Lean Product Group
Payments

The new third-party risk guidance: less paperwork, more proof

The proposed interagency third-party risk guidance is being read as relief. For most vendors it is. For banks running payment programs with fintech and PayFac partners, the bar isn't dropping. It's moving from paperwork to proof.

By Hanson Hodges · November 6, 2026 · 5 min read

Every sponsor bank I talk to has the same binder. It's the one that proves the bank did its homework on a partner: the due diligence questionnaire, the policies, the contract with every recommended clause, the annual review. Some of those binders are very thick. Not all of them tell you whether anything actually works.

The banking agencies seem to agree. In September the OCC, FDIC, Federal Reserve and NCUA proposed new third-party risk management guidance to replace the version they issued in 2023. Comments are due November 16. Their own explanation is blunt: the 2023 guidance was "interpreted in an overly broad manner," and examiners came to expect every item to be checked off whether it mattered or not.

Most of the coverage I've seen calls this relief. For a lot of relationships it is. For a bank running a payment program with fintech or PayFac partners, I read it differently.

Two questions instead of a checklist

The proposal drops the old idea of "critical activities" and replaces it with a two-part test. A relationship is higher-risk if its failure could cause "an actual non-trivial violation of law or regulation," material financial harm or significant disruption to customers, and there's a material likelihood that could happen under current or reasonably foreseeable conditions.

A two by two grid. Down the side: failure could break the law or hurt customers, or failure is an inconvenience. Across the top: harm unlikely to happen, or material likelihood of harm. Big harm with low odds can be de-tiered if the bank documents why. Big harm with real odds is higher-risk and gets heightened oversight, which is where most bank payment programs land because of BSA, OFAC and consumer protection exposure. Relationships where failure is an inconvenience get streamlined oversight.

That second part is new, and it's where the relief comes from. A bank can now look at a relationship where the harm would be serious but the odds are low and decide it doesn't need the full treatment, as long as it can explain why. Office vendors and professional services get lighter oversight, and keeping an inventory of them becomes optional.

Now run a payment program through the same test. Merchant onboarding touches BSA and OFAC. Disputes and refunds touch consumer protection. A PayFac that onboards merchants for you is making decisions that, if they go wrong, become your violation. And the likelihood isn't theoretical. Sponsor banks have spent the last few years in enforcement actions over exactly these gaps.

Most payment partnerships pass both parts of the test easily. They stay higher-risk.

What goes away, and what doesn't

The proposal does remove real process. The five-stage lifecycle is gone. So is the 17-item list of contract terms, replaced by a flat statement that there "are no generally applicable expected contract terms." The assumption that newer, innovative companies are riskier just because they're new is gone too, which matters for anyone building in payments today. The proposal would also withdraw the 2024 joint statement on bank-fintech deposit arrangements without replacing it.

Two columns. Proposed to go away: the five-stage lifecycle checklist, the 17-item list of expected contract terms, the critical activities label, the presumption that newer firms are riskier, direct oversight of every subcontractor, and the 2024 statement on bank-fintech deposit arrangements. Still there: BSA/AML and OFAC obligations, consumer protection law, the bank's responsibility for the outcome, supervisory action for unsafe or unsound practices, card network rules for sponsors and PayFacs, and proof that delegated controls actually work.

None of the obligations underneath went anywhere. The guidance is explicitly not enforceable on its own, but the laws it points to are. Supervisors can still act on unsafe or unsound practices. The bank is still responsible for what its partners do, including their subcontractors, which now get overseen through the main partner rather than one by one. And Visa and Mastercard didn't change their rules for sponsors and PayFacs because the agencies changed their guidance.

So the checklist shrinks and the responsibility stays the same size. That combination means the question an examiner asks shifts from "did you follow the process?" to "how do you know this works?"

Ask for evidence, not documents

If you're a bank with a payments partner, or thinking about one, this is the part worth acting on. A policy tells you what's supposed to happen. Evidence tells you what did.

What to ask a payments partner. Paper: we have a fraud monitoring policy. Proof: here are last month's alerts, who worked them and how fast. Paper: we screen merchants against OFAC. Proof: here's what happens when the screening vendor is down; it blocks. Paper: we monitor chargebacks. Proof: here's every merchant over threshold and what we did about each one. Paper: we test our controls annually. Proof: here's the test from last Tuesday, and the one that failed.

The OFAC example is the one I'd start with. Ask a partner what happens to a merchant application when their sanctions screening service times out. If the honest answer is that the application goes through and gets checked later, that's a gap no policy document will show you. A control that fails open looks exactly like one that works, right up until the day it doesn't.

A few more questions I'd put to any partner:

  • Which controls do you own, which do we own, and where is that written down?
  • When did each one last get tested, and what did the test find?
  • Can we see complaints and their resolution without filing a request?
  • If we had to move this program to another provider, what would we get back and how fast?

That last one matters more now. The proposal gives "due consideration" to a bank's judgment that an alternative provider could take over. You'll want a real answer when that comes up.

Where this leaves sponsor banks

Lighter guidance is a chance to stop spending effort on paperwork that never reduced risk. It isn't permission to do less on the programs that actually carry it. The banks that come out ahead will be the ones that can pull up evidence on demand, from partners that generate it as part of running the program rather than assembling it before an exam.

That's how we think about payment programs at LPG, and it's the standard we hold LPG Pay to.

If you're a bank with a view on the proposal, there's still time to file a comment before November 16.

Sources: Proposed Third-Party Risk Management Guidance, Federal Register, September 15, 2026; K&L Gates, "New Proposed Risk Management Guidance" (September 2026); Hunton, "Banking Agencies Propose to Replace the 2023 Third-Party Risk Management Guidance" (September 2026); Crowell FinTalk, "Proposed Third-Party Guidance: What It Means for Sponsor Banks and Fintechs" (October 2026). This is a summary of a proposal, not legal advice.