Banking as a Service materially changes a bank's risk profile by embedding fintech partners in regulated banking activities. Regulators have been explicit that sponsor banks remain fully accountable for compliance, operational integrity and control effectiveness, regardless of who performs the activity. This brief covers what examiners expect and how internal audit should expand its scope and testing for BaaS programs.
Executive Summary
Banking-as-a-Service arrangements embed fintech partners directly in activities that are core to banking, including account opening, payment processing, lending origination, and compliance-related monitoring. Regulators view these activities as integral to a bank’s safety and soundness, and they have been explicit that using a third party does not lessen the bank’s responsibility to comply with applicable laws and regulations. As BaaS programs scale, examiners are increasingly focused on whether sponsor banks can demonstrate clear ownership, effective governance, and independent validation across the full BaaS lifecycle. Internal audit sits at the center of that assurance: coverage that tests how fintech-executed controls actually operate, not just what contracts say, is the foundation of supervisory readiness. [1][2]
Key Takeaways
• Sponsor banks remain accountable. Using fintech partners does not lessen a bank’s responsibility for compliance, regardless of how roles are assigned by contract. [1][2]
• Control ownership must be explicit. Contracts define roles, but risk accountability stays with the bank, so ownership of each control should be clear and documented. [2]
• Oversight is a lifecycle, not an onboarding event. Risk management should be continuous and adaptive as products, volumes, and customer populations change. [2][3]
• Fintech-executed compliance functions need independent validation. Where partners perform activities such as transaction monitoring or customer due diligence, the bank must independently validate that the controls operate effectively. [1][4]
• Internal audit scope must reach real execution. Audit plans should prioritize high-risk BaaS activities and test fintech-executed processes with evidence-based methods, not rely only on policy review, contract review, or third-party reports. [2]
Why BaaS Has Become a Regulatory Priority
Banking-as-a-Service arrangements introduce a level of operational complexity that differs materially from traditional outsourcing models. Under BaaS, fintech partners often perform customer-facing and transaction-driven activities that are core to banking operations, including account opening, payment processing, lending origination, and compliance-related monitoring. Regulators view these activities as integral to the bank’s safety and soundness profile.
The federal financial regulators’ Interagency Guidance on Third-Party Relationships: Risk Management confirms that sound risk management must be applied commensurate with the level of risk and complexity associated with a third party’s activities, from planning through ongoing monitoring.[2] This applies regardless of whether the third party is a traditional vendor or a fintech delivering embedded services on behalf of a bank.
In July 2024, the FDIC, Federal Reserve, and OCC issued a joint supervisory statement outlining risks related to bank arrangements with third parties to deliver bank products and services, reminding banks that using third parties does not lessen their responsibility to comply with applicable laws and regulations.[1]
The Most Common BaaS Control Weaknesses Identified by Regulators
As supervisory attention on BaaS programs has intensified, recurring control weaknesses have emerged, especially when traditional third-party risk practices are applied without proper adaptation to fintech relationships.
Unclear Control Ownership
Banks often rely on legal contracts to define roles, but regulators emphasize that actual risk accountability resides with the bank regardless of contractual delegation. Clear ownership of controls is essential to satisfy examiner expectations.[2]
Inadequate Lifecycle Risk Management
Regulatory guidance emphasizes that risk management must be dynamic and continuous, not static. Practices limited to due diligence at onboarding, without periodic reassessment as circumstances change, may leave gaps in coverage.[2] Federal banking regulators have emphasized that third-party risk management must be continuous and adaptive, not limited to onboarding due diligence, particularly as products, volumes, or customer populations change. This expectation is outlined in the Third-Party Risk Management: A Guide for Community Banks, which applies risk management practices across the full lifecycle of third-party relationships.[3]
Insufficient Oversight of Compliance Functions
When fintech partners execute compliance functions such as transaction monitoring or customer due diligence, sponsor banks must independently validate that controls operate effectively across the relationship. This requirement aligns with the agencies’ broad principle that engaging third parties does not diminish the bank’s compliance responsibility.[1]
What Regulators Expect Sponsor Banks to Demonstrate
Regulatory publications do not prescribe rigid procedures, but examiners consistently assess the following areas when evaluating banking organizations’ arrangements with third parties:
Accountability Across the BaaS Lifecycle
Regulators expect banks to maintain clear governance over all critical activities performed through third parties. Boards and senior management must be able to articulate how responsibilities are assigned and how oversight is exercised.[2]
Governance and Escalation
Governance practices should include mechanisms for reporting performance, operational disruptions, or compliance deficiencies to appropriate authorities within the institution. The risk management guidance calls for governance commensurate with the complexity of relationships.[2]
Independent Validation of Controls
Internal audit’s independent testing is often a focus area in examinations of third-party relationships, assessing whether risk-management practices such as ongoing monitoring, issue tracking, and control effectiveness are documented and validated.[2] The Interagency Guidance on Third-Party Relationships: Risk Management further reinforces that independent testing and validation are critical components of effective third-party risk governance, particularly for higher-risk and more complex relationships.[4]
The Role of Internal Audit in BaaS Oversight
Internal audit plays a critical role in assuring management and boards that third-party risk is effectively managed. Regulators expect audit functions to:
Expand Audit Scope Beyond Traditional Models
Internal audits of third parties must address real-world execution of controls and compliance responsibilities, not just policy compliance or contract review.[2]
Apply Risk-Based Audit Planning
Audit plans should prioritize high-risk BaaS activities, including high-volume transaction flows, customer onboarding systems, and compliance functions that impact safety, soundness, and legal adherence.
