Partnerships between banks and financial technology firms (fintech) can create innovative products or technologies that increase efficiency, reduce costs, and enhance risk mitigation, including anti-financial crime (AFC). These partnerships also enable banks to provide additional digital products and services.

Joint agency guidance from the Federal Reserve System, the Federal Deposit Insurance Corporation, and the Office of Comptroller of Currency was introduced in 2021 and updated in 2023, titled “Conducting Due Diligence on Financial Technology Companies,”¹ which considers the risk of a rapidly growing fintech space.

As in all partnerships, robust third-party risk management is important for remaining compliant. Financial institutions should consider their risk appetite and how a fintech partnership could impact the integrity of the risk assessment and policies and procedures surrounding BSA/AML compliance, and they should perform thorough due diligence and implement ongoing monitoring related to their fintech partnerships.

Six Key Elements of an Adequate Due Diligence Program

Business Experience and Qualifications

To effectively run a compliant financial institution or a fintech, employees and directors must have the necessary experience to adequately assess an organization’s needs and risks. Adequate staff is critical to ensure segregation of duties and timely completion of tasks. Both sides should do their due diligence to determine if the partnership is a strategic match. The evaluation should consider an organization’s structure, governance protocols, promoter and founder experience, and track record.

Financial Condition

The financial stability of the parties involved in bank-fintech partnerships can be assessed through reviews of financial statements, annual reports, source of funds, competitor analysis, and customer base evaluations. A sudden closure of one partner could expose the other to heightened risks and potentially create gaps in their risk management and compliance programs.

Legal and Regulatory Compliance

Incorporation documents can assess if the company is in good legal standing and is licensed to operate in their jurisdiction. Beyond that, regulatory requirements must be considered and followed to mitigate risk. Policies and procedures surrounding internal controls for regulatory compliance and AFC should be thoroughly reviewed to ensure partners are meeting industry standards and regulatory requirements.

Risk Management and Controls

Financial institutions must evaluate the risk management framework through policies and procedures, products, and personnel involved. Previous audits, key performance indicators, and reports given to the board of directors should be reviewed to validate that risks are being adequately managed.

Information Security

Fintechs should have robust policies and procedures surrounding safeguarding information and disposing of it once the retention period ends. Banks should consider incident reports, security control assessments, and whether the partner has the infrastructure to support the partnership. Smaller banks, for example, may lack the resources to integrate with a fintech’s operations.

Operational Resilience

Fintechs must have contingency plans and strategies in place to operate effectively in the case of a disruption. Financial institutions should review documents related to business continuity, disaster recovery, and incident response plans to confirm stability during unexpected events. Additionally, fintechs should regularly back up their system files in the instance of a system failure, conduct cybersecurity audits, and maintain adequate business-related insurance.

Benefits of Bank-Fintech Partnerships

While bank-fintech partnerships inherently carry higher risks due to the dynamic nature of fintechs, these partnerships offer significant benefits to both parties. Banks can gain access to new technologies, products, services, or personnel, while fintechs can benefit from faster go-to-market, established systems, and regulatory guidance.

The promise of a bank-fintech relationships can only be achieved through strong due diligence, and robust third-party risk management and ongoing compliance monitoring frameworks. Some fintechs specialize in AFC, allowing banks the opportunity to partner with them to manage their AFC risks. This symbiotic relationship helps financial institution and fintech partnerships to grow, generate higher revenue streams, and remain compliant with relevant regulation.

This article was prepared with assistance from Alexandra Bartkoske.

1. “Conducting Due Diligence on Financial Technology Companies: A Guide for Community Banks,” The U.S. Federal Reserve, October 2023.