The Proposed 2026 Interagency TPRM Guidance: Are We Managing Risk or Managing the Process?
Four federal regulators are proposing changes to third party risk management (TPRM) guidance. What is changing, how could it affect existing programs, and what might it mean for the future of TPRM?
In September 2026, federal financial regulators proposed revisions to the Interagency Guidance on Third-Party Relationships: Risk Management, potentially reshaping how financial institutions approach TPRM.
The proposal comes just three years after the first unified interagency guidance was finalized in June 2023. That guidance brought together the Office of the Comptroller of the Currency (OCC), Federal Reserve Board, and Federal Deposit Insurance Corporation (FDIC), replacing their separate supervisory guidance with a common framework.
The 2023 guidance established a principles-based approach organized around the third party relationship lifecycle. It emphasized that risk management practices should reflect an institution's size, complexity, risk profile, and the nature of its third party relationships.
The 2026 proposal retains those principles but places renewed emphasis on how they are interpreted and implemented.
NCUA Joins the Interagency Framework
One notable development is the addition of the National Credit Union Administration (NCUA) as a fourth participating agency.
The NCUA did not participate in the 2023 guidance, and credit unions have historically relied on separate supervisory guidance for third party relationships.
Its participation would extend the common framework to federally insured credit unions, promoting greater consistency across banks and credit unions while recognizing differences in their size, resources, and operational complexity.
The inclusion of NCUA is also significant because it brings credit unions into a broader interagency discussion about proportionality, supervisory expectations, and the management of increasingly complex third party relationships.
Why Revisit the Guidance After Only Three Years?
The agencies acknowledge concerns that the 2023 guidance, despite its risk-based intent, has sometimes been interpreted too broadly.
Detailed examples and recommendations have contributed to overly prescriptive practices, extensive documentation requirements, and checklist-driven approaches that may not reflect the actual risks of individual relationships.
The proposal seeks to address these concerns by emphasizing proportional oversight, informed risk acceptance, and greater flexibility.
Risk-based TPRM is not a new concept. What is changing is how explicitly the agencies are addressing interpretations of the guidance that may have encouraged unnecessarily prescriptive practices.
The proposed guidance was published September 15, 2026, and the public comment period closes November 16, 2026. With less than two weeks remaining, practitioners and industry organizations still have an opportunity to provide feedback.
The following analysis examines the most significant proposed changes, their potential implications for existing TPRM programs, and what they could mean for the profession.
1. From Lifecycle Management to Risk-Based Components
The 2023 guidance organized TPRM around planning, due diligence and selection, contract negotiation, ongoing monitoring, and termination, supported by governance and oversight.
The proposal reorganizes these activities into four components:
Risk identification and assessment
Risk oversight
Residual risk acceptance
Governance
Traditional lifecycle activities remain within the risk oversight component. The revised structure places greater emphasis on identifying risks, evaluating their significance, and determining appropriate responses.
This represents a change in organization and emphasis rather than a departure from lifecycle-based risk management.
Potential Implications for TPRM Programs
Existing lifecycle-based programs may remain consistent with the proposed framework.
However, the revised structure could influence how institutions evaluate the relationship between individual TPRM activities and their broader risk management objectives.
Programs with extensive procedural requirements may face greater questions about how those activities contribute to identifying, assessing, and managing material risks.
2. Risk Assessments: Moving Beyond Criticality
The 2023 guidance placed particular emphasis on third parties supporting critical activities, which often became a primary driver of enhanced due diligence and monitoring.
The proposal places greater emphasis on the magnitude and likelihood of potential harm associated with a relationship.
A provider supporting an important operational function may present manageable risks because appropriate safeguards exist. Conversely, a provider supporting a less critical function could introduce significant cybersecurity, regulatory, financial, or reputational exposure.
The distinction between operational criticality and the risks associated with a particular relationship may become increasingly important.
Potential Implications for TPRM Programs
The proposed approach could affect inherent risk assessment methodologies and risk-tiering models, particularly those that rely heavily on criticality classifications to determine oversight requirements.
Programs that automatically assign enhanced due diligence or monitoring based on criticality may find that the proposed framework places greater emphasis on the specific risks associated with each relationship.
The extent of the impact would depend on how an institution currently defines criticality, evaluates impact and likelihood, and determines appropriate oversight.
3. Due Diligence: Flexibility Without Sacrificing Defensibility
The 2023 guidance provided extensive examples of due diligence considerations, including financial condition, information security, operational resilience, compliance, and subcontractor management.
Although intended as risk-based considerations, these examples have sometimes been interpreted as standardized requirements.
The proposal more explicitly recognizes that due diligence should correspond to the risks presented.
