Bank partnerships
Sponsor bank due diligence for fintechs
Many fintechs offer accounts, cards or payments through a partner bank, an arrangement often called banking as a service (BaaS). The bank has to vet you before it signs and supervise you after. This guide explains what the bank is required to look at, what to prepare, and what to check about the bank in return.
Not legal advice. Each bank sets its own requirements within its regulators' expectations. Checked September 2026.
Why banks scrutinize fintech partners
In June 2023 the Federal Reserve, the FDIC and the OCC issued the Interagency Guidance on Third-Party Relationships: Risk Management. It replaced each agency's earlier guidance and applies to the banking organizations they supervise, including relationships with fintechs. The guidance describes a life cycle for every third-party relationship:
- Planning: the bank decides whether the relationship fits its strategy and risk appetite.
- Due diligence and third-party selection: the bank evaluates you.
- Contract negotiation: responsibilities, rights and remedies are written down.
- Ongoing monitoring: the bank keeps checking performance and risk.
- Termination: the relationship ends in an orderly way.
Governance, oversight and independent review run across all five stages. A bank that cannot show it followed this life cycle for a fintech program is exposed in its own exams, which is why its questions to you are detailed.
The rigor is not academic. The 2024 bankruptcy of Synapse Financial Technologies, a middleware company that sat between fintech apps and their partner banks, left many end users unable to reach their money while records were reconciled. Banks and their regulators have focused on ledgers, reconciliation and wind-down planning since.
What the bank will ask for
| Area | Typical requests |
|---|---|
| Company and people | Formation documents, ownership chart, board and management biographies, background checks on key people |
| Financial condition | Financial statements, runway, capital plans, insurance coverage |
| Product | Product description, target customers, flow of funds diagram, fee schedule, marketing materials, customer terms |
| BSA/AML and sanctions | Risk assessment, policy and procedures, monitoring rules, staffing, independent test results; see building a BSA/AML program |
| Consumer compliance | Disclosures, complaint handling, UDAAP review of marketing, Regulation E error resolution, fair lending if you offer credit |
| Information security | Security program, recent audit reports, penetration tests, incident response plan, access controls, PCI DSS status if you handle card data |
| Operations | Ledger design, daily reconciliation, customer support model, business continuity and disaster recovery |
| Your vendors | Your own third parties, especially identity, processing and cloud providers, and how you oversee them |
| Licensing | Your analysis of which state and federal licenses and registrations apply |
How to prepare, step by step
- Build a data room organized by the areas above, with current versions and owners for each document.
- Draw the flow of funds for every product: which accounts, whose name they are in, who moves money, and when each party's obligation ends.
- Write the ledger story. Explain how your ledger records each customer's money and how it reconciles with the bank's records every day.
- Draft a responsibility matrix that lists each compliance task, whether the bank or the fintech does it, and how the other side checks it.
- Prepare a wind-down plan that shows how customers get their money if your company fails or the program ends.
- Run a mock review. Have someone outside the team ask the questions an examiner would.
What to put in the program agreement
- Which party owns the customer relationship and which party's name appears on accounts and cards
- How customer funds are held, including account titling and the records needed for deposit insurance to reach the end customer
- Compliance responsibilities, reporting and escalation timelines
- The bank's rights to audit, approve marketing and require changes
- Service levels, incident notice and data ownership
- Termination rights, transition assistance and the wind-down process
The agreement also decides whether a fintech can rely on a bank-agent exemption from state money transmission licensing. See Texas money transmission exemptions.
Diligence you should run on the bank
- Regulatory standing. Public enforcement actions are searchable on the websites of the FDIC, the OCC and the Federal Reserve. An open order can limit new programs.
- Concentration. How much of the bank's business depends on fintech programs, and how many programs it supports with its current staff.
- Capabilities. Which rails it supports, cut-off times, limits, card programs and API access; see ACH vs RTP vs FedNow.
- Middleware. Whether a third party sits between you and the bank, and what happens to the ledger if that party fails.
- Timeline and cost. Onboarding steps, minimums, revenue share and any reserve requirements.
After signing: ongoing monitoring
Due diligence does not end at launch. Under the interagency guidance the bank keeps monitoring the relationship, so expect standing requests such as:
- periodic compliance metrics, complaint logs and incident reports;
- approval of new products, new marketing and material changes to existing ones;
- copies of audits, independent tests and regulatory correspondence; and
- updated financial statements, so the bank can judge whether you can keep meeting your obligations.
Treat these as part of the product's operating cost, and staff for them from the start.
Describing deposit insurance accurately
FDIC deposit insurance protects depositors against the failure of an insured bank. It does not protect anyone against the failure of a non-bank fintech, and pass-through coverage to end customers depends on the account records meeting FDIC requirements. The FDIC has rules against misrepresenting insured status and against misusing its name and logo, so review every mention of FDIC insurance in your app and marketing with the bank.
Common questions
How long does sponsor bank due diligence take?
It varies by bank and by product, and there is no standard timeline. Having a complete data room and a clear flow of funds is the part a fintech controls.
Can a Texas fintech partner with a bank in another state?
Yes. Banks are chartered and supervised by their own regulators, and many fintech programs use banks located outside the fintech's home state. The fintech still has to consider the licensing rules of each state where its customers are.
Does a bank partnership remove the need for licenses?
Sometimes, for some activities. It depends on how the program is structured and on each state's exemptions. Document the analysis rather than assuming it.
What is the most common gap banks find?
There is no published ranking, but ledger reconciliation, alert backlogs and marketing that overstates deposit insurance are recurring themes in regulators' public statements on bank-fintech arrangements.
For everything a partner bank will expect to see documented, use the fintech compliance checklist.
Last reviewed 2026-09-17