The central question: can the bank deliver what the customer was promised?
brings together a regulated bank’s accounts, lending or payment capabilities and a partner’s distribution, product design or software. It can give customers more convenient services and give banks access to markets they could not economically reach alone. Its quality depends on how those capabilities work together when transaction volume rises, a credit cohort deteriorates or a critical partner becomes unavailable.
The most useful investment in oversight is evidence that the bank can identify its obligations, control material changes and continue essential service. A signed agreement, a growing deposit base and a balanced aggregate ledger each answer only part of that question. This article’s assessment is that sustainable program economics require operational independence proportionate to the activity—not necessarily ownership of every system.
Research reviewed September 29, 2026. Named examples below are dated company disclosures or official publications. The calculations, proposed operating tests and decision criteria are analytical illustrations, not reported results or universal regulatory limits.
One label, four different businesses
An account program, a loan-origination arrangement, card issuing and payment sponsorship expose a bank to different combinations of credit, , operational and consumer risks. The first diligence question is which services the bank actually supplies and which legal entities perform the remaining work. A fintech brand, its program manager and its technology provider may be separate counterparties.
Use the following framework to build a program-specific income statement and responsibility map. Fees should be allocated to the activity that earns them, and costs to the activity that creates them; gross payment volume is a poor substitute for either.
Scroll horizontally to see all columns.
| Service | Potential bank economics | Exposure that must be priced |
|---|---|---|
| Deposit accounts | Service fees and the value of usable funding | Interest paid, customer support, recordkeeping, liquidity and channel concentration |
| Lending | Origination and servicing fees; spread on retained loans | Funding while loans are held, credit losses, failed sales, repurchases and servicing obligations |
| Card issuing | Net interchange, program fees and interest where applicable | Processor/network charges, rewards sharing, fraud, disputes, credit losses and servicing |
| Payments and settlement | Transaction fees and relationship value | Returns, settlement timing, prefunding, intraday liquidity, sanctions screening and operational errors |
The market remains active, but adoption takes several forms
The examples below demonstrate identifiable commercial use, not an estimate of market share or proof of superior risk performance. Current website disclosures establish an advertised banking relationship; an acquisition announcement establishes a proposed transaction. Neither supplies all the economics of a particular program.
Chime’s September 8 agreement is especially useful for thinking about the boundary between partnership and ownership. Its SEC filing describes the proposed acquisition of Central Service Corporation, Stride Bank’s parent, for $590 million subject to adjustments. Chime’s announcement targets the first half of 2027, subject to approvals and other closing conditions, and forecasts more than $100 million in net synergies. Those are announced terms and management expectations; this article does not treat the transaction as completed. [8][9]
Scroll horizontally to see all columns.
| Relationship | Verified role or development | Interpretation boundary |
|---|---|---|
| Chime / The Bancorp Bank, N.A. and Stride Bank, N.A. | Chime’s September 8 announcement identifies its existing banking providers and proposed Stride acquisition. [9] | The proposed acquisition is distinct from the existing service arrangements. |
| Mercury / Column N.A. and Choice Financial Group | Mercury’s Column legal page covers demand-deposit and debit services and identifies both banking providers; checked September 29. [10] | The operative product agreement determines the relevant bank and terms. |
| Pathward / TabaPay | August 5 announcement extends the agreement into 2031, including acquiring sponsorship and loan disbursement/repayment capabilities. [11] | Providing payment rails does not establish that Pathward funds every underlying loan. |
| FinWise Bank / FinWise Bancorp and Tallied | July 20 announcement describes the parent’s acquisition of technology and related assets supporting the bank’s card programs. [7] | Technology ownership and retained bank credit exposure must be analyzed separately. |
| Coastal Community Bank / Coastal Financial Corporation | The parent’s July 30 results describe CCBX activity and a material expense tied to one partner. [6] | Consolidated results are not standalone results for every bank program. |
Two disclosures that change how protection should be evaluated
Coastal Financial Corporation reported a $42.1 million consolidated net loss for the quarter ended June 30, 2026. Its July 30 release identified $68.8 million of expense associated with one CCBX partner: a $22.8 million credit-loss provision and a $46.0 million valuation adjustment to a credit-enhancement asset. The company did not expect full collection under the indemnification arrangement. Management characterized the problem as isolated. These are dated holding-company disclosures, not a sector-wide failure rate. [6]
The distinction matters: a deterioration in underlying loans and a reduction in the value of a reimbursement claim can hit the same program. Treating a contractual indemnity as equivalent to immediately available cash obscures that combined exposure. It also invites double counting if forecast losses are reduced for a guarantee while the same guarantee is separately credited as an asset.
