What is the OCC's third-party risk management guidance?
By Nick Jang, founder of MINERVA Studio ·
The short answer
The OCC's third-party risk management guidance is the Interagency Guidance on Third-Party Relationships: Risk Management, issued on 6 June 2023 by the OCC (as Bulletin 2023-17), the Federal Reserve and the FDIC together. It replaced each agency's earlier guidance, including the OCC's Bulletin 2013-29 and its 2020 FAQs, and applies to every banking organization they supervise with third-party relationships. It organises the work as a life cycle (planning, due diligence and selection, contract negotiation, ongoing monitoring and termination) wrapped in oversight and accountability, independent reviews, and documentation and reporting, all in proportion to the risk and criticality of each relationship.
One guidance for three agencies
Before 2023 each US banking agency had its own third-party guidance, and they didn't quite match. The final interagency guidance put them on one text. The OCC published it as Bulletin 2023-17, the Fed as SR 23-4, and the FDIC as a financial institution letter, all on 6 June 2023, with the Federal Register notice following on 9 June.
It's guidance, not a regulation, but examiners use it. And it reaches every kind of outside relationship, not only classic outsourcing: vendors, fintech partners, data providers, cloud services and, increasingly, the companies that supply AI models.
The life cycle and the three practices
| Stage | What it covers |
|---|---|
| Planning | Why use a third party, the risks it brings, the cost, and whether the activity is critical, before anything is signed. |
| Due diligence and selection | The third party's strategy, business experience, legal and regulatory standing, financial condition, risk management, information security, resilience, incident handling and its own subcontractors. |
| Contract negotiation | Performance standards, audit and information rights, data protection, business continuity, subcontracting, default and termination terms. |
| Ongoing monitoring | Performance, risks and changes over the life of the relationship, more closely for critical activities. |
| Termination | Exiting in an orderly way: transition, data return or destruction, costs, and continuity of the service. |
Around that loop sit three governance practices: oversight and accountability (the board and senior management own it), independent reviews of the risk management process, and documentation and reporting.
Critical activities and proportionality
The guidance says plainly that not every relationship carries the same risk. A relationship supporting a critical activity, one whose failure could cause significant harm to the bank or its customers, gets more planning, deeper due diligence, tighter contracts and closer monitoring. What's critical for one bank may not be for another, so each bank decides and documents its own view.
In May 2024 the agencies added Third-Party Risk Management: A Guide for Community Banks, which walks through each stage with practical examples. It doesn't change the guidance, but it's the most readable version of it.
Where AI vendors come in
An AI vendor is a third party like any other, with some extra questions: what data the vendor trains on or keeps, how its model is validated and monitored, what changes when the vendor updates the model, and whether its AI features can be switched off. If the vendor's model informs decisions, the bank's model risk guidance applies too: in the US that's SR 26-2, which replaced SR 11-7 in April 2026.
For more on that overlap, see third-party AI and how to run a vendor risk assessment.
How it compares with OSFI B-10
| US interagency guidance | OSFI Guideline B-10 | |
|---|---|---|
| Issued by | OCC, Federal Reserve and FDIC | OSFI |
| Date | 6 June 2023 | In effect 1 May 2024 |
| Who | Banking organizations the three agencies supervise | All federally regulated financial institutions, banks and insurers |
| Shape | A five-stage life cycle and three governance practices | Outcomes and principles across the relationship |
| Scales by | Risk and critical activities | Risk and criticality of each arrangement |
A Canadian bank with a US operation may face both. The records largely overlap: an inventory of third parties, a risk and criticality rating, due diligence, contracts, monitoring and exit plans. See OSFI B-10. MINERVA keeps that record for B-10, with the models and AI agents that depend on each supplier. See AI vendor risk software.
Related questions
What is OCC Bulletin 2023-17?
The OCC's issuance of the Interagency Guidance on Third-Party Relationships: Risk Management, published on 6 June 2023 with the Federal Reserve and the FDIC. It rescinded OCC Bulletin 2013-29 and the 2020 FAQs that supplemented it.
What are the stages of the third-party risk management life cycle?
Planning; due diligence and third-party selection; contract negotiation; ongoing monitoring; and termination, surrounded by oversight and accountability, independent reviews, and documentation and reporting.
Does the OCC guidance apply to fintech partnerships?
Yes. It applies to all third-party relationships, including bank-fintech arrangements, not only traditional outsourcing.
Is there an OCC guide for community banks?
Yes. In May 2024 the agencies published Third-Party Risk Management: A Guide for Community Banks, which explains each stage of the guidance with examples.
Is the interagency guidance a regulation?
No. It is supervisory guidance. It sets out how the agencies expect banks to manage third-party risk, and examiners use it in their reviews.
Sources
- OCC — Bulletin 2023-17, Third-Party Relationships: Interagency Guidance on Risk Management (6 June 2023)
- Federal Reserve — Interagency Guidance on Third-Party Relationships: Risk Management (SR 23-4)
- OCC — Third-Party Risk Management: A Guide for Community Banks (May 2024)
New answers are posted on MINERVA on LinkedIn. Follow along, or send the question you’d like answered next to minerva@minerva.studio.
A plain-language explanation, not legal advice. The regulator’s own text is the source; read it, and take advice on how it applies to your institution.