US Agencies released a guide to provide community banks with a resource to assess risks and perform due diligence on prospective relationships with fintech companies. These US Agencies are the Board of Governors of the Federal Reserve System (FED), the Federal Deposit Insurance Corporation (FDIC), and the Office of the Comptroller of the Currency (OCC). The guide covers six key areas of due diligence that community banks can consider: business experience and qualifications, financial condition, legal and regulatory compliance, risk management and control processes, information security, and operational resilience. The guide is relevant for community banks that are entering into business arrangements with fintech companies to offer enhanced products and services to their customers, increase efficiency, and reduce internal costs.
The guide highlights practical sources of information that may be useful when evaluating fintech companies. Use of this guide is voluntary and a community bank can tailor how it uses relevant information in the guide, based on its specific circumstances, the risks posed by each third-party relationship, and the related product, service, or activity offered by the fintech company. While the guide is written from a community bank perspective, the fundamental concepts may be useful for banks of varying size and for other types of third-party relationships. The following are the key highlights of the due diligence topics covered in the guide:
- Business experience and qualifications. Evaluating a fintech company’s business experience, strategic goals, and overall qualifications allows a community bank to consider a fintech company’s experience in conducting the activity and its ability to meet the bank’s needs.
- Financial condition, legal and regulatory compliance. Evaluating a fintech company’s financial condition helps a community bank to assess the company’s ability to remain in business and fulfill any obligations created by the relationship.
- Legal and Regulatory Compliance. Evaluating a fintech company’s legal standing, its knowledge about legal and regulatory requirements applicable to the proposed activity, and its experience working within the legal and regulatory framework enables a community bank to verify a fintech company’s ability to comply with applicable laws and regulations.
- Risk management and control processes. Evaluating the effectiveness of a fintech company’s risk management policies, processes, and controls helps a community bank to assess the company’s ability to conduct the activity in a safe and sound manner, consistent with the community bank’s risk appetite and in compliance with relevant legal and regulatory requirements.
- Information security, Evaluating a fintech company’s information security measures allows a community bank to assess the adequacy and integrity of a fintech company’s processes for handling and protecting sensitive information, including community bank customer information, depending on the third-party relationship and activity proposed.
- Operational resilience. A community bank may evaluate a fintech company’s ability to continue operations through a disruption. Depending on the activity, a community bank may look to the fintech company’s processes to identify, respond to, and protect itself and customers from threats and potential failures, as well as recover and learn from disruptive events. It is important that third-party continuity and resilience planning be commensurate with the nature and criticality of activities performed for the bank.
Keywords: Americas, US, Banking, Fintech, Community Banks, Third-Party Arrangements, Outsourcing Arrangements, Cloud Computing Arrangement, Regtech, Guidance, US Agencies
The three European Supervisory Authorities (ESAs) issued a letter to inform about delay in the Sustainable Finance Disclosure Regulation (SFDR) mandate, along with a Call for Evidence on greenwashing practices.
The International Sustainability Standards Board (ISSB) of the IFRS Foundations made several announcements at COP27 and with respect to its work on the sustainability standards.
The International Organization for Securities Commissions (IOSCO), at COP27, outlined the regulatory priorities for sustainability disclosures, mitigation of greenwashing, and promotion of integrity in carbon markets.
The European Banking Authority (EBA) issued a statement in the context of COP27, clarified the operationalization of intermediate EU parent undertakings (IPUs) of third-country groups
The Office of the Superintendent of Financial Institutions (OSFI) published an annual report on its activities, a report on forward-looking work.
The Australian Prudential Regulation Authority (APRA) finalized amendments to the capital framework, announced a review of the prudential framework for groups.
The Bank for International Settlements (BIS) Innovation Hubs and several central banks are working together on various central bank digital currency (CBDC) pilots.
The Financial Accounting Standards Board (FASB) is seeking comments, until November 03, 2022, on the proposed technical and other conforming improvements for the 2023 GAAP Financial Reporting Taxonomy.
The European Central Bank (ECB) published the results of its thematic review, which shows that banks are still far from adequately managing climate and environmental risks.
Among its recent publications, the European Banking Authority (EBA) published the final standards and guidelines on interest rate risk arising from non-trading book activities (IRRBB)