Thread Bank, a financial institution based in Rogersville, Tennessee, has been issued a consent order by the Federal Deposit Insurance Corporation (FDIC). 

This action mandates comprehensive reforms in the bank’s operations, particularly focusing on its information technology (IT) practices, anti-money laundering (AML) measures, and overall risk management framework.

Thread Bank is one of the largest banking-as-a-service partner banks, behind Evolve (which has been mired in issues) and Blue Ridge Bank.

Some of the popular FinTech apps that Thread Bank serves includes Relay, Baselane, Cleo, and others.

FDIC Issues

The consent order, effective May 21, 2024, outlines multiple areas where Thread Bank must take immediate corrective actions. 

These include enhancing board oversight, updating strategic plans, refining enterprise risk management, and improving policies and procedures to comply with regulatory standards. Additionally, the bank is required to bolster its AML and countering the funding of terrorism (CFT) program to ensure robust compliance with federal laws.

It also places a lot of emphasis on oversight of their banking-as-a-service and lending-as-a-service offerings.

Key Requirements

Here are the key requirements of the consent order:

1. Board Oversight: The Board of Directors must ensure that all actions taken to comply with the order are documented in meeting minutes. They must also verify that the bank has adequate policies, personnel, and systems to adhere to the order’s provisions.
2. Strategic Plan: Within 120 days, the board must update the bank’s strategic plan to address examination findings and recommendations. This plan should include financial goals, profit strategies, liquidity management, and support for the AML/CFT program.
3. Enterprise Risk Management: The bank must update its risk management framework to address examination findings. This includes setting risk tolerance thresholds for fintech partners based on financial analyses under various scenarios.
4. AML/CFT Compliance: The bank must assess its AML/CFT resources and designate a qualified individual to oversee compliance. Within 120 days, a written plan must be developed and submitted to the FDIC for review and comment. The plan should ensure that internal controls are sufficient to maintain compliance with AML/CFT laws.
5. Fintech Partnerships Oversight: The order mandates that the bank’s third-party risk management program be updated to address the complexities of its FinTech partnerships. This includes implementing documented risk assessments, customer due diligence processes, and monitoring for suspicious activity.
6. Policies and Procedures: The bank must review and update all policies and procedures to reflect current objectives and risk tolerances. An internal control system must be established to track policy changes and evaluate adherence.

Regulatory Implications

The FDIC’s consent order highlights the increasing regulatory scrutiny faced by banks involved with FinTech partnerships. Thread Bank, known for its collaborations with various fintech companies, must now improve regulatory compliance with a large focus on oversight of its FinTech Partnerships.

This regulatory action underscores the increased scrutiny banks that are involved with FinTechs are facing in light of the Yotta and Synapse issues, along with what happened recently with Evolve Bank. All banks offering banking and lending-as-a-service should be “on notice” that they are just as responsible for their FinTech partner’s customers and their funds.

Don’t Miss These Other Stories: