Bank regulators put core-provider contracts on the exam agenda of the banks that signed them
The FDIC, Federal Reserve, OCC and NCUA want examiners looking harder at transparency, contract structure and technology inside core servicing deals. The guidance carrying that expectation is non-binding, with 60 days for comment.
The Investor · Invest desk
What happened
- The FDIC, Federal Reserve Board, NCUA and OCC proposed new third-party risk supervision guidelines on Friday morning, aimed in particular at community banks' relationships with their core service providers.
- Examiners would apply extra scrutiny to core arrangements that give community banks limited transparency or that unreasonably limit their ability to do due diligence, monitor, or negotiate contract terms.
- A separate statement from the agencies sets out factors they will consider when making supervisory and enforcement decisions related to core service providers.
- A companion proposal for so-called traditional community banks calls for less supervisory oversight of institutions that avoid novel activities such as fintech partnerships and digital asset services.
- Comments on the proposed guidance are due 60 days after it is published in the Federal Register.
Why it matters
- What it limits constraint An examiner can now criticise contract terms a small bank had almost no power to set, because the agencies themselves say the core sector is concentrated and the choice of providers is thin.
- Who has to decide decision A community bank weighing a fintech partner is also choosing which supervisory track it sits on, and the cheaper track is the one without the partner.
- Who's exposed exposure Core providers, which are not the examined institutions, are named in a document about enforcement decisions, so their disclosure and contracting practices become reachable through their clients.
- What doesn't add up contradiction A sitting Fed governor says the package puts its detail in the wrong place, leaving the banks with the most complex vendor arrangements with the vaguer of the two documents.
Next story · Invest · Oct 7
OCC's Gould recruits Minnesota community banks against a nearly 300% rise in check-fraud filingsConfirmed2 publishers
The instrument here is a bank examination. The agencies say the core services sector is highly concentrated and that community banks have few providers to choose from [12]. The remedy they propose for that concentration is risk-based examinations of the arrangements [13]. An examiner reads a contract the bank signed and had little power to rewrite. The guidance itself is addressed to the banks. It "is intended to assist banks and credit unions to better align and tailor their third-party risk management practices to the risks of individual third-party relationships," the agencies said in a joint statement [10].
The providers get a document of their own, of a kind. Neither account says what authority those supervisory and enforcement decisions would rest on, or what a core provider would actually face. A dollar figure appears nowhere in either one [17].
The proposed guidance takes a principles-based approach and, as with all supervisory guidance, is non-binding, according to the OCC's release [5]. Pressure therefore arrives at the next exam, in an examiner's judgement about transparency, contract structure and technology components [3]. The proposal also asks for closer oversight of servicers' technology investments and capabilities [9]. When the text is final the agencies plan to rescind the existing third-party risk management guidance and replace it [7].
The lighter track is the part that changes procurement. A community bank comparing its incumbent core provider's own digital product against a third-party fintech partnership now has a supervisory reason to prefer the incumbent. That sits awkwardly beside Federal Reserve Gov. Lisa Cook's statement that a principles-based and risk-focused approach "may be helpful towards promoting these goals," "especially for enabling innovation and competition for vendor services" [16].
Fed Gov. Michael Barr objected that the traditional-bank guidelines were drafted more specifically than the broader third-party guidance [14]. "Experience suggests that many banks with complex business models are especially in need of guidance that better addresses their particular third-party risk management issues, which is not addressed in these proposals," he said [15].
The two accounts also differ on who issued the community-bank companion. American Banker describes a joint proposal from the agencies covering traditional community banks and their third-party service providers [18]. The OCC release says the Federal Reserve Board separately requested comment on a guide for Fed-supervised community banks [19]. Three documents landed that day, or four, depending on which account is right [20].
The counter-thesis is straightforward, and it is cheap. Examiner attention is free leverage for a small bank at renewal: a compliance officer who can cite supervisory expectations on transparency and on the ability to negotiate terms [4] has an argument he did not have last week. Making it costs nothing. That reading holds only while the leverage stays with the buyer. If the agencies open a supervisory action against a core provider itself under the factors in that separate statement [8], the pressure has found the party with the market power, and the argument above is wrong.
