Federal Banking Agencies Propose Overhaul of Third-Party Risk Management Guidance

The useful part

The proposal instead directs banking organizations to focus resources on relationships presenting greater financial, operational, or compliance risk. Banking organizations would assess third-party relationships based on both the magnitude and likelihood of potential harm, rather than treating particular categories of third parties as inherently higher-risk. Due diligence, contract negotiations, ongoing monitoring, and termination planning could vary based on the banking organization's size, complexity, risk profile, and the risks presented by the particular relationship.

How it works

• The proposal would replace the agencies' 2023 third-party risk management guidance and related supplemental resources with a framework that places greater emphasis on tailoring oversight to the actual risks...
• The agencies expressly state that banking organizations are not expected to eliminate all third-party risk and may accept residual risk when it falls within established risk appetites and tolerances.

What to take from it

The agencies explained that the 2023 guidance has sometimes been interpreted as requiring a broad, process-driven approach that applies heightened risk management practices across third-party relationships without sufficient regard to the magnitude or likelihood of harm.