Financial technology in the United States is governed by a layered system, not by one “fintech” regulator. The rules that apply depend on the activity, while agencies supervise the institutions within their remit and those institutions must manage the technology providers they rely on. In a bank-fintech arrangement, outsourcing work or distributing a bank product through a partner does not transfer the bank’s responsibility for complying with applicable law.
Start with the activity, not the technology company
A company’s use of an app, cloud service, artificial intelligence, or other technology does not by itself determine its regulatory status. The relevant questions are what financial activity is being performed, which entities perform it, and which institutions are responsible for the resulting customer and compliance obligations. A technology firm can take different roles in different arrangements.
As an Amazon Associate I earn from qualifying purchases.
For example, a product might involve deposits, payments, lending, or access to consumer financial data. Securities, insurance, state money-transmission licensing, and product-specific consumer-protection laws may add separate requirements. This guide focuses on bank-fintech arrangements and the governance of technology and third parties; it is not a complete account of every regime that may apply to every financial product.
Governance has several layers
Statutes and regulations set the obligations
Applicable laws and regulations establish the obligations for the activity and the institutions performing it. There is no general exemption from those obligations simply because a service uses a fintech provider or an online interface.
#1 Best Overall
Agencies supervise institutions and issue guidance
Federal banking agencies oversee banks within their respective authorities and communicate supervisory expectations through materials such as guidance, statements, and requests for information. These materials do not all have the same legal status. A proposal is not a final rule, and a supervisory statement may illustrate risks without creating new legal requirements.
The OCC says its financial technology work covers bank-fintech arrangements, artificial intelligence, digital assets and tokenization, and other changing technologies and business models affecting OCC-supervised banks. It established its Office of Financial Technology in March 2023 as a point of contact and information clearinghouse. That office is not a single regulator for the entire fintech market.
Institutions translate obligations into controls
Governance becomes practical through assigned owners, documented procedures, monitoring, escalation routes, and evidence that controls work. In a bank partnership, the bank remains accountable for compliance with applicable laws and regulations even when a third party performs tasks or provides the technology. The agencies’ July 2024 interagency statement on bank arrangements with third parties in deposit-taking activities is a supervisory reminder: it says it does not alter existing legal requirements or create new supervisory expectations.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #2
Who does what in a bank-fintech arrangement?
Responsibilities can be divided among a bank, a fintech, and one or more intermediary platform providers. The arrangement’s actual contracts and operating model matter; the table describes governance questions, not a universal assignment of legal duties.
| Participant | Governance question |
|---|---|
| Bank | Which applicable obligations remain the bank’s responsibility, and how can it oversee the provider, access records, monitor performance, respond to problems, and execute an orderly exit? |
| Fintech provider | Which customer-facing, operational, data, or compliance tasks does it perform, and what evidence can it provide that those tasks are controlled and reliable? |
| Intermediate platform provider | Does it sit between the bank and fintech, and can its involvement affect the bank’s visibility into data, operations, or other providers? |
| Agency supervisor | Which institution is within the agency’s supervisory remit, and what laws, regulations, guidance, or supervisory materials are relevant to that institution and activity? |
The 2024 interagency request for information on bank-fintech arrangements describes the range of arrangements and the risks that can arise when responsibilities are divided or banks have limited access to arrangement data. A company should not be assumed to be unregulated merely because it is a technology firm; its activities and role are the starting point.
How banks should govern a third-party relationship
1. Identify the activity and map responsibilities
Before contracting, document the product, the entities involved, and the tasks each performs. Map who communicates with customers, holds or can retrieve records, handles complaints, monitors fraud and compliance, and has authority to make operational decisions. Include intermediaries rather than treating the relationship as a simple two-party arrangement.
2. Assess the partner before signing
The 2021 interagency community-bank guide groups fintech due diligence into six areas. Use them as a practical review framework:
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11- Business experience and qualifications: Can the provider perform the work and support the product as designed?
- Financial condition: Is there reason to doubt its ability to remain viable and sustain the service?
- Legal and regulatory compliance: Does it understand its role and the requirements relevant to its activities?
- Risk management and controls: Are processes defined, evidenced, and subject to meaningful oversight?
- Information security: How is customer and bank information protected and access controlled?
- Operational resilience: Can critical services recover from disruption, and are dependencies understood?
