On September 15, 2026, the Federal Reserve published a Proposed Third-Party Risk Management Guide for Traditional Community Banking Organizations (TCBO) in the Federal Register.
We’ll be reviewing the guidance and answering frequently asked questions, like:
The Federal Reserve defines a TCBO as a banking organization with less than $30 billion in assets that serves its local community.
The term TCBO is new and unique to this guidance. The Federal Reserve has historically used the term “community banking organization” to mean institutions with less than $10 billion in assets. However, Federal Reserve Board Vice Chair for Supervision Michelle Bowman has advocated for years that “community bank” should mean a business model, not just an asset threshold. This new TCBO term and definition seem to reflect this perspective.
As proposed, the guide would be a resource for TCBOs supervised by the Federal Reserve.
If the Federal Reserve is not your primary regulator, while this particular guide would not apply you, the ideas presented are still sound. The companion All-Bank TPRM Guidance, published the same day, applies to all banking organizations supervised by the Board, FDIC, OCC, and NCUA.
Two quick additional scoping notes:
The guide is not written for institutions with more complex profiles, such as banks in complex bank-fintech partnerships.
The Federal Reserve released this proposal as a supplement to the Proposed All-Bank TPRM Guidance.
The Federal Reserve’s guidance exists to help explain how TCBOs can “operationalize” the principles from the other guidance, basically zooming in and saying, “Here’s what these principles could look like in your specific context.”
The interesting thing about the Federal Reserve’s proposed TPRM supplement is that it doesn’t contain any new requirements. Instead, it does two primary things:
Part 1 summarizes high-priority considerations across four common TPRM topics.
Part 2 describes these considerations in the context of eight common third-party categories.
Let’s take a quick look at both parts.
The first part of the proposed guidance talks about four TPRM topics that are typically given highest priority by community institutions and the typical techniques used to manage these areas.
| Topic | What It Means | Typical Management Techniques |
| Operational Resilience | The risk of a third-party outage disrupting the bank’s operations. |
Review independent assessments (e.g., SOC reports, TSP examination reports, audit reports, penetration test reports, industry certifications). Review historical uptime and service availability metrics. |
| System and Information Security | The risk of a third party’s access to bank systems or data resulting in theft or compromise. | Review independent control assessments (e.g., access controls, encryption, incident response plans, backup procedures, business continuity and disaster recovery plans). Consider contract requirements (e.g., access to security testing reports, incident notification requirements, liability and insurance provisions). Monitor cyber events and control enhancements. Upon termination, confirm data is returned or destroyed and access is removed. |
| Compliance | The risk of a third party performing a regulated function (or supporting the bank’s compliance) causes a violation. | Review independent assessments (e.g., compliance attestations, certifications, audit reports). Consider contract requirements (e.g., responsible parties, timely updates, notification requirements, response times, liability or indemnification, access to audit reports, data retention requirements). Monitor news sources for vendor or regulatory updates. Proactively communicate about regulatory changes. |
| Financial Resilience | The risk of a third party’s financial status disrupting the bank’s operations. | Review financial data (e.g., credit ratings, SEC filings, market intelligence, funding sources, cash outlay, pro forma financial statements). Consider risk acceptance or other controls (e.g., financial investment in the vendor, contractual requirements for future financial reports, insurance requirements, limited growth until financial performance is assessed). |
The second part of the proposed guidance talks about eight third-party categories that are most common to TCBOs. The eight categories are:
Core Providers
Information Technology (IT) Infrastructure Providers
Cybersecurity Providers
Payment Processing and Digital Banking Providers
Loan Management System Providers
Card Issuing and Processing Providers
BSA/AML and Financial Crime Platform Providers
The proposal provides overarching risk management considerations, as well as specific considerations for each.
For example, for the Cybersecurity Providers category:
Overarching Risk Management Considerations include operational resilience and system and information security for these relationships.
Specific Risk Management Considerations include reviewing independent assessment reports, obtaining references from peers, reading publicly available reviews, reviewing system performance reports, and tailoring contractual requirements.
This section of the proposed guidance is extremely practical and designed to paint a picture of what effective oversight could look like based on the relationship’s nature and characteristics.
Just like with the proposed interagency TPRM guidance, there are four things you can do right now to prepare for this update.
Get familiar with the guidance. Read it now on the Federal Register.
Comment before November 16, 2026. The Federal Reserve wants to hear from you.
Coordinate with your associations. Your banking associations are likely reviewing the proposal and may be planning to comment. Sharing your thoughts with them helps them advocate more effectively on your behalf.
At Tandem, our goal is to help community financial institutions keep up with changes in regulations, guidance, and industry best practices. When new guidance comes out, we read it and make updates to the Tandem software.
Tandem Vendor Management is our third-party risk management product. It helps you track your third-party relationships, assess third-party risks, and manage those risks across the life cycle of each relationship.
With helpful features like Significance Questions and our library of Review Templates, Tandem is already well-suited to help you right-size your vendor management program. See how Tandem can help you at Tandem.App/VM.
What is a traditional community banking organization (TCBO)?
A TCBO is a banking organization with less than $30 billion in assets that focuses on serving its local community. The Federal Reserve introduced the term in its September 2026 proposed third-party risk management guide to describe the smaller institutions the guide is written for.
Is the Federal Reserve’s proposed TPRM guide a new rule?
No. The guide is not a rule and creates no new requirements. The Federal Reserve states that non-compliance with the guide will not, by itself, result in supervisory criticism.
When are comments on the proposed guide due?
Comments are due by November 16, 2026. You can submit them through the Federal Reserve’s website under Docket No. OP-1880.
How is the Fed’s TPRM guide different from the interagency (All-Bank) TPRM guidance?
The interagency All-Bank TPRM Guidance sets high-level principles for all banking organizations, while the Federal Reserve’s companion guide shows TCBOs how to apply those principles in practice. Both were published the same day and are meant to be read together.
Who does the proposed guide apply to?
The guide is written for traditional community banking organizations with less than $30 billion in assets that are supervised by the Federal Reserve. It is not intended for institutions with more complex models, such as banks in complex bank-fintech partnerships, and consumer compliance is out of scope.
What risk topics does the proposed guide cover?
The guide focuses on four overarching topics: operational resilience, system and information security, compliance with rules and regulations, and financial resilience. It then applies those topics to eight common third-party categories.
What third-party categories does the guide address?
The guide covers eight vendor categories common to community banks: core providers, IT infrastructure providers, cybersecurity providers, payment processing and digital banking providers, loan management system providers, card issuing and processing providers, BSA/AML and financial crime platform providers, and fraud prevention and detection providers.
Do I need to change my vendor management program because of this guide?
Not from the proposal itself. As written, the guide is not a rule and adds no new requirements, so it doesn’t inherently require any changes to your program. If it is finalized, it would be worth reviewing your current practices and comparing results. In the meantime, it can be a useful benchmark for what effective third-party oversight can look like.