Federal Banking Agencies' Supervisory Guidance and RFI on Bank-Fintech Arrangements

This memorandum reviews two issuances released by the federal banking agencies (the Federal Reserve Board, the Federal Deposit Insurance Corporation, and the Office of the Comptroller of the Currency, jointly the “Agencies”) related to bank-fintech partnerships: (1) a supervisory guidance (the “Guidance”) on banking-as-a-service (“BaaS”) arrangements; and (2) a request for information on bank-fintech arrangements involving banking products and services distributed to consumers and businesses (the “RFI”). Comments on the RFI are due 60 days after publication in the Federal Register, and the list of questions in the RFI is attached as an appendix.

The Guidance and RFI address many of the same risk management concerns including managing rapid growth; proper oversight of third parties; and potential violations of consumer protection laws, including deceptive marketing, particularly regarding deposit insurance.

Supervisory Guidance

The Guidance focuses on BaaS arrangements between banks and third parties. Under these arrangements, a third party (such as a fintech) markets, distributes, or otherwise provides access to a bank’s deposits or other services for consumers and businesses. In these arrangements, banks rely on third parties to provide a variety of services, including maintaining records of deposit transactions; processing payments; performing regulatory compliance functions; providing customer facing technology applications; servicing accounts; performing customer service; and providing complaint and dispute resolution functions. Regardless of the services provided by a third party, the Guidance states that a bank’s use of third parties does not diminish the bank’s responsibility to comply with all applicable laws and regulations.

While BaaS arrangements have been utilized for certain banking activities for many years (e.g., prepaid card programs), the Agencies state that they are issuing this Guidance due to the evolution and expansion of these arrangements.

The Guidance does not impose any new restrictions, limitations, or supervisory expectations on BaaS business arrangements. The Agencies state that the Guidance is intended to “reemphasize” existing risk management guidance applicable to arrangements with third parties. However, the issuance of this Guidance, combined with a series of enforcement actions against banks engaged in BaaS arrangements, indicates that the Agencies are concerned about the risk management practices of banks engaged in these arrangements, especially smaller banks that may lack the resources to implement appropriate risk management practices.

The Guidance is divided into two sections: the first section lists potential risks associated with BaaS arrangements; and the second section addresses risk management and governance considerations.

Potential Risks

• Operational and Compliance:
  • Substantially relying on third parties to manage a bank’s deposit operations which can eliminate or reduce a bank’s crucial existing controls over and management of the deposit function;
  • Fragmented operations, making it more difficult for the bank to effectively assess risks;
  • Lack of access to records;
  • Third parties performing compliance functions, which may increase the risk of the bank not meeting its regulatory requirements;
  • Insufficient risk management to meet consumer protection obligations, including investigating and resolving certain payment disputes and accurate disclosures;
  • Lack of contracts, if the bank does not have direct contracts with entities that perform crucial functions, may pose challenges to the bank’s ability to identify, assess, monitor and control various risks;
  • Lack of experience with new methods; and
  • Weak audit coverage.
• Growth:
  • Misaligned incentives between the third party and the bank;
  • Operational capabilities lag growth: rapid growth may result in risk management and operational processes struggling to keep pace;
  • Financial risks from funding concentrations;
  • Inability to manage emerging liquidity risks; and
  • Pressure on capital levels.
• End User Confusion and Misrepresentation of Deposit Insurance Coverage
  • Potentially misleading statements and marketing; and
  • Regulatory violations, including regarding inaccurate or misleading information regarding deposit insurance.

The second section addresses risk management and governance considerations. This section largely repeats guidance contained in the Interagency Guidance Establishing Standards for Safety and Soundness and the Interagency Guidance on Third Party Relationships. (The Guidance includes links to these and related materials previously issued by the agencies.) The Guidance includes the following examples of effective risk management practices:

