Interagency Guidance on Third-Party Relationships: Risk Management (OCC Bulletin 2023-17; Board SR 23-4; FDIC FIL-29-2023), June 2023
OCC Bulletin 2023-17 third-party risk management: due diligence and ongoing monitoring evidence
The guidance describes due diligence before selecting a third party and ongoing monitoring throughout the relationship, including the third party's legal and regulatory compliance, and states that a banking organization should maintain documentation and reporting sufficient to support oversight and demonstrate compliance to examiners. source
Who it reaches
National banks, federal savings associations, state member and nonmember banks and their holding companies — for every third-party relationship, scaled to risk.
The record the rule expects
Dated, exact-name reads of OFAC SDN and the Consolidated Screening List, SAM exclusions, SEC and CFPB rows as printed, LEI as published by GLEIF — attached to the due-diligence and monitoring file as the evidence line. The risk rating, the tiering and the decision are the bank's; this record never scores.
Free
Read one name now — every source, dated, hashed.
Free, once
500 names you already screened — the 48-hour comparison.
Sector receipt
/receipts/for/banks
Duty Sheet
One page per rule, generated on any receipt
Questions readers ask
Is this a sanctions-screening tool?
No. Banks run fuzzy sanctions screening elsewhere. This is the dated, exact-name evidence attachment — what the public files printed on the date — for the TPRM file.
Does it score the vendor?
Never. The guidance leaves the risk assessment to the bank; the receipt prints rows and dates.
This page quotes the rule and describes the record; whether your organization meets the rule is your compliance office's and counsel's reading. All rules · Methodology.