Reference · Third-party risk

What a Bank's Third-Party Risk Review Asks an AI Vendor

The interagency third-party guidance, SR 26-2, and the evidence behind each answer

Last reviewed October 11, 2026

A bank that buys an AI product enters a third-party relationship, and the federal banking agencies expect it to manage that relationship through a life cycle of planning, due diligence and selection, contract negotiation, ongoing monitoring, and termination.2023 guidance · § C The governing text is the Interagency Guidance on Third-Party Relationships: Risk Management, issued in June 2023 by the Federal Reserve, the FDIC, and the OCC. A proposed replacement is open for comment until 16 November 2026.Proposed guidance

For the vendor, that guidance arrives as a questionnaire, a request for documents, and a set of contract terms, and an AI product has to answer each of them with evidence.

The bank stays responsible for what its AI vendor does

The three agencies issued the guidance on 6 June 2023, each under its own number: SR 23-4 at the Federal Reserve, OCC Bulletin 2023-17, and FDIC FIL-29-2023. It replaced the Federal Reserve's SR 13-19, OCC Bulletins 2013-29 and 2020-10, and FDIC FIL-44-2008.SR 23-4 OCC Bulletin 2023-17 FDIC FIL-29-2023 It was published in the Federal Register on 9 June 2023.88 FR 37920

The guidance is directed to every banking organization the three agencies supervise, and it covers any business arrangement between a bank and another entity, by contract or otherwise. Its central sentence is the one a vendor meets in every review: "A banking organization's use of third parties does not diminish its responsibility to meet these requirements to the same extent as if its activities were performed by the banking organization in-house."2023 guidance · § A The requirements are safe and sound operation and compliance with applicable law, including laws that protect consumers and laws that address financial crimes.

Supervisory guidance does not have the force of law.2023 guidance · footnote 2 Examiners review a bank's third-party risk management as part of their standard supervisory process, and when circumstances warrant, an agency may use its legal authority to examine functions a third party performs on a bank's behalf. The vendor's own operation can therefore come within an examination.2023 guidance · § E

Be ready for five stages of review, deeper where the risk is higher

Oversight scales with risk. The guidance expects more comprehensive and rigorous oversight of relationships that support higher-risk activities, including critical activities: those that could expose the bank to significant risk if the third party fails, have significant customer impacts, or significantly affect the bank's financial condition or operations. Each bank identifies its own critical activities.2023 guidance · § B An AI product that reads customer data or drafts what customers receive weighs toward the higher tiers.

The review follows the relationship through five stages, and three governance practices run across all of them: oversight and accountability, independent reviews, and documentation and reporting.2023 guidance · §§ C, D

Flow

The life cycle a bank's third-party review follows

Stage 1PlanningThe bank weighs the risks, including access to customer data
Stage 2Due diligence and selectionControls, security, resilience, incidents and subcontractors
Stage 3Contract negotiationData use, change notice, audit rights, breach notice and exit
Stage 4Ongoing monitoringAudit results, subcontractor changes, incidents and continuity tests
Stage 5TerminationData returned or destroyed, access revoked, activity moved

The five stages of the third-party relationship life cycle in section C of the 2023 interagency guidance, which draws them as a continuous cycle. Each detail line summarizes considerations the guidance lists for that stage.

Show evidence for each due diligence question

The guidance lists the factors a bank typically considers before selecting a third party, scaled to the risk and complexity of the relationship.2023 guidance · § C.2 For an AI product they become the following questions, each with the evidence that answers it.

Data handling. What bank and customer data does the product receive, where is it processed and stored, and who can reach it? The guidance asks how the vendor protects the confidentiality, integrity, and availability of bank data and limits access to it, naming multifactor authentication and end-to-end encryption.2023 guidance · § C.2.g Evidence: a data-flow diagram, a data inventory, and the access controls that enforce them.
Subprocessors. Which model providers and other service providers touch bank data, and where are they? The guidance calls them subcontractors and asks how the vendor selects and oversees them, and whether their location or a dependency on a single provider adds risk.2023 guidance · § C.2.l It also asks how the vendor keeps timely and accurate inventories of its technology and its contractors.2023 guidance · § C.2.h Evidence: a current subprocessor list with locations, and a model inventory naming each provider and model.
Control testing. Who tests the vendor's controls? The guidance points to SOC reports and independent certifications, and asks whether their scope and results are relevant to the activity.2023 guidance · § C.2.f Evidence: an independent audit report whose scope covers the product under review.
Incidents. How are incidents identified, reported, investigated, and escalated? The guidance looks for clearly documented processes, timelines, and accountability.2023 guidance · § C.2.j Evidence: the incident process, its notification timelines, and the people accountable for it.
Resilience. How does the product operate through a disruption, including an outage at its model provider? The guidance looks for disaster recovery and business continuity plans that specify the time frame to resume activities and recover data, and the results of testing them.2023 guidance · § C.2.i Evidence: those plans and their test results.

