Community banks get fewer exams — and tougher core-vendor scrutiny

In two consecutive days, federal bank regulators handed community banks a lighter exam calendar and a harder look at the vendors that run their cores. On September 10, the OCC, Federal Reserve, and FDIC raised the asset ceiling for an 18-month examination cycle from $3 billion to $6 billion. On September 11, the same three agencies said core providers whose practices “unreasonably limit” community banks’ due diligence and contract negotiation will face more supervisory attention — and, in some cases, direct enforcement.

What the core-provider statement actually changes

On September 11, the OCC, Federal Reserve, and FDIC published a joint statement on how they will supervise core service providers that run the systems community banks depend on — transaction processing, account management, payments, online banking, and related infrastructure. The agencies call these vendors “core providers” and say they are typically a community bank’s most material, complex, and highest-risk third-party relationships.

The operational shift is in how the agencies allocate examinations and when they may bring enforcement. Practices that “unreasonably limit” a community bank’s ability to conduct due diligence and ongoing monitoring, or to negotiate contract terms that address its business needs, are treated as associated with greater risk. Those practices feed decisions about the nature, extent, and frequency of core-provider exams, what client banks see in examination reports, and whether a provider is added to the agencies’ service-provider examination program.

The same day, the three bank agencies plus the National Credit Union Administration (NCUA) requested comment on proposed principles-based third-party risk management guidance intended to replace the 2023 interagency guidance. That proposal is non-binding supervisory guidance; the core-provider statement is the sharper instrument aimed at the vendors themselves.

Three factors the agencies say they will weigh

The September 11 statement organizes supervisory attention around three buckets.

None of that is framed as a new statute. It is an explicit statement of how existing supervisory and enforcement authorities will be applied when community banks cannot get the information or exit terms they need from a concentrated core market. The agencies note that a significant share of that market is held by “just a few large providers,” which they say limits community banks’ negotiating power. The joint statement does not name individual vendors.

On enforcement, the agencies say they may have a reasonable basis to treat certain core providers as “institution-affiliated parties” (IAPs) under the Federal Deposit Insurance Act — persons who participate in the conduct of an insured depository institution’s affairs — and may bring actions against providers and/or the bank as institution-affiliated parties (IAPs) when safety-and-soundness issues or legal violations are identified. Outsourcing does not reduce the bank’s own compliance responsibility.

The exam-cycle relief that landed a day earlier

A day before the vendor statement, on September 10, the same three agencies issued an interim final rule implementing section 903 of the 21st Century ROAD to Housing Act. That statute, enacted July 11, 2026, raised the asset threshold under which qualifying insured depository institutions may sit on an 18-month on-site examination cycle instead of an annual one.

OCC Bulletin 2026-45 restates the other gates that did not change: well capitalized; for national banks and federal savings associations, a management rating of 1 or 2; not subject to a formal federal enforcement proceeding or order; and no change of control in the preceding 12 months. Parallel changes apply to U.S. branches and agencies of foreign banks. The agencies keep the authority to examine a qualifying bank more often when they deem it necessary.

The Federal Register notice estimates that raising the ceiling expands the pool of institutions that may be eligible for the extended cycle — including banks with total assets of $3 billion or more but less than $6 billion that meet the other criteria — and frames the change as burden relief for those institutions.

Why the two messages land as one week for community banks

Read together, the week is not a simple deregulatory story. The exam-cycle rule expands who can qualify for fewer on-site exams. The core-provider statement and the proposed third-party guidance push supervisory attention toward the vendors that sit under those banks’ operations, and toward risk management that is tailored rather than one-size-fits-all.

For a compliance or vendor-management reader, the concrete questions are operational: whether due-diligence packages, SLA terms, billing clarity, deconversion economics, and incident reporting improve under the threat of deeper provider exams and possible IAP treatment; and whether a bank between $3 billion and $6 billion in assets that already meets the CAMELS, capital, management, and enforcement gates can replan exam-year staffing and consulting budgets under the new ceiling. The agencies’ documents answer the legal thresholds. They do not publish a bank-by-bank eligibility list or name which core providers will face heightened exams first.