Fintech
Fed Reserve Board issues cease-and-desist order against BaaS provider
Federal Reserve Board issues cease and desist order against banking services provider
On June 14, the Federal Reserve Board (Fed) released a cease and desist order against an Arkansas-based bank-as-a-service (BaaS) provider for compliance and risk management failures. As part of the order, the bank is prohibited from, without prior approval, (i) establishing new fintech partners, subsidiaries, business lines, products, programs, services, or program managers, or (ii) offering new products, programs, or services to an existing fintech partner, program manager, or subsidiary.
According to the Fed, its review found deficiencies in risk management at the bank as early as August 2023, and a subsequent review in January 2024 revealed further non-compliance with Anti-Money Laundering (“AML”), Bank Secrecy Act (“BSA”), and Office of Foreign Asset Control (“OFAC”) requirements. The Fed also revealed deficiencies in the bank’s management of consumer compliance risks.
According to the order, the bank is required to take several measures. These include:
- The board of directors must develop a plan to strengthen the board’s oversight of the bank’s management and operations and its compliance with BSA/AML and OFAC regulations;
- Submit a plan to improve their risk management practices, including written policies and procedures to identify and manage risks with fintech partners; measures to ensure that staff are adequately trained and have sufficient expertise and independence to manage their fintech partnerships; and have a process to quickly identify and report risk exposures related to their fintech partnership program;
- Hire an independent third party to audit and review your fintech partner program for compliance with consumer protection laws and regulations;
- Develop a plan to improve capital risk management taking into account its fintech partnership program and assess the bank’s capital adequacy; the bank must also develop a plan to improve liquidity risk management;
- Improve its processes and controls related to its BSA/AML program; and,
- Improve its lending and credit risk management practices in relation to its fintech partnership program.
Putting it into practice: The bank joins a growing list of BaaS providers that have seen orders demanding better oversight of their fintech partnerships. (See our blog posts on similar consent orders in the past.) Here, HereAND Here). The orders highlight concerns among federal regulators that banks do not have adequate oversight of their fintech partners, resulting in unsafe and unsound banking practices. This order further underscores the need for banks to proactively reassess their fintech partnerships and current risk management practices with prudential regulators. final interagency guide to ensure compliance and mitigate risks.