6.2 How Banks Risk-Rate FinTechs: Onboarding, Ongoing Oversight, and De-Risking
Key Takeaways
Banks often assess a FinTech in three ways at once: as a high-risk customer type, as a third party under risk management guidance, and as a nested or correspondent-like channel.
Wolfsberg Group questionnaires such as the CBDDQ and FCCQ are common tools banks use to collect a FinTech's financial crime programme information.
The US Treasury's April 2023 De-risking Strategy, required by AMLA section 6215, highlighted MSBs, non-profits and small correspondent relationships as most affected.
In September 2026, the US banking agencies and the NCUA proposed new third-party risk guidance to replace the 2023 interagency guidance, which remains in effect until finalised.
CAFCA sub-topic 1.8 asks how FinTechs are risk-categorised by more traditional institutions and how to maintain those relationships through onboarding, ongoing review and the threat of de-risking. Almost every FinTech depends on banks for accounts, card issuing, settlement or sponsorship. Losing a bank can stop the business overnight.
Three lenses banks use
| Lens | Why the bank uses it | What it drives |
|---|---|---|
| High-risk customer type | MSBs, payment service providers, VASPs and third-party payment processors appear as higher-risk business types in supervisory manuals | Enhanced due diligence on the FinTech's licences, ownership, management, AML programme and expected activity |
| Critical third party | In BaaS and program-manager models, the FinTech performs bank functions such as onboarding, servicing and first-line monitoring | Full third-party lifecycle management under bank guidance: planning, due diligence, contracting, ongoing monitoring and termination |
| Nested or correspondent-like channel | The FinTech's own customers' payments flow through the bank, often in aggregated form | Questions about the end-customer base, nested providers, visibility of originators and beneficiaries, and data feeds |
The US interagency third-party guidance of June 2023 still applies. In September 2026 the OCC, Federal Reserve, FDIC and NCUA proposed replacement guidance, with comments due in November 2026. Banks therefore expect FinTech partners to work within a lifecycle approach, whatever the final text.
Factors that move a FinTech's risk rating
- Licensing and regulatory status: licensed, registered, relying on an exemption, or in a sandbox.
- Business model and products: cross-border payouts, cash loading, crypto, high-risk merchants, lending.
- Customer base: consumers or businesses, geographies, non-residents, PEP exposure, high-risk industries.
- Programme maturity: policies, MLRO capability, screening and monitoring tools, QA, independent testing, audit findings.
- Growth and scale: rapid growth without matching compliance staffing is a well-known red flag in enforcement actions.
- Ownership and funding: opaque investors, sanctions exposure, financial stability.
- History: enforcement, complaints, chargeback or fraud ratios, previous bank exits.
- Data and transparency: will the bank see raw transaction and customer data?
- Nesting: does the FinTech serve other payment firms, which creates a further layer of customers?
Onboarding with a bank
Expect the bank to send a due diligence questionnaire. Many banks use or adapt the Wolfsberg Group Correspondent Banking Due Diligence Questionnaire (CBDDQ) or Financial Crime Compliance Questionnaire (FCCQ). The bank will also review policies, test sample files, interview management, examine independent audit or SOC reports, and agree contractual controls. A FinTech that prepares a data room in advance gets through onboarding faster: licences, policies, risk assessment, the last independent test, MI samples, organisation chart, and screening and monitoring tool details.
Ongoing oversight and keeping the relationship
| What the bank needs | What the FinTech should provide |
|---|---|
| Visibility | Agreed MI: customer counts by risk rating, alert volumes and ageing, SAR referrals, fraud and chargeback rates, complaints |
| No surprises | Advance notice of new products, countries, partners and vendors. Many contracts require prior approval |
| Responsiveness | Fast, complete answers to requests for information about specific customers or payments |
| Evidence of control | QA results, independent testing, remediation tracking, model validation for scoring tools |
| Shared escalation | Named contacts, joint incident procedures, agreed timelines for suspicious activity referrals |
Relationship failures usually start with information asymmetry. The bank learns about a risk from an examiner or the media before it hears from its partner.
De-risking
De-risking is the wholesale ending or restriction of relationships with whole categories of customers to avoid risk instead of managing it case by case. FATF has warned that de-risking can push activity into less transparent channels and harm financial inclusion. The US Treasury's 2023 De-risking Strategy, published in April 2023 under section 6215 of the AML Act of 2020, found that small MSBs, non-profits working in high-risk regions, and foreign banks with low correspondent volumes were the most affected. In August 2025 a US executive order directed regulators to address politicised or unlawful debanking.
Supervisors expect risk-based decisions about individual relationships. They do not expect zero tolerance by category. A bank can still exit a FinTech whose risk it cannot manage. FinTechs reduce that risk by showing controls that work, keeping honest MI, and fixing issues quickly.
Realistic exam scenario
A partner bank's annual review notes that the FinTech's cross-border payouts doubled without notice. Its alert backlog is 45 days, and two new payout corridors were added without approval. The bank warns that it may restrict the programme. The FinTech's best response is to acknowledge the gaps and provide accurate data. It should pause new corridors pending approval, present a resourced backlog plan with milestones, and agree enhanced MI and an independent review. Disputing the findings or delaying the data increases the chance of exit.
Common exam traps
- "Being a bank's customer means the bank does our compliance." The FinTech still runs its own obligations and any delegated controls.
- Launching features first and telling the bank later.
- Treating de-risking as required by regulators. Supervisors expect relationship-level risk management, not blanket exits.
Why does a sponsor bank often treat its FinTech partner both as a customer and as a third party?
It is a higher-risk customer type and also performs bank functions under third-party oversight
Because third-party guidance applies only to customers, never to service providers
Because the FinTech pays the bank programme fees and also prepares and files the bank's quarterly call reports
Because federal law requires every FinTech partner to hold its own bank charter first
Which practice best helps a FinTech keep a healthy bank partnership?
Responding to bank findings only through legal counsel
Agreed MI, early notice of changes, and fast answers to the bank's information requests
Launching new payout corridors first and informing the bank at the annual review
Limiting the bank's access to raw transaction data in order to protect customer privacy
What does 'de-risking' mean in the AML context?
Transferring compliance responsibility to a partner bank
Moving customers from a high-risk rating to a low-risk rating after a periodic review
Reducing residual risk by adding enhanced due diligence for a high-risk customer
Ending or restricting whole categories of customers to avoid rather than manage risk
Sections you finish are checked off in the contents.