Regulators Just Proposed New Vendor Risk Rules, and the NCUA Helped Write Them
On September 11, four federal regulators put out a proposal that matters to any credit union that buys technology, which means all of them. The FDIC, the Federal Reserve, the OCC, and the NCUA jointly asked for public comment on new guidance for managing the risks that come with outside vendors. If it's finalized, it replaces the third-party risk guidance the agencies issued in 2023.
Two things are worth knowing right away. First, this is supervisory guidance, not a rule, and the agencies say plainly that it's non-binding. Second, the NCUA is a co-issuer. That puts credit unions inside the conversation instead of watching a banking-only discussion from the sidelines.
What the proposal is trying to change
The core idea is proportionality. According to the OCC's bulletin, the guidance is meant to help institutions focus their vendor oversight on the size of the harm a vendor could cause and how likely that harm is, rather than running every relationship through the same heavy process. The agencies specifically say they want to avoid "overly process-driven" approaches that treat every vendor as inherently high risk. The guidance also asks institutions to tailor their approach to their own size, complexity, and risk profile.
In plain terms: the agencies are saying a company that processes your core transactions and a company that supplies your office coffee machine shouldn't get the same level of paperwork, and your oversight should be able to show why.
Along with the main proposal, the Federal Reserve separately asked for comment on a companion guide for the community banks it supervises. The FDIC, OCC, and Federal Reserve also issued a joint statement about how community banks work with their core service providers, which tells you regulators are paying close attention to that particular relationship.
The timeline
Comments are due 60 days after the proposal is published in the Federal Register, which puts the deadline around mid-November. When the guidance is finalized, the bank agencies plan to withdraw the current guidance and put the new version in its place.
Why this matters more once AI is in the picture
Nearly every AI feature a credit union uses arrives through a vendor: the chatbot, the fraud tool, the underwriting model, the AI assistant inside your core. That makes vendor oversight the main place where AI risk actually gets managed.
There's a second reason. A 2025 report from the Government Accountability Office noted that the NCUA lacks the authority to examine technology service providers, even though credit unions rely on them more and more. When the regulator can't look inside the vendor, the evidence about how that vendor's technology works has to come from you.
What to do while comments are open
Start with a simple vendor list that marks which ones have AI features and what member data each one touches. Sort that list into tiers: vendors whose failure would stop something members depend on, vendors that handle sensitive data, and everyone else. Then write down, in a sentence or two per tier, how much oversight each gets and why. That one page is the practical version of what the proposal is asking for.
If your credit union has operational experience with vendor management, consider sending a comment. Trade associations will submit their views, but regulators also read the specifics that practitioners provide about what works and what doesn't.
Sources
- Agencies seek comment on proposed third-party risk management guidance (Federal Reserve)
- Third-Party Risk Management: Proposed Guidance and Request for Comment, Bulletin 2026-46 (OCC)
- Agencies Seek Comment on Proposed Third-Party Risk Management Guidance, News Release 2026-77 (OCC)
- Financial Institution Letter, September 11, 2026 (FDIC)
- Artificial Intelligence: Use and Oversight in Financial Services, GAO-25-107197 (GAO)