Interagency guidance makes relationship structure a risk fact

The relationship label does not define the risk perimeter

A banking organization cannot determine the relevant risk record from a supplier category alone. The Federal Reserve's summary says the interagency principles can support all types of third-party relationships regardless of how they are structured. It specifically notes that newer arrangements, including some financial-technology relationships, may place an outside company in varying degrees of interaction with the bank's customers. The important fact is therefore the arrangement's operating structure, not whether the parties use a familiar label.

That distinction changes the minimum useful inventory. A record should identify the third party, the product or service, the banking entity and business process using it, customer interaction, data and system access, subcontracted dependencies, accountable owners, and the decision rights retained by each participant. A legal-entity row remains necessary, but it cannot explain a multi-party service model or show which part of an arrangement creates a particular exposure.

Structure must remain connected to lifecycle evidence

The agencies frame third-party risk management as a lifecycle practice. Planning, due diligence, contract work, ongoing monitoring, issue response, and termination may produce different evidence, yet each stage concerns the same operating relationship. When the structure changes, the organization needs to know which earlier assumptions, approvals, controls, and contingency plans require review.

A platform evaluation should therefore test a structural change rather than a static profile. Add a customer-facing function, change a data flow, introduce another service participant, or move responsibility between parties. The demonstration should show how the system identifies affected records, assigns review, preserves the prior state, records the disposition, and carries the approved change into monitoring. A refreshed overall score does not explain that chain.

Proportionality requires context, not omission

The Federal Reserve says banking organizations should tailor practices to their size, complexity, risk profile, and the nature of each third-party relationship. Proportionality is therefore a reason to preserve decision context. Reviewers should be able to see why one relationship received deeper diligence, a different contract control, more frequent monitoring, or a stronger exit plan than another.

Technology can help encode thresholds and route work, but the configured rule is not the supervisory guidance itself. Buyers should ask whether a system retains the relationship facts, policy version, accountable approver, evidence considered, exception, and review trigger behind each tailored treatment. Without that record, a lighter process can be difficult to distinguish from an incomplete one.

What a buyer can and cannot conclude

A credible procurement test follows one nonstandard arrangement through its full operating model. The provider should show entity and service relationships, customer touchpoints, fourth parties, linked systems, obligations, issues, continuity dependencies, and the history of structural changes. Export behavior matters because the organization may need to reconstruct the arrangement outside the platform during examination, incident response, migration, or exit.

The guidance does not prescribe a universal data model, workflow, tier, score, or product. It also does not determine whether a specific arrangement is acceptable. Official product documentation may establish a documented capability to represent relationships or route reviews; only configuration and representative operating tests can show whether that capability preserves the organization's actual structure and accountability.

What we will watch next

Third Party Current will watch for later primary-source evidence that changes the maintained company, capability, or standards record. The next useful evidence may include implementation documentation, release details, regulator findings, corrected methods, product packaging, customer-observable workflow, or a subsequent company statement. Until then, the dated source and its stated boundary remain attached to this analysis.