Sponsor Banks Keep the Compliance Risk for Their Fintech Partners

WASHINGTON — Most consumer finance apps present a single brand. Behind that brand, a bank holds the deposits or issues the cards, and a technology firm runs the marketing, onboarding and support. The industry calls this a partnership, or banking-as-a-service. Economically it is a rent swap, in which each side leases a scarce asset that the other cannot cheaply build.

US federal banking agencies spent the mid-2020s putting that arrangement into supervisory language. In June 2023 the Office of the Comptroller of the Currency (OCC), the Federal Reserve and the Federal Deposit Insurance Corporation (FDIC) issued final Interagency Guidance on Third-Party Relationships: Risk Management (OCC Bulletin 2023-17). The guidance applies to business arrangements with third parties in general and mentions novel fintech structures by name. Under it, a bank that hands customer contact to a partner keeps the accountability for that contact.

Each side rents what the other lacks, but when supervisors want someone to answer for the program, they go to the bank.

What each side is leasing

The bank's scarce assets are legal and institutional. It has a charter or a membership path into payment systems, deposit insurance branding, compliance programs and sometimes spare balance-sheet capacity. The fintech's scarce assets are commercial: a good mobile interface, performance marketing, distribution through vertical software, and the ability to change the product quickly. The contract splits the economics through interchange sharing, deposit-rate spreads, program fees and minimums. Branding usually favors the fintech on the customer's phone and the bank in the fine print of the account agreement.

Because of that split, the question of who owns the customer has a layered answer. The fintech may own the push notification, while the bank carries many of the legal duties whenever the product is a bank deposit or bank credit. When something goes wrong, whether fraud, misleading marketing, a Bank Secrecy Act (BSA) failure or an outage, the agencies' third-party framework expects the bank to have assessed, contracted, monitored and, if necessary, exited the relationship as seriously as it would with any other critical vendor.

Deposit delivery made the rent explicit

In July 2024 the same three agencies issued a Joint Statement on Banks' Arrangements with Third Parties to Deliver Bank Deposit Products and Services. It deals with arrangements in which a nonbank markets, distributes or facilitates bank deposit products to end users. Banks may use these arrangements to gather deposits, add revenue, reach new geography or acquire technology. The agencies flag the risk-management and compliance problems that arise when someone other than the bank sits between the bank and its customer.

On the same day the agencies published a request for information on bank-fintech arrangements (OCC Bulletin 2024-21), asking the industry for detail on how these programs work and how their risks are managed. Supervisors would hardly go to that trouble over a few quirky pilots, so the request suggests they regard bank-fintech arrangements as a large market structure whose workings they are still piecing together.

Where the structure breaks

Switching costs and concentration risk

Fintechs that treat the sponsor bank as a commodity API eventually find out how high the switching costs are. Moving ledgers, card bank identification numbers (BINs), compliance files and deposit portfolios to another bank is slow and politically fraught. Banks that treat fintech partners as fee income eventually meet concentration risk from the supervisory side, once one program accounts for a large share of deposits or operational dependency. Both parties can collect rent for years without buying any protection against a failure at the other.

The practical message of the interagency guidance is deliberately dull. Examiners expect a bank to inventory its third parties and give each a risk rating. They also expect contract terms that cover audit rights, data and an exit path, and monitoring of nested relationships where a fintech partner relies on vendors of its own. The quality of the app does nothing to move that duty off the bank. Commercially, the partnership is priced as rent for specific scarce assets, and whoever controls retention bears the churn risk. Either side can raise its price, and an exam cycle can end the arrangement early.

Earlier third-party models worked the same way. Affinity cards, white-label deposits and merchant-branded products all rented a bank's license to a nonbank distributor. The new element is scale: software lets a single fintech program gather deposits or card accounts across many states very quickly. The 2023 guidance and the 2024 deposit statement respond to that, because concentration and nested vendors turn a marketing partnership into a safety-and-soundness question.

I would have boards on both sides run a quarterly rent audit built on a few questions:

1. What fee does the bank earn per active account, and does it compensate for risk or reflect a race to the bottom?
2. What customer acquisition cost (CAC) does the fintech pay, and who keeps retention if the bank ends the program?
3. Whose name appears on the account agreement, on the FDIC legend where one applies, and in the complaint log?

Vague answers mean the partnership is less clearly specified than examiners will require.

Bank–fintech distribution will continue because both scarcities are real. Charters and the trust that deposit insurance brings are hard to replicate, and many community banks cannot build mobile distribution or vertical software on their own. A useful analysis tracks who pays whom for the regulatory perimeter, for customer attention, and for the residual risk when a customer complains. The supervisory texts of 2023–2024 already assign that residual risk to the bank.