Agencies Extend Comment Period for Proposed Third-Party Risk Management Guidance

The change is procedural, so no new requirements take effect now, but it signals continued supervisory focus on how banks and credit unions oversee vendors, fintech partners, subcontractors and other service providers. Compliance, procurement, legal and technology teams should use the additional time to compare current vendor lifecycle practices with the proposal's likely expectations: complete third-party inventories, risk-based due diligence, contract clauses covering audit and access, ongoing monitoring, concentration-risk assessment, and exit planning. Firms with critical operational dependencies should prioritize gap assessments and board/management reporting.

Comments are due December 16; stakeholders who want to influence the final text should coordinate submissions. RegCanary view: treat the extension as preparation time, not a deferral—final guidance could require formal program updates and contract remediation.