US Agencies released a guide to provide community banks with a resource to assess risks and perform due diligence on prospective relationships with fintech companies. These US Agencies are the Board of Governors of the Federal Reserve System (FED), the Federal Deposit Insurance Corporation (FDIC), and the Office of the Comptroller of the Currency (OCC). The guide covers six key areas of due diligence that community banks can consider: business experience and qualifications, financial condition, legal and regulatory compliance, risk management and control processes, information security, and operational resilience. The guide is relevant for community banks that are entering into business arrangements with fintech companies to offer enhanced products and services to their customers, increase efficiency, and reduce internal costs.
The guide highlights practical sources of information that may be useful when evaluating fintech companies. Use of this guide is voluntary and a community bank can tailor how it uses relevant information in the guide, based on its specific circumstances, the risks posed by each third-party relationship, and the related product, service, or activity offered by the fintech company. While the guide is written from a community bank perspective, the fundamental concepts may be useful for banks of varying size and for other types of third-party relationships. The following are the key highlights of the due diligence topics covered in the guide:
- Business experience and qualifications. Evaluating a fintech company’s business experience, strategic goals, and overall qualifications allows a community bank to consider a fintech company’s experience in conducting the activity and its ability to meet the bank’s needs.
- Financial condition, legal and regulatory compliance. Evaluating a fintech company’s financial condition helps a community bank to assess the company’s ability to remain in business and fulfill any obligations created by the relationship.
- Legal and Regulatory Compliance. Evaluating a fintech company’s legal standing, its knowledge about legal and regulatory requirements applicable to the proposed activity, and its experience working within the legal and regulatory framework enables a community bank to verify a fintech company’s ability to comply with applicable laws and regulations.
- Risk management and control processes. Evaluating the effectiveness of a fintech company’s risk management policies, processes, and controls helps a community bank to assess the company’s ability to conduct the activity in a safe and sound manner, consistent with the community bank’s risk appetite and in compliance with relevant legal and regulatory requirements.
- Information security, Evaluating a fintech company’s information security measures allows a community bank to assess the adequacy and integrity of a fintech company’s processes for handling and protecting sensitive information, including community bank customer information, depending on the third-party relationship and activity proposed.
- Operational resilience. A community bank may evaluate a fintech company’s ability to continue operations through a disruption. Depending on the activity, a community bank may look to the fintech company’s processes to identify, respond to, and protect itself and customers from threats and potential failures, as well as recover and learn from disruptive events. It is important that third-party continuity and resilience planning be commensurate with the nature and criticality of activities performed for the bank.
Keywords: Americas, US, Banking, Fintech, Community Banks, Third-Party Arrangements, Outsourcing Arrangements, Cloud Computing Arrangement, Regtech, Guidance, US Agencies
The Prudential Regulation Authority (PRA) published the final policy statement PS21/21 on the leverage ratio framework in the UK. PS21/21, which sets out the final policy of both the Financial Policy Committee (FPC) and PRA
The Consumer Financial Protection Bureau (CFPB) proposed to amend Regulation B to implement changes to the Equal Credit Opportunity Act (ECOA) under Section 1071 of the Dodd-Frank Act.
The Prudential Regulation Authority (PRA) decided to maintain, at the 2019 levels, the buffer rates for the Other Systemically Important Institutions (O-SII) for another year, with no new rates to be set until December 2023.
The Financial Stability Board (FSB) published a progress report on implementation of its high-level recommendations for the regulation, supervision, and oversight of global stablecoin arrangements.
In a letter to the authorized deposit taking institutions, the Australian Prudential Regulation Authority (APRA) announced an increase in the minimum interest rate buffer it expects banks to use when assessing the serviceability of home loan applications.
The Committee on Payments and Market Infrastructures (CPMI) and the International Organization of Securities Commissions (IOSCO) are consulting on the preliminary guidance that clarifies that stablecoin arrangements should observe international standards for payment, clearing, and settlement systems.
The European Banking Authority (EBA) and the European Insurance and Occupational Pensions Authority (EIOPA) have set out their respective work priorities for 2022.
The Malta Financial Services Authority (MFSA) updated the guidelines on supervisory reporting requirements under the reporting framework 3.0, in addition to the reporting module on leverage under the common reporting (COREP) framework.
The European Commission (EC) published the Implementing Decision 2021/1753 on the equivalence of supervisory and regulatory requirements of certain third countries and territories for the purposes of the treatment of exposures, in accordance with the Capital Requirements Regulation or CRR (575/2013).
EC published the Implementing Regulation 2021/1751, which lays down implementing technical standards on uniform formats and templates for notification of determination of the impracticability of including contractual recognition of write-down and conversion powers.