FinWise’s July 20 announcement illustrates a deliberate change in the allocation of risk and revenue. Approximately $50 million of credit-card balances would convert from credit-enhanced treatment to standard balances retained by the bank, which would retain the associated interest and interchange economics and credit exposure. The parent expected about $4 million of integration and transition costs over the following year, excluding specified intangible amortization. These were the announcement’s estimates, not realized savings. [7]
Buying technology can remove a commercial handoff while adding maintenance, staffing and credit responsibilities. Similarly, Chime’s expected sponsor-fee savings must be evaluated alongside the costs and obligations of bank ownership. The relevant comparison is the return after those responsibilities are funded. [8][9]
Follow three maps: money, records and decision rights
For a single customer transaction, document where the money moves, where each record is kept and who can authorize a change. These maps should agree, but often describe different entities and systems. A payment can be authorized in one system, settle through another and appear in an app before the bank’s account record is updated.
The bank needs usable evidence across material subcontractors, even when its commercial contract runs through one program manager. A contractual right to receive a file becomes operationally valuable only when the file is timely, interpretable and reconcilable. Keep ownership, access, retention and permitted use of customer data distinct; describing one party as owning the customer does not settle those rights.
The table is a suggested control design. Assign a named bank owner, a production evidence source and a fallback operator to each function.
Scroll horizontally to see all columns.
| Function | Evidence that demonstrates control | Decision when evidence fails |
|---|---|---|
| Customer/account mapping | Stable identifiers, ownership records and a verified contact path | Restrict ambiguous onboarding; resolve affected accounts |
| Funds and transaction records | Bank records, customer subledger and settlement records with traceable exceptions | Investigate by amount, age and customer impact; stop unsupported activity |
| Credit or fraud-policy change | Approved version, production settings and override/deployment logs | Roll back unauthorized settings and identify affected decisions |
| Disputes and complaints | Receipt time, applicable deadline, case owner and resolution evidence | Escalate before deadlines; activate backup servicing |
| Critical provider outage | Usable exports, working access rights and tested recovery procedures | Invoke the rehearsed continuity plan and limit new exposure |
A ledger can balance while individual customers are wrong
Hypothetical example: an omnibus bank account holds $100 million, and the partner’s customer subledger also totals $100 million. Customer A’s balance is understated by $50,000; customer B’s is overstated by $50,000. Aggregate reconciliation shows no difference. Both customer records are still wrong.
That is why a reconciliation dashboard should show gross unexplained differences and affected accounts alongside the net difference. Tests should cover duplicate postings, missing transactions, ownership mappings, pending versus settled items and corrections across systems. Separate ordinary timing differences from exceptions whose cause is unknown.
A practical reconstruction exercise selects an account and a historical cutoff, recreates its opening balance and verified activity, then connects the closing position to bank and settlement records. Repeat across products and difficult cases—refunds, reversals, account closures and data migrations. Test completeness of the population as well as sampled accuracy.
The July 2024 interagency statement identifies fragmented operations and insufficient bank access to deposit records as risks. It also explains that outsourcing does not reduce the bank’s responsibility for compliance. It reiterates existing guidance; it is not a new licensing regime. [1]
Deposit insurance, customer access and liquidity answer different questions
The FDIC explains that pass-through deposit insurance depends on conditions including records identifying ownership and each person’s amount. Coverage relates to failure of an insured bank; it does not insure a nonbank company against insolvency or bankruptcy. Funds held through an app are therefore not automatically protected against every operational or counterparty problem. [5]
Customer-facing communications should explain the actual bank and arrangement, including when funds reach a bank and how relevant sweep structures work. Operationally, the bank also needs a plan for customers whose access depends on an unavailable platform. Insurance eligibility, accurate ownership records and prompt access are related concerns, but one does not demonstrate the others.
