US banks with financial technology partnerships accounted for an outsized share of severe enforcement actions in 2023, and they will likely remain in regulatory crosshairs for the foreseeable future, industry experts said.

In 2023, banks that provide banking as a service (BaaS) to fintech partners accounted for 13.5% of severe enforcement actions issued by federal bank regulators, including prompt corrective action directives, cease and desist orders, consent orders and formal agreements, according to data compiled by S&P Global Market Intelligence. The number of banks that received enforcement actions due to fintech partnerships is disproportionately large, considering it is estimated that fewer than 100 community banks are in the business of BaaS and there are roughly 4,800 banks in the US.

The enforcement actions made public are only the tip of the iceberg. BaaS providers are also facing informal actions that are kept private, said Jonah Crane, a partner at advisory firm Klaros Group, said in an interview.

Different from formal actions that are legally enforceable, informal actions are voluntary commitments of banks to address regulators' concerns. For instance, the Office of the Comptroller of the Currency issues matters requiring attention, or MRA, to alert banks about problems that warrant improvements in a timely manner. It could take years and several exam cycles before such informal alerts get escalated into formal orders.

For sponsor banks that have sizable fintech partnerships, "over the next year or two, I don't think there will be any of them that don't have at least a couple informal enforcement action type of issues to deal with," Crane said.

It is because federal regulators have been getting their arms around the business models of BaaS through years' of real learning through examinations, and they will be looking hard enough to identify practices with higher risks, Crane said.

Another regulatory risk for BaaS providers is lower CAMELS composite ratings due to negligence in fintech partnerships. CAMELS is a scoring system for regulators to assess banks' capital adequacy, assets, management capability, earnings, liquidity and sensitivity.

"Regulators have to hold the management accountable, to the extent that stuff isn't being done. It wouldn't surprise me if that bears out in ratings. Generally, the management rating is a very powerful tool for them to use," said Max Bonici, an attorney at Venable LLP.

Lack of handbook in BaaS regulation

Behind the larger number of enforcement actions are challenges faced by banks and their examiners. Banks' fintech partnerships are structured differently on various matters, and there is no handbook to address all the nuances as to what is satisfactory and what is not.

"It's been hard. Banks have encountered delays where the supervisors on the ground were waiting for feedback from D.C.," Crane said.

Public enforcement orders showed that regulators have been using existing laws to discipline banks' fintech partnerships, including consumer protection laws and anti-money laundering rules in the Bank Secrecy Act. But this approach relies on a patchwork of rules and regulations, and federal agencies need to streamline it with state regulators and other policy makers, according to industry trade group American Fintech Council, whose members include fintechs and sponsor banks.

"It's what we call regulation by enforcement. Instead, what we need is clear, consistent supervisory expectations," Phil Goldfeder, CEO of American Fintech Council, said in an interview. "Responsible innovative banks are increasingly frustrated with the nature of treatment by their supervisors, examiners and regulators who refuse to engage in pragmatic or meaningful dialogue."

Regulators have taken the first steps to provide clarity. In June 2023, the OCC, the Federal Reserve Board and the Federal Deposit Insurance Corp. issued the "Interagency Guidance on Third-Party Relationships: Risk Management."

Federal agencies have also been allocating resources aiming to catch up with fintech innovations. In 2023, the OCC established the Office of Financial Technology. The Federal Reserve Board created a Novel Activities Supervision Program that same year, and one of the focuses is banks' "technology-driven partnerships with nonbanks to deliver financial services to customers." Those dedicated fintech programs will help bring more consistency on a national basis, Crane said.

"They're going to expect really high standards, but they'll be more consistent and they'll be more tailored. And I think eventually, they'll get around having targeted handbooks for guidance," Crane said.

Banks still see benefits of BaaS

An impact of the heightened regulatory scrutiny is that BaaS is getting more expensive to enter and maintain. Flaws in fintech partnerships may lead to additional cost to maintain higher capital levels, and in general there are additional regulatory costs with more frequent supervisory activities, said Bao Nguyen, a partner advising financial institutions at Skadden Arps Slate Meagher & Flom LLP.

In a consent order to Blue Ridge Bank NA, the bank unit of Blue Ridge Bankshares Inc., the OCC raised required capital requirements due to safety and soundness issues in part because of the bank's fintech partnerships. It prompted Blue Ridge to raise $150 million in a private placement in December 2023.

Still, the space continues to see new bank entrants, and experts with related experience are sought after.

In November 2023, former chief strategy officer at MVB Financial Corp. Matt West left the company and bootstrapped his own business, Xenios, to help banks break down some of the regulations and guidance, and put together policies, procedures and training programs for fintech partnerships. His new firm now works with several banks making inroads into fintech, such as BayFirst National Bank.

West views the current hiccups as short-term challenges since regulators are holding many banks to higher standards for the first time, but it is positive in the long term because regulators are setting expectations, whether through exams or more formal guidance.

The financial incentive is the growth driver attracting banks. In the third quarter of 2023, BaaS providers continued the strong momentum in deposit growth, with many outperforming peers of community banks, according to Market Intelligence data.

"I still do believe that these banks see a bona fide strategy for deposits first, and for fee revenue second," said Brian Love, head of banking and fintech at executive search and talent advisory firm Travillian Group.

In a newly formed five-year partnership with BM Technologies Inc. subsidiary BMTX Inc., a banking platform tailored to college students, Rocky Mount, NC-headquartered First Carolina Bank onboarded over $431 million of deposits in December 2023 originated by BMTX. First Carolina has used the majority of the funding to pay off all of its Federal Home Loan Bank borrowings, which were approaching $300 million, and will use the rest to fund loans in 2024, Ron Day, the bank's president and CEO, said in an interview.

Because the balances of the deposit accounts, which students use to pay tuitions and receive financial aids, tend to be smaller, the bank's uninsured balances have dropped to the low teens from mid- to high-20s, Day said. First Carolina also aims to more than double its non-interest income over 12 months since the partnership began on Dec. 1, 2023, he added. It will be driven by payments flowing through debit cards associated with the deposit accounts.

"The regulators frankly are happy with us in terms of what we're doing here. It has improved our liquidity metrics, loan-to-deposit ratio, all that kind of stuff there," Day said.