# SR 23-4: Interagency Guidance on Third-Party Relationships: Risk Management

Source: https://www.bankingnewsai.com/ai-regulation/documents/fed-sr-23-4
Last updated: Aug 26, 2026

SR 23-4, issued June 7, 2023 by the Federal Reserve, OCC, and FDIC, is the interagency guidance on managing risk from third-party relationships and is the framework examiners use when a bank buys AI tools, cloud-hosted models, or foundation-model access from vendors. It replaces the Fed's 2013 outsourcing guidance (SR 13-19), applies to all supervised banking organizations regardless of size, and sets out a lifecycle of planning, due diligence, contract negotiation, ongoing monitoring, and termination. Vice Chair Bowman said in May 2026 that supervisors are assessing how these expectations apply to vendor-provided AI.

## At a glance

| Field | Value |
| --- | --- |
| Authority | [Federal Reserve](https://www.bankingnewsai.com/ai-regulation/federal-reserve) |
| Type | Guidance |
| Status | In force |
| Published | Jun 7, 2023 |
| Effective | Jun 7, 2023 |
| Applies to | All banking organizations supervised by the Federal Reserve, regardless of size (issued jointly with the OCC and FDIC, replacing each agency's prior outsourcing guidance including SR 13-19) |
| Official text | https://www.federalreserve.gov/supervisionreg/srletters/SR2304.htm |

## Key points

- Covers the full lifecycle: planning, due diligence and third-party selection, contract negotiation, ongoing monitoring, and termination
- Applies to all third-party relationships, including fintech partnerships, cloud providers, and 'new or novel structures', with risk management tailored to the criticality of the activity
- Places responsibility on the board and management: a bank's use of third parties does not diminish its obligation to operate safely and in compliance with law
- Expects due diligence on a third party's information security, resilience, subcontracting, and — for models — validation consistent with model risk management guidance
- Requires contracts to address performance measures, data access and ownership, audit rights, incident notification, and termination
- Does not impose new legal requirements; the agencies committed to additional resources for community banks, delivered as a May 2024 guide on third-party risk for community banks

## What changed for banks

It replaced three inconsistent agency frameworks with one lifecycle-based standard and dropped the old distinction between 'outsourcing' and other vendor relationships. For AI specifically, it is the document that governs foundation-model vendor dependence, cloud-hosted ML platforms, and fintech AI partnerships — the risks the 2026 model risk guidance explicitly leaves to broader risk management. Banks pair SR 23-4 with SR 26-2 to cover vendor AI end to end.

## Use cases it governs

- [Third-party & vendor AI](https://www.bankingnewsai.com/ai-regulation/by-use-case#third-party-vendors)
- [Generative & agentic AI](https://www.bankingnewsai.com/ai-regulation/by-use-case#generative-agentic-ai)
- [Cybersecurity](https://www.bankingnewsai.com/ai-regulation/by-use-case#cybersecurity)
- [AI governance (general)](https://www.bankingnewsai.com/ai-regulation/by-use-case#governance-general)
- [Model risk management](https://www.bankingnewsai.com/ai-regulation/by-use-case#model-risk)

Same interagency text issued as: [OCC Bulletin 2023-17](https://www.bankingnewsai.com/ai-regulation/documents/occ-bulletin-2023-17), [FDIC FIL-29-2023](https://www.bankingnewsai.com/ai-regulation/documents/fdic-fil-29-2023).

## FAQ

### Does SR 23-4 apply to a bank's use of a large-language-model vendor?

Yes. SR 23-4 covers all third-party relationships, and the Fed has said it is assessing how third-party risk-management expectations apply to vendor-provided AI tools. Due diligence, contract terms, and ongoing monitoring should be proportionate to how critical the AI tool is.

### Does SR 23-4 apply to community banks?

Yes. The guidance applies to all banking organizations supervised by the Fed, OCC, and FDIC regardless of size, with the expectation that risk management is scaled to the bank's complexity and the risk of the relationship.

## Which AI tools for banks does SR 23-4 apply to?

- [Fraud detection](https://www.bankingnewsai.com/ai-tools/fraud-detection) — Third-party risk management
- [AML compliance](https://www.bankingnewsai.com/ai-tools/aml-compliance) — Third-party risk management
- [Document AI](https://www.bankingnewsai.com/ai-tools/document-ai) — Third-party risk management
- [Enterprise AI assistants](https://www.bankingnewsai.com/ai-tools/enterprise-ai-assistants) — Third-party and concentration risk
- [Banking platforms](https://www.bankingnewsai.com/ai-tools/banking-platforms) — Third-party risk management

## Related documents

- [Cook: Opportunities and Risks of AI (May 2026)](https://www.bankingnewsai.com/ai-regulation/documents/fed-cook-speech-ai-economy-financial-system-2026) — The Opportunities and Risks AI Presents for the Economy and Financial System — Governor Lisa D. Cook (May 27, 2026)
- [Bowman: AI in the Financial System (May 2026)](https://www.bankingnewsai.com/ai-regulation/documents/fed-bowman-speech-ai-financial-system-2026) — Artificial Intelligence in the Financial System — Vice Chair for Supervision Michelle W. Bowman (May 1, 2026)
- [SR 26-2](https://www.bankingnewsai.com/ai-regulation/documents/fed-sr-26-2) — Revised Guidance on Model Risk Management (Apr 17, 2026)
- [2021 BSA/AML Model Risk Statement](https://www.bankingnewsai.com/ai-regulation/documents/fed-bsa-aml-model-risk-statement-2021) — Interagency Statement on Model Risk Management for Bank Systems Supporting BSA/AML Compliance (Apr 9, 2021)
- [2021 Interagency AI RFI](https://www.bankingnewsai.com/ai-regulation/documents/fed-interagency-ai-rfi-2021) — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 31, 2021)
- [SR 11-7](https://www.bankingnewsai.com/ai-regulation/documents/fed-sr-11-7) — Supervisory Guidance on Model Risk Management (Apr 4, 2011)
- [FCA multi-firm review: Frontier AI and cyber resilience (Sep 2026)](https://www.bankingnewsai.com/ai-regulation/documents/fca-frontier-ai-cyber-resilience-2026) — Frontier AI and Cyber Resilience (Sep 2, 2026)
- [FSB Chair's letter to G20 (Aug 2026)](https://www.bankingnewsai.com/ai-regulation/documents/fsb-chair-letter-g20-august-2026) — FSB Chair's letter to G20 Finance Ministers and Central Bank Governors: August 2026 — risks arising from frontier artificial intelligence models (Aug 31, 2026)

Last reviewed Aug 26, 2026. Cite the official text (https://www.federalreserve.gov/supervisionreg/srletters/SR2304.htm) for the rule and this page for the summary and dates.

---

Canonical page: https://www.bankingnewsai.com/ai-regulation/documents/fed-sr-23-4
Part of [BankingNewsAI](https://www.bankingnewsai.com/) — a free daily brief on AI in banking, an AI regulation tracker (41 authorities, 237 documents) and AI-strategy profiles of the 120 largest US banks. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.