US Third-Party Risk Proposal: Comments Due November 16
The proposal announced in September remains open for comment, with a November 16, 2026 deadline.
Four US financial regulators requested comment on proposed third-party risk management guidance on September 11, 2026. The announcement described a principles-based approach intended to tailor practices to the risks of each relationship. It also noted that supervisory guidance of this kind is nonbinding. The official proposal page lists November 16, 2026 as the comment deadline.
Why suppliers matter
Financial institutions may rely on external providers for data processing, technology operations and other functions. A provider can contribute expertise and efficiency, while creating operational dependencies that need oversight. Choosing a large vendor does not remove the institution’s need to understand the service, its limits and its continuity arrangements.
Reading the proposal
A consultation draft is different from an adopted final text. Comments may produce changes, and replacing existing guidance is not a general permission to disregard legal or contractual obligations.
Practical assessment questions concern the importance of the service, data sensitivity, replacement options and the response to disruption. More critical functions may require deeper oversight than low-impact services. These are explanatory considerations, not a newly issued legal checklist. The announcement does not endorse a particular supplier or guarantee a technology product’s quality. Institutions must consult any subsequently finalized guidance, their contracts and applicable local obligations to determine what is relevant to their own circumstances.
Source: US financial agencies: Proposed third-party risk guidance