Interagency guidance on third-party relationships, in plain words

The Interagency Guidance on Third-Party Relationships: Risk Management is the joint statement of the Federal Reserve, the FDIC and the OCC on how banks should manage any business arrangement with another company, published on June 9, 2023 at 88 FR 37920. It describes a life cycle from planning to termination, asks for more rigorous oversight of relationships that support critical activities, and rests on one sentence: a bank's use of third parties "does not diminish its responsibility" to operate safely and comply with the law "to the same extent as if its activities were performed by the banking organization in-house." For a sponsor bank whose fintech partners run identification, monitoring and SAR referrals on its behalf, that sentence is the whole problem in one line. Botminds' BaaS Compliance exists to produce the evidence the guidance expects: partner files re-performed with the bank's own sources, partner records tied to their FBO accounts daily, and findings a named BSA Officer approves.

This page reads the guidance as a sponsor bank's BSA officer and third-party risk manager would, quoting it where precision matters. Where it points to the solution, the examples come from a fictional sample bank, Tessaly Community Bank, and its 11 partner programs.

What is the interagency guidance on third-party relationships?

It is the single third-party risk guidance of the three federal banking agencies, replacing each agency's own: the Board's 2013 guidance, the FDIC's 2008 guidance, and the OCC's 2013 guidance with its 2020 frequently asked questions. The agencies issued it "to promote consistency in supervisory approaches," and it applies to every banking organization they supervise. Its scope is deliberately wide: it "addresses any business arrangement between a banking organization and another entity, by contract or otherwise," and "a third-party relationship may exist despite a lack of a contract or remuneration" (88 FR 37920).

The guidance is principles, not a checklist. It says sound practice "takes into account the level of risk, complexity, and size of the banking organization and the nature of the third-party relationship," and it repeatedly qualifies its examples with "depending on the degree of risk and complexity." That flexibility is why two banks can read the same text and build very different programs, and why an examiner reads the bank's methodology first: "a key element of effective risk management is applying a sound methodology to designate which activities and third-party relationships receive more comprehensive oversight."

Is the 2023 third-party guidance still in effect?

Yes. As of late October 2026 the 2023 guidance is in force. On September 15, 2026 the OCC, the Board, the FDIC and the NCUA proposed replacement guidance, with comments due November 16, 2026; until a final version is issued, the 2023 text is the standard (91 FR 58536). The Board's staff memo says that with the final version the agencies "would rescind the 2023 Guidance" along with the 2024 community bank guide and the July 2024 joint statement on bank-fintech deposit arrangements (Federal Reserve staff memo, August 28, 2026).

A sponsor bank should therefore plan on two horizons. Today's examinations still use the 2023 life cycle and the 2024 joint statement. A program built to evidence real testing of partners will satisfy either text, because the proposal changes how much process the guidance expects, not whether the bank answers for its partners.

What are the stages of the third-party life cycle?

The guidance names five stages, planning, due diligence and selection, contract negotiation, ongoing monitoring and termination, and three governance practices that run across all of them: oversight and accountability, independent reviews, and documentation and reporting. The table reads each stage for the case this site cares about, a partner that performs part of the bank's BSA program.

Two sentences from the due diligence stage are worth pinning above a BaaS team's desk. "Relying solely on experience with or prior knowledge of a third party is not an adequate proxy for performing appropriate due diligence." And when a third party will not share what the bank asks for, the guidance tells the bank to write the limitation down, understand the risk it leaves, and look for another way to get comfort. A bank that cannot see a partner's identity responses should say so in writing and decide what it will test instead.

What is a critical activity in third-party risk?

A critical activity, in the 2023 guidance, is one that could "cause a banking organization to face significant risk if the third party fails to meet expectations," "have significant customer impacts," or "have a significant impact on a banking organization's financial condition or operations." The bank decides which of its activities qualify: "an activity that is critical for one banking organization may not be critical for another" (88 FR 37920).

For most sponsor banks, a partner that onboards end customers, holds the only record of their balances and refers suspicious activity meets all three tests at once. A failure exposes the bank to BSA violations, end customers can lose access to their money, and a large program can be a material share of deposits. Critical status matters because the guidance then expects more: plans that may go to the board, more comprehensive due diligence, board awareness of the contract, and "more comprehensive or frequent monitoring."

Does the third-party guidance apply to fintechs?

Yes, and it says so. The guidance notes that some banks "may form third-party relationships with new or novel structures and features—such as those observed in relationships with some financial technology (fintech) companies," and that where a relationship involves customers, "the banking organization and the third party may have varying degrees of interaction with those customers" (88 FR 37920). The July 2024 joint statement then applied it to the BaaS deposit model directly, encouraging banks "to review and consider the risk management principles for third-party relationships set forth in the Interagency Guidance" (joint statement).

The guidance also reaches past the fintech to whoever the fintech relies on. Subcontracting "can result in risk due to the absence of a direct relationship between the banking organization and the subcontractor," and the bank may want contract terms on notice, consent and the third party's liability for its subcontractors. In BaaS that usually means a middleware firm or program manager; the middleware layer is where that clause earns its keep.

What the guidance expects when a partner runs part of the BSA program

When a partner performs a compliance function, the guidance expects the contract to make the bank's oversight possible and the monitoring to actually test it. On contracts, it calls it important "for a contract to specify the obligations of the third party and the banking organization to comply with applicable laws and regulations," and to give the bank "the right to monitor and be informed about the third party's compliance ... and to require timely remediation if issues arise." On data, it lists the bank's "ability to access its data in an appropriate and timely manner" and how that data "may be shared with regulators in a timely manner."

