Federal Banking Agencies Issue Final Guidance on Third-Party Relationship to Enhance Risk Management Practices

Paul Noring and Lucas Lima review the final “Interagency Guidance on Third-Party Relationships,” issued by the Federal Deposit Insurance Corporation, Board of Governors of the Federal Research System, and Office of the Controller of the Currency in June 2023; and identify differences in the framework relative to previous guidance documents.

In particular, they provide an overview of the guidance’s increased flexibility for banking organizations when considering risk management practices. The guidance has notable differences from previously published guidance, including:

• Emphasizes the need for banking organizations to tailor their practices according to the specific risks they face.
• Addresses bank-fintech partnerships, particularly those involving novel or complex structures where the fintech company directly interacts with and provides banking services to end customers (banking as a service).
• Eliminates more rigid aspects of the proposed guidance, aiming to provide a principles-based framework for risk management.
• Addresses concerns raised by smaller banking institutions during the comment period. These concerns included the lack of recognition regarding the limited bargaining power of small institutions in dealing with certain third parties and the perception that the proposed guidance would impose excessive burdens on smaller institutions.