The OCC's Lighter Bank Rules Cut Community-Bank Paperwork — Not the Dependence That Hurts Them

On September 11, the OCC, the Federal Reserve, the FDIC, and the NCUA jointly proposed tearing up the 2023 interagency rules on third-party risk management and replacing them with something lighter for community banks — the institutions the OCC now defines as anything up to $30 billion in assets. The pitch is straightforward: stop grading banks on "check-the-box" processes and let them focus on the material financial risks that actually matter, so they can run cheaper and partner with fintechs more freely.

For the hundreds of small banks on your watch list, this is real money. Third-party risk management is the compliance machinery a community bank builds to prove it knows what its vendors are doing — contracts, due-diligence files, monitoring schedules, annual reviews. When a bank the size of a few branches must run the same full-dress vendor program as a giant, the cost is proportionally far heavier. The OCC has spent a year peeling that back — it already cut community banks out of the full model-risk validation grind, telling them annual validation isn't required and that reasonable judgments won't draw supervisory criticism. This proposal is the same logic applied to every outside vendor, and it pairs with a joint statement meant to clarify how examiners will treat the "core service providers" most small banks run on. Less documentation, fewer exam surprises, more room to sign a profitable fintech partnership. That's a genuine lift to the efficiency ratio.

But before you read "lighter rules" as "less risk," it's worth answering who the burden was actually protecting — and what happened the last time the lights went out on a piece of this system.

The failure that wasn't a paperwork problem

In April 2024, a small fintech middleman called Synapse went bankrupt. Synapse was a "banking-as-a-service" glue company: it sat between consumer fintech apps and real FDIC-insured banks, keeping the ledger that tracked whose money was whose. It held no deposits itself and was supervised by no one, because it wasn't a bank. When it collapsed, more than 100,000 customers lost access to over $265 million, partner banks couldn't retrieve accurate balance records, and roughly $65 million to $96 million of consumer money remained unaccounted for — partly because it sat in pooled "for benefit of" accounts where no single bank's ledger could verify the end balances. The partner banks pulled into it — Evolve, Lineage — took enforcement orders and faced lawsuits, even though the actual failure belonged to a vendor outside their charts.

Nothing about the OCC's new proposal touches that structure. Non-binding, principles-based guidance doesn't give a community bank better insight into a middleware firm that holds the one ledger that matters; it doesn't force segregated accounts or reserve deposits. It says the bank should size its diligence to the risk of the relationship — which is advice, not leverage. The bank still eats the counterparty event; the only thing softened is the grading of its paperwork.

The dependence nobody is relieving

The deeper structural point is that the risk that actually damages a community bank was never its own process. It's that small banks run on a handful of vendors they can't escape. The Kansas City Fed's study of the core banking market found the "Big Three" — Fiserv, FIS, and Jack Henry — serve more than 70% of U.S. banks, with Fiserv alone running the core systems for 42% of them. Most institutions have been with the same provider for more than a decade; systems run on decades-old code that takes months to years and millions of dollars to migrate. When Fiserv suffered a cascading outage on a Friday morning in May 2025, digital banking, Zelle, and payment processing died across hundreds of community banks and credit unions at once — on payday, when members couldn't pay rent or buy groceries.

That is the exposure that matters, and it's also the one place the new rule is thinnest. The "clarity" being added on core service providers is a joint statement about how examiners will think about the work — the OCC's own comptroller has called the negotiating position of a small bank against its processor "very uneven" — but none of it is an enforceable standard. The regulators have historically been far slower to act against a core provider for a compliance failure than against the bank that used it. The guidance explicitly says non-compliance won't result in supervisory action. It relieves the banks of documentation duty without handing them, or their supervisors, any new tool against the concentrated vendor that sits beneath half the industry.

Read the incentives and the direction is clear. Community banks win a lower overhead and an easier path to fintech revenue — good for the stock on a margin basis. Fiserv, FIS, and Jack Henry win even more: banks stay locked into their cores, and oversight pressure on those providers stays framed as soft guidance rather than hard rules. The party that loses is anyone who assumed "lighter third-party rules" was a stronger system. It's the opposite — a system tuned to be gentle, where the risk that actually removed $265 million of customer money a couple of years ago still lives in the unregulated seam that the lighter rule doesn't reach.