What to watch
- Whether the lighter oversight track for traditional community banks survives into the final text after the comment period closes.
- Whether the community bank companion document is finalised as a Federal Reserve-only guide or as a joint product of all four agencies.
- Whether the largest core providers file comment letters objecting to the language on contract negotiation and due diligence access.
Information, not investment advice. This story is general information about companies and markets, drawn from cited reporting. It is not a recommendation to buy, sell or hold any security; check the cited sources before acting.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+15
- Incentives55
- Confidence62
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The Federal Deposit Insurance Corporation, the Federal Reserve Board, the National Credit Union Administration and the Office of the Comptroller of the Currency requested comment on proposed guidance to assist financial institutions with managing risks associated with third-party relationships.
- [2]
The four agencies proposed the new third-party relationship supervision guidelines on Friday morning, and the guidance is aimed in particular at improving the dynamics between community banks and core service providers.
- [3]
The proposal would empower regulators to apply more supervisory oversight to transparency, contract structures and technology components within core servicing relationships.
- [4]
The proposal calls for agencies to provide additional supervisory scrutiny to core services arrangements that provide limited transparency to community banks as well as those that "unreasonably limit [banks'] ability to conduct due diligence and ongoing monitoring or to negotiate contract terms that address their business needs."
- [5]
The proposed guidance focuses on a principles-based approach and, as with all supervisory guidance, is non-binding.
- [6]
Comments on the proposed guidance are due 60 days after publication in the Federal Register.
- [7]
When finalized, the federal bank regulatory agencies plan to rescind existing third-party risk management guidance and replace it with the finalized guidance.
- [8]
The federal bank regulatory agencies are issuing a statement on community banks' engagement with core service providers that discusses certain factors the agencies will consider in making supervisory and enforcement decisions related to these core providers.
- [9]
The proposal calls for closer oversight of core servicers' technology investments and capabilities.
- [10]
"The proposed guidance reflects the agencies' supervisory experience and lessons learned from examining financial institutions' third-party risk management practices. It is intended to assist banks and credit unions to better align and tailor their third-party risk management practices to the risks of individual third-party relationships," the agencies said in a joint statement.
- [11]
Core service providers handle back-end functions for client banks, typically small to medium-sized community banks and credit unions, including account management, transaction processing and loan servicing.
- [12]
The agencies highlighted that the core services sector is highly concentrated, giving banks few options to choose from.
- [13]
The proposal seeks to address some of the competitive challenges that come with constrained market dynamics through risk-based examinations of these arrangements.
- [14]
Fed Gov. Michael Barr took issue with the fact that the guidelines for the traditional community bank proposal were more specific than the broader third-party guidelines.
- [15]
"Experience suggests that many banks with complex business models are especially in need of guidance that better addresses their particular third-party risk management issues, which is not addressed in these proposals," he said.
- [16]
"A principles-based and risk-focused approach may be helpful towards promoting these goals ... especially for enabling innovation and competition for vendor services."
- [17]
Neither account of the proposals contains any monetary figure, including any estimate of what the expected due diligence and monitoring would cost a community bank.
- [18]
The agencies issued a joint proposal pertaining specifically to "traditional" community banks and their third-party service providers, calling for less supervisory oversight of banks that do not engage in novel activities such as fintech partnerships and digital asset services.
- [19]
The Federal Reserve Board separately requested comment on a proposed third-party risk management guide specifically for Federal Reserve-supervised community banks, intended to serve as a companion document to the proposed guidance.
- [20]
Three separate documents were issued that day on the two accounts taken together, or four if American Banker's joint traditional-bank proposal and the OCC release's Fed-only community bank guide are different documents.
Sources
2 independent publishers whose own reporting we read for this story.
- americanbanker.comRegulators propose new guidance on core providers
1 article · September 11, 2026
- crowdfundinsider.comAgencies Seek Comment on Proposed Third-Party Risk Management Guidance and Issue Statement on Community Bank Engagement with Core Service Providers
2 articles · September 11, 2026
Topics and entities
Topics
- Third-Party Risk Management
- Bank Supervision
- Core banking services