The recent cease and desist order against embattled Evolve Bank & Trust illustrated how regulators are increasing the scrutiny of banks' partnerships with financial technology companies and their potential impact on capital.
The Federal Reserve Board issued the order June 14 and identified deficiencies with risk management, compliance with consumer protection and anti-money laundering rules in Evolve's banking-as-a-service (BaaS) practices. Evolve, which is also dealing with the fallout from a cyberattack and the bankruptcy of BaaS middleware vendor Synapse Financial Technologies Inc., is now on deadline to submit at least 16 written plans over the next two to three months to improve its strategic planning in capital, liquidity, credit and interest rate risks.
"It's so widespread. It's almost recreating the bank in its entirety," Sam Haskell, managing member at Colarion Partners, said in an interview. Colarion Partners is an investment firm focused on bank equities but is not an investor in Evolve.
In particular, Evolve is asked to elaborate on capital risk management associated with BaaS activities. It reflected that regulatory reviews are becoming more granular as to how operational risk in fintech partnerships weighs on an institution's capital, according to John Popeo, partner at advisory firm The Gallatin Group.
"Basically, the Fed is saying that they have to manage their capital with respect to the technology risk," Popeo said in an interview.
The emphasis on operational risk capital is a relatively new area of focus in recent years, said Jason Cave, senior consultant at Patomak Global Partners and a former official at the Federal Deposit Insurance Corp. Regulators have started to expect BaaS banks to set aside additional capital to prepare for future disruptions, such as breaking up with a fintech partner, Cave said.
"A lot of these exposures are more like contingent liabilities. If you only hold capital for your risks today, you will likely be short of capital for some of these things. So I think there is a greater emphasis from the bank regulators to say, 'We want you to hold additional capital for some of these events,'" Cave said in an interview.
One challenge is how to decipher the risks into a number, Cave noted. Unlike holding capital for credit risks, there is no historical data such as default rates for banks or their regulators to come up with a specific amount of capital to put aside.
"It's very difficult to come up with an amount or a range to say, 'Here's what it costs to break up your relationship,' and all these things," Cave said. "It's a bit more of an art."
From bad to worse
The ongoing incidents at Evolve illustrate the level of stress that disruptions in fintech partnerships can cause for a bank. Industry experts cautioned that the largest risk lies in the unknown because more issues could surface and put a dent in the balance sheet.
The cease and desist order was issued at a time when the bank is flooded with complaints from customers of Evolve's fintech partners who could not access their deposits amid the bankruptcy of the BaaS middleware company Synapse.
Separately, Evolve confirmed a ransomware attack on June 26, less than two weeks after the Fed identified deficiencies in the bank's information technology and security systems. According to Evolve's disclosure, the data breach resulted from a ransomware attack by the Russian hacker group LockBit, which gained access to its systems after an employee clicked on a malicious link.
"Regulators saw this coming, with Evolve's recent [cease and desist order], but could not act fast enough," Haskell wrote in the newsletter 5 Points. The data breach, as well as other problems revealed in the Synapse case, could cause its fintech partners to be closed at worst and redirected to other bank partners at best, he wrote.
Evolve plans to continue growing its BaaS business, which is its largest revenue stream, said a person familiar with the matter but who declined to be named because they are not authorized to discuss the bank's communication with regulators. Some of its fintech partners include buy-now, pay-later lender Affirm Inc. and small business banking platform Mercury Technologies Inc. Evolve also provides personal and business banking and mortgage.
Evolve is working on fulfilling the requirements raised in the order. One focus of the remaining work is to add more personnel in the compliance and third-party risk management fields and form required committees for oversight, the source familiar with the bank said.
After the order was issued, an Evolve spokesperson issued a statement saying it is well-capitalized. However, the Fed's scrutiny of the bank's capital, liquidity, credit and cash flows suggests concerns about what Evolve's ultimate profile may look like after its ongoing issues are resolved, Haskell said.
Capital constraints
Along with emphasizing operational risk, the cease and desist order imposes capital conservation requirements. Evolve Bank & Trust and its bank holding company Evolve Bancorp Inc. will need written approvals before they pay dividends, buy back shares or pay interest on subordinated debt, as well as before increasing debt levels. While capital conservation is not uncommon in Fed cease and desist orders, Haskell noted that the restrictions on the debt payments underscored the regulator's concern. Another fintech-friendly banking institution that faced similar restrictions is Mode Eleven Bancorp., which agreed to exit BaaS before the issuance of a cease and desist order by the Fed.
"You normally would not force a company to ask for approval to make payments on its sub debt if you didn't have serious concerns about their capital," Haskell said.
While capital conservation is a typical lever regulators use in enforcement actions, it does not apply to all fintech-friendly banks that have received such orders. Among its recent actions, the Fed did not impose capital conservation requirements on Metropolitan Commercial Bank. The FDIC also did not impose such terms in the consent orders to Choice Financial Group and Sutton Bank.
Given Evolve's struggles, it is more important for its bank holding company to be a source of financial strength for the bank unit, said Chip MacDonald, managing director at MacDonald Partners LLC.
As of Dec. 31, 2023, Evolve Bancorp had total assets of $158.01 million and total equity capital of $106.08 million, according to a regulatory filing from the company. The financials imply that the bank holding company's total liabilities are equal to roughly one-third of its total assets. This is relatively high, although compliant with regulations because the company is small, MacDonald noted.
Bank holding companies could also help provide funding to support their bank's strategic pivots. In April, Blue Ridge Bankshares Inc. raised $150 million in a private placement to help its bank subsidiary Blue Ridge Bank NA meet higher regulatory capital ratios imposed by the Office of the Comptroller of the Currency, in another example where bank regulators require banks to commensurate capital planning with BaaS risks. Blue Ridge is winding down deposit-focused fintech partnerships and returning to traditional community banking.
"There could be some kind of private equity recapitalization, but it's a complicated situation because there's so much work to be done on the front end," Haskell said. "It would be a positive [factor] if they were given access to the capital markets — the way Blue Ridge has been."
Whether or not Evolve will tap capital markets, the urgency is to solve deep-rooted problems in its operations instead of maintaining a good-looking capital ratio on paper.
"Having a large capital ratio is not a guarantee of a bank being safe and sound," said an industry lawyer. "The other thing is, how do you apply risk management oversight to your capital?"