Interagency guidance on third-party relationships: a bank’s working guide

A bank can outsource document screening or customer onboarding while still carrying the consequences when the service fails. The hard part is deciding how much oversight each relationship needs and keeping that oversight connected to daily operations.

The interagency guidance on third-party relationships gives banks a risk-management framework. Putting it to work means connecting supplier evidence to operational decisions, with named owners and a credible exit. For lenders adding fraud-detection tools, those connections reach directly into underwriting.

Which guidance applies?

The Federal Reserve, Federal Deposit Insurance Corporation (FDIC) and Office of the Comptroller of the Currency (OCC) issued the final Interagency Guidance on Third-Party Relationships: Risk Management on June 6, 2023. Their 2023 guidance applies to banking organizations supervised by those agencies, including community banks, and replaced their previous general third-party guidance.

The 2023 framework is supervisory guidance. Its opening provisions clarify that it does not have the force of law or impose new requirements. A bank’s existing obligations to operate safely and comply with applicable law continue when another organization performs the activity.

There is also a pending replacement. In September 2026, the agencies, joined by the National Credit Union Administration (NCUA), issued a proposed replacement framework. The proposal would replace the 2023 guidance and specified supplemental resources when finalized. Comments are due November 16, 2026. It remains a proposal, so its proposed framework does not replace the existing guidance.

For community banks, the agencies’ May 2024 companion guide supplies practical examples. This voluntary community-bank resource supplements the 2023 guidance and creates no compliance safe harbor.

Define the relationship before assigning a risk tier

The 2023 framework reaches beyond conventional vendors. A business arrangement can fall within scope without a contract or payment. Examples include referral arrangements, consultants, affiliates and joint ventures. Critical activities warrant closer oversight when a failure could have a significant customer impact or significantly affect the bank’s operations or financial condition. Each bank identifies its own critical activities; a supplier’s price or size does not settle the question.

We recommend recording the activity in operational language: “screens uploaded bank statements before underwriting,” rather than “software subscription.” That description exposes the decision the service influences.

For a lender, our document-authenticity analysis can sit at that point in the workflow. Our document-forgery service supplies scores and localized evidence for review of financial documents, including bank statements and pay stubs. The bank determines how that evidence affects an application. A supplier assessment of Scam AI belongs alongside the assessment of any other third party supporting that process.

A useful relationship record answers:

• Which bank activity depends on the service, and who owns it?
• What customer information or system access does the provider receive?
• Can its output delay, redirect or otherwise affect a customer decision?
• Which subcontractors support delivery, and where are the dependencies shared with other services?
• How would the activity continue if the provider became unavailable?

The same provider may support several uses with different consequences. A limited evaluation using synthetic files and a production deployment handling applicant records deserve separate descriptions of exposure. A later expansion into automated decisioning also deserves a fresh approval decision.

Turn the life cycle into operating decisions

The guidance follows a five-stage life cycle: planning, due diligence and third-party selection, contract negotiation, ongoing monitoring, and termination. We recommend using each stage to resolve a decision and preserve the evidence behind it.

Planning: define what the bank will retain

Before procurement becomes a contract exercise, the business owner needs a clear boundary between the service and the bank’s responsibilities.

For document screening, that boundary covers supported document types and where analysis occurs. It also defines permitted actions after a result. Underwriting judgment and communication with the applicant stay within the bank’s assigned responsibilities, including investigation of disputed findings.

The planning record can be short. It needs an intended use, an accountable owner, an explanation of the risk tier and a fallback route. A fallback that sends every unavailable result to manual review also needs staffing capacity. Otherwise, an apparently safe design can create an unmanageable queue.

Due diligence: connect the evidence to the intended use

A supplier’s security documentation answers only part of the selection question. A financially fragile provider can create a problem even when security controls are well documented. An unsuitable service or an opaque subcontracting arrangement also deserves attention.

The agencies’ fintech due-diligence resource supports a tailored assessment of prospective technology relationships. For an artificial intelligence (AI)-enabled lending control, we recommend organizing the decision around the following evidence:

A missing assurance document belongs in a decision record with its implications. Our preferred format names the unavailable evidence, the uncertainty it leaves, alternative evidence, any compensating control and the person authorized to accept the remaining risk. A sales assurance alone leaves that reasoning incomplete.

For document tools, our software buying guide separates authenticity analysis from extraction, identity verification and source-based financial verification. That distinction helps prevent procurement from approving a tool for a job its output cannot establish.

Contract negotiation needs usable information rights

Specific operational needs give contract negotiations a useful starting point. “Audit rights” is a broad label; a more usable discussion names the service reports and the required access to their findings.

For an evidence-producing service, the contract discussion can cover:

• Access to result records and relevant audit or assurance information.
• Incident escalation, notification responsibilities and service recovery.
• Permitted data uses, retention, deletion and treatment of customer information.
• Notice of material service, model or subcontractor changes.
• Assistance with transition, export formats, termination costs and continuing obligations.
• Allocation of liability and applicable insurance, with legal review appropriate to the arrangement.

