Third-Party Risk Management for US Financial Institutions in 2027

What Is Third-Party Risk Management for US Financial Institutions?

Third-party risk management (TPRM) is the discipline of identifying, assessing, monitoring, and governing the risks created by vendors, service providers, and partners that support a financial institution’s products, services, or operations. The institution stays accountable even when a third party performs the activity, so a vendor breach or outage becomes its regulatory and customer problem.

In practice, TPRM covers the full relationship lifecycle: planning, due diligence, contracting, ongoing monitoring, and termination. It also reaches fourth parties, meaning the subcontractors and cloud providers your vendors depend on, and concentration risk, where several critical functions rest on the same provider. Our guide to a modern TPRM program with risk scoring and automation shows how tiering and monitoring fit together.

What Is Changing in US Third-Party Risk Expectations Heading Into 2027?

US expectations are moving from process-heavy documentation toward risk-based judgment, although several regimes still apply at the same time.

What Would the Proposed Interagency Guidance Change?

The proposal is non-binding, and comments are due November 16, 2026. If finalized, it would replace the June 2023 Interagency Guidance on Third-Party Relationships, along with the 2024 community bank guide, the July 2024 statement on deposit product arrangements, and OCC Bulletin 2002-16. Until then, the 2023 guidance remains the published baseline. The main themes are:

Four components: identify and assess risks, oversee them in proportion to their significance, decide on residual risk, and establish governance.
The agencies do not expect institutions to eliminate third-party risk. Accepting residual risk within a stated risk appetite is a valid decision.
No contract terms would be universally expected, and a missing clause alone would not justify an adverse finding.
A vendor’s refusal to provide reasonably necessary information can be grounds to decline the relationship.
Institutions keep ultimate responsibility for sound risk management and legal compliance.

The Federal Reserve also proposed a companion guide for community banks under $30 billion in assets, and a joint statement says core provider transparency will influence supervisory attention, with direct enforcement possible against core providers.

Documented reasoning will matter more than document volume. Institutions need to show why a vendor was tiered as it was and why a residual risk was accepted. Sound governance framework development gives those decisions a defensible structure.

Which Other Rules Still Shape Vendor Oversight?

The proposal does not displace sector and state requirements.

Regime	Who It Covers	Third-Party Expectation
NYDFS 23 NYCRR 500.11	Entities covered by Part 500	Written provider policy covering risk assessment, due diligence, and periodic reassessment, with contract protections on MFA, encryption, incident notice, and representations.
SEC Regulation S-P (amended)	Broker-dealers, investment companies, registered advisers, and other covered institutions	Service provider oversight, with policies designed so providers notify the firm within 72 hours of becoming aware of a breach. Larger entities complied by December 3, 2025, and smaller entities by June 3, 2026.
FTC Safeguards Rule	Non-bank financial institutions under FTC jurisdiction	Select capable providers, require safeguards by contract, and assess providers periodically.
Computer-Security Incident Notification Rule	Banking organizations and bank service providers	Banks notify their primary regulator within 36 hours of determining a notification incident occurred, and service providers alert affected banks promptly.

How Should Financial Institutions Build a Risk-Based TPRM Program?

Start with a complete inventory, tier each relationship by the magnitude and likelihood of harm, and match due diligence, contract terms, and monitoring to that tier. This mirrors the proposal’s risk identification focus.

Build one inventory of vendors, fintech partners, affiliates, and known subcontractors, with the data, access, and business functions each touch.
Tier by impact and likelihood, using data sensitivity, operational criticality, privileged access, substitutability, and regulatory exposure. Measuring vendor blast radius helps rank which relationships can hurt most.
Scale due diligence to tier. Critical vendors warrant independent evidence such as SOC 2 Type II reports and resilience test results.
Set contract baselines for breach notice windows, MFA, encryption, subcontractor disclosure, data location, audit rights, and exit support.
Monitor by tier, with continuous signals and defined escalation thresholds for critical providers and periodic review for the rest.
Test exit and concentration scenarios, especially for core providers where substitution is slow.

What Evidence Do Examiners and Auditors Expect to See?

Examiners and auditors look for evidence that oversight decisions were reasoned, consistent, and current. A reviewer should be able to trace any critical vendor from inventory entry to tier rationale, contract, monitoring record, and leadership reporting.

A current inventory with documented tier rationale.
Due diligence files proportionate to each tier.
Executed contracts, with documented exceptions where a vendor declined a term.
Monitoring records and the actions taken on escalations.
Residual risk acceptances approved within stated risk appetite.
Board and senior management reporting on material vendor exposure.
Exit and contingency plans for critical services.

Building this trail continuously, as our audit readiness guide describes, avoids a scramble after an exam notice.

Where Do Financial Institutions Commonly Struggle With Vendor Risk?

Most gaps come from point-in-time assessments, incomplete inventories, and contracts that do not match regulatory clocks. Five patterns appear most often:

Questionnaire dependence: A completed questionnaire records what a vendor claimed on one day and says little about posture afterward.
Unmanaged adoption: Business units sign up for SaaS tools and AI services that handle customer data outside procurement or security review.
Contract mismatch: A written incident program exists, but vendor agreements lack a notification window that supports the institution’s own deadlines.
Fourth-party blind spots: Subcontractors and shared cloud dependencies stay unknown until an outage exposes them.
Limited leverage over core providers: Consider a hypothetical regional lender whose core processor declines on-site assessment. The institution can still document alternative evidence, compensating controls, and a formal residual risk decision.

What Should US Financial Institutions Do Before 2027?

Run a gap assessment against the guidance and rules that apply today and design the program to adapt when final guidance arrives. Waiting leaves the same inventory, contract, and monitoring gaps in place.

Map your current program to the 2023 guidance, NYDFS, Regulation S-P, and any other applicable requirement.
Re-tier vendors and confirm the rationale is documented.
Review contract baselines for notification windows and subcontractor terms.
Decide whether to submit comments before November 16, 2026, directly or through an industry group.
Add continuous monitoring and exposure quantification for critical vendors.

This is where outside expertise shortens the path. Ampcus Cyber supports institutions with TPRM assessments, program design, and continuous vendor visibility, helping teams validate controls, close contract and evidence gaps, and prepare for supervisory review.

Conclusion

Third-party risk management for US financial institutions is entering a period of regulatory recalibration. The direction is clear even while the final text is not: examiners will expect risk-based tiering, proportionate oversight, and documented decisions on residual risk, while NYDFS and SEC requirements continue to demand specific contract and notification practices. Institutions that build a living inventory, tie evidence to risk tiers, and monitor critical vendors continuously will be ready under either the 2023 framework or its replacement.

Benchmark your vendor oversight against 2026 interagency, NYDFS, and Regulation S-P expectations.

Speak with Ampcus Cyber’s TPRM specialists to review your inventory, tiering, contract baselines, and monitoring coverage, and leave with a prioritized remediation plan.