Agencies Propose Revisions to Third-Party Risk Management Guidance

On September 15, the Federal Reserve, the FDIC, the NCUA, and the OCC published in the Federal Register a proposal to revise and replace existing third-party risk management guidance from 2023. The agencies explained that the 2023 guidance has been interpreted too broadly and is not sufficiently focused on risk-based tailoring. The proposal is intended to assist banking organizations in prioritizing third-party risk management according to material financial risks, compliance, and resource allocation in light of the nature of the third-party relationship as well as organization’s size, complexity, and risk profile. The proposal addresses aspects of risk oversight at different stages of a third-party relationship, including due diligence and selection, contract negotiation, ongoing monitoring, and termination. In doing so, the proposal addresses third-party arrangements with affiliates, highly regulated entities, and subcontractors, as well as cooperative risk-management arrangements, such as use of co-ventures, standard-setting organizations, and consultants. Comments are due on or before November 16.

On September 14, the Federal Reserve, the OCC, and the FDIC published in the Federal Register an interim final rule to implement a provision in the 21st Century ROAD to Housing Act to raise the asset threshold for institutions eligible for an extended examination cycle from $3 billion to $6 billion in total assets. Federal law generally requires a full-scope, on-site examination of an insured depository institution at least once during every 12-month period, but small institutions that meet certain requirements may be examined at least once during an 18-month cycle. The interim final rule would permit each of the agencies to extend the examination cycle for an institution it supervises for a full-scope, on-site examination from at least once during each 12-month period to at least once during each 18-month period if the institution: (1) has total assets of less than $6 billion, (2) is “well capitalized” as defined for purposes of Section 38 of the Federal Deposit Insurance Act, (3) was found at its most recent examination to be “well managed” and meet certain other requirements to be considered well-rated, (4) is not subject to a formal enforcement proceeding or order by a federal banking regulatory agency, and (5) has not been the subject of a change of control during the preceding 12-month period in which a full-scope, on-site examination would have been otherwise required. Except for the increase in the asset cap to $6 billion, the remaining requirements were previously existing. The agencies retain authority to examine an institution more frequently. The interim final rule became effective upon publication in the Federal Register, but the public may submit comments to the agencies no later than October 14, 2026.

On September 11, the Federal Reserve, the FDIC, and the OCC issued a statement clarifying their approach to risk-based supervision of core providers servicing community banking organizations (CBOs). According to the agencies, marketplace concentration among a few large core providers has limited CBOs’ negotiating power, ability to conduct due diligence, and power to hold providers accountable for their services. The statement explains that in making supervisory allocation decisions relevant to core providers, the agencies will consider: (1) the level of a core provider’s transparency with a CBO, (2) contract features that impair a CBO seeking to exit the relationship or obtain supplemental services, and (3) the core provider’s investment and maintenance of its technology. The statement provides additional details regarding each factor. The agencies cautioned that they may bring actions against core providers or CBOs related to safety and soundness or violations of law.

On September 8, the U.S. Treasury Department’s Financial Crimes Enforcement Network (FinCEN), the Federal Reserve, the OCC, the FDIC, and the NCUA (collectively, the Agencies) issued FAQ guidance addressing the extent to which financial institutions may use verifiable digital credentials (VDCs), such as mobile driver’s licenses, to verify the identity of a natural person customer under the Customer Identification Program (CIP) rule for banks (which includes credit unions and trust companies for Bank Secrecy Act purposes). FinCEN’s CIP rule for banks mandates that each bank required to maintain an anti-money laundering program under rules implementing Section 352 of the USA PATRIOT Act and certain other laws must implement a written CIP that includes risk-based procedures for verifying the identity of each customer to the extent reasonable and practicable. The CIP rule permits a bank to verify a customer’s identity through various methods, including reliance on documents, including, in the case of an individual, an unexpired government-issued identification evidencing nationality or residence and bearing a photograph or similar safeguard, such as a driver’s license or passport. The FAQ guidance describes the type of digital credential the Agencies would consider to be a VDC and advises that a bank may consider accepting an unexpired government issued VDC that meets the requirements of the CIP rule as evidence of identity if the bank maintains appropriate technology or systems to extract relevant information from the VDC and if use of the VDC is permitted by the bank’s CIP. Banks and certain other covered financial institutions are required under FinCEN’s Customer Due Diligence (CDD) rule for legal entity customers to identify the beneficial owners of certain legal entity customers and to verify the identity of each such beneficial owner identified to the financial institution. The FAQ guidance does not address whether a bank may use VDCs to verify the identity of beneficial owners of a legal entity customer as required by the CDD rule, but the CDD rule requires that an institution’s procedures for verifying the identity of beneficial owners must, at a minimum, contain the elements required for verifying the identity of customers that are individuals under the relevant CIP rule for the institution. The Agencies also updated existing FAQ guidance addressing use of electronic credentials as a non-documentary method of verifying a customer’s identity to also reference VDCs issued by a non-governmental third party. The FAQ guidance specifically references the CIP rule applicable to banks and not the rules applicable to other types of financial institutions required to implement a CIP, such as broker dealers.