Coverage: October 2026 · Information to 1 October 2026
TGB Premium Intelligence · Subscriber Edition
This report is part of TGB Premium Intelligence and is available by request to qualified institutions. It will not enter the open archive for at least twelve months.
Regulatory Policy Brief (RPB) · October 2026
September 2026 sharpened the focus of third-party risk supervision on concentration, substitutability and supervisory reach. On 11 September the four US federal banking and credit-union agencies proposed replacing the banking agencies' 2023 third-party guidance with a principles-based framework, while three of them warned that a handful of core-banking vendors now constrain community banks. One week later the European Banking Authority finalised guidelines that will repeal its 2019 outsourcing rules. On 23 September the European Supervisory Authorities flagged reliance on non-EU technology providers as a financial-stability vulnerability. UK oversight of its first four designated critical third parties, which began on 13 July, and Australia’s CPS 230, now past its last transitional deadline, complete a global picture: less paperwork for low-risk vendors, more scrutiny of the few providers on which the system depends.
Executive Summary
The US proposal was published in the Federal Register on 15 September 2026. It reorganises supervisory expectations around four components (risk identification and assessment, risk oversight, residual-risk acceptance and governance) and drops the 2023 framework’s emphasis on “critical activities”. It states that there are “no generally applicable expected contract terms” even for higher-risk relationships, and that the absence of a contractual term an examiner considers best practice would not alone justify an adverse finding. When finalised, the agencies plan to rescind the existing guidance.
Europe is moving in the same direction on proportionality but further on structure. The EBA’s final Guidelines on the sound management of third-party risk related to non-ICT services, published on 18 September, concentrate requirements on arrangements supporting critical or important functions, align the register of arrangements with the Digital Operational Resilience Act (DORA) and give institutions a two-year transitional period. Alongside DORA, which covers ICT services and has brought 19 critical ICT providers under direct EU oversight, the EBA guidelines will cover non-ICT services once they apply.
The common thread is a deliberate trade. Supervisors are proposing or preparing to lower the documentary burden for low-risk vendors and fintech partnerships, while raising their focus on the small number of providers whose failure would affect many banks at once. For boards, the practical consequence is to tier the vendor book far more aggressively, invest in exit and substitution planning for the top tier, and expect examiners to ask about concentration as well as contract clauses.