Fed proposes third-party risk guide for community banks under $30 B

The Board of Governors of the Federal Reserve System issued a proposed Third-Party Risk Management Guide specifically for "traditional community banking organizations" (TCBOs) - banks with less than $30 billion in assets that focus on serving local communities. The guide is advisory, not a rule, and is intended to help TCBOs apply the high-level principles set out in the agencies' Proposed All-Bank TPRM Guidance.

The Community Bank Guide is designed as a companion document that translates supervisory experience into practical steps for smaller banks. It outlines overarching risk considerations - operational resilience, system and information security, compliance with rules and regulations, and financial resilience - and then breaks down vendor-by-vendor expectations for core providers, IT infrastructure, cybersecurity, payment processing, loan management, card issuing, BSA/AML platforms, and fraud prevention providers.

The Board invites public comment on any aspect of the draft guide, with submissions due on or before November 16, 2026. Comments must reference Docket No. OP-1880 and may be submitted via the Board's website, mail, hand delivery, or email. The notice lists specific topics for comment, including the merits of the $30 billion asset threshold, clarification of the TCBO definition, the guide's level of detail, vendor-category adjustments, contract-negotiation support, and whether deposit placement networks should be added as a vendor category.

For further information, the Board listed contacts in the Division of Supervision and Regulation and the Legal Division, providing phone numbers for each. The notice also states that the guide does not create any new information-collection requirements under the Paperwork Reduction Act, and therefore no OMB control number is required.

The proposed guide is published in the Federal Register (Vol. 91, No. 177, pages 58438-58446) as FR Doc No. 2026-18852.