FDIC Consent Order Against Cross River Bank A Warning About Fintech Partnerships

The FDIC has hit Cross River Bank in Teaneck, New Jersey, with a consent order saying it engaged in unsafe or unsound banking practices related to fair lending provisions. The order was given in March, but was made public on Friday.

Cross River is a bank-as-a-service provider that provides loans through fintech lenders such as Affirm, Upstart, Rocket Loans and the former Kabbage.

The bank has not admitted or denied accusations of unsafe or unhealthy banking practices or violations of laws or regulations.

“The consent order signed by Cross River is narrow and limited to correcting Cross River’s fair lending program in the state that existed in early 2021,” a bank spokeswoman said Friday. “We are dedicated to partnering with the fintech community as part of our mission to reach long-standing underserved communities and provide all Americans with access to the modern financial services they need and deserve. We have always and will continue to serve as a model for transparent, compliant rules. , fair and responsible lending.”

This FDIC action alerts all banks that work with fintechs.

“It’s a shot across the bow for every partner bank, especially the small ones,” said Todd Baker, senior fellow at the Richman Center for Business, Law and Public Policy at Columbia University; and managing principal of Broadmoor Consulting. “If the largest and most sophisticated partner bank can get into this much trouble, all partner banks are at risk.”

Other regulators, including the Office of the Comptroller of the Currency, have also asked banks to tighten oversight of their fintech partners. In a September speechActing Comptroller of the Currency Michael Hsu spoke about the recent proliferation of bank-fintech partnerships, noting that more than 10 OCC-regulated banks have relationships with nearly 50 fintechs.

“He basically said there’s been a lot of activity in this ‘banking as a service,'” Maria Gotsch, president and CEO of the Partnership Fund for New York City and co-founder of the FinTech Innovation Lab, said in an interview. is a risk in that for the system, and we are going to lay out parameters around how we want the interaction to work. Banking as a service does not mean that you are outside the regulatory area and that you are not subject to the same standard regulations as we have for the big banks.”

That same month, the OCC issued a consent order against Blue Ridge Bank in Martinsville, Virginia, for unsafe or unsound practices, including those related to third-party risk management, Bank Secrecy Act and anti-money laundering risk management, suspicious activity reporting, and information technology controls and risk management.

There is a lot of overlap in what the OCC and FDIC orders cover, Gotsch said, including the technology used for underwriting, monitoring and for security and data privacy, and the need to provide regulators with information about fintech partners.

The spokeswoman for Cross River Bank said the bank has already put in place many of the protections the FDIC requested in the order.

“This order is the result of a standards review related to certain aspects of our lending processes conducted two years ago,” she said. “We had identified areas for improvement prior to the survey, and the survey identified others. Since then, we have proactively made significant improvements to our fair lending and other programs, including investing in technology and personnel. At this time, many of the improvements have been completed or will be completed in the coming months.”

The order does not identify discriminatory practices or anything that would require Cross River to compensate consumers for harm, she said. And it places no restrictions on existing fintech partnerships or the credit products it offers alongside them.

“We do not expect the order to have any meaningful impact on our growth trajectory,” she said.

This is not the first time the FDIC has issued an enforcement action against Cross River over its fintech partnerships. In 2018, the agency announced a settlement with the bank and Freedom Financial Asset Management of San Mateo, California, a consolidation loan provider, for unfair and deceptive practices and violations of the Truth in Lending Act and the Electronic Fund Transfer Act. The FDIC said Cross River and Freedom required borrowers to sign loan documents without knowing the terms and conditions of the loan; failed to inform borrowers that certain major creditors would not negotiate debt with Freedom Finance; misrepresented to consumers that the loans would result in settlement of all their debts within 90 days, which was not true for nearly half of consumers, according to the agency; and misrepresented that consumers’ creditworthiness would be improved by obtaining a consolidation loan.

As the originator of these loans, Cross River was responsible for compliance with all applicable laws, the FDIC said. The regulator asked the bank to implement a compliance management system that would identify, address, monitor and control consumer protection risks related to third-party activities.

“It is clear that the FDIC has lost confidence in management’s commitment to fix the compliance issues with partner banks in light of this and previous violations related to Freedom Finance,” Baker said Friday, the day the FDIC released the consent order. “So in that regard, the action seems appropriate.”

The consent order the FDIC issued Friday directed Cross River Bank’s board of directors to increase its supervision and direction of management, and its supervision and monitoring of the bank’s system of internal controls, information systems, credit underwriting practices and internal audit systems related to consumers. protective laws and regulations.

The board must also ensure that the bank implements all necessary measures to ensure compliance and monitoring of this compliance.

Cross River must also send the FDIC a list of all its credit products and fintech partners and obtain the FDIC’s no-objection before taking on a new fintech partner or credit product.

The bank must engage an independent third party to review the technology it uses to underwrite loans and assess whether the information the bank has about all credit products and models is sufficient to determine and monitor compliance of such credit products, third parties and credit models with all applicable fair lending laws and regulations .

After Cross River receives a no-objection to its list of loans and fintech partners, it must conduct a fair lending risk assessment within 60 days. It also needs to ensure it has a well-staffed group dealing with fair lending compliance, and train the board and everyone in the bank involved in credit on fair lending legislation.

The bank must assess the fair lending compliance of each fintech partner at least once a year and report those assessments to the FDIC.

One reason for the tough action against Cross River Bank may be the fact that some of its fintech partners use artificial intelligence in their lending decisions, including Upstart and Affirm. The CFPB and other regulators have emphasized that banks must be able to explain how such decisions are made.

“There’s a big problem for regulators with algorithms and artificial intelligence as they become more complicated and more of a black box,” Gotsch said. “And if they can’t do that, that’s a problem.”

Some startups that have recently passed through The Fintech Innovation Lab offer analysis and monitoring of AI-based lending systems for compliance with fair lending laws. One is Arthur AI, whose CEO, Adam Wenchel, used to write algorithms for Capital One.

Going forward, compliance requirements and costs for fintechs to do business with partner banks will increase and supervision will be strict, Baker said.

“Partner banks themselves will reject underfunded and under-resourced fintechs as too risky, something they had already begun to do over the past few years and regulators have increased oversight,” Baker said. “Fintechs that can comply with usury statutes will reconsider whether direct lending is a better option for them.”