Internal audit considerations for fintech partnership risk

The financial services industry has already witnessed an increase in regulatory commentary, guidance, and enforcement actions related to bank-fintech partnerships, including:

• The Federal Reserve’s Novel Activities Supervision Program, which enhances the monitoring of technology-driven partnerships with nonbanks.
• Interagency guidance on third-party relationships as it relates to risk management
• Recent public consent orders
• Additional nonpublic regulatory actions

The heightened regulatory scrutiny has touched on a range of risk areas, including:

• Bank Secrecy Act compliance and anti-money laundering risk management
• Data management, reporting, and governance
• Information technology control and risk governance
• Consumer protection, including fair lending
• Lack of management oversight

Failures within these areas have led to safety and soundness concerns with the increased focus on long-term, sustainable, and profitable bank-fintech partnerships.

Based on these regulatory trends, financial services organizations and their internal audit teams can’t afford to take a wait-and-see approach to act. Moving now could help organizations avoid potentially serious consequences.

So, how can organizations respond to the increased regulatory risk associated with fintech partnerships? Exploring the innovations and revenue streams offered by new fintech relationships is a popular option for many banks. Bank-fintech partnerships can be highly profitable, and banking customers are increasingly demanding the flexibility and wide range of services made possible by bank-fintech partnerships.

Some organizations might try to roll the new expectations of the guidance into their existing internal audit and risk management activities. However, the guidance and the resulting regulatory enforcement activity show that the agencies are casting a highly focused spotlight on fintech relationships – which means organizations might want to do so as well.

Organizations that want to meet the new guidance head on and address compliance risks now should consider building a specific fintech-focused audit into their internal audit plans. The audit plan should include identifying the most significant threats, what could potentially go wrong, and how to mitigate those risks. The overall goal of this audit should be to foster an understanding of the organization’s fintech partners and how those partners address customer management and regulatory compliance.

Activities that internal audit teams can consider as part of a fintech-focused audit might include:

• Sampling focused on and limited to fintech partners, transactions, customers, and controls
• Evaluation of risk posed by fintech relationships, which might influence frequency and extent of the audits of each relationship
• Development of a work program and workpapers specifically focused on fintech relationships and aligned closely to the interagency guidance
• In-depth interactions with fintech partners and third parties, including on-site visits
• Testing targeted at design and operational effectiveness of fintech companies’ controls
• Fourth-party testing of fintechs’ clients and customers
• Detailed, thorough testing of fintech partners’ compliance programs

Once the plan for a fintech-specific internal audit is in place, organizations should conduct a staffing assessment and determine whether they have the resources, budget, and subject-matter expertise to execute the plan. Many organizations, especially those with a large, diverse portfolio of fintech clients, might find they need to look outside the organization for help.

With the right internal audit programs in place, your organization can pursue high-value fintech partnerships knowing that the proper controls exist and the risks are managed. And those opportunities can help you offer new products, services, and benefits for your customers without having to constantly worry about if or when your fintech partnerships could invite not only regulatory consequences but financial harm, damaged brand reputation, and customer loss as well.

Crowe specialists understand and support the business model, jobs to be done, and roles and responsibilities that affect internal audit departments. Our teams have studied the interagency guidance in detail and developed targeted internal audit programs, which, with Crowe support, your organization can implement and customize.

Crowe internal audit and fintech specialists have decades of experience understanding regulatory expectations and creating audit programs that are specific to regulatory guidance. Our teams also have extensive experience working with banking organizations and fintech companies, so whatever your place is in the industry, we can help you meet compliance with confidence. And if you’re already experiencing heightened scrutiny from examiners, our regulatory response team is ready to step in.