Sponsor bank due diligence should establish whether a bank and fintech can run the proposed activity safely, legally and operationally. A product demo is not enough. The review needs evidence about the business, financial condition, compliance controls, information security, resilience and the contract that will govern the relationship.
The US banking agencies’ fintech due diligence guide is written for community banks, but it gives both sides a practical map of the information a bank may need.
Scope follows the activity and its risk
The guide says the scope and depth of due diligence depend on the nature and criticality of the activity. A marketing tool and a platform that opens accounts or moves customer money do not present the same operational or compliance exposure.
Begin with a precise operating model. The BaaS hub separates this relationship work from the site’s payment and infrastructure explainers. Identify the bank, the fintech, any processors or other fourth parties, the product, the customer relationship and who performs each controlled activity.
The 2023 interagency third-party risk guidance describes a life cycle rather than a single onboarding check. Planning, due diligence and selection, contract negotiation, ongoing monitoring and termination are connected stages.
Review the business before the interface
The agencies’ fintech guide groups due diligence into six topics:
- Business experience and qualifications.
- Financial condition.
- Legal and regulatory compliance.
- Risk management and controls.
- Information security.
- Operational resilience.
A bank can tailor the questions, but skipping a topic should be a reasoned decision rather than an accident.
Business experience includes whether the company has people, systems and a strategy suited to the proposed activity. References and customer growth can help, but they do not replace evidence about the exact service the bank will rely on.
Financial condition is an operating dependency
A fintech can have strong technology and still be unable to support a long implementation, rising compliance costs or an incident. The due diligence guide points to financial statements, funding, cash position, growth and other indicators that can help a bank assess sustainability.
The question is not whether the bank predicts the company’s future perfectly. It is whether a financial change could interrupt the activity and what protections exist if that happens.
Contracts can support that analysis with reporting rights, notice of material changes and transition assistance. They cannot repair a business model the bank does not understand.
Compliance responsibilities need named owners
The agencies state that using a third party does not reduce a bank’s responsibility to operate safely and comply with applicable law. A sponsor bank therefore needs more than a statement that the fintech “handles compliance.”
Create a responsibility map for onboarding, customer communications, complaints, transaction monitoring, sanctions controls, recordkeeping, regulatory reporting and issue escalation where those functions apply.
For each function, record:
- who performs the task;
- whose policy governs it;
- which data and evidence are retained;
- which exceptions reach the bank;
- how the bank tests or oversees performance;
- what happens when the parties disagree.
A service-level target can measure speed. It does not establish that a regulatory decision was made by the right party with the right evidence.
Controls need evidence, not only descriptions
Policies describe intended behavior. Due diligence should also examine how controls operate: recent test results, issue logs, audit findings, access reviews, change approvals and remediation evidence.
The depth should match the risk. A bank may need to sample workflows or data rather than accept a slide stating that a control exists.
Third-party reports can help, but their scope, period, systems and exceptions matter. A clean report for one environment does not automatically cover the product being proposed.
Information security follows the data
Map what customer, account and transaction data moves between systems. Then identify where it is stored, who can access it, how access is removed and how incidents are reported.
The guide includes information security as its own due diligence topic. That is useful discipline because security can be diluted when it is treated as a single line inside a general technology review.
Data rights belong in the contract as well. The bank needs enough access to oversee the activity, respond to regulators and customers, investigate events and transition if the relationship ends.
Operational resilience includes exit planning
Resilience is more than uptime. Consider recovery objectives, manual workarounds, staffing, concentration, subcontractors, incident communications and the ability to move or wind down the service.
The interagency guidance says risk management should be commensurate with the bank’s risk profile, complexity and the criticality of the activity. A critical account or payment service needs a more detailed contingency than a replaceable internal tool.
Exit provisions should cover data return, migration support, customer communications, unfinished transactions, record retention and access after termination. Discussing them before launch is easier than negotiating them during an incident.
Contract terms should reflect the review
A due diligence finding matters only if the operating model or contract addresses it. Translate material assumptions into rights and duties.
| Finding | Contract or control response |
|---|---|
| Bank relies on fintech data | Data access, quality standards and reconciliation |
| Material subcontractor supports the service | Disclosure, approval or notice and flow-down obligations |
| Control evidence is needed | Audit, testing and reporting rights |
| Incident could affect customers | Notification triggers, timeframes and response roles |
| Service is critical | Continuity, recovery and transition assistance |
| Regulation changes | Change process, responsibility and termination rights |
The contract is not the end of the life cycle. Ongoing monitoring should test the indicators and controls that mattered to approval.
