# OCC Bulletin 2023-17: Third-Party Relationships: Interagency Guidance on Risk Management

Source: https://www.bankingnewsai.com/ai-regulation/documents/occ-bulletin-2023-17
Last updated: Aug 26, 2026

OCC Bulletin 2023-17, issued June 6, 2023, transmits the interagency Guidance on Third-Party Relationships: Risk Management from the OCC, Federal Reserve, and FDIC. It replaces the OCC's 2013 third-party guidance (Bulletin 2013-29) and 2020 FAQs (Bulletin 2020-10) and is the framework banks apply to AI vendors, cloud and model providers, and fintech partners. It sets a five-stage lifecycle — planning, due diligence and selection, contract negotiation, ongoing monitoring, and termination — with expectations scaled to the risk and criticality of each relationship.

## At a glance

| Field | Value |
| --- | --- |
| Authority | [OCC](https://www.bankingnewsai.com/ai-regulation/occ) |
| Type | Guidance |
| Status | In force |
| Published | Jun 6, 2023 |
| Effective | Jun 6, 2023 |
| Applies to | All OCC-supervised national banks, federal savings associations, and federal branches and agencies of foreign banks; issued jointly with the Federal Reserve and FDIC for all banking organizations |
| Official text | https://www.occ.gov/news-issuances/bulletins/2023/bulletin-2023-17.html |

## Key points

- Joint OCC/Fed/FDIC guidance; the OCC rescinded Bulletin 2013-29 and Bulletin 2020-10 (third-party FAQs).
- Applies to all business arrangements with third parties, including fintech partnerships, technology service providers, and vendors of models and AI tools.
- Risk management lifecycle: planning, due diligence and third-party selection, contract negotiation, ongoing monitoring, and termination, plus governance (oversight, documentation, independent review).
- Not all relationships carry the same risk: banks should identify 'critical activities' and apply more rigorous oversight there.
- Due diligence expectations cover information security, business resilience, subcontractors, and the third party's own risk management — the basis for questions banks ask AI and cloud providers.
- Non-compliance is not itself a basis for enforcement; it is supervisory guidance, applied through examinations.

## What changed for banks

It unified three agencies' third-party regimes and, for AI, became the operative document: most bank AI is bought rather than built, and examiners assess model and AI vendors through this lifecycle. Bulletin 2026-13 refers to vendor and third-party models and expects model-risk and third-party programs to work together; the Spring 2026 risk report also emphasises support for community banks that rely on third-party technology.

## Use cases it governs

- [Third-party & vendor AI](https://www.bankingnewsai.com/ai-regulation/by-use-case#third-party-vendors)
- [Generative & agentic AI](https://www.bankingnewsai.com/ai-regulation/by-use-case#generative-agentic-ai)
- [Model risk management](https://www.bankingnewsai.com/ai-regulation/by-use-case#model-risk)
- [AI governance (general)](https://www.bankingnewsai.com/ai-regulation/by-use-case#governance-general)
- [Cybersecurity](https://www.bankingnewsai.com/ai-regulation/by-use-case#cybersecurity)

Same interagency text issued as: [SR 23-4](https://www.bankingnewsai.com/ai-regulation/documents/fed-sr-23-4), [FDIC FIL-29-2023](https://www.bankingnewsai.com/ai-regulation/documents/fdic-fil-29-2023).

## FAQ

### Does the 2023 third-party guidance cover AI vendors?

Yes. It applies to all third-party business arrangements, including providers of AI models, cloud platforms, and fintech partners, with due diligence and ongoing monitoring scaled to the criticality of the activity.

### What did OCC Bulletin 2023-17 replace?

OCC Bulletin 2013-29 (Third-Party Relationships: Risk Management Guidance) and OCC Bulletin 2020-10 (the 2020 FAQs supplementing it).

## Which AI tools for banks does OCC Bulletin 2023-17 apply to?

- [Fraud detection](https://www.bankingnewsai.com/ai-tools/fraud-detection) — Third-party risk management
- [AML compliance](https://www.bankingnewsai.com/ai-tools/aml-compliance) — Third-party risk management
- [Conversational AI](https://www.bankingnewsai.com/ai-tools/conversational-ai) — Third-party risk management
- [Document AI](https://www.bankingnewsai.com/ai-tools/document-ai) — Third-party risk management
- [Enterprise AI assistants](https://www.bankingnewsai.com/ai-tools/enterprise-ai-assistants) — Third-party and concentration risk
- [Banking platforms](https://www.bankingnewsai.com/ai-tools/banking-platforms) — Third-party risk management

## Related documents

- [OCC Semiannual Risk Perspective, Spring 2026](https://www.bankingnewsai.com/ai-regulation/documents/occ-semiannual-risk-perspective-spring-2026) — Semiannual Risk Perspective from the National Risk Committee, Spring 2026 (May 7, 2026)
- [OCC Bulletin 2026-13](https://www.bankingnewsai.com/ai-regulation/documents/occ-bulletin-2026-13) — Model Risk Management: Revised Guidance (Apr 17, 2026)
- [Acting Comptroller Hood, 'AI in Financial Services' (Apr 2025)](https://www.bankingnewsai.com/ai-regulation/documents/occ-hood-responsible-ai-speech-2025) — Remarks by Acting Comptroller Rodney E. Hood at the National Fair Housing Alliance's Responsible AI Symposium: 'AI in Financial Services' (Apr 29, 2025)
- [OCC Bulletin 2021-19](https://www.bankingnewsai.com/ai-regulation/documents/occ-bulletin-2021-19) — Bank Secrecy Act/Anti-Money Laundering: Interagency Statement on Model Risk Management for Bank Systems Supporting BSA/AML Compliance and Request for Information (Apr 9, 2021)
- [2021 Interagency AI RFI (OCC Bulletin 2021-17)](https://www.bankingnewsai.com/ai-regulation/documents/occ-bulletin-2021-17-ai-rfi) — Request for Information and Comment on Financial Institutions' Use of Artificial Intelligence, Including Machine Learning (Mar 31, 2021)
- [OCC Bulletin 2011-12](https://www.bankingnewsai.com/ai-regulation/documents/occ-bulletin-2011-12) — Sound Practices for Model Risk Management: Supervisory Guidance on Model Risk Management (Apr 4, 2011)
- [OCC Bulletin 1997-24](https://www.bankingnewsai.com/ai-regulation/documents/occ-bulletin-1997-24) — Credit Scoring Models: Examination Guidance (May 20, 1997)
- [FCA multi-firm review: Frontier AI and cyber resilience (Sep 2026)](https://www.bankingnewsai.com/ai-regulation/documents/fca-frontier-ai-cyber-resilience-2026) — Frontier AI and Cyber Resilience (Sep 2, 2026)

Last reviewed Aug 26, 2026. Cite the official text (https://www.occ.gov/news-issuances/bulletins/2023/bulletin-2023-17.html) for the rule and this page for the summary and dates.

---

Canonical page: https://www.bankingnewsai.com/ai-regulation/documents/occ-bulletin-2023-17
Part of [BankingNewsAI](https://www.bankingnewsai.com/) — a free daily brief on AI in banking, an AI regulation tracker (41 authorities, 237 documents) and AI-strategy profiles of the 120 largest US banks. Markdown versions of every reference page: append `.md` to the page URL; index at https://www.bankingnewsai.com/llms.txt.