OCC
Is the September 2026 third-party risk guidance final?
Content reviewed 2026-10-10 · How we check sources
Short answer
The OCC’s 11 September 2026 Bulletin 2026-46 announces proposed guidance. The bulletin describes what would apply if finalised; it does not announce an effective new requirement.
Applies to: Bulletin 2026-46 proposal status · not a partnership approval
What this means
The proposed approach tailors third-party risk management to the institution and the risks of each relationship. The bulletin says the proposed guidance would not set enforceable standards or prescriptive requirements.
This answer establishes the status described in that bulletin. Before acting, check for a later final publication and assess the full proposal and existing duties separately.
Your next step
- Record the publication as a proposal for review.
- Keep approved controls in place while assessing potential changes.
- Check subsequent official publications before treating it as final.
Suggested workflow; confirm applicability for your institution.
Official sources
OCC — Bulletin 2026-46, proposed guidance ↗Ask with your entity, activity and regulator.
Regulatory research, not legal advice. This answer has the scope and review date shown above; your institution decides applicability.