- Key insight: The FDIC is in early conversations to create standards for bank tech providers through an independent standard-setting body and an assessor for vetting fintechs on behalf of smaller banks.
- What's at stake: According to the agency, the initiative may be particularly valuable to community banks that might not otherwise have the resources or expertise to evaluate multiple bank tech providers.
- Expert quote: "If a credible certification lowers the cost of considering a partner, it will expand the practical vendor universe for a bank in a way nothing else on the table does." —CCG Catalyst's Paul Schaus
Federal regulators are considering options for helping banks vet their technology providers.
The Federal Deposit Insurance Corp. is in preliminary discussions with multiple banking and fintech trade associations to establish an independent standard-setting body, referred to as a "Banking Innovation Standards Development Organization," that would help certify whether bank tech vendors meet federal regulatory guidelines. The news was first reported by
A senior FDIC official confirmed with American Banker that discussions are ongoing and verified the origins of a
Most U.S. banks are members of at least one of the trade groups involved in preliminary discussions, and the official said that the groups are currently consulting with their members. None of the trade groups responded to a request for comment by time of publication.
The agency does not yet have a timeline for when the standards-setting body would be rolled out, as it has only had two meetings with the involved trade groups so far, but the official said it may have a clearer schedule in the next several months.
Paul Schaus, managing partner at bank consulting firm CCG Catalyst, told American Banker that vendor due diligence has an impact on community and regional banks.
"Over the years, I have watched hundreds of institutions ask the same due diligence questions of the same vendors, one bank at a time, each paying its own way," he said. "The smaller the bank, the more that duplication costs relative to what it can afford. A community bank evaluating a fintech partner today has four options: go with what everyone else uses, staff up expertise it doesn't have, hire outside counsel or consultants to do the assessment or walk away. The majority will use a standard vendor like FIS, Fiserv or Jack Henry, or walk away if it is not a simple check-the-box process."
Read more:
The top-performing 20 public banks with under $2B of assets in 2025 The top-performing banks with $2B to $10B of assets in 2025 'The data has to be perfect': BofA CEO Moynihan on AI Should a bank ever be liable when a customer gets scammed?
The draft term sheet, dated July 21, outlines "a framework for establishing a voluntary public-private standards development organization, along with a conformity assessment (i.e., attestation and certification) program, to support third-party risk management and technology integration at banks."
Today, banks do their own due diligence processes when evaluating whether to work with a fintech offering vendor services of some kind, such as customer relationship management or transaction monitoring for AML compliance. According to the FDIC official, the formal structure of bank-vendor relationships would not change as they still have an obligation to track everything their vendors are doing.
The current due diligence process for starting a vendor relationship looks like the following: if a bank hires someone to do payments processing, for example, the bank asks specific questions of each fintech candidate and subsequently makes a decision on whether to work with them. Fintechs apply separately with each bank and banks audit each fintech in what is often a manual process involving either internal or outsourced counsel.
The proposed standard-setting body would, according to the term sheet, build an independent non-profit organization that would set a series of publicly available standards using existing regulations for bank-fintech vendor relationships. The body would create and release a series of standardized questions for interested parties to answer. A separate independent assessor would also be established to evaluate responses submitted by fintechs to the standardized questions.
Should a vendor pass the assessment, the organization could issue a certificate that the fintech could bring to banks that accept it as proof of passing "due diligence" checks from a coalition rubber-stamped by federal regulators.
"The framework would allow a provider, its solutions, and its controls to be assessed once, kept current and used by multiple banks," the term sheet read. "A certification would indicate that the provider and its specific solutions have met a defined baseline under the standards."
The proposed certification may also serve as a "green light to consider," according to the term sheet, "which may be particularly valuable to community banks that might not otherwise have the resources or expertise to evaluate multiple providers or solutions."
The FDIC official confirmed with American Banker that any certification process established by the standard-setting body would be fully voluntary for both banks and fintech vendors.
"The term sheet is a good starting point," Schaus said. "If a credible certification lowers the cost of considering a partner, it will expand the practical vendor universe for a bank in a way nothing else on the table does. This term sheet is the most serious attempt yet to build that and the first with federal regulators at the table from day one."
Other attempts to assess fintech vendors for banks have been pursued in the private sector, such as True Digital's
The FDIC is also in preliminary conversations with the Federal Reserve and the Office of the Comptroller of the Currency, according to the senior official, but neither have officially joined the effort yet.
Schaus said that the concept of setting industry standards for bank tech vendor contracts is sound but "not a cure-all," as regulators have issued
Should a standard-setting body be established, according to Schaus, the bulk of the work for banks and regulators alike rests on how well the standards are applied and how the bank manages the ongoing relationship after an initial contract is signed.
"It is infrastructure, and infrastructure is judged on execution," he said. "Governance, funding and assessor oversight over the next several months will decide whether this becomes something banks will rely on or another well-intentioned framework on a shelf."
