THE SIGNAL
On June 6, 2023, the Federal Reserve, the FDIC and the OCC issued final joint guidance on managing risks from third-party relationships. It replaced each agency’s earlier general third-party guidance.
The guidance organizes the work into a lifecycle: planning, due diligence and third-party selection, contract negotiation, ongoing monitoring, and termination. It includes illustrative examples to help community banks fit their practices to the risk of each relationship.
BEFORE
Hypothetical: a community bank’s commercial lending team selects a tool that drafts credit memos. Due diligence is complete. Because the tool sends borrower data to an outside service, it is rated critical, and the critical-vendor committee meets quarterly.
The memos stay manual for another eleven weeks. The file is ready. The person who can release it is not.
WHAT THE WAIT COSTS
The risk was evaluated, but nobody decided. The business case gets weaker every week. And when the approved path is slow, teams are tempted to find unapproved ones.
AFTER
The bank sets the risk tier from documented facts: what data leaves the bank, where the model runs, and who can change it. When a tool runs inside the bank's own environment and borrower data stays there, the bank documents a different risk profile, and review effort goes to the risks that remain.
A named officer with authority for that tier approves it. Contract terms, monitoring and an exit plan still apply. Nothing is skipped, but nothing waits for a calendar either.
HOW WISDOMTWIN FITS
WisdomTwin.ai is building a sovereign judgment layer for regulated enterprises in banking, healthcare, legal, government, pharma and defense. It is designed to run inside your own environment, assemble the decision packet with the evidence attached, route it to the named person who holds the authority, and keep a record of who released the decision and why.
We don't replace judgment. We remove the wait.
TRY THIS THIS WEEK
For each pending AI vendor, write down where the data goes and where the model runs.
Check whether your tiering rules actually use those two facts.
Name the approver for each tier and set a target number of days.
SOURCES
Board of Governors of the Federal Reserve System, Agencies issue final guidance on third-party risk management, June 6, 2023: https://www.federalreserve.gov/newsevents/pressreleases/bcreg20230606a.htm
Examples in this issue are hypothetical. WisdomTwin demonstrations use synthetic data, and nothing here describes a customer result.
Book a 20-minute call: https://calendly.com/romanbodnarchuk/20min
Roman Bodnarchuk, Co-Founder and CEO, WisdomTwin.ai