Third-party risk rules bind the bank, not the vendor it cannot replace
US regulators have put draft third-party risk guidance out for comment and, separately, addressed how small banks deal with their core providers. The second document quietly concedes the first one's weakness.
Most banks do not write the software that tracks your account. They rent it from a small number of specialist firms, known as core service providers. American banking regulators have now published draft guidance on how banks should manage the risks of using outside suppliers, opened it for public comment, and issued a separate note about how small banks deal with those core firms.
Guidance binds the bank, not the supplier it cannot replace. Telling a small bank to negotiate better terms with its core provider asks the weaker party to fix a market it did not make.
The supplier you cannot fire
A bank can change its cleaners, its auditors, even its law firm. What it usually cannot change is the company that keeps its ledger. Core service providers run the software on which every account balance, every payment, every statement and every overnight batch actually lives. Switching means moving every customer record onto a different system without losing one of them, over a weekend, while the branch reopens on Monday. Contracts run for years. There are not many providers. That is the whole problem, and everything else in this story follows from it.
On 11 September the US banking agencies did two things at once. They put proposed guidance on third-party risk management out for public comment — the standard mechanism by which supervisors tell banks what they expect before writing it down for good. And they issued a separate statement about how community banks engage with their core service providers.
The second document is the tell
You do not issue a companion statement about small banks and their core providers unless you already know that the relationship is the sore point. If the general guidance worked evenly across all outside suppliers, the core providers would need no special mention. They got one. The agencies are signalling that they understand the asymmetry, and are choosing to address it through encouragement rather than through the guidance itself.
That choice matters, because guidance of this kind is enforced through examination, and examination is of banks. The supervisors look at the bank’s files, its due diligence, its contract terms, its monitoring, its exit plan. The provider experiences none of that directly. It feels supervisory pressure only through its customers’ willingness to walk away — and its smallest customers cannot walk away. So the mechanism by which guidance is supposed to improve behaviour is precisely the mechanism that is broken for the banks the companion statement is about.
What that produces in practice
It produces documentation. A community bank that cannot obtain a right to audit, or a service-level commitment with teeth, or an orderly exit clause, will instead write a memorandum explaining why it could not obtain them and what compensating controls it has instead. The examiner reads the memorandum. The risk has not moved. The file has grown.
It also produces a cost that falls the wrong way round. A large bank has in-house counsel who negotiate vendor contracts as a matter of routine, and volume that a provider does not want to lose. A small bank buys the same compliance capability from consultants, per hour, and brings no volume to the table. Guidance written to apply flexibly across institutions of all sizes still costs far more, per dollar of assets, at the bottom.
The strongest case for doing it this way
Here is the serious argument on the other side, and it is not weak. Supervisors have clear authority over banks and a much messier relationship with firms that are not banks. Guidance to banks is the tool that actually exists. And if it is written well, it can work as a coordinating device: when every bank in the country is expected to ask for the same clause, the request stops being one small customer’s unusual demand and becomes a market-wide condition of sale. A provider can refuse one bank. It cannot easily refuse the entire deposit-taking system. On this reading, guidance addressed to banks is indirect pressure on vendors, and the comment period is exactly where banks get to say which clauses are unobtainable.
That argument holds — but only if the expectations are specific. Coordination requires a common text. Language that tells each institution to act commensurately with its size and risk profile delivers no common text at all; it delivers a hundred different negotiating positions, which is the same thing as none. The more flexible the guidance, the less it functions as the collective bargaining device its defenders say it is. Flexibility and leverage are in direct tension here, and the drafters have to pick.
What the comment period is for
A comment process is a genuine opportunity and it is also, routinely, captured by whoever can afford to file. Trade associations and large institutions submit; a bank with a handful of branches usually does not. If the agencies want to know which contract terms are actually unobtainable in the market, they will have to go and ask, rather than wait for letters that will not arrive.
There is a version of this exercise that changes something real. It looks like a final document that distinguishes clearly between terms a bank must have and terms a bank should seek; that says what a bank is expected to do when a provider simply refuses; and that is accompanied by some public account of how concentrated the core provider market is, so that everyone is arguing about the same facts. Without that, the agencies will have restated good practice to an audience that already agrees with it, and the negotiating position of a small bank facing its core provider in 2027 will be exactly what it was in 2026.
Before finalising, the Federal Reserve and the other banking agencies should hold structured outreach with small institutions rather than relying on letters that arrive, and publish a tally of comments received by institution size. In the final text they should state plainly which expectations are a floor and which are a preference, and say what a bank is expected to do when a provider refuses a term outright.
They should also publish, on a regular schedule, what supervision already knows about concentration among core service providers — how many banks depend on how few firms — so that the next round of this debate starts from evidence rather than from everyone's anecdotes.
What would change this view
I am wrong if the final version of this guidance, when adopted, states expectations addressed directly to the service providers themselves — or if the agencies publish supervisory findings about core providers as a class, including how many banks depend on how few firms. Either would show the agencies are willing to look at the vendor side rather than only at the bank's file.
If that happens, the guidance stops being a paperwork obligation on the weaker party and becomes a genuine constraint on a concentrated market. I would also drop the objection if the agencies publish a tally of comment letters showing small banks filed in numbers, and identify which submitted contract terms they adopted.