A charter you can rent, an obligation you cannot
On September 15, 2026, four federal regulators (the OCC, the FDIC, the Federal Reserve, and the NCUA) published a proposed rewrite of how banks are expected to manage their third-party relationships. Comments are due November 16. Beneath the mechanics of risk tiering and vendor diligence sits a message that every institution running a fintech partnership program already knows in its gut: the obligation does not move.
Banking-as-a-service, or BaaS, is the arrangement that lets a neobank, a payroll app, or an expense-card startup offer insured accounts without holding a charter of its own. A chartered bank supplies the charter and the regulated rails; the fintech supplies the app, the brand, and the customer relationship. It is a powerful growth model. It is also one where the institution legally responsible for anti-money-laundering compliance frequently never sees the customer, never runs the onboarding screen, and never touches the transaction interface.
That is the quiet tension at the center of every bank-fintech deal: the customer belongs to the fintech, but the compliance failure belongs to the bank.
In a BaaS program, the bank can outsource the interface, the onboarding flow, and even the brand. It cannot outsource the Bank Secrecy Act.
The enforcement record already wrote the thesis
The proposed guidance did not arrive in a vacuum. It follows two years in which the examination record made the stakes unmistakable. In March 2024, the FDIC issued consent orders against Sutton Bank, a 2.2 billion dollar institution in Attica, Ohio, and Piermont Bank, a 578 million dollar lender in New York City, both tied to how they oversaw fintech partners. Sutton was directed to go back and review every prepaid-card customer onboarded since July 1, 2020, to reconfirm who those customers actually were. Piermont was told to re-examine every transaction since September 2022 to confirm that suspicious activity had in fact been reported. Later that year, Thread Bank received a comparable order over its BaaS program. The pattern was consistent, and it was not about intent.
The common finding was not fraud by the bank. It was that the bank could not see, in reliable form, who its partners were actually banking.
The same year made the customer side of the problem visible. When the middleware provider Synapse collapsed in 2024, roughly 160 million dollars in end-user funds was frozen while a bankruptcy trustee tried to reconcile ledgers that did not agree. The lesson for compliance officers was blunt: when the record of who holds what, and who is who, lives in a partner’s systems rather than the bank’s, the bank inherits the gap when the partner stumbles.
Accountability does not divide
The 2026 proposal would replace the June 2023 interagency guidance and, notably, bring the NCUA in alongside the banking agencies. Much of it is procedural. The sentence that matters for BaaS is simpler: a bank’s obligations remain its own regardless of how the work is split with a partner. A relationship is treated as higher-risk when its failure could cause a real, non-trivial violation of law, and a sponsor bank can reasonably expect its partnership programs to land in that category.
In practice, that keeps diligence and monitoring expectations high and shifts the burden toward proof. Examiners increasingly want evidence rather than assurances: documented testing, complaint reviews, and remediation records that show the bank is looking through its partners to the end customers. Effective this November, the OCC and FDIC are also reserving formal violation findings for substantive, systemic issues or more-than-minimal customer harm, which means the findings that do land are the ones that carry real consequences.
Oversight is a data problem wearing a governance costume
Most BaaS oversight programs are built from questionnaires, attestations, and quarterly partner reviews. Those are necessary, and they are not sufficient. A partner can attest that it screens its customers against sanctions and watchlists; the bank’s obligation is to know that the right names were screened, against current lists, with the context that separates a true hit from a common-name collision. An attestation describes a process. Compliance requires the underlying data.
This is where partner oversight quietly becomes a data-quality question. A sponsor bank needs to apply one standard of authoritative screening and risk data across every partner’s book, rather than inherit whatever each fintech happened to buy. It needs that screening to read not just a name on a list but the surrounding context: the adverse-media report, the politically-exposed-person connection, the materiality of a match. And it needs the result in a form an examiner can inspect long after onboarding.
You cannot supervise what you cannot see, and you cannot evidence what you never collected in a consistent form.
What a partnership program should be able to prove
- Screen to one standard. Apply the same authoritative watchlist, PEP, and adverse-media screening across every partner’s book, rather than trusting each fintech’s own vendor choices and thresholds.
- Keep the evidence. Retain the screening result, the match context, and the disposition, so the bank can show an examiner what was checked and why, not merely that a partner said it was handled.
- Refresh, do not snapshot. Lists and risk profiles change; a customer cleared at onboarding in a partner’s app can surface on a sanctions or adverse-media record months later, and that perpetual screening is the bank’s responsibility.
- Investigate across the stack. When a match or alert lands, the bank needs to pull the full entity picture across partners and sources, not chase it through a fintech’s support queue.
From questionnaire to investigation
The next step for partner oversight is to make the entity picture itself investigable, so that a sponsor bank can move from a quarterly review of a partner’s attestations to a live view of the customers behind them. That is the purpose of Vital4 Investigate, our AI-native investigative intelligence platform launching in Q4 2026 and Q1 2027: it brings authoritative screening data, adverse-media and PEP context, and network views into one place, so that an alert on a partner’s customer can be worked with the bank’s own evidence rather than someone else’s summary.
The bank-fintech model is not going away, and it should not. It has brought real accounts and real credit to people the traditional branch never reached. But its growth has outrun the data plumbing that supervision depends on, and regulators have now said, in plain language, that the charter-holder owns the outcome. The programs that thrive under the new guidance will be the ones that treat partner oversight as an authoritative-data discipline, not a paperwork exercise.