It also acknowledges that providers may be unable or unwilling to supply certain information and that public information, independent assessments, certifications, or other credible sources may provide sufficient insight.
The emphasis shifts toward whether an institution has enough reliable information to make an informed risk decision rather than whether every requested document has been obtained.
Potential Implications for TPRM Programs
The proposal could have implications for standardized due diligence questionnaires, evidence requirements, and assessment methodologies.
Institutions that rely on uniform documentation requirements across broad categories of providers may have greater flexibility to determine what information is necessary for individual relationships.
At the same time, less prescriptive requirements could place greater importance on the ability to substantiate why particular evidence was considered sufficient.
4. Contract Negotiation: Recognizing Commercial Realities
The proposal acknowledges that institutions may have limited negotiating power, particularly with large technology providers or in markets with few alternatives.
Rather than emphasizing the inclusion of every preferred contractual provision, it focuses on evaluating protections relevant to the relationship's risks.
The proposal also recognizes that institutions may proceed despite certain contractual limitations when they understand and appropriately accept the resulting exposure.
Potential Implications for TPRM Programs
This approach could affect how institutions interpret contractual requirements and evaluate deviations from standard terms.
Existing contract review practices may increasingly distinguish between provisions addressing material risks and those representing preferred contractual protections.
The proposed framework may also place greater emphasis on how contractual limitations relate to residual risk decisions.
5. Ongoing Monitoring: Reconsidering Standard Review Cycles
Many TPRM programs rely on standardized review schedules, such as annual assessments for high-risk providers.
The proposal reinforces that monitoring frequency, scope, and intensity should correspond to assessed risk and evolve as circumstances change.
While this principle existed in the 2023 guidance, the proposal places renewed emphasis on proportionality rather than uniform monitoring requirements.
Potential Implications for TPRM Programs
The proposed approach could influence how institutions establish monitoring schedules and determine the scope of periodic reviews.
Programs that rely primarily on predetermined review frequencies may have greater flexibility to incorporate targeted, continuous, or event-driven monitoring.
This could also affect how organizations evaluate the effectiveness of monitoring activities, particularly whether those activities identify meaningful changes in risk rather than primarily confirm completion of scheduled reviews.
6. Fourth-Party Risk: Clarifying the Boundaries of Oversight
The proposed guidance clarifies that a third party's use of subcontractors does not ordinarily create a separate direct third party relationship between the subcontractor and the financial institution.
Nor does it automatically establish an expectation of direct oversight.
Institutions may manage subcontractor risks through the primary provider, including contractual requirements and evaluation of the provider's subcontractor management practices.
Potential Implications for TPRM Programs
This clarification could influence how institutions define the scope of fourth-party oversight.
Programs that routinely require direct assessments of subcontractors may interpret the proposal as supporting greater differentiation based on the risks presented.
It may also place greater emphasis on understanding how primary providers identify, manage, and monitor their own subcontractor relationships.
The clarification does not diminish the importance of material fourth-party dependencies, particularly where they introduce significant operational, cybersecurity, or concentration risks.
7. Residual Risk Acceptance: From Exception to Core Component
Perhaps the most meaningful conceptual change is the elevation of residual risk acceptance to a standalone component.
The agencies explicitly recognize that eliminating third party risk is neither realistic nor the objective of effective risk management.
Organizations routinely encounter circumstances where additional mitigation is unavailable, impractical, or disproportionate. A provider may refuse contractual terms, alternatives may not exist, or terminating a relationship may introduce greater risk.
Risk acceptance was recognized in the 2023 guidance. The difference is the prominence given to it in the proposed framework.
Potential Implications for TPRM Programs
The proposed framework could bring greater attention to how institutions evaluate, document, and authorize residual risk acceptance.
It may also highlight distinctions between accepting an identified risk and granting an exception to an established procedural requirement.
Institutions with mature risk acceptance processes may see relatively little operational change, while others may find that the proposed framework places greater visibility on how these decisions fit within their overall risk management practices.
8. Governance: Accountability Without Unnecessary Complexity
The proposed guidance retains governance as a fundamental component, including roles and responsibilities, risk appetite, reporting, documentation, and independent review.
However, it more explicitly recognizes that there is no single correct governance structure.
Governance practices are expected to reflect an institution's circumstances and risk profile.
Potential Implications for TPRM Programs
The proposal could influence how institutions evaluate governance structures, accountability, escalation practices, and management reporting.
It may also contribute to broader discussions about whether traditional TPRM reporting provides sufficient insight into material third party risks.
Operational measures such as assessment completion rates and overdue reviews remain useful, but the proposed emphasis on risk management effectiveness could increase attention to how those activities relate to actual risk exposure.