• Governance and third-party risk management: developing and maintaining appropriate policies and procedures; developing appropriate risk assessments that identify and analyze risks; entering into contracts and agreements that clearly define roles and responsibilities of banks and third parties; assessing potential risk when the bank does not have a direct contractual relationship with all parties with significant roles; and establishing effective ongoing monitoring processes.
• Managing operational and compliance implications: maintaining a clear understanding of any management information system that will be used to support the activity; developing and maintaining risk-based contingency plans; implementing internal controls to mitigate risks inherent in deposit functions; and establishing adequate policies, procedures, oversight, and controls to help ensure compliance with applicable laws.
• AML/CFT and sanctions compliance: having adequate policies, procedures, oversight and controls to help ensure the bank complies with applicable AML/CFT requirements.
• Managing growth, liquidity, and capital implications: establishing appropriate concentration limits, diversification strategies, liquidity risk management strategies, and exit strategies, as well as maintaining capital adequacy; performing appropriate analysis to determine whether parties involved in the placement of deposits meet the definition of deposit broker and appropriately reporting any such deposits as brokered deposits.
• Addressing misrepresentations of deposit insurance coverage: establishing policies and procedures and developing prudent risk management practices for certain deposit-related arrangements to ensure compliance with applicable laws and regulations on the same; and ensuring those policies and procedures include, as appropriate, provisions related to monitoring and evaluating activities of persons that facilitate access to the bank’s deposit-related services or products to other parties.

RFI on Bank-Fintech Arrangements

In the RFI, the Agencies acknowledge that bank-fintech arrangements may provide benefits to consumers and businesses. At the same time, the Agencies state that such arrangements present a variety of risks. As a result, the RFI invites input on the nature of bank-fintech arrangements; the benefits and risks of such arrangements; effective risk management practices for bank-fintech arrangements; and whether enhancements to existing supervisory guidance may be helpful in addressing risks associated with these arrangements.

The RFI also describes several bank-fintech arrangements and use-cases, as well as the risks the Agencies have seen manifesting and arising from these arrangements. Below, we summarize the discussion of these arrangements, use-cases, and risks that are set forth in the RFI. The Agencies clarify that the RFI is not intended to impose any obligations or define any rights, and it is not an interpretation of any statute or regulation.

Bank-Fintech Arrangements

The Agencies have observed that bank-fintech arrangements vary significantly in structure and product and service offerings, but many commonly fall into one or more categories of facilitating deposit-taking, payment (including card issuance and digital wallet capabilities), and lending activities. Such arrangements may be effectuated either directly between banks and fintech companies or indirectly using an intermediate platform provider.

Bank-Fintech Arrangements in Connection with Deposit-Taking Activities

In arrangements involving deposit-taking activities, a fintech contracts with one or more banks, directly or through an intermediate platform provider, to provide end users with access to deposit accounts, debit cards, savings accounts, and other account-related services through the fintech company’s online or mobile platform. In such arrangements, fintech companies often play a critical role in maintaining deposit and transaction records, and these records may not be reflected in the bank’s core processing system. The bank’s core deposit ledger may only include omnibus accounts, often titled to reflect that they are held for the benefit of end users.

The contracts governing these arrangements commonly set forth the operational responsibilities of each party, such as: record-keeping and access to records; end-user on-boarding; compliance management; transaction monitoring; and complaint handling. Bank-fintech arrangements involving deposit-taking activities often involve heightened levels of operational complexity, including as it relates to reconciliations and Bank Secrecy Act (BSA) recordkeeping and compliance (e.g., customer identification and due diligence, suspicious activity monitoring and reporting and sanctions screening).

Bank-Fintech Arrangements in Connection with Payment Activities, including Card Issuance

Bank-fintech arrangements involving fund-transfer services, card issuance, contactless payments, and other payment solutions are not new. However, the types, number, and complexity of payment-related products and services and associated bank-fintech arrangements have rapidly increased in recent years. The RFI describes a variety of arrangements in this category, including card offerings, prepaid services, and offering of ACH transactions, wire transfers, and settlement of payment services to end users. These arrangements also include digital platforms and applications that permit the transmittal and exchange of funds between and among consumers. The RFI also highlights arrangements to offer digital wallets, often in conjunction with associated payment applications. Each of these arrangements may also include a variety of additional services provided by the fintech and bank. The Agencies note that many fintech companies enter these arrangements with banks in order to gain access to existing payment systems and card networks, with the bank being the “sponsor” for the fintech company’s access.

