STORIES OF IMPACT / Articles by Endurance / Lineage Bank - Lessons for Banks of all Stripes

Lineage Bank - Lessons for Banks of all Stripes by Stephen Curry

On February 23rd, the Federal Deposit Insurance Corporation (FDIC) announced a consent order with Tennessee-based Lineage Bank regarding its third-party risk management program and financial technology (fintech) partners. This order underscores the regulatory attention on BaaS banks and fintech clients, signaling concerns about potential risks in the financial system.

In the past decade, significant advancements have occurred in payments technology, with ACH payment rails serving as a cornerstone of modernization. Despite the convenience these financial apps and technologies offer consumers, they pose unseen risks in transactions and financial flows. Regulators are acutely aware of these risks due to findings in their examinations of banks during the last nine months and are now taking steps to address vulnerabilities. In an era of increased regulatory ferocity, banks need to pay close attention to these developments. I anticipate that dozens of banks will be getting orders on these topics in the coming months.

Based on what we have seen in our practice, fintechs and their technology vendors often lack the robust controls and effective risk management practices that have been developed in the banking industry. Banks have tended to underestimate these risk factors when assessing fintech relationships, often leading to unrealistic expectations of their operational resilience. Some fintechs also experience volatile funding, have opaque operations, or excessive leverage. In some cases, while a fintech may have risk management in place, the underlying data management discipline is deficient, rendering risk management ineffective. Irrespective of the maturity of risk management in a fintech, the sponsoring Bank retains the second line oversight responsibilities. In some cases, Banks lack the resources to provide appropriate oversight of the risk management activities supposedly performed by fintechs.

This Consent Order serves as a reminder for banks to approach third-party risk assessments with the same diligence applied to typical credit risk evaluations. Another significant concern with non-banks is their ability to meet customer redemptions promptly. Whether dealing with fintechs, money market funds, or hedge funds, the rapid movement of money can present challenges. Few non-bank financial institutions maintain adequate liquidity during peak flow requirements. Liquidity problems can quickly escalate during market stress, as witnessed in the FTX, Signature Bank and SVB collapses, and banks and fintechs without the appropriate controls and resources can find themselves stranded.

To address these issues, banks should consider several diligence considerations when assessing fintechs and vendors:

1. Assess Key Control Roles: Evaluate the qualifications and experience of key personnel. Monitor for departures and turnover.

2. Board-Level Control: Ensure appropriate oversight and control procedures at the Board level.

3. Cash Flow and Funding Plans: Analyze cash flow requirements and funding to finance operations.

4. Risk Management Framework: Review risk management practices and review complaints, especially in areas that contributed to past incidents.

5. Segregation of Funds: Ensure proper segregation of customer funds from company funds, and verify appropriate internal controls.

6. Cash Management Processes: Scrutinize cash management processes for transparency and control. Request copies of internal and external audits.

7. ACH & Wire Transfer: Take nothing for granted; ensure the Bank maintains controls and close oversight over all payments processing.

8. Liquidity Management: Assess liquidity management practices and identify vulnerabilities.

9. Information Security: Review data handling practices for security and compliance, as well as data quality and accuracy. Banks must have visibility to customer and transaction data to comply with BSA requirements.

10. Technology Performance Tracking: Evaluate technology performance and related contingency plans.

11. Proof of Reserves and Liabilities: Require evidence of reserves and liabilities through audits.

12. Regulatory Compliance: Ensure compliance with relevant regulations and industry standards. Validate and test customer verification procedures as well as ongoing customer and transactions sanction screening.

13. Legal Agreements: Establish clear service level requirements, periodic representations and warranties, and termination rights.

Internally, banks should involve the board in third-party risk management, maintain robust policies and controls for ACH & wire transfers, closely monitor performance, develop exit strategies, conduct stress tests, validate risk management processes, diversify relationships, establish security operations centers, and implement incident response escalation processes. That's a lot, perhaps by design. It will become increasingly difficult for BaaS to be a small side business for banks. The cost of building the appropriate risk and compliance oversight will likely driver mergers in between BaaS banks, and lead to further consolidation in the fintech arena. Smaller fintechs which cannot absorb these costs are likely to go out of business in 2024.

In conclusion, as fintechs continue to reshape the financial landscape, regulators are bringing intense scrutiny to ensure banks recognize and manage the associated risks diligently. It's essential for banks to treat these partnerships with the same level of scrutiny applied to credit risks, ensuring effective risk mitigation and regulatory compliance.