November 12, 2026 | data²

On September 15, the OCC, Fed, FDIC and NCUA proposed replacing the 2023 third-party risk guidance. Their own description of what it produced was "check-the-box exercises." Comments close November 16.

Most of the reaction so far reads the proposal as relief. Fewer questionnaires, more room for judgment, less paperwork for low-risk vendors.

That reading misses the cost. When the checklist goes away, so does the easiest thing to show an examiner. What replaces it is your judgment, and judgment has to be backed by evidence. By the end of this piece you will know what that evidence looks like on one critical vendor, and how to test whether your program could produce it today.

Flexibility in Third-Party Risk Management Guidance Moves the Burden to You

Under a checklist, the completed checklist was the proof. Under principles, the proof is the reasoning: why this vendor is critical, why you accepted the risk you kept, and how you know the vendor did what the contract said.

As BRG put it in October, "Greater flexibility will not remove accountability." The examiner's questions get fewer and harder. Expect them to land on one vendor at a time.

Where the Evidence Breaks Today

Most TPRM programs run lean. Ncontracts' 2026 survey found 63% of programs run on one or two people, and 53% manage more than 300 vendors. KPMG's 2026 global survey found only 16% of financial services respondents are very confident in their TPRM data.

The reason is structural. The evidence for one vendor lives in three places that were never built to talk to each other:

• The TPRM tool holds questionnaires, ratings and due diligence files.

• The contract file holds the terms: rates, caps, service levels, change-of-control clauses.

• Accounts payable holds what was billed, what was approved and what was paid.

Each system looks complete on its own. The proposal names a third party that "has breached contract terms" as a risk to manage, and for most vendors that shows up in the billing. "What did this vendor bill, what did the contract allow, and who approved the difference" cannot be answered from any one of the three.

What Evidence on One Vendor Looks Like

Here is a decision record for one invented vendor. Every field traces back to a source document, and nothing is inferred without one.

This is the artifact an examiner can follow. It does not summarize the vendor. It shows the clause, the invoice line, the payment and the person who signed, and it marks where two systems disagreed.

Run This Test on One Vendor This Month

Pick one critical vendor before your 2027 program decisions are made. Then time how long it takes your team to answer these five questions with documents, not memory:

1. Which contract terms and amendments govern what this vendor can bill today?

2. What did the vendor bill last quarter, line by line, against those terms?

3. Where do your TPRM tool, contract file and AP records disagree about this vendor?

4. Who approved each payment, and on what basis?

5. If your examiner asked why you accepted the residual risk, which record would you hand over?

If the answers take less than a day, your program is ready for principles-based review. If they take longer and multiple emails, the redesign starts with the evidence, not the questionnaire.

Where data² Fits

data² builds this record across the systems you already run, with no data migration. reView™ connects the contract, the invoices and the approvals where they live, checks every line against the term that governs it, and saves each finding as a decision record your examiner, auditor or board can follow back to the source. It is built for vendor and payment integrity. It is not an AML tool and it is not a dashboard.

The checklist is going away. The examiner's question is not. View the sample Decision Record™

Frequently Asked Questions

What is the proposed third-party risk management guidance?

On September 15, the OCC, Fed, FDIC and NCUA proposed replacing the 2023 third-party risk guidance. They described what that guidance produced as "check-the-box exercises." Comments close November 16.

When do comments close on the proposed third-party risk management guidance?

November 16. The Federal Register notice says comments must be received on or before November 16, 2026.

What will an examiner ask for if check-the-box reviews go away?

Your judgment, backed by evidence. You should be able to show why a vendor is critical, why you accepted the risk you kept, and how you know the vendor did what the contract said. As BRG put it in October, "Greater flexibility will not remove accountability."

What should evidence on a critical vendor include?

A Decision Record™ that traces every field back to a source document. It should show the vendor and why it is critical, the contract term that governs billing, what was billed, what was paid, the rule that governs the difference, any conflict between systems, how confident you are in the sources, and who signed off.