Bank-Fintech Arrangements in Connection with Consumer and Small Business Lending

Bank-fintech arrangements can facilitate loans to consumers and small businesses through a fintech company’s online platform. Banks increasingly engage with fintech companies to access these lending markets. In these arrangements, fintechs may be assigned to perform various core operational functions in connection with lending, including those relating to the processing, underwriting, closing, delivering, or servicing of loans. In a typical arrangement, a partner bank agrees to facilitate and fund loans, while the fintech company solicits end users and collects application data.

The Role of Intermediate Platform Providers

The growth of bank-fintech arrangements has spurred the development of a new business model in which a fintech company provides an intermediate technology platform (“aggregation layer”) to facilitate relationships between a bank and other fintech companies that seek to distribute banking products and services directly to consumers or businesses. An intermediate platform provider may also offer to assist fintech companies in implementing compliance risk management programs and in handling the transfer and flow of funds across deposit taking, payments, card issuance, or lending activities.

Risk Implications

The RFI’s discussion of the risks in bank-fintech arrangements is meant to be illustrative, not comprehensive. Risks also may be heightened if the fintech is the distributor of the banking product or service or if the fintech or intermediate platform provider performs key functions.

Accountability

Failure to conduct sufficient due diligence, ongoing monitoring, and oversight of the bank-fintech arrangement may complicate the bank’s ability to ensure compliance with applicable law and regulations and to identify risk. In addition, contractual division of labor may complicate the bank’s ability to establish clear lines of accountability, implement effective risk and compliance management strategies, and address and remediate issues as they arise, especially where novel arrangements place certain traditional banking activities outside of the bank.

It may be difficult for a bank to perform oversight and control functions over the fintech company if the fintech company has substantial negotiating power relative to the bank or if the bank relies on revenue or liquidity from the fintech company. These risks may be heightened if the fintech company is not familiar with, or has a different risk tolerance for, the applicable laws and regulations.

End-User Confusion

The fintech’s efforts to provide a seamless experience for end users could make it difficult for them to know in what capacity they are dealing with the bank or the fintech. In some cases, marketing materials or other statements by the fintech company or bank may exacerbate this confusion. For example, end users may not be well-informed regarding the type of account relationship that is established through the fintech and may not understand that Federal deposit insurance does not protect them from a nonbank fintech company’s failure. Customer confusion also may complicate compliance efforts and pose other risks to the bank, including responding to consumer complaints if they are directed solely to the fintech.

Rapid Growth

A bank, especially a smaller, community bank, may experience rapid growth because of engaging in a bank-fintech arrangement (e.g., growth in deposits or transaction volume). Various risks can emerge from rapid growth and the bank’s changing risk profile, including risks that may threaten the bank’s safety and soundness or its ability to comply with applicable laws and regulations. These risks may arise from challenges such as appropriately scaling risk and compliance management systems, operational complexities, significant deposit growth, and insufficient capital to support the rapid growth, among other things.

Bank-fintech arrangements also may pose operational complexities, which may lead to increased risk. For example, potentially significant increases in the volume of payment processing may give rise to increased transaction monitoring alerts. These risks may be heightened if the bank-fintech arrangement involves an additional entity (e.g., an intermediate platform provider). Rapid deposit growth related to a bank-fintech arrangement also can pose risks related to funds management and liquidity stress should the bank face material short-term withdrawal requests.

Concentration and Liquidity Management

Bank-fintech arrangements may result in the bank’s business becoming highly concentrated. This concentration risk may amplify other risks to the bank, including risks from market stresses or if deposits are used to fund longer-term assets. Bank-fintech arrangements also may pose liquidity risks if the bank fails to establish adequate liquidity contingency plans and exit strategies, particularly when arrangements represent a funding concentration.

Use and Ownership of Data and Customer Information

Bank-fintech arrangements often rely on new, innovative, and potentially untested uses of data to expand or enhance access to financial services, which may lead to risks related to compliance with laws and regulations, operational challenges, and the ownership, use, and nature of that data. These include, for example, risks related to the bank’s ability to address concerns associated with alternative data and its use (including as to accuracy and biases) and to incorporate alternative data types and formats into its information technology systems, credit risk modeling capabilities, and compliance management systems.