On monitoring, the guidance is concrete enough to test against. Typical activities include "review of reports regarding the third party's performance and the effectiveness of its controls," periodic meetings, and "regular testing of the banking organization's controls," and "in certain circumstances, based on risk, a banking organization may also perform direct testing of the third party's own controls." It adds that the bank "dedicates sufficient staffing with the necessary expertise, authority, and accountability" to do this. Re-performing a partner's end-customer files with the bank's own identity service is exactly that direct test.

"A banking organization's use of third parties does not diminish its responsibility to meet these requirements to the same extent as if its activities were performed by the banking organization in-house."

Interagency Guidance on Third-Party Relationships, 2023

Documentation is the third leg. The guidance lists what the agencies have seen in effective programs, including "a current inventory of all third-party relationships (and, as appropriate to the risk presented, related subcontractors)," "remediation plans and related reports," "risk and performance reports required and received from the third party," and "periodic reporting to the board." If the bank cannot produce these on request, the work it did is hard to prove.

Documentation the guidance describes, built in one step for an examiner

Is third-party guidance enforceable?

Not on its own. The agencies' rules on the role of supervisory guidance say that guidance, unlike a law or regulation, does not bind with the force of law, and that the OCC does not bring enforcement actions on the strength of guidance (12 CFR part 4, subpart F, appendix; the FDIC and the Board have the same text). The September 2026 proposal repeats the point: the OCC says it "will not set forth enforceable standards or prescriptive requirements" (OCC Bulletin 2026-46).

That is not the same as optional. Enforcement rests on laws and on unsafe or unsound practices, and orders routinely translate the guidance into binding terms. The OCC's 2024 order against Blue Ridge Bank required a written third-party risk management program and told the bank to "Refer to OCC Bulletin 2023-17," the OCC's issuance of this guidance, while defining third-party relationships to include its fintech partners and their subpartners (AA-ENF-2023-68). The enforcement casebook shows how far those orders went. Guidance does not bind a bank; a consent order built from it does.

What did the September 2026 proposal change?

The September 2026 proposal would keep the core principle and lighten almost everything around it. The Board's staff memo names four problems with the 2023 text: it "has been interpreted too broadly," gives "insufficient focus on tailoring," has "unintentionally incentivized process-driven approaches over risk-focused practices," and "has been read to discourage banks from engaging with newer and innovative third-parties" (staff memo). The proposal answers each one.

Read closely, the proposal does not let a sponsor bank do less on BSA. Its first principle now names the case BaaS banks live in, where the bank's own risk management is partly done by the third party. And the Fed's companion guide for smaller banks excludes the complex bank-fintech partnership by name. What the proposal removes is the expectation of uniform process; what it keeps is the expectation that the bank can show the risk is managed.

What is FFIEC third-party risk management guidance?

People often search for "FFIEC third-party guidance," but the 2023 text was issued by three agencies, the Board, the FDIC and the OCC, not by the FFIEC as a council; the September 2026 proposal adds the NCUA. The FFIEC's own material on the subject sits mainly in its IT Examination Handbook and in the BSA/AML Examination Manual, which examiners use alongside the interagency guidance. The July 2024 joint statement lists the FFIEC IT Examination Handbook among its sources for managing BaaS arrangements.

For AI tools used in oversight, the guidance applies the same way. Treasury's 2024 report on AI in financial services found broad agreement among respondents that the 2023 guidance already covers many of the risks of buying AI from third parties (Treasury, December 2024). Agentic AI in third-party risk management takes that question further.

The guidance's ongoing monitoring, as a finding with criteria cited

Questions people ask

Who issued the interagency guidance on third-party relationships?

The Board of Governors of the Federal Reserve System, the FDIC and the OCC, jointly, final as of June 6, 2023 and published June 9, 2023 at 88 FR 37920. The OCC issued it as Bulletin 2023-17, the Board as SR 23-4 and the FDIC as FIL-29-2023. It replaced each agency's earlier third-party guidance.

Does the third-party guidance require a contract with every vendor?

No. It says a relationship "may exist despite a lack of a contract or remuneration," and that a bank "typically determines whether a written contract is needed." For higher-risk and critical activities it expects written terms on compliance, data, audit rights and termination, and board awareness of the contract.

What does the guidance say about due diligence on fintechs that will not share information?

It accepts that a new third party "may not have a long operational history" or "may not share" what the bank asks for. The bank should document the limitation, understand the risk it leaves and compensate, for example with extra monitoring or controls on the partner, or by choosing a different one.

Does the 2026 proposal remove the July 2024 BaaS joint statement?

It would, once the replacement guidance is final. The Board's staff memo states that the agencies would rescind the joint statement on banks' arrangements with third parties to deliver deposit products, together with the 2023 guidance and the 2024 community bank guide. Until then all three remain in force.

Do examiners test the bank or the third party?

Mainly the bank. The 2023 guidance says examiners assess management's oversight and "perform transaction testing or review results of testing to evaluate the activities performed by the third party." It adds that "when circumstances warrant, an agency may use its legal authority to examine functions or operations that a third party performs on a banking organization's behalf." The BaaS Compliance examiner pack is built for the first case.