Agencies Extend Comment Period for Third-Party Risk Management Guidance

Federal banking regulators, including the Federal Reserve Board, the Federal Deposit Insurance Corporation (FDIC), the Office of the Comptroller of the Currency (OCC), and the National Credit Union Administration (NCUA), have announced an extension of the comment period for their proposed third-party risk management guidance. The new deadline provides stakeholders additional time to analyze and respond to the regulatory proposals.

Details of the Extension

The original deadline for submitting comments was November 16, 2026. Industry groups, including the Independent Community Bankers of America (ICBA) and the American Bankers Association (ABA), had requested a 30-day extension to allow for a more thorough review of the proposals. These groups highlighted the need for additional time to evaluate the interaction between the Interagency Third-Party Risk Management Guidance and the Federal Reserve's specific guidance for community bank organizations.

In their joint letter, the ICBA and other associations noted that the proposals include helpful elements, such as risk-based tailoring and a more focused scope. However, they emphasized the importance of further discussion on critical topics like due diligence, contracting, cybersecurity, resilience, privacy, and compliance.

Proposed Guidance Overview

The proposed guidance aims to tailor risk management practices to the level of risk involved in third-party relationships. It seeks to provide a framework for financial institutions to manage risks associated with outsourcing and other third-party engagements effectively. The regulators have emphasized the importance of aligning these practices with the complexity and risk profile of each institution.

Implications for Stakeholders

The extension is expected to benefit financial institutions by allowing them to provide more comprehensive feedback on how the proposed guidance could impact their operations. It also underscores the regulators' commitment to ensuring that the final guidance is both practical and effective in addressing third-party risks across the financial sector.

Stakeholders now have additional time to analyze the proposals and submit their comments, which will play a crucial role in shaping the final regulatory framework.