3. Put operational expectations into contracts
Due diligence should shape the contract and ongoing oversight. Agreements should make responsibilities and access rights workable in practice, not just describe them in broad terms. Address what data and records the bank can obtain, audit or examination access, customer-facing duties, incident notification, service continuity, and how records and services can be transferred or closed out. The 2024 interagency request for information identifies limited bank access to arrangement data as a risk; the agencies’ September 2026 policy discussion also highlights interest in clearer responsibility allocation for areas including record management.
4. Monitor, escalate, and plan for exit
Oversight continues after launch. Assign accountable owners, review performance and control evidence, define thresholds for escalation, and maintain continuity and termination plans. The 2024 interagency request for information notes that provider stress or termination can lead to large withdrawals in deposit arrangements, while inadequate liquidity contingency planning and exit strategies may increase operational and strategic risks. These are risks to manage, not inevitable outcomes of every partnership.
Risks that deserve special attention
Deposits, liquidity, and customer understanding
Third-party deposit arrangements can present operational, compliance, strategic, liquidity, and concentration risks. Customers may be unclear about which institution holds their funds or what deposit insurance covers; inaccurate descriptions can create consumer-protection concerns. A provider’s stress or a contract termination may also disrupt service or contribute to withdrawals. The July 2024 interagency statement describes these as matters for risk management, not proof that all deposit partnerships are unsafe.
Data quality, models, and fair outcomes
Alternative data and automated systems may support access to financial services, but they can also create accuracy and bias concerns. Where data affects credit decisions, the agencies warn that it may raise unlawful-discrimination risks. Governance should make data purpose, permitted use, access, retention, deletion, and record availability clear and enforceable, and should connect data and model controls to the institution’s compliance processes.
Free tools Windows power users keep installed
One-click scans. No signup required.
Cybersecurity and operational resilience
Security and continuity are not confined to a provider’s technical assurances. The bank needs enough information and access to assess relevant controls, understand dependencies, respond to incidents, and maintain or restore critical services. A partnership model that obscures who must act during an outage or incident is a governance weakness.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Consumer financial data rights: check the rule’s current status
Section 1033 of the Consumer Financial Protection Act concerns consumer access to personal financial data. The CFPB’s final rule text addresses data-provider access and obligations for authorized third parties, including limits on collection, use, and retention. Those provisions should not be confused with every privacy or data-security obligation that may apply to a financial institution or provider.
As of October 4, 2026, the CFPB reports that a court stayed the rule’s compliance dates on October 29, 2025. The CFPB also describes an August 2025 reconsideration notice. Because a stayed compliance date should not be presented as currently operative, institutions and readers should check the CFPB’s current status information and relevant court orders before relying on any particular deadline. The existence of final rule text does not, by itself, establish that its original compliance schedule is in force.
What current federal policy activity means
The OCC’s technology overview reflects supervisory attention to bank-fintech arrangements, AI, digital assets and tokenization, and other changing business models. Its issuance index listed a proposed third-party risk guidance item on September 11, 2026, and a cybersecurity supervision work program on September 21, 2026. A proposed guidance item is not final guidance; these listings indicate activity, not a new binding requirement by themselves.
In a September 11, 2026 statement on the proposal, Federal Reserve Governor Lisa D. Cook said: “However, I welcome comments on whether the agencies should provide greater specificity on effective risk management practices relating to cybersecurity or the allocation of responsibilities for consumer protection, record management, and anti-money laundering in bank-fintech partnerships.” This is Governor Cook’s view on the proposal, not an adopted agency rule.
A practical review before launch or renewal
Use these questions to test whether governance is specific enough to operate under normal conditions and during a disruption:
Quick Recap
- What financial activity is involved, and which entities perform each task?
- Who contracts and communicates with the customer, handles complaints, and owns each compliance task?
- Can the bank access customer, transaction, and compliance records in a usable form, including through intermediaries?
- How are fraud, security incidents, service outages, and control failures reported and escalated?
- For deposits or customer funds, how are the holding institution and any applicable insurance coverage described to customers?
- How are data use, quality, retention, deletion, and access controlled, including when data affects credit decisions?
- Can critical services continue or recover if a provider fails, and can records and services be transferred or closed out?
- Who monitors the relationship, what evidence do they review, and what conditions trigger remediation or termination?
These are comparison criteria for evaluating arrangements, not a regulator-issued ranking of embedded banking, sponsored accounts, lending partnerships, payment processing, or data aggregation. The right controls depend on the activities, parties, customer impact, and risks of the particular arrangement.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
