Fintech
FDIC Orders Thread Bank to Step Up BaaS Oversight
Short dive:
- A Federal Deposit Insurance Corp. consent order issued to Rogersville, Tenn.-based Thread Bank specifically mentions the lender’s banking-as-a-service business, with the regulator ordering Thread Bank to ensure its third-party risk management program takes into account the level of risk and complexity of the fintech partners in the bank’s BaaS program.
- The ordinance, dated May 21 and made public on Fridayit also requires the bank to implement a documented risk assessment of fintech partners. The bank’s board of directors must approve risk tolerance thresholds for individual fintech partners “based on a corporate financial analysis of each fintech partner’s financial projections under expected and adverse scenarios”, the order establishes.
- The bank is “dedicated to meeting all obligations,” Thread Bank CEO Chris Black said in a statement, “and we have already made substantial investments to enhance our policies, processes, procedures and controls over the past three years, all in collaboration with the FDIC and the Tennessee Department of Financial Institutions.”
Further information:
The 10-page consent order states that Thread Bank’s BaaS and Loan-as-a-Service program policies and procedures address third-party partner and customer approval requirements, due diligence processes, growth and stress, ongoing anti-money laundering/counter financing terrorism compliance monitoring and measures to unwind the business lines of third parties, “including FinTech partners”.
Thread Bank must implement documented customer due diligence and suspicious activity monitoring processes for its BaaS program and ensure that information systems associated with its fintech partners provide timely and accurate information, according to the consent order.
The lender must also ensure that anti-money laundering/terrorist financing staff are adequately trained to detect suspicious activity, that such activity is reported in accordance with regulatory deadlines, and that third-party partners comply with the bank’s AML/CFT program requirements .
Additionally, Thread Bank is required to ensure that beneficial ownership information is documented and maintained. This is an issue under the spotlight in the context of the bankruptcy proceedings of the fintech middleware company Synapse: customers are in debt From $65 million to $96 million more of how much is held for them in the accounts of partner banks, according to the company’s bankruptcy trustee, former FDIC Chairwoman Jelena McWilliams. But Synapse and Evolve Bank & Trust, one of Synapse’s partner banks, disagree about which company holds the funds.
Thread Bank must also develop an exit plan that establishes how to monitor fintech relationships, including third-party, fourth-party, and fifth-party vendors, for service disruptions. The bank must also specify response steps; outline staffing requirements; define customer notification of service disruptions and how the bank will respond; and specify how regulators and external stakeholders will be notified.
“We will continue to invest in our teams and services to ensure we meet the needs and provide strong protections for our customers and partners as we move forward,” Black said in the statement.
This is the latest enforcement action against a bank engaged in BaaS, which has attracted increased regulatory scrutiny in recent months. It evolves, Blue Ridge Bank, Piermont Bank, Sutton Bank AND Lineage Bank have all recently faced enforcement action over their BaaS programs, as regulators scramble to rein in the size and scope of creditors’ third-party partnerships.
However, the order “is much broader than BaaS,” requiring updates to the bank’s strategic plan, enterprise risk management and BSA/AML, noted Margaret Tahyar, head of the financial institutions group at law firm Davis Polk.
Thread Bank was also ordered to improve its liquidity management policy, establish formal objectives and define strategies to strengthen the bank’s earnings as part of a profit plan.
This isn’t the first time the lender, formerly known as Civis Bank, has faced regulatory pressure. In 2015, the bank was hit by a FDIC Consent Orderrequiring it to develop a plan to improve profits and increase its capital ratios.
Renamed Thread Bank in 2022, it has partnered with Middleware Company Unitand supports about 35 fintech programs, according to Fintech Business Weekly. A spokesperson for Thread Bank declined to comment on the bank’s fintech partnerships.
“Regulators write a broad order like this when they want to send a harsh message, typically of a lack of confidence in the board and management,” Tahyar said in an email. “It appears they want a complete change in the business model.”