Regulator orders since 2023 tied to US banks’ fintech, BaaS or third-party payment business, with their status.
This tracker lists sponsor-bank enforcement actions by the FDIC, the OCC and the Federal Reserve since March 2023: formal orders and agreements whose own text or announcement ties them to a bank’s fintech, banking-as-a-service, program-manager or third-party payment business. As of October 5, 2026 it holds 17 actions, 16 against banks and one against a bank holding company. Ten are in force and seven have been terminated.
Last checked: October 5, 2026. Refreshed weekly.
Orders in force
| Bank | Regulator | Order | Issued | What it requires or restricts |
|---|---|---|---|---|
| Cross River Bank | FDIC | FDIC-22-0040b consent order | Mar 8, 2023 | FDIC non-objection before any new third-party lending partner or new credit product |
| Choice Financial Group | FDIC, North Dakota | FDIC-23-0086b consent order | Dec 18, 2023 | AML program covering customers onboarded through third parties; lookback of those customers |
| Lineage Bank | FDIC | FDIC-23-0041b consent order | Jan 30, 2024 | No new fintech partners until a formal onboarding process is in place; exit plans for major fintech partners |
| Sutton Bank | FDIC, Ohio | FDIC-23-0110b consent order | Feb 1, 2024 | Inventory of program managers’ AML duties; customer identification lookback for prepaid cards from July 2020 |
| Piermont Bank | FDIC | FDIC-23-0038b consent order | Feb 27, 2024 | Review of data, systems and controls for every third-party relationship; board approval for new partners |
| Mode Eleven Bancorp (holding company of Summit National Bank) | Federal Reserve | 24-008-B-HC cease-and-desist order | Mar 28, 2024 | No expansion of its fintech business strategy without Reserve Bank approval; wind-down plan |
| Evolve Bank & Trust | Federal Reserve, Arkansas | 24-012-B-SM, 24-012-B-HC cease-and-desist order | Jun 11, 2024 | Supervisors’ prior approval for new fintech partners, program managers or products in its Open Banking Division |
| Green Dot Bank | Federal Reserve | 24-005-B-SM, 24-005-B-HC cease-and-desist order | Jul 19, 2024 | $44 million penalty; independent reviews of consumer compliance and AML for prepaid and tax refund services |
| FFB Bank | FDIC, California | FDIC-24-0112b consent order | Jan 10, 2025 | No new ISOs or sub-ISOs in its merchant services program until its ISO review plan is in place |
| Community Federal Savings Bank | OCC | AA-ENF-2025-21 consent order | Apr 24, 2026 | BSA/AML action plan for its payment processing line; independent lookback of suspicious activity |
“In force” means the regulator had published no termination by October 5, 2026. The FDIC’s monthly releases name banks only from February 2025 onward, so for older FDIC orders we also searched the FDIC order database.
Terminated orders
| Bank | Regulator | Order | Issued | Terminated |
|---|---|---|---|---|
| Metropolitan Commercial Bank | Federal Reserve (NYDFS penalty separately) | 23-018-B-SM cease-and-desist order and $14.5 million penalty | Oct 16, 2023 | Dec 4, 2025 |
| First Fed Bank | FDIC | FDIC-23-0026b consent order | Nov 21, 2023 | Oct 23, 2024 (date from the bank’s SEC filing) |
| Blue Ridge Bank | OCC | AA-ENF-2023-68 consent order | Jan 24, 2024 | Nov 13, 2025 (AA-ENF-2025-58) |
| Thread Bank | FDIC | FDIC-24-0022b consent order | May 21, 2024 | Dec 22, 2025 |
| Axiom Bank | OCC | AA-SO-2024-83 formal agreement | Oct 3, 2024 | Apr 29, 2026 (AA-SO-2026-26) |
| Patriot Bank | OCC | AA-NE-2025-05 formal agreement | Jan 14, 2025 | Jun 30, 2026 (AA-ENF-2026-34) |
| Hatch Bank | FDIC (California parallel order) | FDIC-24-0062b consent order | Apr 3, 2025 | Jan 21, 2026 |
What the orders have in common
- Limits on growth. Seven of the 17 actions limit new partners or products without a regulator’s approval or until controls are fixed: Cross River, First Fed, Blue Ridge, Lineage, Mode Eleven Bancorp, Evolve and FFB. Five of those seven are still in force.
- Third parties in the text. Every order in the tracker names third parties, fintech partners, program managers or independent sales organizations in its findings or requirements.
- Lookbacks. Sutton, Choice, Axiom, Patriot and Community Federal Savings Bank were ordered to re-review past customers or transactions.
What is not in the tracker
Orders whose text does not tie them to fintech, BaaS, program-manager or third-party payment business are left out, even when the bank has fintech partners. For example, Lineage Bank’s second consent order, FDIC-26-0028b of June 24, 2026, covers capital, problem loans and brokered deposits and is listed on the Lineage Bank profile but not here. The inclusion rule is on the methodology page.