Key points

  • Four regulators proposed nonbinding guidance tailored to the risks of individual outside-provider relationships.
  • A separate statement addresses core providers' transparency, contracts and technology practices.
  • Fed Governor Michael Barr dissented, warning that the proposals could leave consumer-compliance and supervisory gaps.

U.S. financial regulators proposed changing how banks and credit unions oversee outside service providers on September 11, emphasizing the risks of each relationship rather than uniform procedures. The package also exposed a disagreement inside the Federal Reserve over whether a less prescriptive approach could weaken supervision and leave consumer-protection gaps.

The Federal Reserve, Federal Deposit Insurance Corporation, National Credit Union Administration and Office of the Comptroller of the Currency jointly sought comments on the draft. The federal banking agencies intend to replace existing third-party risk guidance once the new version is finalized; Friday's announcement did not itself complete that replacement.

Related reporting: U.S. Bank tests USBDC stablecoin payment on Stellar

Attention should follow the risk

The OCC described an approach scaled to an institution's size, complexity and risk profile, as well as the nature of its outside relationships. Banks would prioritize the likelihood and magnitude of harm, instead of treating every vendor arrangement as inherently high-risk. The proposal is supervisory guidance, not a new set of legally enforceable requirements.

That distinction does not remove existing obligations. The OCC said supervisors would not take action merely because an institution failed to comply with the guidance itself. For banks assessing the proposal, the practical question is how much discretion this gives them to concentrate staff and monitoring on the relationships most capable of causing harm.

Core technology providers face a separate spotlight

Alongside the consultation, the federal banking agencies issued a separate statement on community banks' engagement with core service providers. These companies support essential functions including transaction processing, account management and payments. The statement describes a market concentrated among a small number of large providers, limiting smaller banks' negotiating leverage.

Regulators identified transparency, contract terms and technology practices as factors in their supervisory decisions. Areas of concern include access to information for vendor assessments, unclear pricing, charges for switching providers and restrictions on integrating other technology. The statement also addresses service quality and technology resilience. ABA Banking Journal separately reported the agencies' focus on these three areas.

For community banks, those issues reach beyond paperwork: they concern the systems used to keep customer accounts and payments functioning. The statement stresses that outsourcing does not reduce a bank's responsibilities. It also preserves the agencies' ability to act against a provider or bank over unsafe practices or legal violations.

Barr challenges the supervisory trade-off

Fed Governor Michael Barr dissented. He argued that a proposed material-financial-risk standard could delay corrections until problems become significant. He also warned that excluding consumer-compliance matters, while potentially rescinding existing guidance, could create gaps or leave institutions navigating competing sets of expectations.

Barr additionally questioned why a companion guide for traditional community banks excludes more complex arrangements, including complex bank-fintech partnerships. Governor Lisa Cook supported taking a fresh look but welcomed comments on whether the framework needs more detail on matters such as cybersecurity, consumer protection and record management.

The consultation leaves the final scope unsettled. As the joint release and Investing.com's report explain, comments are due 60 days after publication in the Federal Register, not 60 days from the announcement. The immediate development is therefore a proposed change in oversight expectations, accompanied by an issued statement on core providers, rather than a completed regulatory rewrite.

Sources

AI-generated editorial image; not a photograph of the reported event. Prepared with AI assistance and source verification.