Funding concentration needs a separate view. Hypothetically, one fintech channels $200 million into a bank with $500 million of deposits: a 40% distribution-channel concentration, even if thousands of end customers hold accounts. A shared outage, promotional change or migration can affect many of them together.
If 30% of that channel leaves, the outflow is $60 million. Assume $20 million in available cash and $50 million of unencumbered securities that can produce $45 million after a hypothetical 10% haircut. The $65 million of resources leaves $5 million before other obligations. This is a illustration, not a regulatory ratio. If the securities are pledged or cannot be monetized in time, the result changes materially.
Worked economics: the difference between contribution and resilience
Consider a hypothetical annual program with $6.0 million of revenue, $2.0 million of processing and servicing expense, $1.0 million of oversight and technology expense, $1.2 million of expected losses/remediation, and a $0.6 million internal capital-and- charge. Its contribution is $1.2 million before tax and unallocated corporate overhead. The internal charge is an analytical assumption, not a regulatory capital requirement or a GAAP expense definition.
Assume a separate incident creates $3.0 million of incremental cost beyond the base-case loss assumption. A partner contract promises reimbursement, but only $0.8 million of controlled cash collateral is available. Counting only that immediate recovery leaves $2.2 million of exposure and turns the $1.2 million contribution into a $1.0 million loss. Subsequent recoveries may improve the outcome; they do not fund today’s customer obligations.
In the growth case below, revenue rises 20%, processing costs rise 20%, oversight costs rise 30%, and expected losses rise 50%. The contribution falls despite revenue growth. These assumptions are deliberately transparent so a reader can replace them with the actual program’s inputs.
Scroll horizontally to see all columns.
| Annual amount, $ millions | Base case | Growth with strain |
|---|---|---|
| Revenue | 6.00 | 7.20 |
| Processing and servicing expense | (2.00) | (2.40) |
| Oversight and technology expense | (1.00) | (1.30) |
| Expected losses and remediation | (1.20) | (1.80) |
| Internal capital/liquidity charge | (0.60) | (0.72) |
| Contribution before tax and unallocated overhead | 1.20 | 0.98 |
Loan sales and indemnities leave risks that need separate limits
An origination-and-sale model needs a bridge-funding plan for the period before a buyer pays. Test the consequences of a missed purchase, an eligibility dispute or a closed . Then distinguish exposure on retained loans from representations, warranties, repurchases, servicing advances and operational liabilities that may survive sale.
Credit enhancement should be decomposed into cash collateral, enforceable third-party support and unsecured promises. Evaluate access restrictions, replenishment triggers, claim priority, expiration and the financial condition of the supporting party. A reserve that can be released during growth may be least available after the portfolio seasons.
The most difficult case is correlated stress: borrower losses rise, the fintech’s revenue and financing weaken, and its indemnity becomes harder to collect at the same time. A second does not necessarily solve this if both programs rely on the same ledger, servicer or funding provider. Diversification should be measured across common dependencies.
For merchant finance, map cancellations, refunds, disputes and non-delivery to the lender, merchant and servicing responsibilities. A merchant closure can generate customer-service and funding demands before recoveries are settled. These are suggested exposure questions; the actual contracts and applicable product rules determine the legal allocation.
Build oversight around decisions, with room for efficient execution
Good oversight does not require a bank to repeat every task its partner performs. It requires enough independent evidence and decision authority to know whether the task works and to intervene when it does not. Routine changes within an approved policy can follow a controlled process; material changes to credit policy, marketing, money movement or subcontractors should have clear review and escalation paths.
That distinction matters to both sides. A fintech needs predictable approvals and launch timelines. A bank needs visibility into consequential changes and credible authority to limit exposure. Define the evidence required, the decision owner, turnaround expectations and the escalation route before commercial urgency makes every request an exception.
A useful board or program-committee scorecard connects measures to actions. Examples include unexplained ledger amounts and age; complaints nearing deadlines; first-payment defaults and seasoned losses by ; controlled collateral relative to plausible exposure; largest common-provider dependencies; and demonstrated recovery capability. Rising approval rates alone cannot establish better underwriting—selection, product mix, loan terms and seasoning may explain the change.
