Five types of risks that threaten bank-fintech partnerships

December 2, 2022 2:05 PM

As banks continue to enter into partnerships with fintechs, the risks as well as the benefits of these arrangements are becoming clearer. The meltdown of FTX and Alameda Research is the latest example of what can go wrong when a less-regulated company is tied to the regulated financial industry, a topic that regulators like the Office of the Comptroller of the Currency have been sounding alarms about throughout the year.

Banks have been increasingly teaming up with financial technology companies to streamline processes like payments, underwriting and app development. Some banks offer banking-as-a-service to fintechs, letting the third parties take advantage of banks' charters and deposit insurance while providing more nimble services to consumers.

Comptroller of the Currency Michael Hsu said in a September speech that bank-fintech partnerships can serve all parties involved, but folks need to think about several due diligence questions to avoid risk. He added deficiencies in risk management can be "devastating."

"Much more work remains to be done. My sense is that we are still in the early stages of a significant shift in how banking services are going to be provided in the future," Hsu said in September at The Clearing House and Bank Policy Institute's Annual Conference. "By expanding our aperture, engaging more substantively with nonbank technology firms, and mapping out bank-fintech relationships and risks, we can help ensure that banking remains trusted and safe, sound, and fair as the system evolves."

Here are some of the biggest risk factors of fintech-bank relationships:

Money laundering

Earlier this year, Charlottesville, Virginia-based Blue Ridge Bank entered an agreement with the OCC to boost its oversight of fintech partners, especially in relation to bolstering its compliance with the Bank Secrecy Act, which relates to money laundering.

Though the OCC didn't specify its concerns, shortly before Blue Ridge entered the agreement, one of its fintech partners announced that it would wind down operations and terminate accounts established with the bank. The fintech, Aeldra Financial in Palo Alto, offered U.S. bank accounts to non-U.S. citizens in India.

The accord between Blue Ridge and the OCC requires the bank to implement a Bank Secrecy Act program, which relates to money laundering risks, including those related to fintechs. Blue Ridge also said it would obtain a nonobjection from the regulator prior to onboarding a new fintech partner.

Todd Baker, managing principal of Broadmoor Consulting and a senior fellow at the Richman Center for Business, Law and Public Policy at Columbia University, said in September that banks have been ramping up their anti-money-laundering compliance and risk management hiring.

Data and security

About one-quarter of supervisory concerns at the OCC relate to risk management involving issues like "insufficient information security controls, change management issues particularly with emerging products and services, and IT operational resilience," Hsu said in his September speech.

The OCC's bank information technology examinations, which have continued to evolve over the last 20 years, include testing ransomware, artificial intelligence, cloud computing and distributed ledger technology.

Banker members of the Alloy Labs Alliance bank technology consortium developed a playbook for banking-as-a-service relationships earlier this year. A key part of creating bank-fintech partnerships should be the focus on data and security, the group concluded. Alloy Labs Alliance CEO Jason Henrichs told American Banker in October that some players don't even have a data use policy to secure information.

"And if you don't specify it, it certainly isn't happening, other than by luck and maybe goodwill," Henrichs said. "And so I think it has to be a trust-but-verify sort of thing: Tell them what the expectation is upfront, but then also go back and verify."

Curt Queyrouze, president of Coastal Community Bank, said in October that understanding what fintechs are doing with customer data is a "primary challenge and focus today." He added it takes time to test and audit tools that can protect and anonymize data and adhere to the Financial Data Exchange's protocols.

Accountability expectations

Hsu said in the fall that blurry dynamics between technology and banking are core to his concerns. He added that it's integral to the OCC's future bank-fintech partnership regulation to understand how bank and fintech business models are changing, especially in line with each other.

"Who is responsible for what when things break? How might confidence be lost in a banking services supply chain disruption and what would it take to regain it? How do banks and their third parties view and treat customers in bank-fintech arrangements — when do customers go from being the client to becoming the product and how are consumer protections maintained? How vulnerable are banking services to stress at fintechs? What happens when fintechs fail?"

The Alloy Labs Alliance playbook proposed that the bank is responsible for outlining end clients and prohibited businesses to ensure mission alignment.

Fintechs’ struggles

The fintech sector has faced headwinds in 2022 as inflation, reduced funding and higher interest rates put pressure on the industry.

Many major fintechs, like Chime, Varo, Upstart and Stripe, have laid off portions of their workforce. A report from Gartner and Alloy showed that customer attrition and regulation were top concerns for fintechs in 2022. Fintech valuations have fallen, and Hsu said this lull has created more incentive for fintechs to try and partner with banks.

As some tech companies feel the stress of the macroeconomic effects, Hsu said in his speech that it can be unclear what happens to banks if their fintech partners fail or experience financial hardship.

Andrew Harrer/Bloomberg

Future of regulation a.k.a Into the Unknown

It's clear that regulation is coming, but the details of when, how and for whom are still in limbo. In October, House Republicans wrote a letter to Hsu shortly after his September speech, criticizing his concern about bank-fintech partnerships, and asking him to elaborate on specific risks.

Patrick McHenry, R-N.C., heir apparent to lead the House Financial Services Committee, led the group who wrote the letter. McHenry has said previously that clarifying fintech regulation is one of his priorities.

While fintechs are regulated to some degree by the OCC, the Federal Deposit Insurance Corp., the Federal Reserve, the Consumer Financial Protection Bureau, the Commodities Futures Trading Commission and state agencies, rules aren't as extensive or clear as the nearly century-old guidelines developed for traditional financial institutions.

The OCC, FDIC and the Fed have all been paying closer attention to banking-as-a-service in the last two years, Plaid co-founder William Hockey said in an interview this summer. Hockey also founded and runs San Francisco-based Column, a fintech that acquired a bank in a deal that was approved last year.

"We take a significant amount of counterparty risk with all of our clients," Hockey said in July. "Business models that people thought were sustainable two years ago may be different now….We need to make sure that our risk tolerance is aligned with our regulators."

Brian Graham, a partner at Klaros group, said in a September interview that banks need to invest more in hiring lawyers, compliance teams and consultants to get their due diligence up to snuff and meet regulators' expectations. He added fintechs need to do more due diligence as well.

Josh Williams, executive vice president, chief banking officer and head of partnerships at Seattle Bank, said in a September interview that the OCC is asking the right questions, and that banks shouldn't be surprised by regulators' increasing interest in bank-fintech partnerships.

"Providing more clarity around what the expectation is is only going to be helpful in terms of making sure that all parties have more realistic expectations coming into a partnership," Williams said.