9. Collaborative Risk Management and Shared Resources
The proposal recognizes the value of shared due diligence, industry consortia, independent assessments, certifications, consultants, and specialized technologies.
These resources can reduce duplication and improve access to expertise, particularly for smaller institutions.
However, institutions remain responsible for determining whether the information is sufficient for their specific circumstances.
Potential Implications for TPRM Programs
The proposed guidance could encourage broader consideration of collaborative approaches and external assessment resources.
This may be particularly relevant where multiple institutions request substantially similar information from the same providers.
It could also influence how institutions evaluate standardized assessments and certifications, including the extent to which those resources address risks specific to an individual relationship.
10. Supervisory Expectations: Guidance Is Not a Mandatory Checklist
The proposal explicitly addresses the nonbinding nature of supervisory guidance.
The agencies acknowledge that detailed examples and recommendations have sometimes been interpreted as mandatory requirements.
The proposed guidance clarifies that deviations from its recommendations alone do not establish grounds for supervisory action.
This does not eliminate accountability for applicable laws, regulations, or unsafe and unsound practices.
Potential Implications for TPRM Programs
This clarification could have implications for internal policies and procedures that incorporate examples from supervisory guidance as mandatory requirements.
Institutions may distinguish more explicitly between legal obligations, supervisory recommendations, and internally established risk management practices.
However, greater flexibility in supervisory guidance does not necessarily translate into immediate changes in established program requirements.
Internal audit, compliance, management, and supervisory expectations may continue to influence how institutions interpret and apply the proposed framework.
One of the more significant questions is whether greater regulatory flexibility will result in meaningful operational flexibility.
11. Supplemental TPRM Resources: What Happens to Existing Guidance?
One of the less-discussed but potentially consequential aspects of the proposal is the proposed withdrawal of supplemental resources issued to support implementation of the 2023 guidance.
The proposal specifically identifies two resources published in 2024.
The 2024 Community Bank Guide
Third-Party Risk Management: A Guide for Community Banks, issued by the OCC, Federal Reserve, and FDIC in May 2024, provided practical considerations for community banks applying the 2023 framework.
It recognized the challenges smaller institutions face, including limited resources and negotiating leverage.
The 2024 Joint Statement on Bank-Fintech Deposit Arrangements
The Joint Statement on Banks' Arrangements with Third Parties to Deliver Bank Deposit Products, issued in July 2024, addressed risks associated with bank-fintech partnerships and other arrangements involving third parties that deliver deposit products and services.
It highlighted concerns involving operational risk, compliance, customer relationships, recordkeeping, and appropriate oversight.
What Is Changing?
The agencies propose replacing the 2023 guidance and these supplemental resources with the new framework.
They are also requesting comments on whether additional TPRM-related guidance documents, interpretive letters, or other resources should be rescinded.
The withdrawal would remove specific supervisory reference materials that institutions have used to interpret and implement the broader guidance.
For community banks, this could mean losing practical examples that help translate principles into operational requirements.
For institutions managing fintech partnerships, it could mean greater discretion in how oversight is structured, but not reduced responsibility for the underlying risks.
Withdrawing guidance does not eliminate the risks it addresses or any independently applicable legal requirements.
Potential Implications for TPRM Programs
The proposed rescission could affect institutions that have incorporated these supplemental resources into policies, procedures, assessment methodologies, or training materials.
Community banks may face greater uncertainty about how to interpret broad principles without the practical examples provided by the 2024 guide.
Institutions involved in bank-fintech partnerships may also need to distinguish between supervisory recommendations contained in the joint statement and obligations arising from other regulatory requirements.
More broadly, the proposal raises questions about the role of supplemental guidance in establishing consistent expectations.
Detailed examples can promote consistency, but they can also become de facto requirements when interpreted too prescriptively.
A less prescriptive framework may provide greater flexibility while increasing the importance of institutional judgment and consistency in applying risk management principles.
What Could This Mean for the Future of TPRM?
Taken together, the proposed changes suggest a potential shift in how TPRM programs are designed, operated, and evaluated.
For years, program maturity has often been associated with comprehensive processes, detailed questionnaires, extensive documentation, and standardized oversight.
Those practices can provide value. However, more activity does not necessarily mean better risk management.
Three broader implications deserve consideration.
Greater Flexibility May Require Greater Accountability
A less prescriptive framework could place greater importance on the quality of risk management judgment.
If institutions have more discretion in determining due diligence, monitoring, and contractual expectations, the methodologies supporting those decisions may become increasingly important.
Clear criteria, consistent application, appropriate governance, and sufficient documentation could take on greater significance.
