# FDIC FIL-29-2023: Interagency Guidance on Third-Party Relationships: Risk Management

Source: https://www.bankingnewsai.com/ai-regulation/documents/fdic-fil-29-2023
Last updated: Aug 26, 2026

FIL-29-2023, issued June 6, 2023, transmits the final Interagency Guidance on Third-Party Relationships: Risk Management from the FDIC, Federal Reserve, and OCC. It replaces the FDIC's 2008 third-party risk guidance (FIL-44-2008) and withdraws the 2016 proposed third-party lending guidance (FIL-50-2016), setting one risk-based framework across the life cycle of a third-party relationship: planning, due diligence and selection, contract negotiation, ongoing monitoring, and termination. It is the document FDIC examiners apply when a bank buys AI models, fraud tools, or chatbots from a vendor.

## At a glance

| Field | Value |
| --- | --- |
| Authority | [FDIC](https://www.bankingnewsai.com/ai-regulation/fdic) |
| Type | Guidance |
| Status | In force |
| Published | Jun 6, 2023 |
| Effective | Jun 6, 2023 |
| Applies to | All FDIC-supervised banking organizations, alongside OCC- and Federal Reserve-supervised institutions |
| Official text | https://www.fdic.gov/news/financial-institution-letters/2023/fil23029.html |

## Key points

- Issued June 6, 2023 jointly with the Federal Reserve and OCC; published in the Federal Register June 9, 2023.
- Replaces FDIC FIL-44-2008 (Guidance for Managing Third-Party Risk) and withdraws the 2016 proposed third-party lending guidance (FIL-50-2016).
- Five life-cycle stages: planning, due diligence and third-party selection, contract negotiation, ongoing monitoring, and termination.
- Using a third party does not diminish a bank's responsibility to operate safely and soundly and to comply with law, including consumer protection and customer-information security.
- Expectations scale to the level of risk, complexity, and size of the banking organization and the criticality of the activity.
- Followed in May 2024 by the interagency 'Third-Party Risk Management: A Guide for Community Banks' to help smaller banks apply it.

## What changed for banks

Before 2023 each agency had its own third-party guidance; the FDIC's dated from 2008. The interagency guidance gave banks one framework and made explicit that fintech and technology partnerships, including vendor-supplied models, fall inside it. In practice it is the basis on which FDIC examiners ask a community bank to show due diligence, contractual rights, and monitoring for AI tools it did not build.

## Use cases it governs

- [Third-party & vendor AI](https://www.bankingnewsai.com/ai-regulation/by-use-case#third-party-vendors)
- [AI governance (general)](https://www.bankingnewsai.com/ai-regulation/by-use-case#governance-general)
- [Fraud detection](https://www.bankingnewsai.com/ai-regulation/by-use-case#fraud)
- [Customer-facing chatbots](https://www.bankingnewsai.com/ai-regulation/by-use-case#customer-chatbots)

Same interagency text issued as: [SR 23-4](https://www.bankingnewsai.com/ai-regulation/documents/fed-sr-23-4), [OCC Bulletin 2023-17](https://www.bankingnewsai.com/ai-regulation/documents/occ-bulletin-2023-17).

## FAQ

### Does the third-party guidance cover AI vendors?

Yes. It applies to all business arrangements with third parties, so a vendor supplying an AI underwriting, fraud-detection, or chatbot tool is covered. The bank must perform due diligence, negotiate appropriate contract terms, and monitor performance commensurate with the risk and criticality of the activity.

### Is there a simpler version for community banks?

Yes. In May 2024 the FDIC, Federal Reserve, and OCC issued 'Third-Party Risk Management: A Guide for Community Banks,' which walks smaller banks through the 2023 guidance without creating new requirements.

