Does the third-party guidance apply to a bank's relationship with a fintech partner, and how much oversight does a bank need to apply?

Yes. Treat a fintech partner as a third-party relationship and scale your oversight to its risk. The interagency guidance covers any business arrangement between a banking organization and another entity, by contract or otherwise, and it notes that some relationships, such as those with some fintech companies, have new or novel structures.

What the guidance says:

• Where a relationship involves providing products or services to customers, or other interaction with customers, the bank and the third party may have varying degrees of interaction with those customers. Their respective roles and responsibilities may differ based on the specific circumstances of the relationship.
• Not all relationships present the same risk, so not all need the same level or type of oversight. A bank tailors its practices to its size, complexity and risk profile and to the nature of the relationship.
• Some banks assign a criticality or risk level to each relationship, while others identify critical activities and the third parties that support them. Either way, a key element of effective risk management is applying a sound methodology to designate which activities and relationships get more comprehensive oversight.
• Relationships supporting higher-risk activities, including critical activities, call for more comprehensive and rigorous oversight.
• It is supervisory guidance. It does not have the force and effect of law and does not impose new requirements on banking organizations. It is relevant to all banking organizations supervised by the Board, the FDIC and the OCC.
• Using a third party does not diminish the bank's responsibility to operate safely and soundly and to comply with applicable laws and regulations, including those addressing financial crimes, to the same extent as if it performed the activity in-house.

What to do:

• Put the fintech partner in your inventory of third-party relationships and periodically assess its risk.
• Decide whether it supports a critical activity. Critical activities may include those that could expose the bank to significant risk if the third party fails, have significant customer impacts, or significantly affect the bank's financial condition or operations. An activity critical for one bank may not be for another.
• Apply and keep a record of the methodology you used, so the oversight level is explainable.
• Ask what happens to customers and to the bank if the partner fails to meet expectations.

For the specific due diligence, contract and monitoring steps at each stage of the life cycle, check the full guidance.

Sources

1. Federal Register document 2023-12340: https://www.federalregister.gov/documents/2023/06/09/2023-12340/interagency-guidance-on-third-party-relationships-risk-management

This answer is general information, not legal advice. Forteris is not a law firm.