The guidance anticipates a vendor with a short operating history or limited information to share. The bank documents the limitation, understands the risk it leaves, and considers alternatives such as other information, added controls or monitoring, or a different third party.2023 guidance · § C.2 Evidence drawn from the vendor's running system gives the bank a direct way to narrow that gap.

Expect contract terms on data use, change, audit, and exit

The contract turns the answers into obligations, with a level of detail the bank tailors to the risk of the relationship.2023 guidance · § C.3 These are the contract factors an AI product tests hardest.

Data use. The bank's access to its own data, whether the vendor may resell, assign, or permit access to customer data or the bank's data, metadata, and systems,2023 guidance · § C.3.c and a prohibition on using or disclosing bank and customer information except as needed to provide the service or meet legal requirements.2023 guidance · § C.3.h For an AI product the question that follows is whether that data trains or improves any model.
Change notice. Notification of significant strategic or operational changes, including use of subcontractors,2023 guidance · § C.3.c and of when and how the vendor will use a new subcontractor.2023 guidance · § C.3.n For an AI product, a new model provider or a new model version behind the product is the change a bank asks to hear about.
Reports and regulator access. The type and frequency of reports the vendor provides, such as performance reports, security reports, and control assessments, and how data and supporting documentation can be shared with regulators in a timely manner.2023 guidance · § C.3.c
Audit rights. The audit reports the bank is entitled to receive and how often, and the bank's right to audit the vendor and its relevant subcontractors, or to engage an independent party to do so.2023 guidance · § C.3.d
Breach notice. When and how the vendor discloses security breaches or unauthorized intrusions, with estimates of the effect on the bank and its customers and the corrective action the vendor will take.2023 guidance · § C.3.h
Business continuity. Operating procedures for when continuity plans are invoked, including recovery time and recovery point objectives, and whether the bank and the vendor test the plans together.2023 guidance · § C.3.i
Regulatory supervision. A stipulation that the vendor's performance of the activity is subject to regulatory examination and oversight, with retention of and access to the relevant documentation.2023 guidance · § C.3.q
Default and termination. Timely return or destruction of the bank's data, an orderly transition of the activity, and termination without penalty if the bank's primary federal banking regulator formally directs it.2023 guidance · § C.3.p

Keep the evidence current after signing, and show the exit

Ongoing monitoring confirms that the answers given at due diligence stay true, on a periodic or continuous basis set by the risk. Its factors include audit and testing results, the vendor's use of subcontractors and the location of related data, its response to new threats, vulnerabilities, and incidents, its ability to maintain the confidentiality, availability, and integrity of bank and customer data, and its business continuity testing.2023 guidance · § C.4 For an AI vendor, the bank typically asks for:

A current model and subprocessor list, with notice when either changes.
The periodic reports agreed in the contract, including security reports and control assessments.
Refreshed audit reports on the agreed cycle.
Incident notifications as incidents occur.
Records of the controls applied to bank data, detailed enough for the bank to test that the product behaves as described.

At termination the bank manages data retention and destruction, information system connections and access control, and jointly held intellectual property.2023 guidance · § C.5 A vendor that can evidence deletion of bank data and revocation of access ends the relationship on the record.

Expect model questions where SR 26-2 applies

SR 26-2, the model risk guidance the Federal Reserve, the OCC, and the FDIC issued on 17 April 2026, reaches vendor products directly.SR 26-2 The OCC issued it as Bulletin 2026-13.OCC Bulletin 2026-13 The principles of model risk management remain applicable when a bank does not receive a vendor's code, data, or methodology, and sound practice is to understand the vendor model, including its conceptual soundness, design, development data, and performance, and to run ongoing monitoring and outcome analysis on it.Revised Guidance · Section VII

Generative and agentic AI models are outside the guidance's scope, and a bank's own risk management and governance practices decide the controls for them.Revised Guidance · footnote 3 The 2023 third-party guidance applies to the vendor relationship whatever kind of model sits inside the product. The carve-out entry covers what still reaches generative and agentic systems.

A traditional model supplied by a vendor, such as a credit score or a fraud model: in scope for SR 26-2 and for the third-party guidance.
A generative or agentic system supplied by a vendor: outside SR 26-2, inside the third-party guidance and the bank's own written approach to governing these systems.
A product that combines the two: each component is scoped on its own, and the third-party guidance covers the whole relationship.

The September 2026 proposal would scale the review to the risk

On 11 September 2026 the OCC, the Federal Reserve, the FDIC, and the NCUA proposed guidance that would revise and replace the 2023 guidance (OCC Bulletin 2026-46).OCC Bulletin 2026-46 It was published in the Federal Register on 15 September 2026, comments close on 16 November 2026, and any final guidance would replace the 2023 guidance and its supplemental resources.Proposed guidance The agencies wrote that the 2023 guidance "frequently has been interpreted in an overly broad manner and with an insufficient focus on tailoring its risk management principles."Proposed guidance · Section I

The proposal organizes third-party risk management into four components: risk identification and assessment, risk oversight (due diligence, contract negotiation, ongoing monitoring, and termination), residual risk acceptance, and governance.Proposed guidance · § B It states that there are no generally applicable expected contract terms, even for higher-risk relationships, and that for lower-risk relationships a bank may rely on less-detailed due diligence and standard form contracts.Proposed guidance · § B.2 Non-compliance with it would not result in supervisory action.OCC Bulletin 2026-46 Until final guidance is issued, the 2023 guidance stands.

