Not directly. The June 2023 Interagency Guidance on Third-Party Relationships is addressed to banking organizations supervised by the Federal Reserve, FDIC and OCC. A fintech is the third party it describes, so a bank partner will apply its lifecycle to you through diligence, contracts and monitoring.
This is general information, not legal advice. Ask counsel how it applies to your arrangement.
What the guidance is
The Federal Reserve, FDIC and OCC issued the guidance in June 2023, and it replaced each agency's earlier general third-party guidance. The OCC's bulletin says it rescinds OCC Bulletin 2013-29 and 2020-10. The text says risk management should match the bank's risk profile and how critical the activity is, because "not all third-party relationships present the same level of risk or criticality."
The Federal Reserve later confirmed in letter CA 24-2 that the guidance applies to every institution it supervises, including those with $10 billion or less in total assets.
Why a fintech still feels it
The guidance is supervisory guidance. It says it does not have the force of law and does not impose new requirements on banks. It does say banks may form relationships with fintechs using new or novel structures, and that its principles apply to all third-party relationships, fintechs included.
In practice that means your bank partner reads it, builds its program around it, and passes the expectations down to you.
The lifecycle you will see from the other side
| Stage | What the bank does | What you see |
|---|---|---|
| Planning | Decides whether the activity is critical and what risk it adds | Early scoping calls |
| Due diligence | Reviews your security program, subcontractors, resilience | Questionnaires and evidence requests |
| Contract negotiation | Sets audit, breach notice, subcontractor terms | Redlines on security schedules |
| Ongoing monitoring | Tracks changes, incidents, test results | Periodic reviews and notices |
| Termination | Plans exit, data return, transition | Exit and data clauses |
How to prepare in a week
- Write a one page description of what your software does for the bank and which customer data it touches.
- List your subcontractors and major open source and SaaS dependencies.
- Gather evidence of MFA, encryption, testing and incident response, as documents rather than promises.
- Draft how and when you would notify a customer of a security incident.
- Decide who answers monitoring requests and how fast.
Do not describe an audit as complete if it is not, and do not call anything a certification unless it is one.
Where Safeguard fits
Safeguard's SBOM and dependency scanning, reachability analysis and compliance evidence automation can help produce the inventory and evidence a bank asks for. You can run a free scan at gold.safeguard.sh/scan.
Quick check
Is the interagency guidance a law?
No. It describes itself as supervisory guidance without the force and effect of law. It still shapes how banks examine and manage you.
Does it cover just big banks?
No. The Federal Reserve letter CA 24-2 says it applies to all institutions it supervises, including smaller ones.
Sources
- Interagency Guidance on Third-Party Relationships: Risk Management, Federal Register, 9 June 2023
- OCC Bulletin 2023-17
- Federal Reserve CA 24-2
Last reviewed: 19 October 2026.
