Federal: Comment Letter to Financial Stability Board on Proposed Third-Party Risk Toolkit

Financial Stability Board
Bank for International Settlements
Centralbahnplatz 2
CH-4002 Basel
Switzerland

Re: Third-Party Risk Management and Oversight

On behalf of the American Fintech Council and its members, we thank the Financial Stability Board (FSB) for the opportunity to comment on its consultative document regarding its third-party risk toolkit (Toolkit).

AFC is the premier trade association representing the largest financial technology (Fintech) companies and the innovative banks that power them. Our mission is to promote an innovative, transparent, inclusive, and customer-centric financial system by supporting responsible innovation in Fintech and encouraging sound public policy. AFC members are at the forefront of fostering competition in consumer finance and pioneering ways to better serve underserved consumer segments and geographies. Our members are also lowering the cost of financial transactions, allowing them to help meet demand for high-quality, affordable products.

I. Introduction

The AFC supports federal policymakers, regulators, and other stakeholders on market-based solutions to issues that regulators and others have emphasized throughout the public discussion around third-party risk. Our members are improving best practices that help advance data security and consumer information, and we are working on better understanding the outcomes. AFC’s membership has a proven track record of facilitating modern, innovative products, especially in online lending, which can provide essential financial services to consumers who have otherwise been all but left behind by legacy financial institutions. Empowering smaller banking organizations to form these partnerships in a safe and responsible manner is critical to ensuring competition throughout the market, which creates lower prices and a variety of superior options for consumers.

While we appreciate the FSB’s issuance of its Toolkit for financial institutions and financial authorities, which can provide important clarity for industry and regulators and create a safer financial services ecosystem for consumers, we believe that the Toolkit should be expanded to include banking services. Sound, unambiguous third-party risk management guidance like an expanded Toolkit will help to propel and foster responsible innovation while creating a level playing field across the ecosystem. We also have other suggestions to improve the Toolkit’s guidance on inter-US agency congruence, definitions, process, and to address the end of third-party partnerships.

II. AFC strongly urges FSB to expand the Toolkit to include guidance including core third-party relationships related to core banking functions, such as lending and payments.

The Toolkit notes that there is an increasing number of financial institutions outsourcing aspects of their financial services. AFC encourages FSB to consider expanding its understanding of financial institution-third-party dynamic, particularly within Fintech, as these engagements have moved beyond outsourcing to full partnerships between the banks and Fintech companies. It is pertinent for the FSB to expand the scope of the Toolkit to include these more robust bank-Fintech partnerships. In order to have the most effective third-party risk management, both industry and regulators must move beyond the traditional understanding of third-party service providers towards a new understanding that includes core banking functions, such as lending and payments partnerships. This would help ensure that guidance at the standard setting body and local country’s regulator allows for the bank-Fintech partnership model. This expansion in understanding is especially timely due to the recent interagency guidance on Third-Party Risk Management (TPRM). As bank-Fintech partnerships expand, it is important for businesses to have a unified set of federal regulatory guidance that sets the appropriate best practices standards. Expanding the Toolkit to cover these issues will establish robust global standards for the benefit of consumers, industry, and regulators, allowing greater transparency in and access to financial services. This is important not just for safe business practices, but for the positive outcomes that responsible bank-Fintech partnerships provide.

Responsible bank-Fintech partnerships promote the availability of affordable credit, especially for traditionally underserved borrowers, and improve the competitiveness of banking organizations, thereby enhancing their safety and soundness. In many cases, the ability for these institutions – many of which previously have played a critical role in delivering affordable credit to low- and moderate-income communities – to continue to drive the industry forward and create innovative solutions depends on their ability to partner effectively with third parties. Supporting responsible partnerships through sound guidance will continue to lead to tremendous growth and benefits for consumers and the financial system as a whole. Consumers are the main beneficiaries of these partnerships because they benefit from, among other things, lower prices through competition, access to products and services designed to meet their needs, and an elevated customer experience.

III. AFC recommends that FSB continue to coordinate with other US federal regulators of jurisdiction as it considers risk guidance in the financial services industry.

In the United States, the recently published final TPRM guidance and other increased regulatory attention to third-party relationships in lending demonstrates the demand for federal leadership and clarity on Fintech lending and third-party relationships. To this end, AFC recommends that as FSB finalizes the Toolkit and any possible related guidance/rulemakings that it coordinates with US financial services regulatory agencies, including the Federal Reserve, Consumer Financial Protection Bureau (CFPB), the Federal Deposit Insurance Corporation (FDIC), the Office of the Comptroller of the Currency (OCC), and other relevant agencies to ensure that rules and requirements addressing third-party risk fit within the FSB’s global approach and are not duplicative or contradictory to the work conducted by other regulators. Clear and congruent rules and/or guidance from regulators will help augment existing frameworks for how consumer financial information can be protected, accessed, and shared in responsible ways to benefit consumers. This will also allow industries to be compliant with one set of federal standards that will allow them to follow the law and better serve their customers globally. Finally, we believe addressing these issues in coordination with the other financial services regulators will avoid potential regulatory arbitrage between regulators and market participants across financial services and other industries.‍

IV. AFC also would like to make the following recommendations:‍

Definitions

We recommend FSB create a definition for “financial institution.” We recommend this definition be congruent with the established use and understanding of “financial institution” by FSB member state regulators.

Proportionality

The Toolkit appears to define proportionality from the perspective of how many consumers may be impacted by a problem rather than size of the financial institution, which is incongruent to how the other US financial regulators have addressed proportionality. Proportionality may be a higher risk at smaller financial institutions because more deposits, lending, or customers, and may be driven by third-party relationships. Although larger institutions may have more total customers through third-party providers, those customers may take up a smaller percentage of the overall deposit, lending, or customer base from the institution as a whole. We urge FSB to consider this as it finalizes its Toolkit.

Due Diligence‍

Financial Institutions and third-party services providers often work with a shared vision, mission, and/or culture. It is important for third-party providers to have all the tools and guidance necessary to best support their own growth projections, through financing, resource allocation, and other coordination. We recommend the Toolkit further expands on tools to promote due diligence that will be most useful in financial services institutions and their third-party providers.

End of Contract Guidance

FSB’s recommendations on “identifying, documenting and, to the extent possible, testing exit strategies for their third-party service relationships involving critical services” present important opportunities to improve the safety and soundness of the financial services industry, as well as ensure consumer protections if applied beyond the current scope of the Toolkit to include bank-Fintech partnerships in lending and payments.5 Establishing a robust exit strategy recognizes the realities that bank-Fintech partnerships do not always operate in perpetuity, and that disruptions to this partnership can have negative impacts on banks, third-parties, and consumers. As noted by the FSB, exit planning is not a standardized process. However, when completed effectively, AFC and its members agree with FSB’s assessment that robust exit planning ensures a safe and sound environment for all parties in the event that engagement between a bank and Fintech or other third-party ends.‍

V. Conclusion‍

We again thank the Financial Stability Board for this opportunity to respond. We urge FSB to expand this or a future Toolkit to more robustly cover lending, payments, and other banking services. Financial Services organizations would benefit from standardized guidance and examination modules across their federal and state regulatory agencies across FSB member states. Uniform best use practices that encourage responsible lending partnerships would greatly benefit consumers, banking organizations, and the financial system.