According to an exclusive Bloomberg Law report, the Federal Deposit Insurance Corporation is considering plans to work with banking and financial technology industry groups to establish a new standard-setting organization. The report is based on a term sheet that would establish a Banking Industry Standards Development Organization (BISDO) to develop standards and issued standard certifications to third-party service providers that partner with banks. The initiative could represent one of the most significant developments in the federal regulatory approach to bank-fintech partnerships, and service provider relationships more broadly, in recent years. This effort is conceptually similar to a previous FDIC initiative, when it issued a Request for Information.
The reported effort comes against the backdrop of heightened regulatory scrutiny of third-party risk management and banking-as-a-service (BaaS) relationships. Over the past several years, the FDIC, the Office of the Comptroller of the Currency, and the Federal Reserve have repeatedly emphasized that banks remain responsible for the activities of their third-party service providers. Numerous enforcement actions and consent orders involving sponsor banks have reinforced regulators’ expectations that banks maintain robust oversight of fintech partners.
A Potential Shift Toward Industry Standards
According to the BISDO term sheet, the FDIC is exploring an approach that goes beyond traditional supervision and enforcement. Rather than simply identifying deficiencies during examinations, the agency would encourage the development of uniform industry standards that banks and third-party service providers could use in structuring and managing their relationships.
Such an organization could potentially develop standards addressing matters such as:
- third-party risk management;
- governance and internal controls;
- cybersecurity and operational resilience;
- consumer compliance;
- Bank Secrecy Act/Anti-Money Laundering compliance;
- complaint management;
- information security;
- due diligence and ongoing monitoring; and
- business continuity planning.
Standardized expectations could reduce uncertainty for both banks and third-party service providers while providing examiners with a more consistent benchmark against which to evaluate partnerships.
Notably, the scope of the proposed framework extends well beyond bank-fintech partnerships. The term sheet makes clear that “BISDO may address any category of third-party service providers and outsourced bank activities where reusable standards and independent assurance provide value…. The framework may apply to technology and non-technology providers, novel and legacy providers, customer-facing and back-office services, and product-, service-, platform-, model-, or control-domain-specific solutions.” This broad scope means the initiative could affect a wide range of entities that provide services to banks, not just fintech companies.
Similar to Other Standard-Setting Models?
The concept is not unprecedented.
In the consumer financial services arena, industry standard-setting organizations have played important roles in promoting interoperability, consistency, and best practices. Perhaps the closest recent example is the CFPB’s recognition of the Financial Data Exchange (FDX) as a standard-setting body in connection with implementation of the Bureau’s open banking rule under Section 1033 of the Dodd-Frank Act.
Likewise, the payments industry has long relied upon organizations such as the PCI Security Standards Council to establish technical and operational standards that have become widely accepted throughout the industry.
Whether the FDIC envisions a comparable model for bank-fintech partnerships remains to be seen.
Potential Benefits
An effective standard-setting organization could offer several advantages.
First, it could reduce the compliance burden created by multiple banks asking fintech partners to satisfy slightly different due diligence and control requirements.
Second, common standards could make examinations more predictable and facilitate more efficient supervisory reviews.
Third, smaller banks that lack extensive third-party risk management resources could benefit from widely accepted frameworks developed by industry participants and subject matter experts.
Finally, recognized standards could enhance consumer confidence by promoting more consistent practices across the rapidly growing banking-as-a-service ecosystem.
Open Questions and Key Decisions
The term sheet identifies a number of open decisions that will need to be addressed as the initiative moves forward. Among them are:
- Who would govern the organization?
- Would participation be voluntary or effectively mandatory?
- How would fintech companies, banks, regulators, consumer groups, and other stakeholders be represented?
- Would regulators formally recognize compliance with the standards during examinations?
- How would the standards evolve to keep pace with rapidly changing technology?
- What governance structure will oversee BISDO, and how will decision-making authority be allocated among stakeholders?
- How will the organization be funded, and what funding model will ensure independence and sustainability?
- What will be the scope of the standards—which categories of third-party services and outsourced activities will be prioritized for initial standard development?
- How will standards be developed, validated, and updated through independent assurance mechanisms?
Industry participants, including banks, fintech companies, and other third-party service providers, should closely monitor these developments and consider engaging with the FDIC as these structural decisions are finalized.
The term sheet expressly states that compliance with BISDO standards will not serve as a regulatory safe harbor. Adherence to the standards would instead serve as evidence of sound risk management practices, but would not insulate institutions from supervisory or enforcement action, which could undercut the value of adherence to the standard for supervised institutions.
What Comes Next?
At this point, the term sheet indicates that the FDIC is working with industry groups to develop the BISDO framework. There has been no formal FDIC announcement describing a final governance structure or a timeline for implementation. To move the BISDO framework forward, we would expect the FDIC to formally propose the initiative and invite public comment.
This initiative reflects an acknowledgment that bank relationships with third-party service providers have matured into a permanent feature of the banking landscape and that both banks and their service providers could benefit from greater consistency in regulatory expectations.
We will be watching closely for any formal announcement from the FDIC regarding this initiative. If the agency proceeds, the development of an industry-backed standard-setting organization could become an important component of the supervisory framework governing bank-fintech partnerships for years to come.