The risk management news that matters most to banks and credit unions in Q3 2026 is the OCC and FDIC final rule redefining unsafe or unsound practice and limiting matters requiring attention, followed by the interagency proposal to replace the 2023 third-party risk guidance.
Below are the quarter’s scope, what each action changes, status and Q4 dates for six actions, and how the changes are tracked in a governance platform.
Supervisory Standards: Unsafe or Unsound Practice and MRAs
The OCC and FDIC adopted a final rule on 27 August 2026 that defines “unsafe or unsound practice” for purposes of section 8 of the Federal Deposit Insurance Act. The rule was published in the Federal Register on 1 September and takes effect on 2 November 2026.
Under the rule, a practice is unsafe or unsound when it is contrary to generally accepted standards of prudent operation and, if continued, is likely to materially harm the institution’s financial condition or present a material risk of loss to the Deposit Insurance Fund. The agencies set no dollar threshold for materiality, and Sullivan & Cromwell reports that examiners must support the call with “objective facts and sound reasoning.”
The rule also narrows matters requiring attention (MRAs). An MRA may address an imprudent practice that could reasonably be expected to materially harm financial condition, or an actual violation of a banking or banking-related law.
In issues management, findings logged after 2 November should record the financial-condition link or the specific legal violation behind each MRA. The Federal Reserve did not join the rule, so state member banks remain under Federal Reserve practice.
Third-Party Risk: A Proposed Replacement for the 2023 Guidance
The main item of vendor risk management news came on 11 September 2026, when the OCC, Federal Reserve, FDIC and NCUA proposed third-party risk management guidance to replace the Interagency Guidance on Third-Party Relationships issued on 9 June 2023. Comments are due 16 November 2026, according to the Federal Register notice.
The agencies wrote that the 2023 guidance “frequently has been interpreted in an overly broad manner.” The proposal changes the program in four ways:
- Risk is tiered by the magnitude and likelihood of potential harm, replacing the focus on “critical activities.”
- Lower-risk services, such as administrative, professional and office support, may receive streamlined review.
- An institution may proceed with a relationship without every requested document or an on-site visit.
- Shared assessments, consultant reviews and certifications may support due diligence.
The Federal Reserve also proposed a companion guide for community banks under $30 billion in assets, and the agencies issued a statement on community banks’ engagement with core service providers.
For vendor risk teams, the useful work before a final version is an inventory review of which relationships would be re-tiered. The 2023 guidance stays in force until the agencies finalize the replacement.
AML Programs, Exam Cycles and Exam Security
AML Program Proposal
On 7 July 2026, the Federal Reserve proposed amending its AML program requirements to align with program changes proposed separately by four other agencies, including FinCEN. Banks would direct AML resources toward higher-risk customers and activities and incorporate FinCEN’s AML/CFT priorities into their risk assessments.
18-Month Examination Cycle
On 10 September 2026, the Federal Reserve, FDIC and OCC issued an interim final rule raising the asset threshold for the 18-month on-site examination cycle from $3 billion to $6 billion, as the 21st Century ROAD to Housing Act requires. Offsite monitoring continues between examinations.
Sensitive Information During Examinations
On 16 July 2026, the same three agencies committed to reviewing highly sensitive information on site and to notifying banks of a material breach of confidential supervisory information no later than 72 hours after discovery.
Q3 2026 Status and Q4 Dates for Risk Teams
The six items of Q3 2026 risk management news differ most in status and in the date each one sets for the fourth quarter.
| Action | Agencies | Status | Next date | Record affected |
|---|---|---|---|---|
| Unsafe-or-unsound and MRA rule | OCC, FDIC | Final | Effective 2 Nov 2026 | Issues and findings log |
| Third-party risk guidance | OCC, Fed, FDIC, NCUA | Proposed | Comments due 16 Nov 2026 | Vendor inventory and risk tiers |
| AML program amendments | Federal Reserve | Proposed | 60-day comment period | BSA/AML risk assessment |
| 18-month exam cycle | Fed, FDIC, OCC | Interim final | Effective on publication | Examination calendar |
| Exam information security | Fed, FDIC, OCC | Joint statement | In place since 16 Jul 2026 | CSI handling procedures |
| Stress test changes | Federal Reserve | Announced, not final | Final action pending | Large-bank capital plans |
Under the final rule, each MRA issued after 2 November rests on material financial harm or a specific legal violation, so the remediation file should carry the same linkage. Under the third-party proposal, examiners would give “due consideration” to an institution’s reasonable judgment on risk assessments, making the written rationale for each vendor’s tier the key document.
On 18 September, Vice Chair for Supervision Michelle Bowman said the Board would consider final rules to publish stress-test model details. A second rule would average stress capital buffer results across a bank’s two most recent tests.
Tracking Regulatory Changes in Predict360
Predict360‘s Regulatory Change Management application assesses regulatory changes, identifies affected policies and business units, and assigns follow-up work.
Issues & Incidents Management assigns owners and due dates and collects evidence for MRA responses. Regulatory Examination and Findings Management coordinates requests, evidence, findings and commitments.
Frequently Asked Questions
What did the OCC and FDIC change about unsafe or unsound practices in 2026?
The OCC and FDIC adopted a final rule that defines unsafe or unsound practice by material financial harm and limits when examiners may issue MRAs. The rule takes effect on 2 November 2026 and applies to institutions the two agencies supervise.
When are comments due on the proposed third-party risk management guidance?
Comments on the proposed interagency third-party risk management guidance are due 16 November 2026. The OCC, Federal Reserve, FDIC and NCUA issued the proposal on 11 September 2026, and it was published in the Federal Register on 15 September.
Does the unsafe-or-unsound rule apply to state member banks and credit unions?
No. The rule applies to institutions the OCC and FDIC supervise: national banks, federal savings associations and state non-member banks. The Federal Reserve did not join, though it revised its own criteria for supervisory recommendations in April 2026, and the NCUA, which supervises federally insured credit unions, was not a party.
The Predict360 Enterprise Risk Management Software ensures managers have complete visibility of enterprise risk on a single dashboard.
Request Demo- Cloud-Based
- Risk Repository
- Assess Risks
- Real-time Monitoring