Paying a bill or have a question about your account? Make a paymentConsumer help
Paying a bill or have a question about your account? Make a paymentConsumer help
ComplianceIf you're a bank, the 2023 third-party guidance still stands while regulators take comments to Nov 16, 2026. The proposal would also reach credit unions. Here's what the proposal changes, what stays in force for your agencies and law firms, and what to keep doing.
Nothing yet. The OCC, Federal Reserve, FDIC and NCUA announced proposed guidance on Sep 11, 2026, published Sep 15, that would replace the 2023 third-party guidance (91 FR 58536), with comments due Nov 16, 2026. Until final guidance replaces it, the 2023 guidance stands for banks, and every creditor keeps its legal duties and its contracts with agencies and law firms.
Where the rule stands
General information, current as of Nov 2, 2026. It isn't legal advice. Rules change and differ by state, so check the sources linked here and talk to your own counsel before you act on it.
TSI publishes it. TSI provides collection services and owns DebtNext, a TSI company, whose software banks and lenders use to manage their agencies. That means TSI may be one of the agencies a reader oversees.
The 4 agencies "plan to rescind and replace existing guidance on third-party risk management" (91 FR 58536). "Any finalized guidance would replace the 2023 Guidance and the Supplemental TPRM Resources," which include the 2024 community bank guide from the Board, the FDIC and the OCC.
Their stated reason: the 2023 guidance "frequently has been interpreted in an overly broad manner and with an insufficient focus on tailoring." The proposal keeps a principles-based approach and sorts oversight into 4 parts: identifying and assessing risk, overseeing it in proportion to its significance, deciding which residual risk to accept, and governance.
The proposal would also reach insured credit unions (12 U.S.C. 1752(7)). The 2023 guidance came from the Board, the FDIC and the OCC.
The Federal Reserve published a separate proposed guide for traditional community banking organizations the same day, with comments also due Nov 16, 2026 (91 FR 58438).
The proposal says "non-compliance with this guidance will not result in supervisory action." It also says the absence of a specific contract term "would not alone be a sufficient basis for an examiner to communicate an adverse finding" (91 FR 58536).
The backstop stays in the text: "the agencies may take action for violations of laws or regulations, unsafe or unsound practices, or other material risks that result from insufficient management of third-party risk."
A vendor's own regulator doesn't stand in for the bank's oversight either. "No supervisory or regulatory agency is responsible for a banking organization's third-party risk management" (91 FR 58536, footnote 14).
The proposed guidance applies to banks supervised by the OCC, the Federal Reserve and the FDIC, and to insured credit unions. The agencies add that it "may also be relevant to any other entity supervised by the agencies."
Their examples of third parties include "operators of call centers" and "lawyers," so collection agencies and collection law firms fit its scope. Hospitals, utilities and other creditors outside bank supervision aren't covered, and they can still use its 4 parts as a checklist for their own agency programs.
The duties that matter most for collections come from law, and the proposal leaves them where they are.
Federal consumer financial law makes it unlawful for "any covered person or service provider" to break that law or to engage in an unfair, deceptive or abusive act or practice (12 U.S.C. 5536(a)(1)). Collecting debt related to a consumer financial product or service is itself a covered activity (12 U.S.C. 5481(15)(A)(x)). The CFPB's service provider bulletin, still listed in its supervisory guidance on Sep 28, 2026, says "legal responsibility may lie with the supervised bank or nonbank as well as with the supervised service provider" (CFPB Bulletin 2016-02).
Your agencies and law firms answer for their own conduct as debt collectors under the FDCPA and Regulation F (12 CFR 1006.2(i)(1)). The proposal itself notes that third-party relationships "may raise additional consumer compliance considerations" it doesn't address (91 FR 58536, footnote 8).
From Jan 1, 2027, the SHIELD Rule's definition of debt collector includes anyone who regularly collects debts owed to itself, "directly or indirectly" (6 RCNY 5-76). DCWP's FAQ says debt collectors "are liable when their contractors or agents violate NYC Laws and Rules" (Aug 4, 2026, section XIV). Ask counsel how that reaches accounts you place.
The proposal says there are no generally expected contract terms, "even for higher-risk relationships," and that "the terms of the contract may allocate responsibility between the parties" (91 FR 58536). Signed agency and law-firm contracts keep their audit rights, complaint reporting, subcontractor approval and data-return terms until you renegotiate them.
| Oversight step | What to keep doing | Where the proposal covers it |
|---|---|---|
| Inventory | Keep a current list of every agency, law firm and debt buyer you use, and the subcontractors each relies on, including offshore work | Risk identification and assessment |
| Risk tiers | Rank each relationship by consumer contact volume, data access, litigation activity and complaint history | Risk assessment |
| Due diligence | Before placing accounts, check licenses, regulatory record, complaint history, information security and call monitoring | Due diligence and third party selection |
| Contract | Keep audit rights, complaint reporting, subcontractor approval, access to call recordings, recall rights and data return | Contract negotiation |
| Monitoring | Review complaints, sample calls, reconcile remittances and closed accounts, and audit on a risk-based cycle | Ongoing monitoring, which lists "reviews of customer complaints" |
| Exit | Plan how accounts come back and how data is returned or destroyed | Termination |
| Governance | Report to senior management and the board, and have the program reviewed independently from time to time | Governance, which lists "periodic independent reviews" |
Subcontractors stay your concern. The proposal says a bank "remains responsible for complying with applicable laws and regulations... regardless of a third party's use of subcontractors" (91 FR 58536).
Comments are due Nov 16, 2026. Each agency takes them under its own number: OCC Docket ID OCC-2026-0793, Federal Reserve Docket No. OP-1881, FDIC RIN 3064-ZA58 and NCUA Docket No. NCUA-2026-1684 (91 FR 58536).
Until final guidance replaces it, keep running the 2023 program. Check each agency and law firm file against the changes in the table above so you know what moves when the agencies finalize.
If you run several agencies and law firms, DebtNext, a TSI company, makes the software many lenders use to track agency performance, compliance and data in one place.
TSI's Recovery Performance Diagnostic covers baseline economics, channel strategy, complaint and risk analysis, and carve-out design for 1 portfolio, stage or segment.
