|
Saturday, September 12 · Lead Federal Banking Agencies Propose New Third-Party Risk Management Guidance Four federal banking agencies proposed new third-party risk management guidance on September 11. The companion document is the one that shifts the balance: a joint statement from the OCC, the Federal Reserve and the FDIC putting core service providers — the processors that run deposit systems, payments, loan servicing for most community banks — inside the supervisory perimeter. The agencies said core providers sometimes give banks little transparency, limiting due diligence or blocking contract terms a bank needs. The proposal would replace existing vendor guidance with expectations calibrated to the risk of each relationship rather than uniform process. Comments run 60 days after Federal Register publication.
|
Sentiment Index
-1
Neutral
→
|
|
|
10-day trend
Sep 12, 6:00 AM ET
|
| ▸ | Bulletin 2026-47, the core-provider hook: The interagency statement, issued September 11 as OCC Bulletin 2026-47, sets out the factors examiners will weigh when a core provider's own practices cause or enable an unsafe or unsound practice at the bank it serves — an approach that keeps accountability with the supervised institution while giving examiners a documented basis to ask why a contract lacks audit rights, incident-notification terms, or exit provisions. It reaches national banks, state member banks, insured state nonmember banks. Examiners can use it in the current cycle. |
| ▸ | New York's single-point-of-failure test: The New York Department of Financial Services told regulated firms to identify where several critical functions ride on one provider, a question its earlier vendor guidance did not ask; the department separately issued guidance on how risk assessments should be built. Concentration, not vendor count, is what the state wants mapped. The requirement sits under 23 NYCRR Part 500. |
| ▸ | Mikula on fintech standard setting: Jason Mikula reads the proposed guidance as laying groundwork for fintech standard-setting bodies — industry organizations that would define baseline diligence for bank-fintech partnerships. Sponsor banks running large program books would inherit those baselines through examination rather than rulemaking. The proposal itself names no such body. |
| ▸ | Nubank's stablecoin rail has a named counterparty: Nu Global, the multi-currency account launched Thursday alongside the US banking suite, runs on Sygnum, the Swiss digital-asset bank, which supplies custody, trading and fiat-to-crypto conversion for the USDC and EURC balances. The timing sits against Brazil's Resolution BCB 561, published April 30 and effective October 1, which bars regulated cross-border payment firms there from settling the offshore leg in stablecoins. Jason Mikula notes the Lead Bank interim product was in the works four months ago. For US readers the point is narrow: the stablecoin balance sits with a foreign custodian, which is a counterparty question, not a charter one. |
REGULATORY DEVELOPMENTS The OCC spent the same week cutting examination burden and adding vendor scrutiny, and state regulators filled the space federal agencies have left on crypto and prediction markets. | ▸ | The relief package behind the exam-cycle change: Alongside the interim final rule lifting the 18-month examination threshold to $6 billion in assets, the OCC's September 11 release listed changes already in force: minimum BSA/AML examination procedures for low-risk community banks, simplified model risk management guidance, a streamlined CRA (Community Reinvestment Act) strategic plan process, an end to Money Laundering Risk System data collection for community banks, plus a higher asset ceiling for the community bank supervision portfolio so organic growth no longer triggers large-bank treatment. Roughly 50 additional OCC-supervised banks qualify for the longer cycle. |
| ▸ | A new vendor class arrives the same week the rules do: OpenAI launched ChatGPT for Financial Services on September 11, a dedicated version aimed at research, modelling and client materials. It lands the same day four agencies proposed vendor-risk guidance sized to the harm a relationship can cause. Finextra's caution is the operative one for model-risk teams: a vendor's own benchmark is not validation evidence. A firm adopting it takes on a third party with access to research and client data. |
| ▸ | Connecticut's prediction-market sweep: Jason Mikula reported Friday that Connecticut announced a sweeping action against prediction markets — cease-and-desist orders to nine firms, including Coinbase and Robinhood, and subpoenas to 29 more. The subpoena list reaches payment and identity vendors that sit inside bank technology stacks: Stripe, Plaid, Socure. Twenty-nine firms received subpoenas. |
| ▸ | State perimeter on crypto cash: Oregon's Division of Financial Regulation proposed a bulletin classifying cryptocurrency ATM operators as money transmitters, requiring licensing through NMLS and pulling those operators into customer identification, monitoring, suspicious-activity filing. Albuquerque took the other route and banned digital-asset ATMs citywide, saying 90% of transactions there tie to fraud. Oregon takes comments to October 12. |
| ▸ | The SEC's adviser docket: The Commission charged 38 entities over false adviser filings, brought its first enforcement action under Rule 18f-4 governing derivatives risk management in registered funds, and extended the Form PF compliance date. It also proposed rescinding the investment adviser pay-to-play rule, Rule 206(4)-5, which restricts political contributions by advisers seeking government business. Comments on that rescission close November 9. |
INDUSTRY SIGNALS | ▸ | August CPI and a 79% hike probability — Friday's print put headline inflation at 3.4% annually, in line with expectations, with core at 2.4% and the monthly gain at 0.4%, the largest since May. The reaction was violent and then reversed: the 10-year Treasury yield touched 4.99% before turning red on the day, while equities erased an early drop. The Kobeissi Letter reports the odds of a September increase surged to 79%, with markets now carrying a base case of four hikes by July 2027 — against four cuts priced for the same window at the start of 2026. Supply added to it: Saudi Arabia shut its East-West crude pipeline, capacity near 7 million barrels a day, after what CNBC described as multiple attacks, and Houthi forces took the island of Perim in the Bab el-Mandeb. Preliminary University of Michigan sentiment fell 3.9 points to 47.8. The decision comes September 16. |
