TPRM maturity check: Take the check
Trestec
Book a demo
One World Trade Center, New York

US third party risk management

Interagency lifecycle guidance, NYDFS security policy and SEC service provider oversight.

Book a demoTalk to us

Overview

The Federal Reserve, FDIC and OCC issued the Interagency Guidance on Third-Party Relationships: Risk Management in June 2023. It describes a risk-based, proportionate approach across the relationship lifecycle.

The lifecycle runs from planning through due diligence and selection, contract negotiation, ongoing monitoring and termination. Board and management oversight and accountability sit across that lifecycle.

The interagency guidance replaced each agency’s earlier guidance, including OCC Bulletin 2013-29 and its 2020 frequently asked questions, the Federal Reserve’s SR 13-19 and the FDIC’s 2008 guidance for managing third-party risk. It applies to all third-party relationships, not only outsourcing, with more comprehensive oversight for relationships that support higher-risk activities, including critical activities.

Additional frameworks include the third party service provider security policy in NYDFS 23 NYCRR Part 500, section 500.11, and the 2024 SEC Regulation S-P amendments on service provider oversight and incident notification.

Applies to

  • Banking organisations supervised by the Federal Reserve, the FDIC or the OCC (Interagency Guidance on Third-Party Relationships: Risk Management, effective 6 June 2023)
  • Entities licensed or authorised by NYDFS, subject to the limited exemptions in section 500.19
  • Broker-dealers (including funding portals), investment companies, SEC-registered investment advisers, and transfer agents registered with the SEC or another appropriate regulatory agency, under Regulation S-P
  • Banking organisations subject to the computer-security incident notification rule, and their bank service providers

Relevant jurisdictions

US

Fed, OCC, FDIC

Scope and applicability

Confirm the requirements that apply to your entity, the service and the arrangement before selecting the depth of review. How the rules apply depends on your entity.

Key dates

June 2023

Interagency third-party relationship guidance issued

1 May 2022

Computer-security incident notification rule compliance date for banking organisations and bank service providers

1 November 2023

NYDFS Second Amendment to Part 500 adopted

May 2024

Interagency guide on third-party risk management for community banks published

2024

SEC Regulation S-P amendments

3 December 2025

Regulation S-P compliance date for larger entities

1 November 2025

Final phase of the NYDFS Second Amendment in effect (expanded multi-factor authentication, 500.12; asset inventory, 500.13(a))

3 June 2026

Regulation S-P compliance date for smaller entities

Inside the regulation

The interagency guidance in outline

The guidance sets out principles rather than prescriptive rules. It recognises that banking organisations differ in size and complexity and that third-party relationships differ in risk, so the level of oversight should be commensurate with the risk and complexity of each relationship.

Its main sections cover risk management across the lifecycle, governance (oversight and accountability, independent reviews, documentation and reporting), and supervisory reviews of third-party relationships. Supervisors consider how a banking organisation manages the risks of its relationships, and, where warranted, may examine functions a third party performs for a banking organisation, using their statutory authority including the Bank Service Company Act.

NYDFS Part 500

NYDFS 23 NYCRR Part 500 sets cybersecurity requirements for entities licensed or authorised by the New York Department of Financial Services. The Second Amendment, adopted on 1 November 2023, introduced phased requirements, including enhanced governance, multi-factor authentication and asset inventory obligations. Phased dates: 1 December 2023 (incident notice, 500.17); 29 April 2024 (most new requirements); 1 November 2024 (governance, encryption, incident response and continuity); 1 May 2025 (automated scans, access privileges, malicious code controls, training); 1 November 2025 (multi-factor authentication and asset inventory).

Covered entities notify NYDFS no later than 72 hours after determining that a cybersecurity incident has occurred at the covered entity, its affiliates or a third-party service provider (section 500.17(a)), and each year by 15 April submit a certification of material compliance or an acknowledgement of noncompliance (500.17(b)).

SEC Regulation S-P amendments

The SEC adopted amendments to Regulation S-P on 16 May 2024. They require covered institutions to adopt an incident response programme for unauthorised access to or use of customer information, including notification to affected individuals, and to oversee service providers through policies and procedures.

Larger entities were required to comply from 3 December 2025 and smaller entities from 3 June 2026.

Detailed requirements

01

Planning

Consider the relationship before selecting a provider. The interagency lifecycle begins with planning, including the strategic purpose, benefits, risks, costs, the effect on customers, and how the relationship will be overseen.

02

Due diligence and selection

Evaluate the third party before selection. The depth of review is risk-based and proportionate. Areas the guidance discusses include strategies and goals, legal and regulatory compliance, financial condition, business experience, key personnel, risk management, information security, operational resilience, incident reporting, management of information systems, physical security, reliance on subcontractors, insurance coverage and contractual arrangements with other parties.

03

Contract negotiation

Use the contract negotiation stage to establish the relationship’s terms. Matters the guidance discusses include the nature and scope of the arrangement, performance measures, compliance responsibilities, costs, ownership and licensing, confidentiality and integrity, operational resilience and business continuity, indemnification and limits on liability, subcontracting, foreign-based third parties, default and termination, regulatory supervision, information rights, the right to audit and require remediation, insurance, dispute resolution and customer complaints. Where a bank has limited negotiating power, it should assess the resulting risks.