Data ownership and use questions may create risks for the bank. For example, banks are restricted in the sharing, use, and disposal of nonpublic personal information, and consumers have opt-out rights, which could pose operational difficulties and compliance risks. Therefore, the bank may require information on the consumers served by the arrangement in order to meet its own compliance obligations, including, but not limited to, those related to recordkeeping, AML/CFT or sanctions, fair lending, or state escheatment requirements. This requirement for information may arise even if the bank lacks a direct relationship with end users or where they are not named account holders with the bank.

Appendix

RFI: Requests for Comment

Bank-Fintech Arrangement Descriptions

1. Do the descriptions and categorizations in this RFI adequately describe the types of bank-fintech arrangements in the industry and the companies involved? If not, why? Are the descriptions or categorizations overly broad or narrow, or are there any types of companies or categories of arrangements missing from the descriptions?
2. Are there any benefits of bank-fintech arrangements that are not addressed by this RFI? What benefits do the bank or the fintech company receive by using an intermediate platform provider?
3. Describe the range of practices regarding banks’ use of data to monitor risk, ensure compliance with regulatory responsibilities and obligations, or otherwise manage bank-fintech arrangements. What data and information do banks typically receive in bank-fintech arrangements, including in those involving intermediate platform providers? To what extent is this information different from the information banks would receive when interacting with end users independent of fintech companies? What challenges have banks experienced in bank-fintech arrangements—including those involving intermediate platform providers—related to the timely access to customer information, and what steps have the parties to bank-fintech arrangements taken to assess potential compliance issues associated with such challenges?
4. How do the parties to bank-fintech arrangements determine the end user’s status as a customer of the bank, the fintech company, or both, including for purposes of compliance with applicable laws and regulations, and each party’s responsibility in complying with contractual requirements? What disputes or uncertainties regarding the status of end users have the parties experienced, and how have they sought to resolve them? How does the type of arrangement impact such determinations?
5. Describe the range of practices regarding the use of a core bank service provider or other third-party providers in bank-fintech arrangements. How do these providers help or hinder bank-fintech arrangements?
6. Describe the range of practices in cases where bank-fintech arrangements involve affiliates of the bank, including fintechs. What are the benefits and risks of these arrangements?
7. Bank-fintech arrangements can involve significant up-front and ongoing costs and resources for the bank involved and may take some time to recoup these costs and resources. What type of up-front and ongoing costs and resources are associated with establishing bank-fintech arrangements? Describe the range of practices regarding how a bank factors such upfront costs and resources into its overall strategy and risk management strategy. Describe the range of practices regarding how revenues and costs resulting from these arrangements are allocated between the bank and fintech company.

