Bank Regulators Extend Comment Period on Third-Party Risk Rules

Federal banking regulators have extended the public comment period for proposed guidance on third-party risk management, giving stakeholders more time to weigh in on rules that would govern how financial institutions oversee outside vendors and service providers.

The extension was announced jointly by the agencies, which have been working to update supervisory expectations around the use of third parties — a practice that has grown significantly as banks increasingly rely on fintech firms, cloud providers, and other external partners for critical operations.

Read more Federal Banking Agencies Extend Third-Party Risk Comment Deadline →

Third-party risk management has become a central supervisory concern in recent years, as regulators seek to ensure that banks maintain adequate oversight of outside relationships that can expose institutions to operational, compliance, and reputational risks. The proposed guidance outlines expectations for how banks should conduct due diligence, monitor ongoing relationships, and plan for potential disruptions.

By extending the comment period, the agencies signal a willingness to gather broader industry input before finalizing the framework. Banks, trade groups, technology vendors, and consumer advocates are among the parties typically expected to submit feedback on guidance of this scope.

The move reflects ongoing regulatory efforts to modernize risk management standards in an era when financial services are deeply intertwined with third-party technology infrastructure. Final guidance, once issued, would apply across the agencies' supervised institutions. Continue reading at FRB: Press Release - All Releases.