The precise terms depend on the relationship. An inability to negotiate a preferred term becomes a documented exposure, rather than an assumption that the term is unnecessary. The bank’s approval record needs to explain the resulting decision.

Information rights also need a practical delivery route. A contractual promise to provide records has limited operational value if no team owns the request or the records arrive in a format the bank cannot use.

Monitoring should follow changes in exposure

Monitoring the bank’s use of the service matters alongside monitoring the supplier. A provider can meet an availability commitment while its output becomes less useful for a changed intake queue.

For a document-authenticity control, useful indicators include unsupported files, missing results, reviewer overrides and unresolved escalations. Changes in document mix or model version can explain a shift. Customer complaints can reveal consequences that a technical dashboard misses.

Each material issue needs a bank owner responsible for the next action, with a defined closure criterion. A supplier’s statement that a fix has shipped is different from evidence that the affected bank workflow is working as intended.

Monitoring also includes dependency concentration. Two providers can share the same cloud or underlying service. A backup plan built on that shared dependency may leave both unavailable together.

A material supplier change also needs an approval path. Our recommended change record describes what changed, the affected bank use and the evidence supporting continued use. A new model version, subcontractor or processing location can raise different questions. The bank service owner brings the relevant risk specialists into the decision before expanding or resuming the affected use. An unresolved change can justify a restricted deployment or a fallback route.

When an incident reaches the application queue

We recommend a response path that assigns the bank service owner responsibility for coordinating the incident, even when the failure began at the provider:

1. Establish the affected scope. The service owner brings in technology, security and compliance staff as appropriate. The incident record identifies the period, data and applications potentially affected, separating confirmed facts from unknowns.
2. Contain the exposure. The authorized bank team can restrict access or suspend affected processing. Unavailable or unreliable results enter the defined exception route. The bank preserves relevant logs and existing case evidence.
3. Protect the customer workflow. Lending operations owns the queue and contingency capacity. Compliance determines applicable reporting and customer-notification obligations. Assigned reviewers resolve affected cases, including decisions that may need correction.
4. Authorize recovery. The service owner records the evidence supporting restoration and any restrictions that remain. Issues exceeding delegated risk authority go to the designated management forum or board committee. Recovery includes follow-through on affected cases, rather than closing the incident when the endpoint becomes available.

Contingency capacity and case follow-through remain part of recovery after the provider’s service returns.

Plan the exit while records are still accessible

An exit plan needs to explain how work continues and how access ends. Records required for open cases need a receiving team and a usable export format, with retention obligations resolved before a termination event.

For document screening, switching providers can change result formats and interpretation. Existing case evidence needs to remain understandable after the original service disappears. Reviewers also need a defined way to handle applications in progress during the transition.

The exit record should distinguish customer files the bank retains from copies the provider must return or delete under the agreed terms. Credentials, connections and subcontractor access belong in the closure process too.

Keep supplier evidence separate from the bank’s decision

An AI-enabled control creates two distinct oversight questions: is the provider suitable, and is the bank using its output appropriately?

For document-authenticity analysis, a score or highlighted region is a detection signal. It establishes neither ground truth nor an applicant’s intent, and it is not a calibrated fraud probability. A score for one input is also different from overall model accuracy. An absent result supplies no favorable evidence. Our guidance on interpreting detection evidence explains these boundaries.

A reviewable decision chain preserves the submitted file, the supplier result and version information available, the bank’s routing rule, and the accountable reviewer’s reasoning.

In an illustrative lending workflow, a bank receives a statement with a suspicious balance field. The detector flags that region. Bank policy routes the application to a trained reviewer, who considers the signal alongside other records and obtains independent corroboration where the case calls for it. The authorized bank decision-maker determines the next action. If the service returns no valid result, the application enters the bank’s defined exception route.

That record demonstrates the difference between “the provider returned a signal” and “the bank made a decision supported by evidence.” A favorable authenticity result also leaves separate questions about account ownership, income and creditworthiness unresolved.

Where lending requires evidence about collateral condition or project progress, Verifit supplies a guided remote-inspection workflow. That is a separate evidence-gathering activity alongside document and media authenticity analysis, with its own scope and review responsibilities.

Give governance a view of unresolved risk

The community-bank guide describes board oversight, management accountability, independent review, and documentation and reporting across the relationship life cycle. The board retains ultimate oversight responsibility; management develops and implements the program.

Reporting needs to surface the decisions that still require attention. A useful management or board packet identifies higher-risk relationships, material service changes, unresolved evidence gaps, accepted residual risks and overdue remediation. It also names the person who can authorize continued use or restrict the service.

Independent review has a different job from supplier assurance. It assesses the bank’s own third-party risk-management process, including whether approvals and escalations work in practice. A supplier audit report cannot answer that question on its own.

For an AI-enabled lending control, the most useful handoff is a case record that shows both the provider’s contribution and the bank’s judgment. That makes the relationship understandable to procurement and risk teams without losing the workflow that matters to underwriting.

If uploaded financial documents are the gap in your lending controls, request a Scam AI demo focused on the evidence your reviewers need and the decision path your bank owns.