Agencies Seek Comment on Proposed Third-Party Risk Management Guidance and Issue Statement on Community Bank Engagement with Core Service Providers

Proposed guidance on third-party relationships signals a familiar gap: institutions engage vendors without producing durable records of the initial selection decision, the officer who owned it, or the scheduled oversight cadence. When vendor performance falters or a concentration emerges, examiners find no contemporaneous rationale, no documented review cycle, and no clear line of authority. The artifact that prevents this failure is a decision record produced at vendor onboarding—owner named, selection criteria documented, review schedule set—so that oversight becomes enforceable rather than aspirational.