Not by itself. The 2023 interagency third-party guidance says it does not have the force and effect of law and does not impose new requirements on banks. It still matters to vendors, because banks use it to set contract terms, and some separate rules and statutes do bind.
This is general information, not legal advice. Ask counsel about your situation.
Three different things
| Type | Example | Binding on a vendor directly? |
|---|---|---|
| Supervisory guidance | 2023 Interagency Guidance on Third-Party Relationships | No, it addresses banks |
| Regulation | Computer-security incident notification rule | Can be, for covered bank service providers |
| Contract | Your security schedule with a bank | Yes, once signed |
The Interagency Guidelines on information security sit in the OCC's regulations at 12 CFR Part 30. They address the bank's duties, including oversight of service providers, and expect providers to be bound by contract.
How guidance becomes binding in practice
A bank reads guidance, builds a program and writes its expectations into contracts. Once you sign, those terms bind you even though the guidance did not.
Examples of terms that trace to the guidance: audit and remediation rights, breach notice timing, subcontractor change notice, data return and continuity objectives.
Where law may reach you directly
The computer-security incident rule includes duties for bank service providers, and the Bank Service Company Act makes some contracted services subject to regulatory examination. See the four-hour notice post and the examination post. Whether you are covered depends on the services you provide.
Reading a clause that cites guidance
If a contract says you must comply with named guidance, treat that as a binding promise to follow it, and ask which version and which parts. Guidance changes. The 2023 text, for example, replaced earlier agency issuances, so a clause pointing at older material may be out of date.
A sensible stance for vendors
- Treat guidance as a preview of the questions you will face.
- Read every security clause as a binding promise.
- Commit to what you operate today and can evidence.
- Ask counsel to confirm if a regulation applies to you directly.
Quick check
If guidance is not law, can we ignore it?
No. Your customers act on it, and your contract will reflect it.
Does the guidance apply to fintechs directly?
It addresses banks. Its principles apply to all of a bank's third-party relationships, fintechs included, so you meet it through the bank.
Sources
- Interagency Guidance on Third-Party Relationships, Federal Register, 9 June 2023
- 12 CFR Part 30, Appendix B
- Computer-Security Incident Notification Requirements, Federal Register, 23 November 2021
- 12 U.S.C. 1867
Last reviewed: 19 October 2026.
