Your core provider has a legal team. Your trade association has a regulatory team. Your institution has something neither can supply: firsthand experience with the contract you signed and the options you actually have.

The agencies are taking comments on proposed third-party risk management guidance. Put that experience in the record.

We have taken our own advice. CCG Catalyst has submitted a comment letter to all four agencies, drawing on our work advising institutions on vendor selection, contract negotiation, implementation, and exit. The four recommendations below summarize our response.

I examined the proposals in my September commentary, “The Regulators Answered.” Now we have put our recommendations directly before the agencies. Your institution should do the same.

On October 29, the American Bankers Association, Bank Policy Institute, Consumer Bankers Association, and Independent Community Bankers of America requested another thirty days to respond. Their questions concern due diligence, contracting, and the interaction of overlapping proposals. The Federal Register notice lists November 16 as the deadline; confirm the current deadline before filing.

Whether the window stays where it is or moves, do not let the trade associations be your only voice.

What Is Changing—and What Is Not

On September 15, the OCC, Federal Reserve, FDIC, and NCUA published proposed guidance to replace the 2023 interagency framework. Separately, the Federal Reserve, FDIC, and OCC issued a September 11 Joint Statement addressing community banks’ relationships with core service providers. The Federal Reserve also proposed a separate third-party risk management guide for community banking organizations.

The interagency proposal moves toward proportionate, risk-based oversight. It emphasizes the magnitude and likelihood of harm, recognizes residual risk acceptance, and acknowledges limited negotiating power. It does not establish generally applicable expected contract terms.

This is nonbinding guidance, not an examination manual. It creates no enforceable standards, and departure from an illustration alone is not grounds for supervisory action. But the final wording can influence how institutions and examiners discuss risk. That is why the distinctions matter.

Less Paperwork Is Not More Control

I support removing documentation that does not improve decisions. A shorter document, however, does not give a community bank better information, stronger negotiating leverage, or a practical alternative to its provider.

A bank cannot manage a risk it cannot see, negotiate a protection it cannot obtain, or execute an exit it cannot afford.

The Joint Statement identifies important provider practices: transparency, service performance, integration restrictions, exit costs, technology investment, and resilience. Those concerns should connect clearly to institution-facing guidance. Otherwise, we tell the bank to manage an exposure while leaving the provider practice that creates it untouched.

What We Told the Agencies: Four Changes Worth Making

1. Scope: Follow the Dependency, Not Just the Paperwork

What the agencies ask: Should the guidance apply only to third-party relationships governed by written agreements?

CCG Catalyst response: Do not make contract form the boundary. Coverage should follow the substance of the arrangement and the institution’s dependency, with oversight proportionate to risk. A click-through agreement is written, but it may offer very different protections from a negotiated contract.

Separately, clarify accountability when an operator, reseller, or CUSO delivers another company’s software. The institution needs to know who controls service delivery, defect remediation, and the roadmap—not directly oversee every subcontractor.

2. Contracts: Preserve Reference Points and Recognize Restrictions

What the agencies propose and ask: The proposal moves away from detailed contract considerations and asks whether the agencies should publish characteristics that may indicate higher-risk relationships.

CCG Catalyst response: Retain useful reference material in an expressly nonbinding appendix. Community institutions use those reference points to negotiate protections. Fix checklist misuse through examiner instruction—not by removing the institution’s negotiating tools.

Also recognize duration and restrictive terms as risk considerations. Longer commitments surrender flexibility. Exclusivity, bundling, and minimum commitments deserve scrutiny when they materially prevent an institution from supplementing deficient services or executing a credible contingency plan.

3. Execution: Make Monitoring, Implementation, and Exit Practical

What the agencies propose: The guidance takes a risk-based approach across the relationship lifecycle. The accompanying Joint Statement identifies provider practices involving transparency, service performance, technology investment, integration, and exit.

CCG Catalyst response: Connect those principles to practical decisions. Monitoring should consider provider finances, ownership, platform investment, end-of-life plans, and continuing strategic fit—not just today’s service levels. A cheaper contract for the wrong platform remains the wrong contract.

Make implementation responsibilities explicit and material vendor promises measurable. As I discussed in “Buying Like a Professional—Part 4,” the institution must own its side of the conversion. The vendor’s project plan is not the bank’s operating plan.

Verify exit assumptions proportionately: usable data, realistic costs, transition assistance, and a workable timetable. Assess integration charges when they impair diversification or contingency options. A termination clause is not a transition plan.

The banking agencies should use their applicable provider-examination authorities and share actionable findings to the fullest extent legally permissible. That should help close information gaps—not replace institutional responsibility.

4. Advisors: Make the Incentives Visible

What the agencies recognize: Consultants and other professional services firms can strengthen risk management, while relying on them can itself introduce risk.

CCG Catalyst response: Identify compensation and vendor relationships as explicit due-diligence considerations. Percentage-of-savings fees can reward longer terms, broader scope, or an inflated baseline while giving insufficient weight to portability, service remedies, and exit protections.

That does not make every percentage fee wrong or other fee models conflict-free. Ask who pays the advisor, how savings are defined, and whether contract size, duration, vendor payments, or referrals affect compensation.

Apply those questions to CCG Catalyst too. We are asking for visible incentives and informed decisions, not a prescribed advisory business model.

Put Your Experience in the Record

A useful comment does not need to be long. Explain your institution’s perspective, describe one or two concrete problems, and propose a specific change. Show how a clarification or nonbinding example would improve a real decision—not just add another procedure.

Follow the Federal Register submission instructions. Comments are generally public, so avoid customer information, confidential supervisory information, and sensitive contract details without appropriate review.

Consider a board or risk committee discussion if the proposal could materially affect your vendor strategy. The purpose is informed decisions, not another compliance artifact. Commenting is an opportunity, not an examination requirement.

An extension, if granted, is a reason to write a better letter—not a reason to wait.

We have put our recommendations in the record. Your institution’s experience will be different from ours—and that is precisely why it belongs there too.

The trade associations can describe an industry pattern. Only you can explain what that pattern means inside your institution—one core, one contract, one examiner at a time.

Tell the agencies what managing that risk actually requires.

CCG Catalyst advises banks, credit unions, and fintech companies on vendor strategy, contract negotiation, and regulatory readiness. Learn more at www.ccgcatalyst.com.

See our latest announcement: CCG Catalyst’s Paul Schaus Named a 2026 Top Consultant by Consulting Magazine

By: Paul Schaus | Founder & Managing Partner, CCG Catalyst Consulting

Disclaimer: The views expressed in this article represent the perspective of CCG Catalyst Consulting based on our direct experience advising financial institutions. This commentary is intended to stimulate industry discussion and does not constitute legal, accounting, or regulatory advice.