Regulation guide

FDIC Third-Party Risk Management

Operationalize the FDIC Third-Party Risk Management requirements—from regulatory obligations and evidence collection to vendor assessments, continuous monitoring, governance, and remediation workflows.

Overview

FDIC-supervised institutions use the interagency third-party risk guidance to manage risks from outside relationships across planning, due diligence, contracting, monitoring, and termination. The guidance is not limited to vendors labeled as outsourcing providers.

FDIC-supervised institutions should match oversight to risk. A low-risk office supplier and a core banking technology provider should not go through identical review.

Rather than prescribing identical controls for every relationship, the regulation emphasizes a risk-based approach, requiring organizations to apply governance, oversight, controls, monitoring, and due diligence according to the criticality and risk of each relationship.

This implementation guide explains what the regulation requires, how those requirements translate into operational controls and evidence, and how Halbarad helps organizations operationalize compliance through assessments, continuous monitoring, governance workflows, and supply chain risk intelligence.

Official Sources

The FDIC describes the guidance as principles supporting a risk-based approach to third-party relationship risk management at each stage of the relationship life cycle.

Intent of the Guide

FDIC-supervised institutions should match oversight to risk. A low-risk office supplier and a core banking technology provider should not go through identical review. The institution should identify the relationships that affect operations, customers, compliance, technology, data, or resilience and keep evidence showing how those relationships are managed.

Operationalization Requirements

  • third-party inventory and risk tiering;
  • pre-contract planning and due diligence;
  • contracts with performance, reporting, confidentiality, security, audit, subcontracting,

continuity, and termination protections;

  • monitoring for performance, incidents, complaints, issues, and changes;
  • termination and transition planning;
  • governance, management reporting, and independent review.

Evidence Requirements

  • Third-party risk policy and lifecycle procedures.
  • Provider inventory and risk assessments.
  • Due diligence and approval records.
  • Contract review evidence.
  • Monitoring, issue, incident, and remediation evidence.
  • Exit and contingency planning evidence.
  • Management and board reporting.

Common Gaps

  • Third-party records are kept for onboarding but not maintained during the relationship.
  • Provider issues are resolved locally without program-level reporting.
  • Subcontractor changes and provider outages are not treated as reassessment triggers.
  • Exit plans are not realistic for important relationships.

How Halbarad Helps

Halbarad helps FDIC-supervised institutions maintain the evidence trail behind third-party risk decisions. It supports provider records, diligence, Nth-Party Discovery, continuous monitoring, issues, remediation, approval history, and reporting.

Halbarad helps run and evidence the program. It does not replace FDIC guidance or supervisory expectations.

Disclaimer

This guide is for general information only and is not legal advice. Review the official regulation, guidance, and supervisory materials, and consult qualified counsel or compliance advisors for your organization's specific obligations.