Board of Governors of the Federal Reserve System

I could support a principles-based approach to third-party risk management guidance that promotes both innovation and safe and sound operations, including compliance with laws and regulations. But I am concerned that this proposal will reduce safe and sound operations, increase financial and other risk, create undue confusion, and leave gaps in supervisory coverage.

The interagency guidance incorporates a new standard of "material financial risk" for supervisors to take action, making it less likely that banks will correct problems before they become material risks to the firm. Additionally, the guidance notes that "…agencies will give due consideration to a banking organization's reasonable decisions." I am concerned that this phrase may be misinterpreted to mean agencies will give deference to the bank's views on third-party risk management, rather than making an independent judgment.

The two proposals specifically exclude consumer compliance matters, but in a final rule could end up rescinding existing guidance, leaving a big gap in risk, or banks could end up needing to comply with two sets of guidance, sowing confusion and increasing burden.

The proposed third-party risk management guide for Board-regulated traditional community banks differs from the principles-based approach by developing specific guidelines, but only for this newly defined subset of organizations. The proposed guidance specifically states that the guide is not intended for community banks with more complex business models or third-party relationship profiles, such as complex bank-fintech partnerships. Experience suggests that many banks with complex business models are especially in need of guidance that better addresses their particular third-party risk management issues, which is not addressed in these proposals.

I dissent.