September 2026 Vendor Management News

Third-party risk doesn't take a month off. Here's what's shaping vendor management, breach response, and AI governance in financial services this September.

Recently Added Articles as of September 17

Regulators propose replacing the 2023 third-party risk guidance. The Federal Reserve, FDIC, OCC, and NCUA proposed guidance that would replace the 2023 interagency guidance with a principles-based framework, asking institutions to weigh magnitude and harm across third-party relationships. Comments are due 60 days after publication in the Federal Register. The Fed, FDIC, and OCC separately addressed community banks' engagement with core service providers, including the agencies' authority where a core provider causes a bank to engage in unsafe or unsound practices.

Vendors that look safe alone can fail together. NYDFS issued guidance directing every licensed firm to identify where several critical operations run through one outside provider, assess concentration risk, and work out how an incident at a single third party would reach other systems and critical business functions. The shared dependencies it names are common infrastructure, cloud providers, software platforms and managed service providers. The letter creates no new obligations under Part 500 and instead describes how examiners read an existing one, and it reaches banks, credit unions, insurers, mortgage brokers, money transmitters and virtual currency companies. Examiners keep finding the same gaps, including outdated asset inventories, untracked customer data locations, and risk assessments that leave out outside service providers and cloud environments.

A vendor can pass every review and still hold the credit union back. Vendor oversight built to confirm compliance verifies that due diligence happened without ever asking whether a vendor can perform under the weight of what leadership is asking of it. Risk also accumulates in the connections between vendors, business units, and internal teams, while reviews triggered by calendars and contract renewals miss dependencies that deepen after onboarding. One credit union renewed its digital banking platform every three years out of habit and learned the platform was the bottleneck on its deposit growth target only when someone compared its twelve-minute, seven-step account opening against competitors who had gotten under three. The vendor never missed a service level commitment, so nothing in the program flagged it.

Trade processing vendor outage put brokers back on the phone. Twice in under a week, advisors at Wells Fargo lost order entry on their desktop platform because of an outage at BetaNXT, which handles trade processing and tax reporting. Brokers entered orders manually by phone and email until service was restored on Sept 10.

Fraudulent requests from a government email domain compromised customer data. A fintech operating as a bank in more than 30 countries disclosed sensitive customer information to an unauthorized party after receiving fraudulent information requests sent from a legitimate government agency email domain. Exposed data included dates of birth, postal and email addresses, phone numbers. and copies of passports and driver's licenses.

Thousands of phishing emails sent through a breached marketing vendor. A compromise at Brevo, the email marketing platform crypto wallet company Trezor uses for newsletters, let attackers send roughly 347,000 messages that appeared as though they came from Trezor and asked recipients for their wallet backup passwords. Brevo said attackers reached 138 customer accounts by abusing a flaw that left their access improperly scoped, extending it to every organization those accounts could touch. This is Trezor's second vendor failure in a month after the ShipMonk shipping breach.

Remote support and software delivery tools lead CISA's newest exploited list. ConnectWise ScreenConnect, GitLab Community and Enterprise Edition, and JFrog Artifactory were added to CISA's Known Exploited Vulnerabilities catalog on Sept 11. All three sit inside the software delivery and remote support stacks that third parties use to reach client environments. Exploitation at a service provider running any of them can reach its clients without ever touching their perimeter.

A January 2025 vendor breach reaches a settlement. Data processor Conduent reached an agreement in principle to settle the consolidated class action over its January 2025 data breach that exposed the healthcare data of at least $25 million people. The plaintiffs are individuals who received notification letters after the incident, not Conduent's own clients. Settlement paperwork is not final and the court has not approved it. Conduent carries cyber insurance and does not expect a material financial impact.

Recently Added Articles as of September 10

Core banking provider breached through a phone call. Jack Henry confirmed a breach that exposed personally identifiable information after attackers used voice phishing to access a small, non-production area of its internal systems. Core platforms and daily processing weren't touched, and the company said its controls caught and contained the activity. All 7,200-plus clients were notified, with the exposure affecting fewer than 10 of them. Jack Henry refused an extortion demand and hasn't said how many individuals were affected, what data was taken, or when the attack occurred.

Court records across 11 states exposed through a case management vendor. Thomson Reuters detected activity affecting its C-Track case management product and disclosed that appellate courts in 11 US states, the US Virgin Islands, and three Ontario courts were affected. Exposed records may contain names, Social Security numbers, driver's license numbers, medical information, and health insurance information, plus material that was confidential, redacted, or sealed. Thomson Reuters said the courts' networks and data security weren’t the cause.

FBI opens a probe into 153 million stolen driver's license scans. Scans of 153 million North American driver's licenses were offered for sale on a Russian cybercrime forum, along with millions of identification cards and travel documents. The trove traced back to IDscan.net, an identity verification service whose clients included Hertz. IDscan has issued no public statement and has pulled its client logos and case studies from its website.