| ▸ | First Citizens closes on 138 branches — North Carolina-based First Citizens BancShares completed its purchase of 138 branches, extending its deposit footprint across the Midwest and Great Plains. Branch-network buyers are paying for funding, not real estate, in a quarter where deposit costs decide margin. The branches span 11 states. |
| ▸ | Stablecoin plumbing, with a supervised bank as issuer — U.S. Bank's USBDC token ran a live intrabank cross-border payment on the Stellar network, the largest US bank to put its own instrument into production rather than partner for one; the vendor layer filled in around it, with Marqeta and BVNK supplying card and wallet rails tied to Mastercard, Anchorage Digital opening regulated custody to Frgmnt's fUSD for institutions, Wirex integrating Tempo for enterprise cards, MoneyGram launching a USDC-backed Visa card in Colombia. Issuer, partner, or tokenized deposit is now a live architecture choice. MoneyGram's card launched in Colombia. |
| ▸ | JPMorgan pulls a fund's credit line — The Financial Times reported the bank cut off lending to Situational Awareness, Leopold Aschenbrenner's AI-focused hedge fund, after the fund took heavy losses in a sell-off. Prime brokerage desks with concentrated thematic exposure own the read-across. The fund's losses ran to billions. |
| ▸ | Revolut staff phished — Jason Mikula reported that Revolut employees fell for an email spoofing a legitimate government address and handed over customer information. The data included identity documents, selfie verification, balances, transaction records. |
POLITICAL & LEGISLATIVE Two calendars matter next week, and one of them decides who runs the CFPB. | ▸ | Senate Banking markup, September 17: The committee will mark up the Terrorism Risk Insurance Program Reauthorization Act of 2026 alongside nominations including Brian Johnson, of Ohio, to be Director of the Bureau of Consumer Financial Protection. The nomination sits against an Inspector General finding that stop-work orders left bureau staff off enforcement and supervision, with consumer complaints backlogged; whoever takes the chair inherits that queue. The markup is set for September 17. |
| ▸ | CLARITY Act's narrowing runway: The Senate's cloture vote on the digital-asset market structure bill is Tuesday, September 15, and it needs 60 votes. House leaders have removed September 21 and 28 from the voting calendar, leaving four voting days before the midterm recess — so a Senate-amended text has almost no correction path this Congress. A White House adviser called Tuesday the bill's last chance for years. |
| ▸ | House Financial Services teed up: The committee is preparing to mark up CFPB restructuring, an earned wage access licensing regime, a GAO study of buy-now-pay-later lending, the American Lending Fairness Act. Separately, the Conference of State Bank Supervisors endorsed legislation clarifying Section 525 of DIDMCA, the provision governing state opt-outs from federal rate exportation. The markups may be the last banking action before recess. |
WHAT'S COMING | ▸ | The FDIC's interim final rule on the expanded examination cycle is expected to publish in the Federal Register on September 14, which starts the 30-day comment clock and makes the relief operative; banks between $3 billion and $6 billion in assets should confirm with their examiner that composite rating, capital status, absence of a formal proceeding, plus no change of control in the prior twelve months all hold, because the eligibility test is continuous rather than annual. |
| ▸ | New York's proposed buy-now-pay-later licensing regime takes comments through Monday, September 14 — two days out. Industry objections center on scope: the text as drafted captures lenders that do not offer BNPL products. Firms with installment or split-pay lines should file on the definition, not the licensing mechanics. |
| ▸ | The Federal Reserve is expected to publish notices on formations, acquisitions, and mergers of bank holding companies on September 14, along with notices on permissible nonbanking activities. |
| ▸ | New Jersey's disparate impact rule drew a federal challenge: the Mortgage Bankers Association sued the state's Division on Civil Rights over the standard it adopted in December 2025. Mortgage lenders operating in the state should watch which theory of liability survives, since the rule reaches lending decisions made outside it. |
WHAT IT MEANS | ▸ | The core-provider statement gives banks a negotiating document, and the clock on using it is the contract renewal, not the exam. Banks whose core processor refuses audit rights, incident notification terms, or tested restoration times can now point to a supervisory statement saying those refusals are a factor examiners weigh — which matters more after this month's Jack Henry breach, where the core provider reported data tied to 10 of its 7,200 client banks taken by an extortion group, with no core platform outage and no ransom paid. Put the restoration-time evidence in the file before the renewal conversation. |
| ▸ | The Connecticut subpoenas reach vendors, not just platforms. Stripe, Plaid, Socure appear on that list as service providers to prediction markets, and they appear in bank onboarding stacks under a different contract. A state securities inquiry into a vendor's other line of business can surface documents about how that vendor operates generally; banks using them should know what their own agreements say about disclosure obligations to third parties. |
Dates That Matter SEP 21
9d | Comments close: Electronic Delivery of Information Under the Federal Securities Laws [SEC] | SEP 25
13d | Comments close: Swap Execution Facility Order Book Requirement for Permitted Transactions [CFTC] | OCT 1
19d | Comments close: Proposal of Special Measure Regarding Banque Misr UAE as a Financial Institution Operating Outside of the… [FinCEN] · Reciprocal Deposits: Implementing the 21st Century ROAD to Housing Act [FDIC] · Violations of Laws or Regulations [OCC] | OCT 1
19d | Effective: Telemarketing Sales Rule Fees [FTC] · Financial Data Transparency Act Joint Data Standards [OCC] | OCT 5
23d | Comments close: Disclosure of Information; Extension of Comment Period [FDIC] |
|