What's Happening?
Federal banking agencies have introduced new interagency third-party risk management guidance, which is set to replace the existing 2023 guidance once finalized. This proposal includes a companion guide from the Federal Reserve specifically for community
banks and a joint statement concerning core providers. A significant change in the new guidance is the replacement of the 'critical activities' test with a 'harm-and-likelihood' standard. Additionally, the proposal removes expected contract terms, narrows the scope of application, and formalizes the acceptance of residual risk. While the prescriptive floor for regulations has been lowered, banks will remain fully accountable for any failures involving third parties, emphasizing the increased importance of thorough risk assessments and documented judgment. Rafael DeLeon, SVP of Industry Engagement at Ncontracts and a former regulator, is expected to clarify these proposed changes, identify which documents apply to specific banks, and outline key considerations.
Why It's Important?
This proposed guidance is crucial for U.S. banks as it redefines how they manage risks associated with third-party vendors. The shift from a 'critical activities' test to a 'harm-and-likelihood' standard means banks will need to re-evaluate their risk assessment methodologies, focusing more on the potential impact and probability of third-party failures. This could lead to significant adjustments in compliance frameworks and operational procedures across the banking sector. Community banks, in particular, will need to understand the Federal Reserve's companion guide to ensure adherence. The continued full accountability of banks for third-party failures, despite a lowered prescriptive floor, underscores the necessity for robust internal controls and due diligence. Financial institutions that fail to adapt their risk management strategies could face regulatory penalties, reputational damage, and financial losses, while those that effectively implement the new guidance may enhance their operational resilience and maintain regulatory compliance.
What's Next?
Banks will need to identify which of the three newly released documents are binding and which serve as reference material. They must also understand the five key changes from the 2023 guidance, particularly the two-part test of harm magnitude and likelihood. Financial institutions are expected to document risk-based tailoring and residual risk acceptance in a manner that meets examiner expectations, including approval authority, revalidation processes, and board visibility. A near-term action plan will involve mapping existing 2023-driven policy and contract requirements against the new proposal. Banks will also need to decide whether to submit a comment letter on the proposed guidance, providing feedback that could influence the final regulations. The implementation of these changes will require significant effort in updating internal policies, training staff, and potentially renegotiating vendor contracts to align with the new risk management framework.
Beyond the Headlines
The move towards a 'harm-and-likelihood' standard reflects a broader regulatory trend focusing on outcomes and potential impact rather than just process adherence. This approach could encourage banks to adopt more sophisticated, risk-based decision-making processes, moving beyond a checklist mentality. The formalization of residual risk acceptance acknowledges that not all risks can be eliminated, pushing banks to clearly define and justify the level of risk they are willing to tolerate. This could lead to a more transparent and accountable risk culture within financial institutions. However, it also places a greater burden on banks to demonstrate sound judgment and comprehensive documentation, potentially increasing compliance costs. The emphasis on documented judgment and board visibility suggests a push for greater governance and oversight at the highest levels of banking organizations regarding third-party relationships, potentially influencing corporate governance structures and board responsibilities.
