The vendor a community bank can't fire
Regulators just said the quiet part out loud: for small banks, core providers aren't vendors, they're infrastructure.
In brief
Regulators just said the quiet part out loud: for small banks, core providers aren't vendors, they're infrastructure. Vendor risk isn't about how many vendors you use. It's about how much of the bank you can't take back if the relationship goes bad. Originally reported by Pymnts.
Two rules, one real problem
On Sept. 11, 2026 the Fed, FDIC, OCC and NCUA proposed a principles-based replacement for third-party risk guidance. A companion statement named the harder issue underneath it.
Calibrate oversight to actual harm
The proposal drops uniform treatment of third parties. Banks would size their oversight to the magnitude and likelihood of harm a given relationship could cause, not to a fixed checklist.
Few providers, little leverage
A handful of large firms hold most of the core provider market. Regulators said that concentration limits what a community bank can actually negotiate for.
“a significant percentage of the core provider market is represented by just a few large providers”
Not ordinary software vendors
Core providers run transaction processing, account management, payments, compliance and online banking. Agencies called them community banks' most material, complex and highest-risk relationships.
“vital to nearly all banking operations”
You can't outsource responsibility
Banks stay accountable for infrastructure they may barely control. Core processing, payments, digital banking, cloud, identity and AI can all sit outside the institution.
Modernized, still stuck
PYMNTS Intelligence found in April that 55% of community bank decision-makers say their tech stack is fully modernized, yet many new accounts never become primary relationships.
“It's not about abandoning legacy systems, but modernizing around them intelligently”
The exit that isn't one
Regulators flagged opaque pricing, tangled billing, undefined deconversion fees and limits on outside providers integrating with core platforms as practices deserving supervisory attention.
“forced to acquiesce to suboptimal core provider relationships”
Migration is not a subscription swap
Replacing a core platform means moving data, rebuilding integrations, retesting systems and touching customers. Payments, deposits, lending and compliance all ride on the thing being replaced.
Measure dependency, not count
The new question for executives is substitutability: how much of the bank runs on something it cannot realistically swap out, and what that dependency costs.
“These companies may contractually be vendors. Operationally, some have become part of the machinery of banking itself.”
The key point
Vendor risk isn't about how many vendors you use. It's about how much of the bank you can't take back if the relationship goes bad.