Internal audits of third parties must address real-world execution of controls and compliance responsibilities, not just policy compliance or contract review.
Coordinate with Risk and Compliance But Maintain Independence
Audit must stay independent, validating risk management rather than performing it, while avoiding unnecessary duplication of work done by compliance or risk functions.
Building Audit Readiness for BaaS Programs
Banks seeking to strengthen BaaS audit readiness should:
Map End-to-End BaaS Activities
Document precisely who performs each function across the BaaS lifecycle, including tech, compliance, and customer onboarding responsibilities.
Align Controls to Regulatory Expectations
Ensure that control frameworks reflect supervisory expectations, including ongoing monitoring, issue remediation tracking, and escalation protocols.
Formalize Independent Audit Testing
Integrate testing of fintech-executed processes into internal audit plans, using evidence-based validation methodologies.
Common Mistakes That Undermine BaaS Audit Readiness
Even well-intentioned BaaS programs often fall short of regulatory expectations due to a small number of recurring missteps. These issues typically arise when banks apply traditional outsourcing assumptions to operating models that embed third parties directly into core banking activities.
One of the most frequent mistakes is treating fintech partners as standard vendors. BaaS arrangements involve ongoing execution of regulated activities, not discrete services, and therefore require deeper governance, monitoring, and validation. When banks rely on vendor-style oversight models, they often fail to capture the full scope of operational and compliance risk.
Another common weakness is overreliance on third-party reports, such as SOC examinations, without supplemental testing. While these reports can support risk assessments, regulators generally expect banks to perform independent validation tailored to their specific BaaS activities and risk profile. Reports alone rarely provide sufficient evidence of control effectiveness across end-to-end processes.
Finally, many banks underestimate the importance of clear issue ownership and board visibility. When deficiencies arise at fintech partners, regulators expect sponsor banks to demonstrate timely escalation, documented remediation, and governance-level awareness. Gaps in documentation or reporting often signal weak oversight, even when remediation efforts are underway.
How AuditOne Supports BaaS Audit Readiness
Strengthening audit readiness for BaaS programs requires a deliberate shift from static oversight to dynamic, risk-based validation. Banks that approach BaaS readiness proactively are better positioned to demonstrate control, ownership, and regulatory alignment during examinations.
A foundational step is to map the full BaaS lifecycle, identifying where activities are performed, who executes them, and who retains accountability. This exercise often reveals hidden dependencies, nested third-party relationships, and control gaps that are not visible through contract reviews alone.
Banks must also ensure that controls are designed to meet regulatory expectations, not just contractual requirements. This includes maintaining appropriate documentation, evidence retention, monitoring routines, and escalation protocols that withstand examiner scrutiny. Controls should be reassessed as programs evolve, transaction volumes increase, or products expand.
Finally, audit readiness depends on formalized, independent audit testing. Internal audit plans should explicitly incorporate fintech-executed processes, using testing approaches that provide credible assurance. Whether conducted through internal resources or co-sourced specialists, this testing must produce evidence that regulators can rely on during supervisory reviews.
Assess Your BaaS Audit Readiness
Engage with AuditOne specialists to evaluate how your internal audit function aligns with regulatory expectations for third-party relationships and fintech partnerships.
About the Author
Ryan McAbee is the BSA Practice Director at AuditOne, where he leads independent BSA/AML program testing and automated AML system validation for community banks, credit unions, and their fintech partners nationwide. He works with boards and BSA officers on whether the risk assessment truly drives decisions and whether the record supporting those decisions would withstand examination.
References
- Federal Deposit Insurance Corporation, Board of Governors of the Federal Reserve System, and Office of the Comptroller of the Currency. Agencies Issue Statement on Bank Arrangements with Third Parties to Deliver Bank Products and Services. FDIC, 25 July 2024, https://www.fdic.gov/news/financial-institution-letters/2024/agencies-issue-statement-bank-arrangements-third-parties.
- Federal Deposit Insurance Corporation, Board of Governors of the Federal Reserve System, and Office of the Comptroller of the Currency. Agencies Issue Final Guidance on Third-Party Risk Management: Risk Management Principles and Practices. Federal Reserve System, 6 June 2023, https://www.federalreserve.gov/newsevents/pressreleases/bcreg20230606a.htm.
- Federal Reserve Board of Governors, Federal Deposit Insurance Corporation, and Office of the Comptroller of the Currency. Third-Party Risk Management: A Guide for Community Banks. Federal Reserve Board of Governors, https://www.federalreserve.gov/frrs/guidance/third-party-risk-management-a-guide-for-community-banks.htm.
- Federal Reserve Board of Governors, Federal Deposit Insurance Corporation, and Office of the Comptroller of the Currency. Interagency Guidance on Third-Party Relationships: Risk Management. Federal Reserve Board of Governors, https://www.federalreserve.gov/frrs/guidance/interagency-guidance-on-third-party-relationships.htm.