Growth gates should require evidence appropriate to the product: observed reconciliation, tested consumer outcomes, funded loss support and functioning exit arrangements. Set thresholds from the bank’s exposure and capacity. No universal reserve percentage, exception count or growth rate can be inferred from the examples in this article.
Exit readiness is an operating capability
Imagine that the partner’s staff and primary system are unavailable tomorrow. The exercise should demonstrate a working route for customer identification, balances, essential payments, disputes, collections where relevant and accurate communications. A stored data export is only useful if authorized staff can interpret it and the replacement process can act on it.
Run the test in stages: contain new unsupported activity; reconstruct customer positions; sustain essential service; transfer or close accounts where appropriate; and reconcile residual claims. Define who funds the transition and the servicing tail after commercial revenue stops. Review insolvency and subcontractor constraints before assuming contractual step-in rights are executable.
Score the observed result, including failures, rather than whether the document exists. Record the people involved, unavailable permissions, missing fields, manual work and elapsed recovery time. Rehearse again after material architecture or provider changes. The objective is to establish what the bank can reliably deliver under the actual arrangement.
The regulatory position as of September 29, 2026
The 2023 interagency third-party guidance, issued through Federal Reserve SR 23-4 on June 7, describes risk-management principles across the relationship life cycle and expressly says it imposes no new requirements. Practices are to be tailored to the bank and arrangement. Binding obligations arise from applicable law and regulation, and from an institution’s own orders where relevant; guidance and internal recommendations should be identified separately. [2]
The agencies announced proposed replacement guidance on September 11, 2026. The September 15 Federal Register notice sets a November 16 comment deadline. The announcement states that existing guidance would be replaced when the new guidance is finalized. As reviewed here, this remains a proposal; it supplies no current permission to abandon controls. [3][4]
For planning, maintain an inventory of operative obligations and an assessment of the proposed changes. A principles-based approach can support simpler processes where risk is low, while a customer-facing program with complex money movement may still warrant intensive evidence. This analysis does not infer confidential supervisory ratings or allege undisclosed problems at named institutions.
The conclusion—and the evidence that would change it
can be an effective way to combine distribution, technology and bank capabilities. The strongest programs should be able to show why their returns remain attractive after the cost of control, loss absorption and continuity is included. Those costs belong in the decision before the next growth commitment.
Evidence that would strengthen the case includes sustained contribution across seasoned cohorts, fewer unexplained customer-level exceptions, usable collateral through stress, successful recovery exercises and dependence spread across genuinely separate providers. Evidence that would weaken it includes growth accompanied by older unresolved breaks, increasingly concentrated funding, uncollectible support or exits that remain executable only with the failing partner’s cooperation.
The decision question is concrete: before approving the next stage of growth, what evidence demonstrates that the bank can keep its promises to customers when a consequential dependency fails?
Sources
- Banking agencies, Joint Statement on Banks’ Arrangements with Third Parties to Deliver Bank Deposit Products and Services; July 25, 2024Official sourceBack to text: ↑
- Federal Reserve SR 23-4, Interagency Guidance on Third-Party Relationships: Risk Management; June 7, 2023Official sourceBack to text: ↑
- Banking agencies and NCUA, proposed third-party guidance announcement; September 11, 2026, updated September 15Official releaseBack to text: ↑
- Federal Register, Proposed Third-Party Risk Management Guidance; September 15, 2026; comments due November 16, 2026Official sourceBack to text: ↑
- FDIC Consumer News, Banking With Third-Party Apps; June 2024 issue, page updated May 31, 2024Official sourceBack to text: ↑
- Coastal Financial Corporation, Q2 2026 results; July 30, 2026; period ended June 30, 2026SourceBack to text: ↑1↑2
- FinWise Bancorp, Tallied technology-platform and asset acquisition; July 20, 2026SourceBack to text: ↑1↑2
- Chime, Form 8-K and Central Service Corporation merger agreement; September 8, 2026Filing / reportBack to text: ↑1↑2
- Chime, agreement to acquire Stride Bank; September 8, 2026SourceBack to text: ↑1↑2↑3
- Mercury, Column N.A. policies and banking-provider disclosures; undated, reviewed September 29, 2026SourceBack to text: ↑
- Pathward, expanded TabaPay agreement; August 5, 2026SourceBack to text: ↑