Under the proposal, a relationship is higher risk when its disruption or failure could cause a non-trivial violation of law, material financial harm, or a significant disruption to the bank's operations or customers, and that harm is materially likely.Proposed guidance · § B.1.iii A product that handles customer data or shapes what customers read is assessed against that test, and a vendor should be ready for the deeper review if it meets it.

Organize the evidence the way the questionnaires ask

Banks gather much of this through questionnaires, written in-house or shared across the industry. The guidance lets a bank use industry utilities or consortiums to supplement its due diligence, provided it evaluates their conclusions against its own circumstances,2023 guidance · § C.2 and it treats a third-party assessment service as a business arrangement of its own.2023 guidance · footnote 7

The Financial Services AI Risk Management Framework (FS AI RMF), released by the U.S. Treasury on 19 February 2026 and developed by the Cyber Risk Institute with the Financial Services Sector Coordinating Council, adapts the NIST AI Risk Management Framework to financial services.Treasury It sets out 230 control objectives organized by stage of AI adoption.Cyber Risk Institute It is voluntary. A bank can use it to structure its own AI governance and its vendor questions, and a vendor whose evidence is organized against it gives the reviewer a structure the reviewer already recognizes.

Control mapping

What a reviewer expects to be able to see.

Obligation	What the system must do	Evidence a reviewer expects
Data handling	Limit bank and customer data to the service, and control who and what can reach it	Data-flow diagram, access controls, and a record of what the enforced policy blocked or redacted
Subprocessors	Know every model provider and service provider that touches bank data, and where	Current subprocessor list with locations, and a model inventory
Model change notice	Tell the bank when the model or provider behind the product changes	Contract notice term and a model version history
Logging and retention	Record each model call and control decision, and keep the records for a stated period	Tamper-evident records with a documented retention period and deletion at its end
Audit rights	Give the bank audit reports scoped to the product, and a right to audit	Independent audit report covering the product, and the contract audit clause
Incident notice	Report security breaches and service incidents to the bank on agreed timelines	Documented incident process, notification term, and incident history
Business continuity	Resume service and recover data within stated objectives, including through a model provider outage	Continuity and recovery plans with recovery objectives, and test results

Key dates

Timeline, drawn to scale

From the 2023 guidance to its proposed replacement

IssuedUpcomingProposed replacement

Dates from SR 23-4, the U.S. Treasury, SR 26-2 and the Federal Register. Status as of October 11, 2026.

6 June 2023The Federal Reserve, the FDIC, and the OCC issue the interagency guidance on third-party relationships (SR 23-4, dated 7 June; OCC Bulletin 2023-17; FDIC FIL-29-2023).
9 June 2023The guidance is published in the Federal Register (88 FR 37920).
19 February 2026Treasury releases the FS AI RMF.
17 April 2026SR 26-2 issued. Section VII covers vendor products, and footnote 3 places generative and agentic AI outside its scope.
11 September 2026The OCC, the Federal Reserve, the FDIC, and the NCUA propose guidance to replace the 2023 guidance (OCC Bulletin 2026-46).
15 September 2026The proposal is published in the Federal Register (91 FR 58536).
16 November 2026Comment period on the proposal closes.

Sources cited

Common gaps

Where AI vendors most often come up short in a bank's review.

Policies with no records behind them. A written policy answers the questionnaire. Ongoing monitoring asks for evidence that the product behaves the way the policy says.
Model providers missing from the subprocessor list. A model provider the product calls is a service provider the vendor enlists, which the guidance treats as a subcontractor.2023 guidance · footnote 14 A list that omits it fails the first data-flow question.
Silent model changes. A provider can change the model behind a stable name. With no change notice and no version record, the bank cannot tie monitoring results to the model that produced them.
Audit reports scoped to something else. The guidance asks whether a SOC report's scope is relevant to the activity. A report that covers corporate systems and leaves out the AI product answers a different question.
Framework alignment presented as compliance. The FS AI RMF and the NIST AI RMF are voluntary. Describing alignment as compliance overstates the posture to a reviewer who knows the difference.
No exit terms. Data return, deletion, and access revocation belong in the contract at signature. The guidance lists them among the contract terms a bank considers before it signs.

In practice

See a sample examination package →

Last reviewed October 11, 2026. This reference summarises publicly available regulatory guidance and is provided for general information. It is not legal advice. Obligations depend on an institution's charter, registration status, size, and activities. Verify against the primary sources cited above and consult counsel before relying on any summary here.