The Office of the Comptroller of the Currency has proposed new guidance on third-party risk management for community banks, moving away from uniform compliance standards toward requirements tied to actual risk.
Under the proposal, banks would size their oversight of vendors based on the potential harm a given relationship could cause, taking into account the bank's own scale, complexity, and risk profile. The current approach relies on process-heavy checklists that treat all vendor relationships uniformly, requiring smaller banks to apply the same scrutiny to low-risk contracts as to high-risk ones.
Clearer Standards for Core Service Providers
The OCC also clarified how it supervises core service providers—firms that supply banks with technology and back-office systems. Many community banks depend on a limited pool of these providers for essential banking functions. The agency said clearer supervision standards would support banks' due diligence and contract negotiations with vendors.
Comptroller of the Currency Jonathan V. Gould linked the proposal to a broader policy agenda aimed at cutting unnecessary regulatory friction while tailoring supervision to genuine risk. He stated the changes seek to strengthen banks' ability to manage vendor relationships without added burden.
Benefits for Smaller Lenders
Community banks have repeatedly cited vendor oversight costs as a compliance challenge. Larger competitors typically maintain bigger compliance staffs to handle the same regulatory requirements, giving them a structural advantage.
The OCC framed the proposal as part of a continuing effort to rightsize supervisory burden for community banks, noting it has taken a series of actions already toward that goal. The agency did not announce a specific timeline for the guidance to take final effect.
Industry observers will track the proposal through public comment. Third-party risk management has drawn increased attention across banking following several high-profile vendor failures in recent years, and how the OCC balances flexibility with adequate oversight will influence the rule's final form.
