Can You Standardize Bank-Fintech Risk?

Alex Johnson (0:00)

This episode is brought to you by Ocrolus.

Better lending starts with better intelligence. A borrower's cash flow only tells half the story. So Ocrolus fills in the rest with behavior signals and industry benchmarking. Visit ocrolus.com to learn more.

Hello, and welcome back to the Fintech Takes podcast. Today's episode is a conversation that I've been wanting to have for a while. It is the standards conversation. As you likely know, if you've been reading the newsletter, listening to the podcast, the FDIC is spearheading an initiative to try to create standards around third-party risk management in order to reduce the risk and make it more efficient for banks to work with various third parties, most pressingly Fintech companies, which as we've seen through the trials and tribulations in banking as a service, is not always as easy as we might hope that it would be. So the FDIC is embarked on this project, which is a very laudable project, to figure out how to standardize some of that work and to make it easier and faster while still keeping the level of risk in those partnerships as low as possible. I've wanted for a while to have like a really focused, dedicated conversation with experts about what we know is happening in that space, what we don't know, how we got to a place where we even need standards at all. And so I called my two Jasons off the bench, Jason Mikula, publisher of Fintech Business Weekly, and Jason Henrichs of Alloy Labs and Breaking Banks. Jason and Jason are the two most knowledgeable people I know on bank-fintech partnerships, banking as a service, third-party risk management. They've seen every single part of it. They spend a lot of their time in the trenches talking to banks that do this work, talking to fintech programs that do this work. And I wanted to get their take on what's happening around the standard-setting initiative, what they think might work, what they're concerned about, and ultimately like what is the problem we're trying to solve and how should we think about it moving forward, not just over the next couple of years with whatever the FDIC is going to do, but longer term, how do we try to solve this problem? It was a great conversation. As always, Jason and Jason, who I tried to refer to as Mikula and Henrichs for clarity over the course of the podcast, were great guests as always, and it was a delight to talk to them. Without further ado, here is the standards conversation with Jason Mikula and Jason Henrichs.

This is Fintech Takes, the podcast keeping you in the loop on all the latest Fintech trends, news and ideas. I'm Alex Johnson, creator of the Fintech Takes newsletter, your host and self-confessed Fintech nerd.

All right. Henrichs is here. Mikula is here. I have them for about 50 minutes, so we are going to just dive right in. Gentlemen, thank you for joining me. Is it okay if I start by recapping where we are and how we got to this point? Absolutely.

Jason Henrichs (3:13)

I have no idea where we are, so I look forward to the orientation.

Alex Johnson (3:19)

Okay. I keep getting confused myself, so I'll try to do this fast, but we'll set a little context.

Last month on August 5th, our friend Evan Weinberger at Bloomberg Law reported that the FDIC is floating a new standard-setting body that would set baseline standards, making it easier for banks to evaluate whether Fintechs and other third-party providers meet risk management standards and to onboard them with the aim of helping banks, particularly community banks, avoid the duplicative reviews of the same service providers. The core idea is to standardize and certify common third-party risk management information so that it can be assessed once and refreshed over time and reused by multiple banks. The proposed structure for this initiative, and this is based on a term sheet that Evan shared, that was a draft term sheet that was going around, would be to have a standard setting body, the acronym for which would be BISDO, which I'm not in love with, but we'll set that aside, which would develop, adopt, or recognize standards aligned with supervisory expectations. Then there would be a certification entry, RAMP or Risk Assessed Manageable Partnerships, which would essentially certify providers or individual solutions against the standards created by BISDO. There would be independent assessors, which would be independent organizations that are qualified to assess third parties against those standards. The RAMP certification would be based on the assessments done by these independent assessors. Then finally, there would be a registry that would record whether the certifications are active, suspended or withdrawn, plus ongoing monitoring, reporting, feedback, escalation, and an emergency circuit breaker to suspend a certification in exceptional circumstances. A couple of notes before I get into the questions.