Tom Curry

All banks, including community banks, have been dependent upon technology to operate since the advent of mainframe computers decades ago and the launch of ATMs in the 1970s. Financial technology has advanced rapidly since the Great Financial Crisis. Third-party providers of technology, including fintech startups and mature BigTech firms, are providing many of the back-office services and customer interfaces once provided manually or in person by banks. Today, banking and technology are intertwined and regulatory expectations for third-party provider management have increased accordingly.

Community banks are increasingly using digital services provided through fintechs to remain competitive and meet their customers’ banking needs. The result is a generally mutually beneficial relationship. Community banks, which may not have access to resources that would allow them to update their technology and meet the needs of their customers, are giving fintechs a space to test their products and services. On the other hand, fintechs, which have limited regulatory compliance infrastructures or experience, often can rely upon community banks to be better equipped to handle those compliance matters.

Kate Henry

Financial regulators recognize the benefits of this relationship but also see potential compliance, reputational privacy and cybersecurity risks that need to be identified, recognized and mitigated. Since 2013, the OCC and the Federal Reserve have provided their supervised entities with similar but differing guidance on third-party risk management. The OCC, to its credit, also recognized the potential burden of its due diligence and monitoring requirements for third party providers on community banks and attempted to provide additional clarity in 2017.

A major recent development was an August publication by the Board of Governors of the Federal Reserve System, the FDIC and the OCC providing uniform guidance to all banks, including community banks, as to best practices when conducting due diligence and entering into prospective business relationships with fintech companies and other significant third-party providers, particularly in the areas of compliance, risk management, resilience and cybersecurity, combining the agencies’ supervisory experience.

Armand J. Santaniello

Areas of Reward and Risk

In September, the Federal Reserve issued a report outlining the responses generated from an outreach initiative with community banks, fintechs and other stakeholders regarding the major types of community bank-fintech relationships as well as the risks lenders face in balancing customer needs with the need to ensure safe banking operations and consumer protection.

In what the report called “operational technology partnerships,” a community bank will utilize third-party technology to enhance and streamline processes, monitoring capabilities, technical infrastructure and regulatory compliance with the goal of reducing error and creating efficiencies. Such a relationship requires community banks to understand new products and services, including inherent risks.

In “customer-oriented partnerships,” a community bank interacts directly with its customers and engages a third party to enhance its customer-facing features. Such relationships benefit community banks’ ability to meet customer expectations, such as improving “agility” in responding to needs associated with the COVID-19 pandemic and Paycheck Protection Program. However, community banks must consider reputational risk and required disclosures associated with such consumer-facing products, along with technical infrastructure considerations.

Lastly, in “front-end fintech partnerships,” a community bank’s infrastructure is combined with fintech technology, which interacts directly with the customer. Such relationships allow banks to reach more customers, including in the digital space, and increase deposit collection and diversify lending portfolios. Community banks and fintech companies must consider the risk that comes with the fintech company appearing as an extension of the bank in the eyes of consumers, which include the fintech companies not understanding bank regulatory requirements.

Leaders Focus Efforts in Key Areas

The Federal Reserve report also highlighted three areas where banks entering into fintech relationships should focus their risk management efforts.

Prior to investing in a fintech relationship, bank leadership often identifies potential problems and the results it hopes to achieve. Such an approach may require an adjustment in bank strategy, especially in including a technology professional in decision-making processes. This vision must be shared by the rest of the bank workforce because they are the ones who use the new technology.

Bank leaders also work to make sure their priorities and objectives are aligned. This includes a clear understanding on such topics as use of customer data, effective risk management standards and regulatory compliance. Community banks surveyed by the Fed stressed that fintechs should understand their role as a fiduciary and financial services partner, while maintaining focus on developing and maintaining customer relationships.

Community banks also see connections with fintechs as an integrated process that facilitates open communication that can improve record-keeping, analytical capabilities, regulatory compliance and marketing efforts. Ideally, siloed bank processes are eliminated.

These publications are an indication of the financial regulatory authorities’ growing recognition of the importance of technology to community banks and the role fintech companies play. Community banks and fintechs alike can look to these publications to develop a better understanding of the needs of the other and the underpinnings of a successful relationship.

Thomas J. Curry is a partner in Nutter’s corporate and transactions department. Kate Henry and Armand J. Santaniello are associates in Nutter’s corporate and transactions department. Curry is former U.S. comptroller of the currency and all are members of the firm’s banking and financial services group.