04

Ongoing monitoring

Continue oversight throughout the relationship rather than treating due diligence as a one-off event. Monitoring is commensurate with the risk and complexity of the relationship. The guidance does not set a frequency; more comprehensive or frequent monitoring is expected for higher-risk and critical activities.

05

Termination

Include termination as part of lifecycle risk management, including transition of services to another provider or in house, termination costs, risks from data retention or destruction and from remaining system connections and access, jointly owned intellectual property, customer impact and continuity during transition.

06

Board and management accountability

The guidance covers oversight and accountability by the board and management. The approach should reflect the risk of the relationship and remain proportionate.

07

Independent reviews, documentation and reporting

Periodic independent reviews of the third-party risk management process, with documentation and reporting that supports oversight, such as an inventory of third-party relationships and reports to the board.

08

Critical activities

Relationships that support critical activities warrant more comprehensive and rigorous oversight. Each banking organisation identifies which of its activities are critical.

09

Third party security policy

NYDFS 23 NYCRR Part 500, section 500.11, requires covered entities to implement written policies and procedures, based on their risk assessment, to ensure the security of information systems and nonpublic information accessible to or held by third party service providers. The policies should include guidelines on access controls including multi-factor authentication, encryption in transit and at rest, notice of cybersecurity events, and representations and warranties. Section 500.11 is not among the limited exemptions in 500.19(a).

10

Service provider oversight and incidents

The SEC Regulation S-P amendments of 2024 address service provider oversight and incident notification. Service providers must notify the institution as soon as possible and no later than 72 hours after becoming aware of a breach, and affected individuals must be notified within 30 days.

11

Bank service provider incident notification

Under the computer-security incident notification rule, banking organisations notify their primary federal regulator within 36 hours of determining that a notification incident has occurred, and bank service providers notify affected banking organisation customers as soon as possible when an incident has materially disrupted or degraded covered services for four or more hours.

How Trestec supports it

Requirement

Scope and service inventory

How Trestec supports it

Record suppliers, services and accountable owners

Module

Supplier mapping

Requirement

Proportionate risk assessment

How Trestec supports it

Document the rating, rationale and approval

Module

Risk assessment

Requirement

Board and management oversight

How Trestec supports it

Prepare an evidence-linked oversight summary

Module

Risk assessment

Requirement

Planning an arrangement

How Trestec supports it

Connect the proposed service to its dependencies

Module

Supplier mapping

Requirement

Provider due diligence

How Trestec supports it

Review questionnaires and supporting documents

Module

Due diligence

Requirement

Contract negotiation

How Trestec supports it

Review obligations alongside the source clauses

Module

Contract oversight

Requirement

Security assurance

How Trestec supports it

Keep supplier policies and certifications together

Module

Due diligence

Requirement

Incident notification

How Trestec supports it

Identify supplier notification clauses for review

Module

Contract oversight

Requirement

Ongoing monitoring

How Trestec supports it

Track reviews, evidence gaps and outstanding actions

Module

Risk assessment

Requirement

Subcontractor dependencies

How Trestec supports it

Map providers behind the direct supplier

Module

Supplier mapping

Requirement

Business continuity

How Trestec supports it

Review continuity and recovery evidence

Module

Due diligence

Requirement

Termination and exit

How Trestec supports it

Record exit obligations, notice dates and owners

Module

Contract oversight

Requirement

Critical activity identification

How Trestec supports it

Record which supplier relationships support critical activities, with reasons

Module

Risk assessment

Illustrative mapping, not a compliance determination.

Supervisory review: gaps to examine

Illustrative review questions, not findings from a supervisor.

Incomplete provider inventory

Arrangements held across several teams may be missing from the central record.

Review depth not explained

Document why an arrangement receives its level of oversight.

Contracts disconnected from assurance

Review clauses alongside current evidence rather than in isolation.

Unowned follow-up actions

Record who will resolve a gap and when it will be reviewed.

Guidance applied only to outsourcing

Relationships outside traditional outsourcing, such as data or technology partnerships, missing from the inventory.

Contract limitations not assessed

Standard terms accepted without documenting the risks of terms the bank could not negotiate.

Termination planning absent

No plan for transition or data return when a relationship ends.

Service provider notification terms missing

Contracts do not require providers to notify security incidents within the periods required by the applicable rules, such as 72 hours under Regulation S-P.

Evidence you can produce

  • Supplier and service inventory
  • Risk assessments and approval records
  • Provider due diligence and source documents
  • Contract review and notification terms
  • Monitoring records and remediation actions
  • Continuity and exit evidence
  • Board and management reporting
  • Record of which regime applies to each entity
  • Inventory of third-party relationships and critical activities
  • Independent review reports

Common questions

Related modules

Supplier mapping

See your suppliers, their subcontractors and the infrastructure they share.

Risk assessment

Make materiality and risk decisions with the evidence in view.

Due diligence

Collect supplier evidence in a guided portal and review it in context.

Contract oversight

Review supplier obligations, renewal dates and regulatory clauses together.

See Trestec on your own supplier list.

Book a demoTalk to us