Banks are handing their AI strategy to their vendors. Regulators updated model risk guidance in April and left generative and agentic AI out of scope, calling it too novel to cover. That means the tools banks use to validate models don't apply to the AI vendors are shipping right now. It also means even a bank that wanted to check anyway would struggle: vendors update or swap the underlying model faster than most banks can clear an internal review. The FDIC has floated a voluntary standard-setting body for fintechs, but voluntary means banks still own the vetting themselves.

Credit unions rate AI model risk far lower than banks do. Only 18% of credit unions call AI model risk a critical or high threat, against 62% at national banks, 54% at midsize banks, and 50% at community banks. That concern gap doesn't show up in readiness, where 71% of credit unions say they aren't prepared and national banks report 73%. Part of it is an assumption that the vendor supplying the model is managing the risk. With vendors not yet commissioning external model validation audits, one interim approach is requiring them to attest in writing that their models are free of bias and violate no regulations.

OCC and FDIC narrow what counts as an unsafe or unsound practice. OCC and FDIC finalized a rule, effective November 2, that defines "unsafe or unsound practice" for the first time: a practice must violate generally accepted standards of prudent operation and either threaten the institution's financial condition or pose a material risk to the Deposit Insurance Fund. The rule also raises the bar for Matters Requiring Attention and separates supervisory observations from MRAs, so observations create no obligation to act or brief the board. Banks should expect fewer TPRM findings framed as reputation risk and more scrutiny reserved for gaps that tie to financial exposure.

CISA flagged three vendor tools this week. Three vendor-side tools landed on CISA's exploited vulnerabilities list in the past ten days: N-able N-central (a console IT service providers use to manage their clients' networks remotely), SonicWall SMA1000 (secures remote access), and PaperCut (print management software). It's a reminder that your third-party risk exposure moves faster than your annual review cycle does. Make sure you have clear sight of your vendors’ critical fourth parties.

CISA cuts six free assessments. The Cybersecurity and Infrastructure Security Agency (CISA) is ending six free assessment services for critical infrastructure operators, including Ransomware Readiness Assessments and External Dependencies Management Assessments, which covered supply chain and vendor dependencies. The change follows the loss of roughly a third of the agency's workforce.

Recently Added Articles as of September 3

Global watchdog warns G20 that AI could outpace bank cyber defenses. Financial Stability Board chair Andrew Bailey told G20 finance ministers that frontier AI models could change the speed, scale, and economics of cyber risk faster than the financial sector's defenses can adapt. His letter singles out the sector's reliance on a small number of concentrated third-party technology providers, warning that an incident at any one of them could undermine confidence system-wide. Many jurisdictions still lack rules for deploying advanced AI models, and Bailey called for internationally coordinated standards on safe model release.

Vendor oversight must go beyond third-party vendors. More capable AI models are expected to surface a new crop of software flaws, and the pressure is already showing: 76% of executives saw more cyberattacks last year, and 63% call AI-introduced code vulnerabilities their top emerging threat. Ask vendors who their vendors are. Build a decision matrix so IT can act quickly during an incident.

Community banks benefit from Treasury’s AI resources. Two AI resources released by the Treasury in February are useful tools for community banks. A shared AI glossary makes it easier to communicate with examiners, while a risk-based framework helps banks assess whether their AI controls align with their risks and ask the right questions of vendors using AI. Those with greater adoption require stronger controls.

Credit unions: a static ERM plan is its own risk. Cyber threats, economic shifts, and rising disaster exposure move faster than a framework built to satisfy examiners. Four things make ERM strategic for credit unions. Assess risks regularly, and stress test the functions you can't operate without. Define your risk appetite so tolerances differ by risk type. Assign clear roles from the board down to the front line. Monitor against predefined triggers so a breach gets a fast response. AI belongs inside that framework, not beside it.

Benefits vendor took eight months to notify after a ransomware breach. Paylogix, a third-party administrator that processes premium billing and voluntary benefits for insurance carriers and employers, discovered a breach in November 2025 but didn't notify its insurance-carrier clients until July 2026. Stolen data includes Social Security numbers, health and financial account information, and passport numbers. The lag left insurers and brokers unable to warn affected policyholders for the better part of a year.

Insurer sanctioned after third-party vendor caused half its code breaches. An insurer was formally sanctioned after reporting 10,105 breaches of Australia’s Life Insurance Code of Practice, with 46% of them traced directly to delays by a third-party vendor distributing annual policy notices. The insurer's own monitoring didn't catch the failures; a customer complaint did, eight months after the problems began. The compliance committee's finding was blunt: outsourcing a function doesn't transfer the liability that comes with it. The insurer must now show its governance and oversight of that vendor relationship are strong enough to prevent a repeat.