Community banks: third-party risk proposal

On September 11, 2026, federal banking regulators requested comment on proposed third-party risk-management guidance. The Federal Reserve's joint release describes guidance intended for banks and credit unions, and identifies it as nonbinding supervisory guidance.

A separate statement addresses community banks' engagement with core service providers. The Fed also proposed a companion guide for its supervised community banks. These developments concern relationships between financial institutions and their providers; they do not establish that a business software vendor is approved to receive your financial documents.

For a small-business borrower, our practical takeaway is to verify the destination of an application before uploading sensitive records. Ask the lender to confirm the portal, the entity receiving the documents and the contact responsible for questions. Do not rely on a familiar logo in a message as proof of the destination.

If a broker is involved, request an explanation of which providers may receive the package and how consent is recorded. Keep copies of what was submitted and when. An unexplained request to resend account details through a different channel deserves clarification before action.

Providing a complete document package does not establish approval. Track requests for missing information separately from changes to pricing or conditions. Ask whether a new document affects the proposed amount, the use of funds or the collateral review.

This briefing does not evaluate any provider's security. It supplies a preparation process: verify the route through the institution's own channel, limit the package to the requested records and retain an exact submission history. Your accountant can help explain inconsistencies without making unsupported changes to the numbers.

Assign one person to maintain the application checklist. Record the current version of the proposal, outstanding questions and deadlines. When a contact changes, ask the institution to confirm the new contact rather than relying on a forwarded message alone.

Use the financing checklist and document-preparation guide below before submission. The regulatory announcement is a proposal and statement, not a certificate of safety for an app, broker or bank. Current terms, document instructions and any provider-specific assurances must come from the organization handling the request.