"We're a capitalist society and unless we put guardrails in place, money will drive outcomes," says Curt Queyrouze, president of Coastal Community Bank.
He was applying this universal truth to the banking-as-a-service movement, in which banks work with fintechs that have built mobile banking apps, online lending sites, and other front ends to financial services. The bank sits in the background, managing checking accounts, Federal Reserve access and Federal Deposit Insurance Corp. insurance. The fintechs pay for the service. The banks are often community institutions that are not subject to the Durbin amendment's cap on interchange income and therefore can reap fees every time a debit card is swiped and share that income with fintech partners.
As dozens of banks have jumped into banking as a service over the past year, some of their new fintech partners are "pushing aside the noble pursuit of broadening financial access for the customer to drive fundraising capital," and other less honorable purposes, Queyrouze said.
About a year ago, Queyrouze and 15 other banker members of the Alloy Labs Alliance bank technology consortium started talking about this and agreed that banks not maintaining a standard of conduct could harm the whole ecosystem. They began developing a set of rules for banking-as-a-service relationships that they are publishing Wednesday as a playbook.
"If we're going to do this right, we have to prove that we can protect the ecosystem, that we can build it in a secure, correct way," Queyrouze said in an interview Wednesday.
There is a shared danger for bankers in this business, he pointed out.
"There's a risk of contagion," Queyrouze said. "If some players are negligent and there's a big meltdown as a result, that's going to affect all of us. We thought, let's get some dialogue and standards and discussion about it started."
Soon afterward, they started to see an increase in regulatory scrutiny of banks' relationships with fintechs.
"Between the summer of 2021 and the summer of 2022, the tone [from regulators] changed dramatically," Queyrouze said.
In recent months, banks and fintechs have felt the harsh glare of regulatory scrutiny on their relationships. In September,
Banks have to act as an extension of their regulators to compel their fintech partners to comply with bank regulations, and they have to continuously monitor what those partners are doing, Queyrouze pointed out.
Coastal Community Bank, which Queyrouze joined in June, has about 30 fintech partners and already had some standards for fintechs in place before the new playbook was created. As the banking-as-a-service program grew in scope and scale, this became more difficult to manage. The bank, which is based in Everett, Washington, has been raising its standards and many of the rules in the playbook are clauses Coastal puts in its contracts with fintechs.
The bank's intent of making financial services more broadly accessible remains the same, Queyrouze said.
Jason Henrichs, CEO of the Alloy Labs Alliance, led and organized the effort to create the playbook.
"We looked at it and said, we need to mature the industry, but we either take it upon ourselves, lead the charge to mature the space, or let it become a race who can run the fastest with regard to compliance," Henrichs said in an interview. "That's a weak proposition for all of us."
The playbook lays out which parties are responsible for different aspects of compliance, customer service, data stewardship, disaster recovery and more.
Alloy Labs Alliance members comprise about 30% of the market share of banks that offer banking as a service, including Sunrise Banks, Lincoln Savings Bank, Coastal Community Bank and Cross River. The bankers worked with several fintechs to create the playbook, including Unit, Treasury Prime and Currency Cloud.
"All of these players came together and said, 'Hey, doing this together benefits everyone,' " Henrichs said. "What we really care about is ensuring strong compliance."
In regular meetings with bank regulators, Alloy Labs let them know this document was coming.
"They were very receptive to the idea," Henrichs said.
At Sunrise Banks in St. Paul, Minnesota, "being able to talk to others that are running into similar challenges, being able to put together this document, was pretty amazing," Laura Wildenborg, fintech innovation manager, said in an interview. Sunrise's fintech partners include Self and TrueConnect.
The first challenge the group had was defining all the terms used in banking as a service.
"That was a really great first piece, defining the terms that we're using over and over in our daily life," Wildenborg said. "That was such a big step because everybody says these words like 'program manager' or 'baas' and starting to get a defined language for that helps everybody have more clarity around it."
"When this group came together, the realization was not only did every organization do things slightly differently, if you look at the portfolio themselves, they even sometimes had different relationships and roles between the different fintech and programs they work with," Henrichs said. Members realized they wanted consistency and standards.
"If we can simplify by codifying, it's going to make it easier for everyone to stay compliant," he said.
Much of the playbook formalizes the way responsible banks and fintechs work together already.
"I would say a lot of the documentation and roles and responsibilities that we have defined are foundationally built on regulations that are put in place," Wildenborg said. "That's where we started and that helped clarify things. We moved forward from there."
Choosing the right partner
Some banks have gotten in trouble for working with fintechs with sketchy business models, like high-cost lenders and fintechs that make
One of the rules in the Alloy Labs Alliance playbook is, "Bank is responsible for clearly outlining acceptable end clients as well as prohibited businesses."
"A huge thing for Sunrise is mission alignment," Wildenborg said. "That is one of our first qualifying pieces when we look at partners: do we see mission alignment?" Sunrise Banks has a mission of empowering financial wellness and is a member of the Global Alliance for Banking and Values and a community development financial institution, she said.
"So we have these different standards that we need to follow," Wildenborg said. "Those are different pieces that we have to take into consideration to maintain those certifications, but also to ensure that whatever our fintech partner is offering, who are they targeting? How are they targeting them? And who are they working with? Sometimes they're working with co-brands, for example, to offer."
One small-business bank in the Alliance has drawn a line against working with fintechs that serve cannabis and gambling businesses, Henrichs said.
Most of the banks in the group only support loans under the military interest rate cap, Henrichs said. They're not working with fintechs that want to get around rate caps by working with a bank in a state that has no rate cap. This is a practice regulatory officials scoffingly refer to as "rent a charter."
Determining which fintechs are good to work with and which are not is still hard, said Queyrouze, who has been working with fintechs for decades. (Before Queyrouze came to Coastal, he was the chief executive of TAB Bank, a Utah financial institution that provides banking as a service.)
"There are no bright lines yet, but some lines are maybe starting to surface behind the scenes," he added. "We're having a lot of discussion about this with our regulatory partners. The theme that I see, which I think is a good thing, is transparency, how you disclose. If you charge a high interest rate, that may be fine, but you have to be very clear about all the costs."
Dealing with data
The document also addresses the use of customer data and says banks have to enforce data use policies at their fintech partners.
"That's one of the trickiest things," Henrichs said. "I think there are a lot of players out there that don't even have a data use policy that they look to enforce on their fintechs. And if you don't specify it, it certainly isn't happening, other than by luck and maybe goodwill. And so I think it has to be a trust-but-verify sort of thing: Tell them what the expectation is upfront, but then also go back and verify."
It can be a challenge for banks to know what their fintechs are doing with customer data, Queyrouze acknowledged.
"That's the primary challenge and focus today that we're working on," Queyrouze said. "How do we build better systems to protect the data, to anonymize the data, to follow [the Financial Data Exchange's] protocols, where you're taking the most minimal needed data and transferring it? When you're working with consumer data and bringing all this into an environment that's shared outside of your domain? There are tools out there to effect that and then to make sure it works, it really comes down to testing and auditing."
All agree that working together on this playbook doesn't hinder any member's ability to compete.
"We can't be competing on what good compliance is," Mike McCrary, first vice president at Lincoln Savings Bank, said in the early days of work on this document. "We can compete on how good we are at enforcing it and managing it, but we should not be competing on who can run fastest and loosest around regulation. That is the wrong thing."
