# The vendor a community bank can't fire

> Regulators just said the quiet part out loud: for small banks, core providers aren't vendors, they're infrastructure.
- Title: The vendor a community bank can't fire · Pymnts | Shortify
- Summary: Regulators just said the quiet part out loud: for small banks, core providers aren't vendors, they're infrastructure. Vendor risk isn't about how many…
- Keywords: banking, regulation, vendor risk, community banks, core providers, business, finance, vendor, community, bank, can't, fire
- Source: Pymnts — https://pymnts.com/legal/bank-regulation/2026/community-banks-biggest-third-party-risk-is-vendor-they-cannot-replace
- Author: PYMNTS
- Published: 2026-09-14T16:15:04+00:00
- Read time: 1 min
- Topics: banking, regulation, vendor risk, community banks, core providers, business, finance
## Two rules, one real problem
On Sept. 11, 2026 the Fed, FDIC, OCC and NCUA proposed a principles-based replacement for third-party risk guidance. A companion statement named the harder issue underneath it.
## Calibrate oversight to actual harm
The proposal drops uniform treatment of third parties. Banks would size their oversight to the magnitude and likelihood of harm a given relationship could cause, not to a fixed checklist.
## Few providers, little leverage
A handful of large firms hold most of the core provider market. Regulators said that concentration limits what a community bank can actually negotiate for.

> a significant percentage of the core provider market is represented by just a few large providers
## Not ordinary software vendors
Core providers run transaction processing, account management, payments, compliance and online banking. Agencies called them community banks' most material, complex and highest-risk relationships.

> vital to nearly all banking operations
## You can't outsource responsibility
Banks stay accountable for infrastructure they may barely control. Core processing, payments, digital banking, cloud, identity and AI can all sit outside the institution.
## Modernized, still stuck
PYMNTS Intelligence found in April that 55% of community bank decision-makers say their tech stack is fully modernized, yet many new accounts never become primary relationships.

> It's not about abandoning legacy systems, but modernizing around them intelligently
## The exit that isn't one
Regulators flagged opaque pricing, tangled billing, undefined deconversion fees and limits on outside providers integrating with core platforms as practices deserving supervisory attention.

> forced to acquiesce to suboptimal core provider relationships
## Migration is not a subscription swap
Replacing a core platform means moving data, rebuilding integrations, retesting systems and touching customers. Payments, deposits, lending and compliance all ride on the thing being replaced.
## Measure dependency, not count
The new question for executives is substitutability: how much of the bank runs on something it cannot realistically swap out, and what that dependency costs.

> These companies may contractually be vendors. Operationally, some have become part of the machinery of banking itself.
## Key takeaway

Vendor risk isn't about how many vendors you use. It's about how much of the bank you can't take back if the relationship goes bad.