There is also a practical challenge: Internal audit teams, compliance functions, risk committees, and examiners may have established expectations based on existing processes.
Whether the proposed flexibility translates into meaningful operational changes may depend on how these stakeholders interpret and apply the final guidance.
Measuring Risk Management, Not Just Process Completion
Traditional TPRM metrics frequently emphasize completed assessments, overdue reviews, outstanding findings, and documentation status.
These measures describe how well-established processes operate but may provide less insight into whether programs identify material risks, support timely decisions, or reduce exposure.
The proposed framework could influence how institutions evaluate program effectiveness, potentially placing greater emphasis on demonstrated risk management outcomes alongside traditional measures of process completion.
It may also influence how organizations evaluate TPRM technology.
Capabilities that support risk identification, analysis, and informed decision-making could receive greater attention alongside traditional workflow automation and documentation management.
Implications Beyond Financial Services
Although the proposed guidance is directed toward regulated financial institutions, its influence could extend beyond banking and credit unions.
Banking guidance has long informed TPRM methodologies, questionnaires, risk-tiering practices, and program structures across industries.
Healthcare, energy, insurance, technology, and other sectors face similar challenges involving expanding third party ecosystems, limited resources, inconsistent evidence, and increasingly complex dependencies.
The proposed withdrawal of supplemental resources adds another dimension.
If regulators move away from detailed implementation examples, institutions may increasingly rely on internal expertise, industry frameworks, professional education, and peer collaboration to interpret broader risk management principles.
This could influence the role of professional associations, standardized assessment frameworks, and shared educational resources in supporting consistency across the profession.
At the same time, there is a risk that industry-developed frameworks could become another set of prescriptive requirements if they are applied without sufficient consideration of organizational circumstances.
Other industries retain their own regulatory obligations, but the broader discussion about proportionality, informed risk acceptance, and effective oversight may resonate across the TPRM profession.
Final Thoughts: Managing Risk Versus Managing the Process
The proposed guidance does not suggest that the fundamentals of TPRM are no longer relevant.
Organizations still need to understand their third party relationships, identify risks, conduct appropriate due diligence, monitor performance, and maintain accountability.
What may change is how much discretion institutions have in determining the most appropriate way to accomplish those objectives.
For the TPRM profession, the proposal raises an important question:
How should organizations balance structured processes, consistent oversight, and regulatory expectations with the flexibility needed to manage third party risks proportionately?
The proposal does not diminish the importance of effective third party risk management. Rather, it signals a potential change in how regulators expect institutions to demonstrate that effectiveness.
Whether the final guidance results in meaningful changes to established TPRM practices remains to be seen.
Much will depend on the final language, supervisory interpretation, and how individual institutions translate those principles into their existing risk management frameworks.
For the broader profession, the proposal offers an opportunity to examine the relationship between process maturity and risk management effectiveness, without assuming that one necessarily guarantees the other.
Ultimately, the central question may not be whether organizations are doing enough TPRM, but whether their established practices provide a meaningful understanding of the risks they are intended to manage.
Public Comment Opportunity
The proposed Third-Party Risk Management Guidance was published September 15, 2026. Comments are due November 16, 2026.
The agencies are seeking feedback on the proposed framework, including risk-based oversight and the potential rescission of existing guidance and supplemental resources.
Practitioners and industry organizations have an opportunity to provide feedback on how these changes could affect real-world TPRM operations.
Primary Sources
About This Analysis
This article is provided by the Third Party Risk Association (TPRA) for educational and informational purposes. It offers an interpretation of the proposed interagency guidance and its potential implications for third party risk management. It does not constitute legal, regulatory, or professional advice. The guidance remains a proposal and is subject to change.
Author Bio
Hilary Jewhurst
Sr. Membership & Education Coordinator at TPRA
Hilary Jewhurst is a seasoned expert in third party risk and risk operations, with nearly two decades of experience across financial services, fintech, and the nonprofit sector. She has built and scaled third party risk programs from the ground up, designed enterprise-wide training initiatives, and developed widely respected content that helps organizations navigate regulatory complexity with clarity and confidence.
Known for turning insight into action, Hilary’s thought leadership and educational work have become go-to resources for professionals looking to mature their TPRM programs. She regularly publishes articles, frameworks, and practical guides that break down complicated risk topics into meaningful, accessible strategies.
Hilary recently joined the Third Party Risk Association (TPRA) as a staff member, supporting industry-wide education, peer learning, and advancing best practices. She is also the founder of TPRM Success, a boutique consultancy that helps organizations strengthen their third party risk management capabilities through targeted training, tools, and strategic guidance.
Comments