Risk and Risk Management

1. Describe the range of practices for maintaining safety and soundness, and compliance with applicable laws and regulations arising from bank-fintech arrangements. How do the practices differ between different categories of arrangements? Does the RFI adequately identify and describe the potential risks of bank-fintech arrangements?
2. Bank-fintech arrangements can present unique or heightened consumer protection risks, such as risks of discrimination, unfair or deceptive acts or practices under the Federal Trade Commission Act, or privacy concerns. Describe the range of practices for managing any heightened risks.
3. Describe the range of practices parties to a bank-fintech arrangement may use in contractually allocating functions among themselves, including the advantages and disadvantages of each such practice. For example, while the parties to such arrangements remain responsible for their own compliance with applicable laws and regulations, as a matter of contractual allocation, who performs which activities related to risk and compliance management, customer identification and due diligence, transaction monitoring, sanctions screening, fraud monitoring, end-user complaint management, dispute resolution, data protection, or credit underwriting, if applicable? Who develops and oversees marketing materials, develops and provides disclosures and account statements, addresses errors, receives and resolves disputes, and responds to complaints? How are contractual breaches and indemnifications typically addressed in these types of arrangements? Describe the range of practices for monitoring compliance with applicable laws and regulations, notwithstanding contractual allocations.
4. How are risks resulting from these arrangements, including those concerning credit, liquidity, concentration, compliance, and operational risk, as well as concerns regarding negative end-user experience managed? What techniques or strategies are most effective in managing the impact of rapid growth, particularly related to deposit-taking and payment-related arrangements?
5. Describe the range of risk management strategies banks and fintech companies use to ensure that required disclosures in bank-fintech arrangements, including those relating to rates and fees associated with end-user banking products and services, are accurately and plainly communicated, and comply with all relevant state and Federal laws and regulations.
6. Describe the range of practices regarding disclosures (e.g., initial, annual, or ongoing) to end users about the involvement of bank-fintech arrangements in the delivery of banking products and services.
7. Describe the range of practices regarding the use of an intermediate platform provider. Describe how the use of an intermediate platform provider may amplify or mitigate risk, and to what extent, if any, intermediate platform providers influence how banks handle operational, compliance, or other issues when dealing with fintech companies within the intermediate platform provider’s network.
8. Describe the range of practices regarding how banks manage the risks of connecting to multiple technology platforms and exchanging data in bank-fintech arrangements.
9. Describe the range of practices regarding planning for when a fintech company or intermediate platform provider exits an arrangement, faces a stress event, or experiences a significant operational disruption, such as a cyber-attack. Describe the range of practices regarding how arrangements are structured to minimize harm to end users, meet compliance requirements, and minimize liquidity risks and other risks in the event of such exits, stresses, or disruptions.
10. Describe the range of practices, and challenges, in negotiating contracts with, or conducting due diligence on fintech companies. Describe the range of practices in maintaining ongoing monitoring of bank-fintech arrangements, particularly related to risk management, regulatory compliance, data ownership and use, and information security assessment rights. What impact, if any, does the size and negotiating power of the bank or the fintech company have on these issues? What impact, if any, does the fintech company’s or intermediate platform provider’s degree of control of operational functions have on these issues? What impact, if any, does bank liquidity or revenues concentration represented by any particular fintech company, intermediate platform provider, or business line have on these issues?
11. Bank-fintech arrangements may involve processing payments transactions unrelated to any specific deposit-taking or credit offering in significant volumes. Describe the range of practices that banks adopt to manage potential risks associated with processing large volumes of otherwise unaffiliated payments transactions. Do banks view bank-fintech arrangements involving such processing differently from other payments-related products and services offered to end users?
12. How do banks ensure bank-fintech arrangements can be suspended or terminated based upon safety and soundness, compliance, or consumer protection concerns? What fees or other costs are typically involved in exiting these arrangements?
13. Are there other techniques or strategies that banks use to manage the various risks bank-fintech arrangements may present? Which of these techniques or strategies are most effective in managing such risks?
14. In the context of bank-fintech arrangements, how are deposit accounts usually titled? Describe the range of practices reconciling bank deposit account records with the fintechs’ records. Generally, what party holds and maintains the account records? Describe the structure in place to exchange accurate customer information between the bank and the fintech company and how the agreements between banks and fintech companies generally address these matters. Describe any additional controls that banks or fintechs may use to provide for accurate reconciliations.
15. Describe the range of practices regarding the maintenance of systems of records and account titling in the context of bank-fintech arrangements. Do certain account structures pose greater risk considerations to banks and end users than others? What additional controls, if any, do banks or fintechs place on these accounts to manage these risks?
16. To what extent would additional clarifications or further guidance be helpful to banks with respect to bank-fintech arrangements? If so, please explain. In what specific areas would additional clarification or further guidance be most helpful?

Trends and Financial Stability

1. What data would be helpful for the agencies in monitoring developments regarding bank-fintech arrangements? For example, this might include data to assist in monitoring developments and trends in bank-fintech arrangement structures and use-cases, concentrations, and the number and types of bank-fintech arrangements in the financial services industry.
2. In what ways do or can bank-fintech arrangements support increased access to financial products and services? Alternatively, in what ways do or can these arrangements disadvantage end users?
3. In what ways might bank-fintech arrangements function as transmission mechanisms to amplify financial shocks (i.e., threaten financial stability)? Conversely, how could these arrangements help to contain shocks and reduce contagion?
4. What factors are important in determining whether bank-fintech arrangements support or hinder responsible innovation and a competitive and compliant financial services landscape?