Fintechs are indispensable partners in financial services. By offering innovative solutions to enhance the consumer experience, these companies have disrupted traditional models, creating opportunities—and challenges—for banks and credit unions.
While partnerships with fintechs can drive growth, improve efficiency, and expand offerings, they also bring significant risks.
In early 2024, Synapse, a middleware provider that connected fintechs without banking licenses with financial institutions, went bankrupt. Since then, four of its bank partners have been sued for allegedly mishandling customer funds. While the lawsuit’s outcome is yet to be determined, it underscores the risk FIs take on when working with a fintech.
While every fintech-FI relationship looks different, there are some common challenges institutions face when partnering with fintechs. Let’s take a look at four of the most common challenges financial institutions face when working with fintechs and how third-party risk management (TPRM) best practices can help address them.
Related: Are Fintechs the Future?
Regulatory compliance
Fintechs often lack the regulatory expertise of traditional financial institutions. While they excel at innovation, they may not fully understand the complex compliance frameworks governing banks and credit unions. This can lead to significant compliance risk for institutions that are ultimately responsible for ensuring their vendors' compliance with all relevant laws and regulations. It’s also the reason why as of October 2024, 10 out of 13 most recent enforcement actions mentioned TPRM weaknesses.
Operational risk
Integrating fintech solutions into a financial institution’s existing systems can introduce operational vulnerabilities, from cyber attacks to software compatibility issues to service disruptions. If a fintech fails or doesn't integrate properly, it can impact the institution's services and reputation. Just look at the credit union that recently paid a $1.5 million penalty to the CFPB after the failed launch of a new online banking platform meant customers couldn’t access their money online for weeks.
Data security and privacy
FIs prioritize keeping their customers' data confidential, but potential data breaches or misuse of information by a fintech can lead to significant liabilities and damage to customer trust. Third-party vendors (including fintechs) are a common source of data breaches and regularly make news.
Cultural differences
Traditional financial institutions prioritize regulatory adherence when making decisions, recognizing that what the institution wants to do isn’t always the same as what it’s legally permitted to do. Fintechs focus on rapid innovation and growth. Their decisions are often focused on how to quickly achieve their growth goals, with legal and regulatory compliance an afterthought at best. These differing priorities can lead to friction when it comes to decision-making and execution, with fintechs sometimes pressuring their financial institution partners and threatening to leave if they can’t support their speed in market plans.
Related: How to Avoid Common Third-Party Risk Management Mistakes | Ncontracts
How can FIs mitigate risk when working with fintechs?
We’ve outlined the challenges FIs face when working with fintechs, but how can these risks be avoided or mitigated? Limited regulatory guidance on engaging in fintech partnerships exists, but the Interagency Guidance on Third-Party Relationships is a good starting point.
Let’s explore the four pillars of the guidance in more detail:
Integrate fintech risk management into enterprise risk management
Managing fintech risks isn’t a standalone task. It should be part of your institution’s broader enterprise risk management (ERM) framework. A well-integrated approach identifies, assesses, mitigates, monitors, and communicates risks across the institution, ensuring that fintech relationships align with your FI’s risk appetite.
Best Practices:
- Ensure fintech vendor management connects with other key areas, such as compliance, business continuity, and information security.
- Clearly define your institution’s risk appetite, especially regarding technology. For higher-risk activities, allocate additional resources to oversight and monitoring.
- Engage the board and leadership to align fintech partnerships with strategic goals.
Related: ERM 101: What’s COSO, and Why Should I Care?
Implement the third-party relationship lifecycle
The interagency guidance breaks down the third-party vendor management lifecycle into five phases that should be a part of managing any fintech relationship:
- Planning. Establish a reason for this fintech partnership. Ensure there is a solid business case and identify the potential risks. Additionally, have adequate time and human resources to oversee the relationship.
- Due diligence and third-party selection. Vendor due diligence involves thoroughly assessing and managing the risks associated with your bank’s third-party service-provider relationships. You should also investigate fintech’s compliance with laws, regulations, and operational capabilities. The scope of your due diligence should reflect the complexity and risk level of the relationship.
- Contract negotiations. Vendor contract management is the process of analyzing, organizing, and overseeing third-party contracts and agreements. Use contract negotiations as an opportunity to include provisions that address risk management.
- Ongoing monitoring. While a fintech relationship can start on the right foot, compliance and productivity levels may fluctuate. Regularly verify that fintechs deliver on promised products and services and that their controls are adequate. If you identify a vendor red flag, communicate it with the fintech, update contracts as needed, and consult your leadership team if the problems escalate.
- Terminations. Define the terms and conditions for ending a fintech relationship. Be explicit about the causes for termination, related costs, data management, and how you will transition to a new service provider if necessary.
Related: Third-Party Service Providers and Vendor Management: What Banks Need to Know About New Guidance
Governance
Assessing a fintech’s governance processes, “such as the establishment of clear roles, responsibilities, and segregation of duties,” is part of the due diligence process when evaluating a third party’s overall risk management.
Put simply, governance refers to your FI’s approach to oversight and accountability for the vendor relationship. Conduct internal reviews of the fintech relationship, ensuring all updates are documented. As the saying goes, “If it isn’t documented, it didn’t happen.”
Documentation is crucial in showing regulators that your FI is taking governance seriously. Lack of appropriate governance, oversight, and risk management systems and controls is a leading cause of enforcement actions.
Related: Bank Compliance: If It Isn’t Documented, It Didn’t Happen
Supervisory reviews of third-party relationships
The newest pillar in interagency guidance, the supervisory review process, refers to how examiners will assess your institution’s third-party risk management process, including whether activities are conducted “in a safe and sound manner” and in compliance with laws and regulations. Activities potentially conducted include transaction testing or reviewing test results, discussing material risk with the board members, and reviewing the institution’s risk profile.
The guidance also explains that the scope of supervisory reviews depends on the institution’s activities and third-party relationships. Depending on your organization’s size, resources, and fintech usage, the review may be less or more extensive.
Review: TPRM 101: Top Third-Party Vendor Risks Pose for Financial Institutions
TPRM as a tool for fintech relationship management
A strong TPRM program helps address the challenges financial institutions face when pursuing fintech relationships. A strong TPRM framework involves thorough due diligence during vendor selection, verifying regulatory compliance, and ongoing monitoring to mitigate risks and reputational damage.
Operational risk assessments are central to TPRM, focusing on fintechs’ cybersecurity, disaster recovery plans, and integration capabilities. Continuous monitoring addresses evolving risks as technology advances.
TPRM also prioritizes data security and privacy, requiring evaluation of fintechs’ data handling, encryption, and incident response policies. Regular audits and monitoring safeguard customer trust and institutional integrity.
Finally, a robust TPRM strategy aligns fintech partnerships with institutional risk appetite and goals. Clear expectations, defined roles, and open communication bridge cultural gaps and foster stronger, more collaborative relationships.
While fintechs can become essential partners and critical vendors for financial institutions, they also present new compliance and operational security risks. As your FI considers implementing fintech technologies, carefully weigh the risks and rewards, ensure a proper risk management strategy, and ensure the necessary controls are in place to maximize fintech relationships.
Want more information on how to identify and assess potential fintech partners?
Download The Ultimate Guide to Fintech and Third-Party Vendor Onboarding for a deep dive into what you need to know.
Subscribe to the Nsight Blog
Share this
What Is a SOC Report and How Can I Use it for Vendor Management?
Is Your Vendor Prepared for Disaster?
