Banking Agencies Extend Third-Party Comment Deadline to December

Four federal regulators gave the banking industry thirty more days to comment on new third-party risk guidance. The Federal Deposit Insurance Corporation, the Federal Reserve Board, the National Credit Union Administration and the Office of the Comptroller of the Currency announced the extension on November 13, 2026. Comments were originally due November 16. They're now due December 16, 2026, three days after the original deadline would have closed the file.

The proposal covers how banks and credit unions manage the companies they hire. Core processors, cloud providers, payment apps, collection firms and AI vendors all sit inside a modern bank's operations, and the guidance is meant to help institutions tailor their oversight to the risk each relationship actually carries. The agencies say the draft reflects their supervisory experience and the lessons from examining third-party practices across the industry.

The approach is principles-based, and the agencies state the limit plainly: like all supervisory guidance, it is non-binding. It doesn't carry the force of a regulation. Examiners still use guidance to shape what they expect to see in an examination, which is why banks treat a non-binding document as a compliance workload anyway. That gap between formal status and practical effect is where most comment letters on guidance proposals land.

When the guidance is finalized, the federal bank regulatory agencies plan to rescind their existing third-party risk management guidance and replace it with the new version. The stated goals are consistency and prudent innovation. The NCUA also plans to rescind its existing guidance for credit unions and will run its own reviews to update related material. A single replacement framework matters because institutions that answer to more than one regulator currently map overlapping expectations that don't always use the same words.

The Federal Reserve added a second extension of its own. Alongside the joint action, the Board extended until December 16 the comment period on a proposed third-party risk management guide written specifically for traditional community banks that the Federal Reserve supervises. Community banks run on vendor software more heavily than large banks do, with smaller staffs to audit it, and the separate guide is the agencies' acknowledgment that one template doesn't fit a two-branch bank and a national chain the same way.

The timing of the extension is part of the story. Announcing a thirty-day extension three days before a deadline usually means the agencies heard from filers who said they couldn't finish, or the agencies want a fuller record before they finalize. Either way, the comment file now closes December 16, in the middle of the holiday reporting season, and the final guidance will be written from whatever that file contains.

For customers, none of this is visible, and that's the point of the exercise. Third-party failures surface as outages, frozen payments and breached data at a bank whose own systems worked fine. The guidance decides how hard a bank has to push on a vendor's security, backups and exit plans before something breaks. A comment deadline in December is the cheapest point in that whole chain for the industry to argue about how hard the pushing should be.