OCC studying risks posed by bank-fintech partnerships

Banks benefit from partnerships with fintechs by getting access to tech innovation at a lower cost, while the latter benefits from affiliating with institutions with “trustworthy (reputations), long-standing customer bases, and access to cheaper capital and funding sources,” Acting Comptroller of the Currency Michael Hsu said in a speech at an industry event Wednesday.

Fintechs offer expertise in online and mobile engagement and provide services at such economies of scale that most banks cannot match, Hsu said.

But bank-fintech partnerships have grown “at exponential rates” and become so complicated it is often difficult to distinguish “where the bank stops and where the tech firm starts,” leaving the banking system vulnerable, Hsu said.

Cryptocurrency has “grabbed the headlines for most of the past year,” but fintechs and Big Tech pose more risk to the banking industry and deserve greater attention, Hsu said.

A recent OCC review of the bank-fintech landscape found at least 10 OCC-regulated banks have banking-as-a-service relationships with nearly 50 different fintechs, Hsu said. Most of the banks had total assets under $10 billion, and a fifth of them had assets under $1 billion.

A review of banks regulated by the Federal Reserve and Federal Deposit Insurance Corporation showed similar results.

Do these partnerships lead to healthy competition and better prices for customers, or “do they lead to a race to the bottom with pressure to cut compliance corners?” Hsu asked.

Left unchecked, bank-fintech partnering is “likely to accelerate and expand until there is a severe problem or even a crisis,” Hsu added.

He worries the risks posed by bank-fintech partnerships are not as well known, unlabeled, and therefore unseen.

“As we learned from the 2008 financial crisis, risks that are unseen have a tendency to grow and later be the source of nasty surprises,” Hsu said.

The OCC is actively working to study the bank-fintech field and eliminate “blind spots,” like the oversights that led to the 2008 financial crisis. The agency is mapping out bank-fintech relationships and risks and engaging with nonbank technology firms to minimize the risks posed by such arrangements, Hsu said.

A process to subdivide bank-fintech arrangements into cohorts that have similar safety-risk profiles is underway at the OCC.

“This will enable a clearer focus on risks and risk management expectations,” Hsu said.

The benefits of technology to a bank are lost if the bank doesn’t pair them with adequate risk management, such as board oversight, governance, and internal controls, Hsu said.

The OCC also expanded its bank information technology examinations to include assessments of ransomware, artificial intelligence, cloud computing, and distributed ledger technology, Hsu said. Typical problems it finds during the examinations include insufficient information security controls, weak IT operational resilience, and management issues, he said.

Hsu added Bank Merger Act guidelines “are ripe for updating,” to bring them in line with President Joe Biden’s July 2021 executive order on promoting competition.