Skip to content
ReportThe 2026 State of TPRMDownload
Coverbase for the Interagency Guidance

Examiners hold US banks to the Interagency Guidance. Coverbase helps you run it end to end.

The 2023 Interagency Guidance on Third-Party Relationships, issued jointly by the Federal Reserve, OCC, and FDIC, lays out the third-party risk lifecycle banks are expected to follow. It's guidance, not a rule, but examiners review against it, and Coverbase keeps the work and the proof in one place.
Book a demo
Bank guidance | lifecycle
Bank guidance | lifecycle

The relationship changes

Activity plan
Provider evidence
Contract record
Agent work
01Scope the risk
02Review the terms
03Watch the change
Bank review prepared

The owner sees the complete relationship history.

01 · Overview

Who the Interagency Guidance applies to

The guidance applies to banking organizations supervised by the Federal Reserve, OCC, and FDIC, including community banks. It's principles-based and scalable: oversight should match the risk of the relationship, with the most scrutiny on “critical activities.” It replaced the agencies' prior separate guidance, including OCC Bulletin 2013‑29. Credit unions fall under the NCUA instead.

On September 11, 2026, the agencies and the NCUA proposed replacement guidance. Comments close November 16, and the 2023 guidance remains in effect until a final version is published. Read our explainer on the 2026 proposal.

02 · Requirements

The third-party risk lifecycle it expects

  1. 01

    Planning

    Weigh the risks and benefits before entering a third-party relationship.
  2. 02

    Due diligence and selection

    Assess a prospective third party's financials, controls, and ability to perform before you sign.
  3. 03

    Contract negotiation

    Put the right terms in place: performance, security, audit rights, and termination.
  4. 04

    Ongoing monitoring

    Monitor the relationship for its whole life, with heightened attention to critical activities.
  5. 05

    Termination

    Plan for a clean exit, including how the activity transitions when the relationship ends.
03 · How Coverbase helps

Cover all five stages, with the evidence

Exam findings often come from scattered evidence, not missing policy. Coverbase keeps every stage in one defensible record.

  1. Diligence prepared for your review

    Gather and assess third-party evidence automatically, scaled to the risk of the activity.

  2. Critical activities flagged

    Tier relationships so your most critical vendors get the deepest oversight.

  3. Lifecycle monitoring

    Track each relationship from planning through termination, not only at onboarding.

  4. Exam-ready evidence

    Pull a complete, time-stamped record for any vendor when examiners ask.
04 · Platform features

One platform for third-party risk and security

Speed with control

Automate intake, assessment, and monitoring with guardrails that keep your policies in force.

Explain with confidence

AI shows its reasoning for each recommendation, so you can explain your ratings and findings.

Automate with assurance

Adapt controls and workflows as your program and its regulations change.

05 · Security

How we protect your data

These are the practices behind the supplier records and evidence you keep in Coverbase. Read our security and privacy program.

To request our SOC 2 report or report a vulnerability, email security@coverbase.ai.

  1. Independent review

    A SOC 2 Type II audit against the AICPA Trust Services Criteria for security, availability, and confidentiality.

  2. Testing and remediation

    External penetration tests every year, plus vulnerability scans and static and dynamic application security tests, with findings tracked through remediation.

  3. Identity and production access

    SSO and SAML with Okta, Microsoft Entra, Google, and other identity providers. Multi-factor authentication is required for production access.

  4. Data protection

    Data encrypted at rest with AES-256 and in transit with TLS 1.2 or higher.

  5. Internal accountability

    Access logging, quarterly least-privilege reviews, and required employee security and privacy training.
06 · Questions

Questions banks ask about the guidance

Use your own risk policy to set the depth of review.

Is the 2023 Interagency Guidance a regulation?

No. The three agencies issued joint supervisory guidance describing sound third-party risk management principles.

Does it apply to credit unions?

No. The issuing agencies supervise banking organizations; credit unions look to NCUA guidance.

Should every vendor get the same review?

No. We tier the relationship so you can match diligence and monitoring to its risk and complexity. Your bank approves the final approach.

Ready for agentic third-party risk and security?

Book a demo