Monthly LRA Update: September 2026

REGULATORY DEVELOPMENTS

Banking Regulators Seek Comment on Proposed Updates to Third-Party Risk Management

On September 11, the banking regulators jointly proposed updated interagency guidance relating to third-party risk management (TPRM) practices [OCC Bulletin 2026-46 | FDIC PR-71-2026]. The proposed guidance advocates for an approach that is more focused on the reasonably assessed risk level of each vendor relationship. The proposal would rescind and replace the 2023 interagency guidance, which regulators noted has frequently been applied in an overly broad, process-driven manner. Instead, the new framework encourages institutions to prioritize oversight based on the magnitude and likelihood of harm a relationship could pose, moving away from uniform controls toward a more risk-based, principles-driven approach.

The proposed guidance organizes TPRM around four core components: risk identification and assessment, risk oversight, residual risk acceptance, and governance. It explicitly clarifies that the document does not establish enforceable standards or prescriptive requirements and that non-compliance will not trigger supervisory action. Rather, it serves as a supervisory reference to help banks align their vendor oversight with their size, complexity, and specific risk profiles. The agencies also acknowledged that while third-party relationships vary widely in scope and criticality, banking organizations retain ultimate responsibility for safe and sound operations and compliance with applicable laws, regardless of outsourcing arrangements.

Comments must be received on or before November 16.

OTHER DEVELOPMENTS

NAIC Responds to Senator Warren’s Inquiry

On September 24, the NAIC responded to Senator Elizabeth Warren’s inquiry. Sen. Warren had sought information on how state regulators are addressing the risks posed by increasing ties between private investment firms and insurance companies, and, in particular, Delaware Life’s reported misclassification of related party exposures. According to Warren’s letter, life insurers’ private credit investments have more than doubled in the past 10 years (from $386 billion to $849 billion).

In its 22-page response, the NAIC highlighted a number of recent initiatives focused on oversight and reporting of investment-related risks, including classifications of bonds and securitizations, use of off-shore reinsurance treaties, enhanced reporting of private and affiliated investments, and the “equal capital for equal risk” principle. The NAIC also continues to monitor the use of related party transactions and affiliated investment management arrangements, noting that they can create conflicts of interest and exposure to overlapping or above-market fees for insurers.

The NAIC did not respond directly to any institution-specific inquiries (e.g., Delaware Life’s circumstances).