Compliance Checklist for Bank-Fintech Partnerships and BaaS Providers

Products
Solutions
Platform
Community
Learn
Company
- About Us
- Events
- News & Press
- Clients
- Careers
- Contact Us

The Compliance Checklist for Bank-Fintech Partnerships and BaaS Providers

Whether you’re a bank, fintech, or BaaS provider, this compliance checklist outlines specific areas of consideration for regulatory compliance and mitigating risk.

Table of Contents

Third-Party Risk Management
Due Diligence
Compliance Management System
Documentation and Reporting
Compliance as a Competitive Advantage

Third-Party Risk Management Process

Organizations should consider implementing the following when building out a third-party risk management process.

An outline of partnership strategy, including:

Identifying the inherent risks of the activity

Details on how the organization selects, assesses, and oversees third-party activity

A process for due diligence when vetting new third-party partners (more on this below)

Written contracts that outline the rights and responsibilities of all parties as it pertains to risk management

Contingency plan(s) for terminating a relationship in an effective manner

Board oversight of development and implementation of third-party risk management process

Clearly defined roles and responsibilities for overseeing and managing the relationship and risk management process

Documentation and reporting that facilitates oversight, accountability, monitoring, remediation and risk management.

Independent reviews from third-party partners that allow management to determine that the bank's process aligns with its strategy and effectively manages risks (an internal auditor or an independent third party may perform the reviews)

Due Diligence

Organizations should consider the following when carrying out due diligence activities.

A review of the organization's business experience, including:

Company overview

Organization charts

List of client references using the activities being considered

Volume and types of complaints, including those available from the company, regulatory agencies, and other public sources

Public records of any legal or regulatory actions and to establish corporate standing, if applicable

Media reports mentioning the company

Summary of any past operational failures of the company

A review of the organization's regulatory compliance practices, including:

Policies, procedures, training, and internal controls pertaining to compliance with legal and regulatory requirements

Proposed contract terms that specify performance of legal and compliance duties

Information regarding customer-facing delivery channels or applications (for example, mail, online, and telephone)

Proposed marketing materials and regulatory disclosures with product details such as fees, interest rates, or other terms

Methods used to monitor, remediate, and respond to customer complaints

Customer complaint records involving thefintech company

A review of the organization's risk management process, including

Policies, procedures, and other documentation related to the prospective activity

List of client references using the activities being considered

Policies and procedures related to the company's internal control environment and overall risk management processes

Information on risk and compliance staffing

Recent results of control reviews and audit reports related to the prospective activity

issue management policies, procedures, and reports

Schedule of planned control reviews and audits

Self-assessments

Training materials and schedules

Inventory of key risk, performance, and control indicators

Sample key risk, performance, and control indicator reports

Compliance Management System

Organizations should ensure the following when building out a robust compliance management system.

Policies and procedures are in place for adhering to applicable state and federal regulations across the internal business and third-party partners

Consumer-facing communications are in compliance with applicable state and federal regulations, including:

Agreements

Disclosures

Marketing materials across formats and channels

Sufficient staff is in place with the necessary expertise, authority, and accountability to manage third-party relationships

Regular and adequate training for staff on laws, regulations, and organizational policies that apply to their jobs

Monitoring of staffing model to make appropriate updates as necessary

Ongoing monitoring of all third-party activities and performance, with a focus on:

Compliance with legal and regulatory requirements

Oversight of any partners associated with the third-party

Discovery and monitoring across all parties’ marketing channels

Identifying and addressing compliance issues before cited in audit reports

Tracking volume, nature, and trends of consumer complaints that indicate compliance or risk management issues

Monitoring process is adaptable to changes in the types and level of risks associated with the lifetime of the partnership

A process for adjusting policies, procedures, and controls in response to external changes

A course of action to quickly remediate customer complaints

Methodology for designating which third-party relationships receive more comprehensive and rigorous oversight and risk management

Particular focus on partners involving critical activities (including significant bank functions or shared services)

Documentation and Reporting

Organizations should have the following documentation and reports available for regulators.

Inventory of all third-party relationships

Highlight relationships that involve critical activities

Approved plans for third-party relationships

Due diligence results, findings, and recommendations

Costs associated with partnerships

Executed contracts

Risk management and performance reports of third parties

Reports to senior management and the board of results of ongoing monitoring of third parties

Reports to senior management and the board of results of reviews of organization’s overall risk management process

Make Compliance Your Competitive Advantage

Whether you’re a bank, fintech, or BaaS provider, prioritizing compliance oversight is critical to managing risk with third-party relationships and for gaining a competitive advantage.

PerformLine’s omni-channel compliance monitoring solution provides