The Federal Reserve (SR 23-4), OCC (Bulletin 2023-17) and FDIC (FIL-29-2023) issued joint Interagency Guidance on Third-Party Relationships: Risk Management on 6 June 2023, replacing OCC Bulletin 2013-29, FDIC FIL-44-2008 and FRB SR 13-19. It sets a common, principles-based framework for managing third-party risk across the relationship lifecycle, and it applies to all banking organisations including community banks.
AI vendor relationships meet several criteria for higher-risk classification under the guidance: they routinely involve sensitive data, subcontractor chains (foundation model providers, cloud platforms, fine-tuning services) and customer-affecting decisions. The combination of these factors lifts AI vendor due diligence well above standard procurement, and pulls the relationship squarely into the deeper end of the lifecycle expectations.
The guidance sits on top of SR 11-7 for the model layer. SR 11-7 governs the bank's use of the model as a model; the third-party guidance governs the bank's relationship with the vendor providing it. Banks that treat the two as substitutes typically have gaps in either ongoing vendor monitoring or in model risk evidence, and examiners now probe both sides of that boundary.
Document the business case, the risk classification and the criticality of the AI activity. AI vendor relationships that affect customers, handle sensitive data or rely on subcontractors typically warrant higher-risk treatment with deeper diligence, contract terms and ongoing monitoring proportionate to that classification.
Cover financial condition, business model, compliance posture, information security, model risk management, subcontractor governance, business continuity and concentration risk. For AI vendors, model documentation, evaluation evidence, training-data provenance and foundation-model dependency disclosures are routine asks during selection.
Negotiate service levels, data ownership, sub-processor disclosure, audit rights, security obligations, incident notification, change management and termination assistance. AI-specific terms cover model version control, training data restrictions, the bank's right to evaluation evidence and notice of material changes to the underlying foundation model.
Run periodic re-assessment, performance monitoring, key indicator tracking and verification that contractual obligations are being met. For AI vendors, monitoring extends to model drift, evaluation re-runs, vendor security posture and any material changes to the underlying foundation model or its training regime.
The guidance is explicit that subcontractor risks transfer to the bank. AI vendors typically rely on foundation-model providers and cloud platforms; the bank must understand those relationships, the data flows, the operational dependencies and the concentration that builds up across the wider vendor estate.
Build right-to-exit clauses, data return and destruction, model portability where contractually possible and operational continuity planning. AI vendor exit is hard if prompts, evaluation suites and fine-tuning data are not owned by the bank, so exit readiness has to be engineered in from contract signature.
Issues SR 23-4 and supervises state member banks and bank holding companies. Examiners cover third-party risk in standard supervisory cycles, with AI vendor arrangements increasingly singled out for review.
Issues Bulletin 2023-17 and supervises national banks and federal savings associations. Bulletin 2024-3 added supplementary guidance for community banks while keeping the lifecycle framework intact.
Issues FIL-29-2023 and supervises state non-member banks. Examines third-party risk as part of the standard supervisory cycle, with sensitive-data and customer-affecting AI activities drawing the closer look.
Supervises consumer-facing activities; third-party AI vendors involved in consumer credit, deposit or payments services come within the CFPB's supervisory perimeter as well as the prudential agencies' frameworks.
The 2023 interagency guidance does not introduce new statutory obligations. It consolidates supervisory expectations into a common framework and replaces the earlier agency-specific bulletins. The operative citations are SR 23-4, OCC Bulletin 2023-17 and FDIC FIL-29-2023.
OCC Bulletin 2024-3 provided supplementary guidance for community banks, recognising the resource constraints of smaller institutions while keeping the lifecycle framework intact. The expectations scale, but they do not disappear, and the audit file still needs to evidence each stage.
Examiner focus on AI vendor arrangements has increased visibly through 2024 and into 2025. The supervisory dialogue tends to begin with the inventory of AI vendors and proceed to due diligence evidence, contract terms and ongoing monitoring outputs, with subcontractor disclosure a recurring question.
| Adjacent rule | How it interacts |
|---|---|
| SR 11-7 (Model Risk Management) | SR 11-7 covers the model as a model; the third-party guidance covers the vendor relationship. Both apply to a hosted AI model used by the bank. The model is in the inventory under SR 11-7 and the vendor is in the third-party inventory under the 2023 guidance, and the two evidence sets must reconcile. |
| FFIEC Information Security Booklet | The FFIEC IT handbook information security expectations apply throughout. AI vendor due diligence and monitoring must incorporate information security controls and the vendor's own programme, with evidence kept in the audit file alongside the third-party lifecycle artefacts. |
| EU AI Act (Regulation 2024/1689) for US banks with EU exposure | US banks placing AI on the EU market or producing outputs used in the EU pick up AI Act provider or deployer obligations. The third-party relationship still sits under the US interagency guidance; the model layer adds EU AI Act Annex IV documentation and post-market monitoring obligations. |
| Consumer Financial Protection Act and ECOA | AI vendors involved in consumer credit, deposits or payments fall within the CFPB perimeter. ECOA fair lending applies to credit decisions regardless of whether they are produced by a model the bank built or by a vendor model. Adverse action notice obligations remain the bank's responsibility. |
| GLBA Safeguards Rule | Personal financial information handled by AI vendors must be safeguarded under GLBA. The bank's vendor due diligence and contract terms must address the Safeguards Rule expectations, including written security plans, access controls and incident response procedures that flow through to the vendor. |
“Banks tend to treat the third-party guidance as procurement's problem and SR 11-7 as model risk's problem. The 2023 interagency guidance is the bridge: the same AI vendor sits in both registers, and the evidence sets have to reconcile.”
No. It consolidates supervisory expectations into a common framework and replaces the earlier agency-specific bulletins (OCC 2013-29, FDIC FIL-44-2008, FRB SR 13-19); the statutory underpinnings are unchanged.
SR 11-7 governs the model; the third-party guidance governs the vendor relationship. Both apply to a hosted AI model, with the bank's inventory carrying entries in both registers and the evidence sets reconciled to each other.
Yes when an AI vendor relies on them. The guidance treats subcontractor risk as transferring to the bank, so foundation model provider risk has to be understood, documented and monitored at the bank level.
Yes. OCC Bulletin 2024-3 added supplementary guidance recognising community bank resource constraints, but the lifecycle framework applies in full and the evidence expectations scale with risk rather than disappearing.
8 to 16 weeks to a production-ready artefact set: AI vendor inventory, lifecycle controls, due diligence templates, contract clause library, ongoing monitoring plan and an audit pack mapped to the interagency guidance and SR 11-7.
The June 2023 interagency guidance from the Federal Reserve, OCC and FDIC sets a common lifecycle framework for third-party risk: planning, due diligence, contract, ongoing monitoring and termination. Most material AI vendor arrangements land in the higher-risk band because of sensitive data, subcontractor chains and customer-affecting decisions. It sits on top of SR 11-7 for the model layer, and both registers must reconcile. Moweb delivers the working inventory, controls and audit pack on a partner-led fixed fee, 8 to 16 weeks to production.