Where there is smoke, there is fire.
The smoke: a recent flurry of regulatory activity in response to poor application of risk and compliance requirements in the bank-fintech partnership model.
The fire: existential risks to the bank-fintech partnership model and, by extension, the provision of financial services products.
The extinguisher: clear-eyed assessment of the current state, commitment to principles of safety and soundness, and considered strategy to manage risk and compliance.
Let’s take a step back.
The last few years have seen an evolution in the nature of the relationship between fintechs and banks. Early theories that fintechs would pose serious threats to community banks haven’t quite proven to be true. Fintechs’ ability to fully execute on their value proposition – that, by using technology, they can service more people, more quickly, and at lower cost – has been hindered by regulatory complexities. Due to the financial, logistical, and political challenges associated with obtaining their own bank charters, fintechs have struggled to compete directly with banks. Although the number of community banks has steadily declined the last few years, this decline is not at the hands of fintechs. Other things, yes; but not fintechs.1
Instead of direct competition, fintechs and banks have orchestrated mutually-beneficial relationships where fintechs create products and define the customer experience, while banks – the regulated entities – provide the infrastructure and regulatory authority to offer the underlying services and products. This is known as ‘banking-as-a-service’ (“BaaS”). In a traditional program manager relationship, the fintech is contractually required to maintain a subset of the regulatory compliance and risk management functions applicable to the products it offers.
This fintech and bank relationship also created a new layer of market participants, known as ‘BaaS platforms’ or ‘middlewares,’ whose principal value proposition is to negate the costly and time consuming interactions between banks and fintechs.2
The BaaS platform pitch is straightforward; if you are a bank, enter into one commercial arrangement and submit to one technological integration, but get the financial benefit of many. If you are a fintech, integrate with sophisticated APIs (as opposed to an outdated bank core) while also handing off some (or in some cases, most) aspects of your risk and compliance program and focus on what is most important to you – customer acquisition.
Commercially, this model has flourished. To provide just a couple of statistics, customer acquisition cost for financial institutions that partner with BaaS platforms are 82.5% to 95% lower than without 3, and projections of global revenues for the BaaS platform industry are as high as $12.2 billion by 2031, up from $2.5 billion in 2020.4
Unfortunately, a great deal of that commercial growth may have outpaced the maturity of the risk and compliance programs designed to support it, much to the discomfort of one group of stakeholders – regulators.
Regulators are charged with, amongst other things, ensuring that banks comply with a myriad of state and federal regulations, including those related to risk management, consumer protection, and anti-money laundering. The tools regulators use to oversee banks – such as mandatory reporting requirements and examinations – have sought to afford them a comprehensive and candid view into the relationships between banks and their end customers, and thus allowed regulators to observe banks’ compliance with applicable rules and regulations. The bank-fintech relationship has made this more difficult by placing the bank one or two steps removed from the compliance program and two or three steps removed from the customers. Commercial agreements by and between banks, BaaS platforms, and fintechs can be complicated, often leaving parties unclear about ownership of risk and compliance responsibilities.
This confusion can be compounded by the growth in capabilities of ‘regtech’ tools, which seek to expedite and automate many aspects of regulatory compliance. While these tools can be efficient, effective, and – in many cases – necessary, fintechs and BaaS platforms too often consider the adoption of a generic written policy and the acquisition of a regtech solution as satisfaction of their regulatory expectations. Then, instead of tailoring procedures and calibrating tools specific to each use case, some BaaS platforms adopt a one-size-fits-all approach. The end result is a ‘RACI’ matrix showing a bank that is not responsible or accountable, and a fintech that is not consulted or informed.
In the eyes of the regulator, however, there is no confusion about whom to blame. Banks are the regulated entities, customers are customers of the banks, and banks are accountable for weaknesses in risk and compliance programs.
