What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Financial technology governance in the United States is a layered system, not a single “fintech” rulebook or regulator. Laws and regulations apply to particular activities; agencies supervise the institutions within their jurisdiction; and financial firms must manage the technology providers and other partners they rely on. In bank-fintech arrangements, a bank remains accountable for its own compliance even when a third party performs work for it.
This guide focuses on bank partnerships, technology and third-party risk, customer data, and current federal policy activity. Money-transmission licensing, securities, insurance, and product-specific consumer laws can involve additional rules and regulators, so a firm’s exact activities and jurisdictions matter.
Governance starts with the activity, not the technology label
“Fintech” describes a broad range of companies and tools; it is not one legal category with one regulator. A company may play different roles across different products or partnerships. The relevant questions are what service is being provided, which institution provides it, and which entity performs each customer-facing, operational, and compliance task.
Three layers shape oversight
- Law and regulation: Requirements depend on the activity and the entities involved. A deposit product, payment service, loan, or data-access tool may raise different obligations.
- Agency supervision: Federal and state agencies oversee institutions and activities within their respective jurisdictions. The OCC says its financial technology work includes bank-fintech arrangements, artificial intelligence, digital assets and tokenization, and other changing technologies and business models affecting OCC-supervised banks. It established an Office of Financial Technology in March 2023 as a point of contact and information clearinghouse.
- Institution-level controls: Banks and other regulated firms need processes to assess partners, monitor performance, manage incidents, protect information, and maintain service continuity.
The 2024 interagency request for information on bank-fintech arrangements describes models in which responsibilities may be divided among a bank, a fintech, and one or more intermediate platform providers. A technology company should not be assumed to be unregulated merely because it is a technology company; its actual role and activities are what matter.
A bank does not hand off its compliance responsibility
When a bank outsources an activity or offers a product through a fintech partner, the third party’s involvement does not by itself transfer away the bank’s obligations under applicable law and regulation. The bank needs enough oversight and access to determine whether the arrangement is operating as intended.
The federal banking agencies’ July 2024 statement on third-party deposit arrangements restated this accountability principle. The statement said it did not alter existing legal requirements or create new supervisory expectations; it is best understood as a supervisory reminder that highlights relevant risks and risk-management practices.
Assess a partner before signing
The 2021 interagency guide for community banks groups fintech due diligence into six areas. These are useful questions for a bank to answer before relying on a provider:
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute- Business experience and qualifications: Does the provider have the people, skills, and relevant experience to perform the proposed work?
- Financial condition: Is the provider financially positioned to sustain the service, including through periods of stress?
- Legal and regulatory compliance: Does it understand the requirements relevant to its role, and can it demonstrate how it meets them?
- Risk management and control processes: Are responsibilities and controls clear, documented, and supported by evidence?
- Information security: How does the provider protect data and systems, and how will the bank evaluate those protections?
- Operational resilience: Can critical services recover from disruption, and are workable continuity arrangements in place?
Due diligence should shape the contract and the bank’s ability to supervise the relationship. The bank should establish what information it can obtain, what audit or examination access is available, and how each party’s customer-service, compliance, records, data-access, and incident-response duties are assigned. It should also consider how services and records can be transferred or closed out if the arrangement ends.
Make governance operational throughout the partnership
A signed contract is not a substitute for ongoing oversight. The 2024 interagency request for information describes risks that can arise when a bank has limited access to data about an arrangement or when multiple layers of providers make responsibilities difficult to see. A workable governance program gives named owners authority to monitor performance, escalate concerns, coordinate responses, and carry out an orderly exit.
Compare arrangements by asking the same questions
Embedded banking, bank-sponsored accounts, lending partnerships, payment processing, and data aggregation are not a regulator-issued ranking of business models. To understand the risks in any particular arrangement, map it against these questions:
- Which entity contracts with the customer and communicates with them?
- Which bank or nonbank performs each regulated and operational task?
- Who controls customer, transaction, and compliance records, and can the bank retrieve them?
- Who monitors fraud, complaints, fair-lending issues, and financial-crime obligations?
- If deposits or other customer funds are involved, where are they held, how are they described, and what protections apply?
- What happens during a cyber incident, provider outage, partner distress, or contract termination?
- Can the bank monitor performance and execute an orderly exit?
Plan for disruption and termination
Third-party deposit arrangements can create operational, compliance, strategic, liquidity, and concentration risks, as well as consumer-protection concerns. Customers may misunderstand which institution holds their funds or what deposit insurance covers. If a partner comes under stress or an arrangement ends, withdrawals may increase and put pressure on liquidity. These are risks to assess and manage, not inevitable outcomes or proof that every partnership is unsafe.
Free tools Windows power users keep installed
One-click scans. No signup required.
The 2024 interagency request for information notes that inadequate liquidity contingency plans and exit strategies can increase operational and strategic risks. Governance should therefore address continuity and termination in practical terms: who takes over each service, how customers and records will be handled, and how the institution will manage a transition if the provider cannot continue.
Govern data use and customer outcomes
Some fintech arrangements use alternative data with the aim of expanding access to financial services. The banking agencies have identified potential concerns about data accuracy and bias, how such data is integrated into credit systems and compliance controls, and whether data affecting credit decisions could create unlawful-discrimination risks.
Data-use agreements should make the permitted purpose and use clear, identify who can access information, and address retention, deletion, and record availability. These terms need to be understandable and enforceable—not just present in a contract—so the institution can oversee how data is handled in practice.
Section 1033 personal financial data rights: check current status
The CFPB has issued final rule text under Section 1033 addressing access to personal financial data by data providers and authorized third parties, including limits on collection, use, and retention. That rule should be distinguished from general privacy obligations, which may arise separately.
Recommended Free Tools
The CFPB’s status information reports that a court stayed the rule’s compliance dates on October 29, 2025, and describes an August 2025 reconsideration notice. A stayed compliance date should not be presented as currently in force. The status of litigation and agency action can change, so anyone relying on the rule’s timing should check the latest CFPB notices and court orders.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Follow federal technology oversight and policy proposals
Technology oversight continues to evolve. The OCC’s issuance index listed a proposed third-party risk guidance item on September 11, 2026, and a cybersecurity supervision work program on September 21, 2026. These entries indicate supervisory activity; a proposal is not final guidance.
In a September 11, 2026 statement on the proposal, Federal Reserve Governor Lisa D. Cook said: “However, I welcome comments on whether the agencies should provide greater specificity on effective risk management practices relating to cybersecurity or the allocation of responsibilities for consumer protection, record management, and anti-money laundering in bank-fintech partnerships.” This is Governor Cook’s view on the proposal, not an adopted agency rule.
For a financial firm, the practical takeaway is to distinguish existing obligations and supervisory reminders from proposed policy. Keep arrangements, controls, and documentation current, and confirm the status of relevant agency guidance and rulemaking when making decisions.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
