Why are regulators scrutinizing bank-fintech partnerships?

The baseline: banks own their partners' risk

In June 2023 the Federal Reserve, FDIC, and OCC published joint guidance on third-party risk management. Its core principle is that using a third party does not diminish a bank's responsibility: activity run through a fintech partner must be overseen as if the bank performed it directly, across the full relationship life cycle from due diligence to termination. For banking-as-a-service banks, whose business is running many such relationships, the guidance functions as a program-design standard examiners test against.

The enforcement pattern that followed

Since 2023, a steady series of public consent orders and formal agreements has involved banks active in banking-as-a-service. The recurring citations are BSA/AML program weaknesses, third-party and fintech partner oversight, and board-level risk management. The orders are public documents on the agencies' enforcement pages, and their remedial requirements read like a template: enhanced partner due diligence, transaction monitoring across partner programs, lookback reviews, and in several cases restrictions on adding new fintech partners without supervisory clearance.

Why examiner findings become your requirements

A bank under a consent order must demonstrate control over partner activity, and the only lever it has is the program agreement. That is why operators see expanded audit rights, demands for underlying customer data, shortened remediation deadlines, and onboarding pauses. A single unaddressed finding in your program becomes evidence in the bank's supervisory file, which is why banks increasingly treat partner remediation speed as an existential metric and cut partners who lag.

The middleware lesson of 2024

The widely reported 2024 failure of a banking-as-a-service middleware provider, which left end users of multiple fintech programs unable to access funds during a prolonged reconciliation dispute, sharpened regulatory attention on where customer money actually sits in sponsored programs and on ledger accuracy between program parties. Agencies followed with proposals and guidance attention on custodial account recordkeeping. For operators, the practical consequence is deeper diligence on flow of funds and reconciliation, from banks and from would-be replacement banks alike.

What this means if you rely on a sponsor bank

The supervisory direction has been consistent across several years and both political administrations: banks are accountable for partner programs, and the cost of running them is higher than it was. Planning on a reversal is not a strategy. The durable responses are to run your program to bank-examination standard regardless of who holds the license, and to reduce the dependence itself, which for money movement means your own state licenses and FinCEN registration.

What to do now

1. 1

   Read the primary sources

   The 2023 interagency third-party risk management guidance and the public enforcement actions involving sponsor banks are short, readable, and explain most of what your bank now asks of you.

2. 2

   Run your program to examination standard now

   Written BSA/AML program, tested monitoring, clean reconciliation, and documented remediation. This keeps your current bank comfortable and shortens diligence with any future bank or state regulator.

3. 3

   Map where customer funds sit at every step

   Account structures, ledger ownership, and reconciliation cadence are now first-order diligence questions. Have the diagram before you are asked.

4. 4

   Reduce the dependence structurally

   Direct state money transmitter licenses take the sponsor bank out of the critical path for money movement, which is the only complete answer to pass-through scrutiny.

Frequently asked questions