Regulators Are Rewriting Bank Vendor Rules — But the Headline Misses the Point

On Friday, the Federal Reserve, FDIC, OCC, and NCUA unveiled a proposal to rewrite how banks manage third-party vendor risk. The headline sounds like another round of compliance costs piling onto the financial industry.

If you hold or watch banking software stocks — FIS, Fiserv, Jack Henry — your first instinct may be to bristle. These companies are the third parties the regulators are talking about. More scrutiny means more friction, right?

But reading past the headline reveals a different story. The proposal is not a new rule. It is non-binding guidance designed to replace a 2023 version that had been interpreted too broadly. And the companion document issued the same day actually tilts the scales in a direction that matters more for small banks than for the vendor giants — yet still changes the economics in ways investors should understand.

Here is what happened, what it means, and where the real investment implications lie.

The guidance is a correction, not a crackdown

The federal agencies released two documents on September 11, 2026. The first is a proposed rewrite of the 2023 Interagency Guidance on Third-Party Relationships. The agencies acknowledged that the 2023 guidance had been "frequently interpreted in an overly broad manner, lacking sufficient focus on tailoring risk management principles." The new proposal pushes financial institutions to calibrate their vendor oversight to the actual risk level of each relationship rather than treating every contract the same way.

The second document — a joint statement on community banks' engagement with core service providers — pledges increased scrutiny of the vendors themselves. The agencies said they will examine whether core providers' business practices "unreasonably limit" community banks from conducting due diligence or negotiating contract terms. They named three specific areas: transparency in audits and incident reporting, contract features like opaque pricing and deconversion fees, and technology investments in cybersecurity and operational resilience.

A 60-day comment period will run from the guidance's publication in the Federal Register. The guidance is principles-based and non-binding; non-compliance does not trigger supervisory action.

The signal here is calibration, not escalation. Regulators are trying to fix a framework that had become too rigid for the reality of modern technology stacks, where banks face hundreds of vendor relationships and increasingly concentrated market power.

Who are the "core providers" in question?

The agencies' concern centers on community banking organizations (CBOs) and the companies that run their backbones: transaction processing, account management, payments, online banking, and compliance systems.

This market is dominated by three companies. Fiserv serves roughly 42% of U.S. banks, Jack Henry about 21%, and FIS around 9%, with the three collectively serving more than 70%, according to a 2022 survey analyzed by the Federal Reserve Bank of Kansas City. Credit union penetration is also significant — close to 50% combined.

The concentration creates the exact dynamic the regulators are targeting. Banks have reported chronic dissatisfaction with the Big Three: a 2022 American Bankers Association survey found 46% of banks using these providers were dissatisfied, compared with 27% using smaller vendors. Complaints center on poor customer support, high upgrade costs, opaque billing, and switching fees that lock banks in. One community bank even filed a lawsuit against FIS over coercive renewal tactics.

The joint statement gives regulators a framework to push back. Core providers that restrict transparency, hide behind complex billing, or underinvest in security could face heightened examination. The agencies also signaled they may treat core providers as "institution-affiliated parties" under the Federal Deposit Insurance Act — meaning enforcement action can target the provider directly, not just the bank.

That is a meaningful shift. Until now, vendor accountability flowed through the bank's compliance obligations. The statement makes the vendors themselves a subject of regulatory attention.

What this means for the stocks

FIS is the most dramatic case study. The stock has fallen approximately 43% over the past year, trading near $38 after hitting a 52-week high above $69. At current levels, FIS trades at a trailing P/E around 5.8x with an EV/EBITDA of roughly 9.7x and a dividend yield near 4.5%. The stock is down roughly 14% over the past month alone.

The decline reflects multiple headwinds. FIS spun off its Worldpay merchant processing business in early 2023, transitioning to a leaner, more focused model. The market has struggled to re-rate the company post-separation, and broader concerns about banking sector demand and regulatory risk have weighed on sentiment.

Here is the critical question: does today's proposal change the fundamental picture for these companies, or is it more of a framework clarification that the market may be overreacting to?

For the Big Three, the practical impact is threefold.

First, the scrutiny on contract practices — deconversion fees, opaque billing, restrictive terms — could force the companies to continue the unbundle-and-simplify trend they have already started. FIS launched a simplified subscription model for community banks. Fiserv acquired Finxact to offer a cloud-native platform. Jack Henry has been unbundling services and opening API integrations with over 200 third-party vendors. The regulatory pressure accelerates, rather than initiates, this shift.

Second, the IAP designation raises the stakes for compliance and security investments. A core provider with repeated security incidents or inadequate audit transparency could face direct regulatory action. That is a cost, but it is also a competitive differentiator — well-managed providers with strong security programs gain an advantage over smaller, less sophisticated competitors.

Third, the 60-day comment period gives industry groups a chance to shape the final language. The American Bankers Association, Independent Community Banks of America, the American Fintech Council, and others have already submitted reform proposals. The FDIC is also exploring a voluntary certification program through a new industry standards body. The regulatory trajectory is toward clarity and standardization, not punitive overreach.

Where the investment edge lies

The market tends to price regulatory headlines as uniform headwinds. This proposal does not fit that template. It is a calibration of an overly broad framework, combined with targeted scrutiny of vendor business practices that have been a documented problem for years.

For FIS specifically, the stock's 43% decline has created a wide gap between price and the underlying business. A $19.7 billion market cap, a 5.8x trailing P/E, and a 4.5% dividend yield are not the multiples of a company in structural decline — they are the multiples of a profitable, cash-generating business the market has stopped believing in. Whether that skepticism is justified depends on the post-Worldpay execution trajectory, not on a proposed piece of non-binding guidance.

For Jack Henry, which trades around $160-$170 and has maintained strong customer satisfaction ratings, the regulatory attention on core providers could actually reinforce its competitive position. The company's focus on API openness and unbundle strategies aligns directly with the direction regulators are pushing.

The broader opportunity is in the TPRM ecosystem itself. Third-party risk management platforms — companies like Bitsight, OneTrust, and ProcessUnity — serve as the tools banks use to manage these relationships. A more structured, calibrated regulatory framework could drive increased adoption of professional TPRM platforms, especially among community banks that have historically relied on manual processes.

What to weigh before acting

The proposal is not final. The 60-day comment period could produce significant changes in scope, language, or emphasis, and the final rulemaking timeline is unclear.

The potential institution-affiliated party (IAP) designation of core providers is the most consequential element for vendor stocks. If regulators pursue enforcement actions against companies that have engaged in the restrictive practices the agencies named — opaque billing, coercive renewal tactics, inadequate transparency — the market could reassess which providers face genuine risk versus which ones have already adapted.

And there is a simple test investors can apply: this is non-binding guidance. If a company is generating strong free cash flow, delivering on its modernization roadmap, and maintaining transparent contracts, the proposal is not a threat — it is tailwind that disadvantages weaker competitors who have not cleaned up their business practices.

The market's knee-jerk reaction to "more regulation" misses the fact that this particular regulation was requested by the industry itself. Community banks have been asking for accountability from their core providers for years. The agencies are responding. That is not a headwind for the incumbents — it is a test of whether their moat is built on lock-in or on genuine value.