US Agencies released a guide to provide community banks with a resource to assess risks and perform due diligence on prospective relationships with fintech companies. These US Agencies are the Board of Governors of the Federal Reserve System (FED), the Federal Deposit Insurance Corporation (FDIC), and the Office of the Comptroller of the Currency (OCC). The guide covers six key areas of due diligence that community banks can consider: business experience and qualifications, financial condition, legal and regulatory compliance, risk management and control processes, information security, and operational resilience. The guide is relevant for community banks that are entering into business arrangements with fintech companies to offer enhanced products and services to their customers, increase efficiency, and reduce internal costs.
The guide highlights practical sources of information that may be useful when evaluating fintech companies. Use of this guide is voluntary and a community bank can tailor how it uses relevant information in the guide, based on its specific circumstances, the risks posed by each third-party relationship, and the related product, service, or activity offered by the fintech company. While the guide is written from a community bank perspective, the fundamental concepts may be useful for banks of varying size and for other types of third-party relationships. The following are the key highlights of the due diligence topics covered in the guide:
- Business experience and qualifications. Evaluating a fintech company’s business experience, strategic goals, and overall qualifications allows a community bank to consider a fintech company’s experience in conducting the activity and its ability to meet the bank’s needs.
- Financial condition, legal and regulatory compliance. Evaluating a fintech company’s financial condition helps a community bank to assess the company’s ability to remain in business and fulfill any obligations created by the relationship.
- Legal and Regulatory Compliance. Evaluating a fintech company’s legal standing, its knowledge about legal and regulatory requirements applicable to the proposed activity, and its experience working within the legal and regulatory framework enables a community bank to verify a fintech company’s ability to comply with applicable laws and regulations.
- Risk management and control processes. Evaluating the effectiveness of a fintech company’s risk management policies, processes, and controls helps a community bank to assess the company’s ability to conduct the activity in a safe and sound manner, consistent with the community bank’s risk appetite and in compliance with relevant legal and regulatory requirements.
- Information security, Evaluating a fintech company’s information security measures allows a community bank to assess the adequacy and integrity of a fintech company’s processes for handling and protecting sensitive information, including community bank customer information, depending on the third-party relationship and activity proposed.
- Operational resilience. A community bank may evaluate a fintech company’s ability to continue operations through a disruption. Depending on the activity, a community bank may look to the fintech company’s processes to identify, respond to, and protect itself and customers from threats and potential failures, as well as recover and learn from disruptive events. It is important that third-party continuity and resilience planning be commensurate with the nature and criticality of activities performed for the bank.
Keywords: Americas, US, Banking, Fintech, Community Banks, Third-Party Arrangements, Outsourcing Arrangements, Cloud Computing Arrangement, Regtech, Guidance, US Agencies
The European Banking Authority (EBA) published four draft principles to support supervisory efforts in assessing the representativeness of COVID-19-impacted data for banks using the internal ratings based (IRB) credit risk models.
The European Council and the European Parliament (EP) reached a provisional political agreement on the Corporate Sustainability Reporting Directive (CSRD).
The Prudential Regulation Authority (PRA) launched a consultation (CP6/22) that sets out proposal for a new Supervisory Statement on expectations for management of model risk by banks.
The European Commission (EC) published the Delegated Regulation 2022/954, which amends regulatory technical standards on specification of the calculation of specific and general credit risk adjustments.
The Bank for International Settlements (BIS) Innovation Hub updated its work program, announcing a set of projects across various centers.
The European Insurance and Occupational Pensions Authority (EIOPA) published two consultation papers—one on the supervisory statement on exclusions related to systemic events and the other on the supervisory statement on the management of non-affirmative cyber exposures.
Certain members of the U.S. Senate Committee on Banking, Housing, and Urban Affairs issued a letter to the Securities and Exchange Commission (SEC)
The European Insurance and Occupational Pensions Authority (EIOPA) published a consultation paper on the advice on the review of the securitization prudential framework in Solvency II.
The Prudential Regulation Authority (PRA) issued a statement on PRA buffer adjustment while the Bank of England (BoE) published a notice on the statistical reporting requirements for banks.
The Basel Committee on Banking Supervision (BCBS) issued principles for the effective management and supervision of climate-related financial risks.