What the September 2026 proposal means for risk-based vendor oversight

Third-party risk programs often operate across large and diverse vendor populations. But not every relationship creates the same level of exposure.

On September 11, 2026, the OCC, Federal Reserve, FDIC and NCUA requested comment on proposed third-party risk management guidance designed to help financial institutions align and tailor their TPRM practices to the reasonably assessed risk of individual third-party relationships.

The proposal takes a principles-based approach and emphasizes prioritizing TPRM according to the magnitude and likelihood of potential harm, rather than treating every relationship as inherently high risk. The OCC describes the proposed approach as moving away from overly broad, process-driven treatment toward risk-based tailoring.

The proposal is not final guidance, and comments are due November 16, 2026.

Why risk-based TPRM matters

A large enterprise may work with hundreds or thousands of third parties.

Some may have limited access and minimal business impact.

Others may:

• Support critical business processes
• Handle sensitive information
• Provide technology infrastructure
• Have extensive system access
• Rely on significant subcontractor networks
• Create concentration or operational risk

Applying exactly the same level of due diligence and oversight to every relationship can make it difficult to focus resources where they matter most.

Start with vendor context

Risk-based TPRM begins with understanding the relationship.

Business criticality, service type, data access, prior risk signals, dependencies and potential impact can help determine the appropriate level of oversight.

This creates a practical sequence:

Vendor Context → Criticality → Risk → Right-Sized Due Diligence → Ongoing Monitoring

Enlighta’s TPRM materials similarly emphasize prioritizing monitoring and resources by business criticality and risk, rather than giving every vendor identical treatment.

Risk-based does not mean one-time

Risk-based TPRM is not simply about assigning vendors to tiers during onboarding.

A vendor’s risk profile can change.

New cyber vulnerabilities, sanctions developments, adverse events, financial changes or fourth-party dependencies can alter the nature of the relationship.

That is why risk-based segmentation works best when connected to continuous monitoring.

The Enlighta framework combines vendor screening and segmentation with real-time risk monitoring, performance monitoring, governance and compliance, and offboarding.

External intelligence needs business context

External risk intelligence can generate important signals, but a signal by itself does not necessarily tell an organization what to do.

Consider a supplier whose cyber-risk posture deteriorates.

The relevant questions may include:

• Is the supplier critical?
• What service does it support?
• What systems or data are involved?
• Does the issue affect a subcontractor?
• Does additional due diligence need to be performed?
• Should remediation be initiated?
• Does management need to be notified?

That is where risk orchestration becomes important.

Enlighta’s internal materials describe external feeds and vendor intelligence alongside risk scoring, assessments, issues/actions, remediation, contracts and governance.

From assessment to continuous oversight

A risk-proportionate TPRM model can be represented as:

Screen Third-Parties → Onboard & Segmentation → Assess Risks → Monitor Risks Real-Time → Monitor Performance → Governance & Compliance → Offboard Third-Party

This allows the organization to adjust its oversight as the relationship evolves.

The approach can also connect due diligence with contractual and performance controls.

For example, contractual controls, SLAs, obligations, performance measures, risk issues and audits can remain part of the same governance framework rather than being managed in disconnected processes.

How Enlighta helps

Enlighta supports risk-based vendor segmentation and assessment, continuous monitoring across multiple risk domains, evidence and document validation, issues and remediation, contracts, SLAs and obligations, performance management, governance and audits.

The platform is designed to integrate external risk intelligence with the broader vendor lifecycle, so risk information can be connected to the appropriate assessment, workflow and governance action.

This allows organizations to differentiate oversight based on vendor criticality and risk while maintaining a connected view across the relationship.

What TPRM teams should take away

The U.S. proposal reinforces a broader direction in third-party risk management:

Risk management should follow the relationship.

The more material the relationship and the greater the potential impact, the more comprehensive the due diligence and oversight may need to be.

For lower-risk relationships, organizations can seek a more proportionate operating model.

For higher-risk relationships, the emphasis can shift toward deeper due diligence, stronger controls, more frequent monitoring and greater management visibility.

The practical requirement is a TPRM platform and operating model capable of supporting that differentiation without creating multiple disconnected processes.

Source: Office of the Comptroller of the Currency, Third-Party Risk Management: Proposed Guidance and Request for Comment, September 11, 2026. Joint release from the OCC, Federal Reserve, FDIC and NCUA, September 11, 2026.

Explore Enlighta Vendor Screening and Continuous TPRM →