40.1 Vendor Monitoring, Fintech Controls and Service-Company Notices

Stage 4: Ongoing Monitoring

Risk management does not conclude upon contract execution; ongoing monitoring validates continuous adherence:

• Performance & SLA Dashboards: Regular review of operational uptime, transaction throughput, and SLA compliance metrics.
• Customer Complaint Surveillance: Tracking, investigating, and analyzing all consumer complaints directed at or arising from the vendor's operations to detect emerging compliance breakdown patterns.
• Evidence refresh: Obtain suitable control, financial and continuity evidence at a risk-appropriate frequency. Annual SOC reports can be useful; neither a particular SOC type nor an annual cycle is prescribed for every relationship.
• Compliance Transaction Testing: Bank compliance personnel should periodically sample and test transactions handled by the vendor (e.g., auditing adverse action letters mailed by a third-party print shop or verifying APR calculations performed by a loan servicing vendor).

Stage 5: Termination & Offboarding

The bank should maintain a documented exit strategy to ensure operational continuity and protect consumer data upon contract expiration or early termination:

• Transition Execution: Smooth transfer of services to an alternate provider or insourcing back into the bank without service disruption or customer harm.
• Verifiable Data Destruction: Formal certification confirming that all bank confidential information, customer records, and NPI have been securely returned or destroyed in accordance with NIST or DoD data destruction standards.
• Access Revocation: Prompt revocation of all digital credentials, system access, API keys, VPN tunnels, and physical badges.

---

3. Special Compliance Considerations for Fintech Partnerships & Banking-as-a-Service (BaaS)

The rapid expansion of Banking-as-a-Service (BaaS) and fintech partnership models has attracted intensive supervisory scrutiny from the OCC, FDIC, and Federal Reserve. In these arrangements, chartered banks provide balance sheet access, payment rails, and regulatory sponsorship to customer-facing fintech platforms.

White-Label Deposit Programs & FDIC Part 328 Subpart B

When fintech partners market white-label deposit accounts, compliance officers should enforce strict adherence to modernized FDIC advertising and signage regulations:

• Prohibition on Misrepresentation (12 U.S.C. § 1828(a)(4)): Fintechs are legally non-banks and should not state or imply that the fintech company itself is an FDIC-insured depository institution.
• Clear Identification of Chartered Bank: Marketing materials, digital landing pages, and mobile application disclosures should clearly identify the specific chartered insured bank that holds the customer deposits (e.g., "ABC Financial is a financial technology company, not a bank. Banking services provided by First Regional Bank, Member FDIC").
• Scope of Coverage: Marketing should accurately explain that FDIC insurance protects against the failure of the insured depository institution—not against the bankruptcy, theft, or failure of the fintech company itself.
• Pass-Through Recordkeeping: To ensure individual customer deposits qualify for pass-through insurance up to the $250,000 SMDIA under 12 CFR § 330.5, the bank should ensure the fintech maintains accurate, real-time sub-accounting records reconciling daily beneficial ownership balances.

Consumer Lending Partnerships & Truth in Lending (Reg Z)

Fintech lending arrangements (such as Buy-Now-Pay-Later or online installment loans) require rigorous oversight:

• Disclosure Timings & Accuracy: Ensuring APR calculations, finance charges, payment schedules, and right-of-rescission disclosures comply strictly with Regulation Z (12 CFR Part 1026).
• Credit Card Fee Restrictions: If issuing co-branded credit cards, ensuring compliance with the Credit CARD Act of 2009 restrictions on penalty fees and first-year fee limits.

Algorithmic Underwriting & Fair Lending (Regulation B / ECOA)

Many fintech platforms leverage machine learning algorithms, artificial intelligence, and non-traditional alternative data (e.g., educational history, utility payments, or digital footprint metrics) to underwrite credit:

• Fair lending testing: Test for unlawful discrimination under the applicable ECOA and FHA standards. Regulation B’s July 2026 amendment removed its effects test; distinguish older exam-cutoff teaching from current ECOA law, and assess FHA liability separately.
• Adverse action notices: Provide applicable ECOA reasons and separate FCRA consumer-report and credit-score disclosures; do not equate score factors with principal reasons or use a generic model output as a reason.

Bank Secrecy Act / Anti-Money Laundering (BSA/AML) & Sanctions

In BaaS partnerships, banks frequently outsource customer onboarding and identity verification to the fintech:

• Non-Delegable Anti-Money Laundering Responsibility: The bank cannot delegate its statutory AML responsibilities under 31 CFR Chapter X. The bank's Board remains accountable for BSA compliance.
• CIP and CDD Execution: The bank should independently audit and validate the fintech's Customer Identification Program (CIP), Customer Due Diligence (CDD), and Office of Foreign Assets Control (OFAC) sanctions screening.
• Direct Transaction Surveillance: The bank should maintain direct, uninhibited access to all transactional data to conduct automated transaction monitoring and submit Suspicious Activity Reports (SARs) and Currency Transaction Reports (CTRs) within federal deadlines.

FDIC CMS examination framework.

Service-company notice and incident terms

The Bank Service Company Act requires notice to the bank’s federal supervisor for covered services within thirty days after the service contract is made or the service starts, whichever occurs first. Classify the service before treating every supplier as covered. The bank computer-security incident rule’s thirty-six-hour deadline applies to the bank after it determines a notification incident; it is not a universal vendor contractual notice period. A bank service provider must notify affected bank contacts as soon as possible after determining it has a qualifying disruption or degradation lasting or reasonably likely to last four or more hours. Negotiate appropriate access, confidentiality, performance, notice and termination provisions and escalate material limitations. Retaining responsibility for compliance does not establish automatic liability for every unrelated vendor action.

Interagency third-party guidance.