SR 23-4, issued June 7, 2023 by the Federal Reserve, OCC, and FDIC, is the interagency guidance on managing risk from third-party relationships and is the framework examiners use when a bank buys AI tools, cloud-hosted models, or foundation-model access from vendors. It replaces the Fed's 2013 outsourcing guidance (SR 13-19), applies to all supervised banking organizations regardless of size, and sets out a lifecycle of planning, due diligence, contract negotiation, ongoing monitoring, and termination. Vice Chair Bowman said in May 2026 that supervisors are assessing how these expectations apply to vendor-provided AI.
| Document | SR 23-4 — Interagency Guidance on Third-Party Relationships: Risk Management |
| Issued by | Board of Governors of the Federal Reserve System |
| Type | Guidance |
| Status | In force |
| Published | Jun 7, 2023 |
| Effective | Jun 7, 2023 |
| Applies to | All banking organizations supervised by the Federal Reserve, regardless of size (issued jointly with the OCC and FDIC, replacing each agency's prior outsourcing guidance including SR 13-19) |
| Also issued as | OCC Bulletin 2023-17, FDIC FIL-29-2023 |
| Official source | federalreserve.gov ↗ |
| Use cases | Third-party & vendor AI · Generative & agentic AI · Cybersecurity · AI governance (general) · Model risk management |
What are the key points of SR 23-4?
- Covers the full lifecycle: planning, due diligence and third-party selection, contract negotiation, ongoing monitoring, and termination
- Applies to all third-party relationships, including fintech partnerships, cloud providers, and 'new or novel structures', with risk management tailored to the criticality of the activity
- Places responsibility on the board and management: a bank's use of third parties does not diminish its obligation to operate safely and in compliance with law
- Expects due diligence on a third party's information security, resilience, subcontracting, and — for models — validation consistent with model risk management guidance
- Requires contracts to address performance measures, data access and ownership, audit rights, incident notification, and termination
- Does not impose new legal requirements; the agencies committed to additional resources for community banks, delivered as a May 2024 guide on third-party risk for community banks
What did SR 23-4 change for banks?
It replaced three inconsistent agency frameworks with one lifecycle-based standard and dropped the old distinction between 'outsourcing' and other vendor relationships. For AI specifically, it is the document that governs foundation-model vendor dependence, cloud-hosted ML platforms, and fintech AI partnerships — the risks the 2026 model risk guidance explicitly leaves to broader risk management. Banks pair SR 23-4 with SR 26-2 to cover vendor AI end to end.
Does SR 23-4 apply to a bank's use of a large-language-model vendor?
Yes. SR 23-4 covers all third-party relationships, and the Fed has said it is assessing how third-party risk-management expectations apply to vendor-provided AI tools. Due diligence, contract terms, and ongoing monitoring should be proportionate to how critical the AI tool is.
Does SR 23-4 apply to community banks?
Yes. The guidance applies to all banking organizations supervised by the Fed, OCC, and FDIC regardless of size, with the expectation that risk management is scaled to the bank's complexity and the risk of the relationship.
| Date | Document | Status |
|---|---|---|
| May 27, 2026 | Cook: Opportunities and Risks of AI (May 2026) — The Opportunities and Risks AI Presents for the Economy and Financial System — Governor Lisa D. Cook | Final |
| May 1, 2026 | Bowman: AI in the Financial System (May 2026) — Artificial Intelligence in the Financial System — Vice Chair for Supervision Michelle W. Bowman | Final |
| Apr 17, 2026 | SR 26-2 — Revised Guidance on Model Risk Management | In force |
| Apr 9, 2021 | 2021 BSA/AML Model Risk Statement — Interagency Statement on Model Risk Management for Bank Systems Supporting BSA/AML Compliance | Superseded |
| Mar 31, 2021 | 2021 Interagency AI RFI — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning | Final |
| Apr 4, 2011 | SR 11-7 — Supervisory Guidance on Model Risk Management | Superseded |
Follow every document these regulators publish
6 curated AI stories for banking executives · Every morning · Free
Subscribe to BankingNewsAI →