Third-Party Risk Management (TPRM)

How does TPRM work in a US bank?

The June 2023 Interagency Guidance on Third-Party Relationships: Risk Management, issued by the Federal Reserve, FDIC and OCC (OCC Bulletin 2023-17), is the main US reference. It replaced earlier agency-specific guidance, including OCC Bulletins 2013-29 and 2020-10 for OCC banks. It says a bank's use of a third party does not diminish its responsibility to operate safely and soundly and comply with law, to the same extent as if it did the work itself.

The guidance describes a life cycle with five stages:

• Planning: understand the purpose, risks, costs and customer impact before entering a relationship.
• Due diligence and selection: assess whether the third party can perform the activity, comply with law and protect information.
• Contract negotiation: set scope, data rights, reporting, audit rights, subcontracting terms and termination terms.
• Ongoing monitoring: review performance, controls, audit results and changes at the third party.
• Termination: plan how to move or end the activity and handle data and system access.

Governance sits across the stages: board and management oversight, independent reviews, and documentation and reporting.

What makes a relationship higher risk?

Not every vendor needs the same oversight. The guidance asks banks to give more rigorous oversight to higher-risk activities, including critical activities, and leaves each bank to decide what is critical. Characteristics include significant customer impact, significant effect on the bank's finances or operations, or significant risk if the third party fails. A vendor that reads customer records, moves money or influences a compliance decision usually lands in the higher tier.

How does TPRM apply to AI vendors?

The guidance does not mention AI in its text, so banks apply the same life cycle and tailor it. The extra questions usually concern what the AI system can read and change, whether customer data is used to train any model, which model providers and subcontractors sit underneath, how changes to the model are controlled and announced, and what logs the bank can obtain. Where the AI acts as a model in a bank decision, model risk management applies as well, and the access an AI system holds is worth reviewing like any non-human account (see agent access review).

How does it connect to GLBA and SOC 2?

For customer information, the Interagency Guidelines Establishing Information Security Standards (12 CFR part 30, appendix B for OCC banks) require due diligence in selecting service providers, contracts requiring appropriate safeguards, and monitoring where risk warrants. Non-bank institutions under the FTC follow 16 CFR 314.4(f), which sets a parallel oversight duty. Vendors often support the review with a SOC 2 report, which a bank should read for relevance to the activity rather than treat as a pass.

Where to learn more

For a stage-by-stage walkthrough of AI vendor oversight, see how to govern AI agents: 12 controls for regulated enterprises. The AI compliance analyst guide shows where an AI employee fits in a compliance team.

Frequently asked questions

Is TPRM the same as vendor risk management?

Mostly. Vendor risk management is the common name for the same discipline. TPRM is the broader term in bank guidance because "third party" covers any business arrangement, including affiliates, consultants and fintech partners, whether or not there is a contract.

Who is responsible for third-party risk at a bank?

The bank. The interagency guidance says outsourcing does not reduce the bank's responsibility. The board oversees the program, management runs it, and the guidance expects independent reviews of how well it works.

How often should a bank review a third party?

The guidance sets no fixed interval. Monitoring should match the risk and complexity of the relationship, with more comprehensive or frequent review for higher-risk and critical activities, and a fresh look when something at the vendor changes.

Does TPRM apply to AI vendors?

Yes. An AI vendor is a third party like any other, and the same life cycle applies. Banks add AI-specific questions on data use, model changes, subcontractors and logs, scaled to what the system can read and do.