## Which AI tools for banks does FDIC FIL-29-2023 apply to?

- [Fraud detection](https://www.bankingnewsai.com/ai-tools/fraud-detection) — Third-party risk management: [Feedzai](https://www.bankingnewsai.com/vendors/feedzai) · [Featurespace](https://www.bankingnewsai.com/vendors/featurespace) · [BioCatch](https://www.bankingnewsai.com/vendors/biocatch) · [Sardine](https://www.bankingnewsai.com/vendors/sardine) · [Socure](https://www.bankingnewsai.com/vendors/socure) · [Alloy](https://www.bankingnewsai.com/vendors/alloy) · [Pindrop](https://www.bankingnewsai.com/vendors/pindrop) · [NICE Actimize](https://www.bankingnewsai.com/vendors/nice-actimize) · [Hawk](https://www.bankingnewsai.com/vendors/hawk) · [Unit21](https://www.bankingnewsai.com/vendors/unit21) · [Zest AI](https://www.bankingnewsai.com/vendors/zest-ai) · [Provenir](https://www.bankingnewsai.com/vendors/provenir) · [FICO](https://www.bankingnewsai.com/vendors/fico)
- [Conversational AI](https://www.bankingnewsai.com/ai-tools/conversational-ai) — Third-party risk management: [Kasisto](https://www.bankingnewsai.com/vendors/kasisto) · [Glia](https://www.bankingnewsai.com/vendors/glia) · [interface.ai](https://www.bankingnewsai.com/vendors/interface-ai) · [Talkdesk](https://www.bankingnewsai.com/vendors/talkdesk) · [Personetics](https://www.bankingnewsai.com/vendors/personetics) · [Eltropy](https://www.bankingnewsai.com/vendors/eltropy) · [Backbase](https://www.bankingnewsai.com/vendors/backbase)
- [Banking platforms](https://www.bankingnewsai.com/ai-tools/banking-platforms) — Third-party risk management: [Fiserv](https://www.bankingnewsai.com/vendors/fiserv) · [FIS](https://www.bankingnewsai.com/vendors/fis) · [Jack Henry](https://www.bankingnewsai.com/vendors/jack-henry) · [Q2](https://www.bankingnewsai.com/vendors/q2) · [nCino](https://www.bankingnewsai.com/vendors/ncino) · [Temenos](https://www.bankingnewsai.com/vendors/temenos) · [Backbase](https://www.bankingnewsai.com/vendors/backbase) · [Alkami](https://www.bankingnewsai.com/vendors/alkami)

## Related documents

- [Hill House oversight testimony (Jun 2026)](https://www.bankingnewsai.com/ai-regulation/documents/fdic-testimony-oversight-prudential-regulators-2026) — Statement of Chairman Travis Hill: Oversight of Prudential Regulators (Jun 4, 2026)
- [FDIC FIL-15-2026](https://www.bankingnewsai.com/ai-regulation/documents/fdic-fil-15-2026) — Agencies Revise the Interagency Model Risk Management Guidance (Apr 17, 2026)
- [FDIC House testimony on AI and innovation (Mar 2026)](https://www.bankingnewsai.com/ai-regulation/documents/fdic-testimony-innovation-speed-of-markets-2026) — Innovation at the Speed of Markets: How Regulators Keep Pace with Technology (Mar 26, 2026)
- [FDIC 2025 Report on Cybersecurity and Resilience](https://www.bankingnewsai.com/ai-regulation/documents/fdic-cybersecurity-resilience-report-2025) — 2025 Report on Cybersecurity and Resilience (Jul 14, 2025)
- [Hill 'Charting a New Course' speech](https://www.bankingnewsai.com/ai-regulation/documents/fdic-charting-new-course-speech-2025) — Charting a New Course: Preliminary Thoughts on FDIC Policy Issues (Jan 10, 2025)
- [FDIC 2024 Risk Review](https://www.bankingnewsai.com/ai-regulation/documents/fdic-risk-review-2024) — 2024 Risk Review — Section 5: Operational and Cyber Risks (May 22, 2024)
- [FDIC FIL-27-2021](https://www.bankingnewsai.com/ai-regulation/documents/fdic-fil-27-2021) — Interagency Statement on Model Risk Management for Bank Systems Supporting BSA/AML and OFAC Compliance (Apr 9, 2021)
- [FDIC FIL-20-2021](https://www.bankingnewsai.com/ai-regulation/documents/fdic-fil-20-2021) — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 29, 2021)

Last reviewed Aug 26, 2026. Cite the official text (https://www.fdic.gov/news/financial-institution-letters/2023/fil23029.html) for the rule and this page for the summary and dates.

---

Canonical page: https://www.bankingnewsai.com/ai-regulation/documents/fdic-fil-29-2023
Part of [BankingNewsAI](https://www.bankingnewsai.com/) — a free daily brief on AI in banking, an AI regulation tracker (41 authorities, 237 documents) and AI-strategy profiles of the 120 largest US banks. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.