Recently, regulators have been making themselves clear:
In contemplating this recent activity, four broad areas comprise the regulators’ concern:
Considering the four areas above, one can see that regulators are taking issue with the very value proposition of this model. Consider the case of the typical BaaS platform, for example. A single BaaS platform will aim to take compliance responsibilities off the hands of one hundred fintechs — one hundred fintechs, with hundreds of thousands of combined customer accounts. That many customers naturally generate a lot of issues regarding AML, Reg E, and unfair, deceptive, or abusive acts and practices (“UDAAP”)6. That volume of activity cannot be resolved by a small bank compliance team, a small BaaS platform compliance team, and limited fintech compliance personnel. Furthermore, the BaaS platform will restrict the ability of its bank partners to interact with the fintechs, whose customers contractually belong to the bank. This creates safety and soundness concerns. When regulators eventually catch on, instead of working with the bank to remediate issues and build a regulator-approved model, the BaaS platform simply moves new or existing fintech partnerships to another bank, effectively trying to outrun the regulators’ implicit demand to modify the operating model.
Before I provide some guidance on how to address these issues, it is worth pausing to examine the big picture. As I mentioned at the top of this article, where there is smoke, there is fire. The potential impact of the recent regulatory activity could be vast.
Now, some good news. Although regulatory scrutiny is increasing, there are ways each of the market participants mentioned throughout this article can help inspire regulatory confidence in these partnerships. The table below illustrates, at a high level, how fintechs and banks should think about building programs that withstand regulatory scrutiny in the areas of concern.
|
Market Participant |
Onboarding |
CMS |
AML |
Reg E |
|
Bank |
Improve the risk assessment process prior to onboarding fintechs. Create a due diligence document request list that is comprehensive and ties directly to the type of product they are offering. Verify that fintechs operationalize and adhere to their policies and procedures. Improve staffing or outsource this part of the process. |
Encourage ongoing improvement of BaaS platform compliance programs, including direct oversight of fintech CMS where justified by risk. Refine nature and scope of audits over time to account for changes in BaaS platform clients. |
Require more documented justification for program standards. Require ongoing validations and calibration exercises. Review staffing levels and alert dispositions. Review write-ups of escalated cases (commonly called “unusual activity reports” or “UARs”) for insight into potential compliance issues. Consider banks’ own transaction monitoring (“TM”) system and its appropriateness for these partnerships; create specific rulesets. |
Review statements, Reg E dispute process, and logs. Inquire into outputs of Reg E disputes; monitor dispute resolution trends. |
|
Market Participant |
Onboarding |
CMS |
AML |
Reg E |
|
BaaS Platform |
Tailor onboarding process to client verticals, including due diligence and risk assessment. Ensure transparency of customer risk ratings with fintechs, to ensure mutual understanding of customer risk ratings. |
Where you own compliance on behalf of the fintech, generate compliance program modules that are specific to the client verticals and structures of each relationship. I.e. the program documents that govern your payments clients should not also govern your lending clients. Improve overall compliance program over time, ensuring it is tailored to the changing mix of fintechs supported. |
Create efficient and systematic processes for UAR escalation to bank partners. Ensure staffing levels are commensurate with AML responsibilities, particularly where leveraging regtech solutions for the benefit of fintech customers. |
Create efficient and systematic processes for collating and resolving Reg E disputes. |
|
Fintech |
Prior to commencing due diligence, be prepared to present a tangible plan for operationalizing the program. Go beyond policy creation — develop artifacts and processes to support execution of policies. Set appropriate expectations — going through bank partner onboarding is not a quick process. |
Consider where you are in the journey and how regulatory expectations increase as risks increase, especially in areas like technology, processes, desktop procedures, and staffing. Seek expertise in mapping risk to appropriate program maturity level. |
For ‘know your customer’ (“KYC”) / ‘know your business’ (“KYB”) — consider customer risk rating and enhanced due diligence standards. For TM — perform coverage assessment and validate TM ruleset and thresholds. I.e., ensure you can justify why rules and thresholds were chosen. Clear alerts on time and improve documentation over time. |
Review standards and create a policy for resolving within timelines. Ensure timely submission of logs to the bank on time. |
In Conclusion
The advent of fintech marks one of the most significant developments in financial services since the Great Recession — it has created billions of dollars of fintech valuations and provided a lifeline to smaller banks that otherwise would have been limited by their traditional bricks and mortar footprints and local customer bases.
The bank-fintech partnership model can likely be thanked for much of the growth and success of fintechs. However, following years of sustained growth, this relationship appears to be under pressure.
The smoke led us to the flickers of a fire; it should be extinguished before it spreads. Now is the time for market participants to think carefully about their roles in managing risk and compliance.