15, 2026, the OCC, Federal Reserve, FDIC and NCUA published proposed third-party risk management guidance (91 FR 58536), with comments due November 16, 2026. It would rescind and replace the 2023 guidance and its supplemental resources, treat insured credit unions as banking organizations for its purposes, and organize oversight around risk identification and assessment, risk oversight, residual risk acceptance and governance. The agencies say the 2023 text has often been read too broadly. Until a final version is issued, the 2023 guidance stands.
How VendRisk360 handles the life cycle
VendRisk360 structures each vendor record around the same stages, from intake through due diligence, contracting, monitoring and offboarding, as described in vendor lifecycle management. Criticality tiering sets assessment depth and reassessment cadence under your own policy, and the platform records whether a relationship supports a critical activity. Board decks and the examiner package export come from the same live records, through board and executive reporting. The platform is aligned to the interagency guidance; see regulatory coverage for the mapping. Each bank remains responsible for its own program and compliance.
Frequently asked questions
Is the interagency third-party guidance legally binding?
No. It is supervisory guidance and does not have the force of law or create new requirements. Banks are still required to operate safely and soundly and to comply with applicable laws, whether an activity is performed in-house or by a third party, and examiners use the guidance as their reference point when assessing how a bank manages third-party risk.
What is a critical activity under the interagency guidance?
A critical activity is one that could cause significant risk to the bank if a third party fails to perform, have significant customer impacts, or significantly affect the bank's financial condition or operations. Each bank identifies its own critical activities using a sound, documented methodology, and relationships that support them receive more comprehensive oversight.
Does the 2023 interagency guidance apply to credit unions?
Not formally. The NCUA did not issue it, and credit unions follow NCUA guidance such as Letter 07-CU-13 and 12 CFR Part 748, Appendix A. Many use the interagency life cycle as a benchmark. The interagency proposal published in September 2026, which the NCUA joined, would cover insured credit unions if it is finalized.
Is the 2023 guidance being replaced?
As of October 2026, the OCC, Federal Reserve, FDIC and NCUA have proposed replacement guidance, published on September 15, 2026, with comments due November 16, 2026. It would rescind the 2023 guidance and its supplemental resources once final. Until then, the 2023 guidance remains in effect, so programs should keep following it while watching the final text.
About VendRisk360
VendRisk360 is an AI-assisted third-party risk management (TPRM) SaaS platform for regulated organizations. It keeps one governed record per vendor from intake to exit, assesses each vendor on evidence scaled to its risk tier, monitors vendors continuously from the outside (attack surface, data breaches, financial distress and adverse news), maps fourth and nth parties, and produces board-ready reporting. Teams run their program on the platform themselves, or turn on managed assessments and monitoring, delivered on the platform by VendRisk360’s certified reviewers. People make every decision.
This post is general guidance, not legal advice. Confirm your obligations with counsel and your supervisors.
