The US third-party risk rewrite that never mentions crypto
The proposed replacement of US interagency third-party risk management guidance does not mention crypto or digital assets. It is material to how CASPs obtain US banking relationships.
The development
On 11 September 2026, the FDIC, the Federal Reserve Board, the NCUA and the OCC issued principles-based third-party risk management guidance for comment, replacing the 2023 Interagency Guidance (88 FR 37920) and three supplemental resources, including SR 24-5. The Board approved publication 6–1, with Governor Barr dissenting.
Higher-risk relationships are framed as those where failure could cause an “actual non-trivial violation of law or regulation”, material harm to financial condition or significant disruption, and there is a “material likelihood” of that occurring—replacing the 2023 Guidance’s “critical activities” classification. The agencies state that non-compliance “will not result in supervisory action against a banking organisation”.
Business model impact
The proposal states there are “no generally applicable expected contract terms for third-party relationships—even for higher-risk relationships”, so sponsor bank onboarding terms would be set commercially rather than by supervisory expectation.
Where a sponsor bank has declined, repriced or exited a crypto relationship citing this third-party risk framework, the framework relied on would be withdrawn. Where a refusal rested instead on the separate 2023 crypto-asset statements, nothing in this package touches it.
The decision does not change: BSA/AML obligations and safety-and-soundness authority are unaffected. The agencies retain the ability to act on “violations of laws or regulations, unsafe or unsound practices, or other material risks”.
Product impact
Fiat on- and off-ramps, FBO and safeguarding structures and card programmes were shaped at contract level by expectations associated with SR 24-5, and those terms would survive as commercial positions rather than supervisory ones.
Due diligence accommodates a third party that “may not have a long operational history”, allowing banks to weigh “the overall qualifications and experience of management and employees”. That is the profile of many CASPs seeking US rails.
Revenue impact
Nothing changes on the P&L this quarter: nothing is rescinded, and comments have not opened. The direction is broader access and lower onboarding cost. Treat it as optionality in a 2027 US rail plan, not 2026 revenue.
The case against
Governor Barr dissented. He argues the guidance sets a “material financial risk” standard for supervisory action, making it “less likely that banks will correct problems before they become material risks to the firm”, and that its deference language may be read as the agencies deferring to a bank’s own view rather than reaching an independent judgement. An unenforced floor is a weaker floor, and that cuts both ways for a CASP.
Actions
Footnote 5 invites comment on whether further documents should be rescinded and names none, and CASPs fall within the class of third parties the guidance addresses.
Sponsor bank conversations closed on guidance grounds can reasonably be re-opened, asking which contract terms the bank would still require once the 2023 Guidance is withdrawn.
Timeline
11 Sep 2026 — US (FDIC, FRB, NCUA, OCC). Proposal issued. Board Docket OP-1881; OCC-2026-0793; FDIC RIN 3064-ZA58; NCUA-2026-1684.
Not yet published — Federal Register. The 60-day comment period begins on publication. No closing date exists yet.
On finalisation — US. The 2023 Interagency Guidance, SR 24-5, SR 24-2/CA 24-1 and OCC Bulletin 2002-16 are replaced.
Prepared by denouement — UK cryptoasset and digital-asset regulation advisory. This note is for discussion. It is not legal advice and is not a substitute for the regulators’ source texts.
Comments