Less Checklist, More Judgment: What the Proposed Third-Party Risk Rewrite Means for Fintech Partnerships

On September 11, 2026, the Fed, FDIC, OCC, and NCUA jointly proposed to rescind the 2023 interagency third-party risk guidance and replace it with something shorter and less prescriptive.

Their stated reason is worth reading closely. The agencies say the 2023 guidance was applied too broadly, with too little tailoring, and that it pushed institutions toward process-driven, check-the-box work instead of real risk management.

If you run a fintech partnership program, you probably built it on that guidance. So the question is not whether the rewrite is good news. It is what, exactly, could get easier, and what does not.

What the proposal actually changes

The new draft is principles-based. Like the 2023 guidance it would replace, it is not a regulation and does not carry the force of law. It organizes the work around four ideas: identifying and assessing risk, overseeing it through the relationship, deciding what residual risk to accept, and governance.

Three shifts stand out:

• Magnitude and likelihood take priority over "critical activities."
• The detailed examples are substantially reduced. de facto checklists that institutions applied to every vendor alike.
• Reasonable decisions get due consideration. Examiners would be directed to give due consideration to well-reasoned bank judgments, including risk assessments. That does not oblige them to accept every conclusion.

The draft also signals more comfort with shared assessments, third-party certifications, and lighter review for lower-risk relationships. The proposal also recognizes that limited operating history or incomplete diligence information need not automatically prevent a bank from entering a relationship. A bank may weigh compensating factors, provided it understands the risks and finds the residual exposure acceptable within its risk appetite.

For a community bank managing dozens of vendors, that could be real relief if the proposal is adopted.

The proposal would also rescind the agencies' supplemental resources, including the July 2024 joint statement on bank-fintech deposit arrangements and the 2024 community bank guide, without replacing the joint statement. That removes guidance written specifically for these relationships. It does not remove the underlying legal obligations the statement addressed.

The part that does not get lighter

Read the tailoring language again. Tailoring works in both directions.

A lighter touch for a facilities contractor implies a heavier one where a partner originates accounts, moves customer money, or sits inside your BSA/AML program. Those relationships will often sit near the top of a magnitude-and-likelihood assessment, though the assessment, not the label "fintech," sets the tier. Nothing in the proposal softens that.

And "due consideration to reasonable decisions" only helps if you can show the decision and the reasoning behind it. The draft asks institutions to document key elements of risk management. It does not prescribe a format. That leaves the burden where it has always been: on you to produce a record an examiner can follow.

Non-binding does not mean optional. Supervisors retain authority over violations of law and unsafe or unsound practices, and a bank remains responsible for compliance when it outsources an activity. That includes BSA/AML, sanctions, customer identification, consumer protection, and payments.

Governor Barr, in his dissent, raised concerns that go straight to this. He argued the draft introduces a new material-risk standard that could delay action on problems until they are large. He also worried that deference language could be read as a signal to examiners to back off.

We don't need to settle that debate to see the practical point. If supervisory posture softens on paper, the institutions that documented their reasoning carefully are the ones that benefit.

The fintech gap

Here is the piece most readers should sit with.

The Fed also proposed a companion guide for traditional community banking organizations, meaning Federal Reserve-supervised banks under $30 billion in assets that focus on serving local communities. It covers eight vendor categories, including core providers, payment and digital banking providers, card processors, and BSA/AML and financial crime platforms. It says plainly that it is not intended for organizations with more complex business models or third-party profiles.

Complex bank-fintech partnerships fall outside it. Barr flagged the same thing, along with the exclusion of consumer compliance matters, which could leave banks working from two sets of expectations.

So the community bank guide is useful for your core processor and your fraud vendor. It does not tell you how to oversee a program partner that onboards customers through an API. For that, you are working from the general principles and your own risk assessment.

That makes the assessment itself the most important document you own.

Separately, on the same day, the OCC, Federal Reserve, and FDIC issued a statement on community banks' engagement with core service providers. It is distinct from both the interagency proposal and the Fed's community bank guide.

Configuring oversight to match each program's risk

Comments are due November 16, 2026, per the agencies' materials. Whether or not you file one, this is a good window to get ahead of the final text. The Across platform is built for this work: it lets a bank configure each type of third-party program and set the requirements and oversight that match that program's risk.

• Configure each program type by its risk profile. Set up the types of third-party programs you run, such as fintech, BaaS, and embedded finance, and define the degree of risk for each. Base it on what a failure would cost customers, the institution, and your regulatory standing, not on how the 2023 categories labeled them.
• Define onboarding and CIP requirements per program. Banks can tailor third-party diligence, verification controls, and ongoing monitoring to each relationship's risk, while maintaining compliance with mandatory CIP and other applicable requirements. Specify the diligence and Customer Identification Program requirements that apply to each program type, so a higher-risk partner is held to a heavier standard from the first day and a lower-risk one is not over-burdened.
• Set review frequency and extent to the risk. Configure activity reviews and periodic reviews for each program, including how often they occur and how deep they go. Lower-risk programs can move to lighter review. Higher-risk fintech programs get monitoring you can defend with dated case files.
• Keep the reasoning on file. Record the risk conclusion, the evidence behind it, who made the call, and when, and make sure someone with the authority to accept residual risk actually signs.

This is where we spend our own time. At Across, we built our platform around the idea that a conclusion is only as good as the file behind it. Each program's configuration, and every review that follows from it, leaves a trail that is complete, attributed, and ready when an examiner asks, without an analyst rebuilding the story weeks later.

What is at stake

A principles-based regime rewards institutions that can explain themselves. It is less forgiving of the ones that relied on the checklist to do their thinking.

If the proposal lands close to its current form, expect examiners to ask a simpler question than they used to: why did you decide this, and can you show me? The banks and credit unions with good answers may spend less time on paperwork. The rest will find out how much the checklist was covering for.

Note: this post summarizes a proposal, not final guidance. Provisions may change before the guidance is adopted.