The Annual Fintech Partner Review, Done Right

The annual review is where most sponsor banks concentrate their partner oversight, and that concentration is exactly the problem. The interagency guidance frames ongoing monitoring as continuous and commensurate with risk, not as a yearly event, which means an annual review that surfaces twelve months of surprises is itself documentation of a monitoring failure. Done right, the review confirms what continuous signals already told you.

Key Takeaways:

• OCC Bulletin 2023-17 describes ongoing monitoring as continuous throughout the relationship, with the annual review as one checkpoint inside it
• A complete review covers financial condition, compliance performance, complaint trends, findings status, risk re-rating, contract compliance, and fourth-party changes
• Scope by risk tier: high-risk partners get a deep dive with independent testing, lower tiers get a structured desk review
• The evidence refresh matters as much as the analysis — expired SOC reports, lapsed insurance, and stale attestations are findings hiding in plain sight

Why an Annual Review Alone Fails the Ongoing Monitoring Standard

OCC Bulletin 2023-17, adopted by the FDIC in FIL-29-2023, is explicit that ongoing monitoring should occur "throughout the duration" of a third-party relationship, with intensity commensurate with the risk the relationship carries. For a fintech partner conducting regulated activity under the bank's charter, that risk is as high as third-party risk gets. A calendar with one review per partner per year does not meet the standard on its own.

The annual review still matters — it is the structured moment when the bank steps back, re-rates the partner, and documents a portfolio-level judgment. The mistake is treating it as the monitoring program rather than a checkpoint within one. When the review is the only oversight event, problems age up to eleven months before anyone is obligated to notice them, and examiners can read the discovery dates.

What the Annual Fintech Partner Review Must Cover

A defensible review works through seven areas, each ending in a documented conclusion rather than a collected PDF:

• Financial condition refresh: updated financials, runway, funding events, and concentration of the fintech's revenue — the same analysis performed at onboarding, repeated with a year of actuals
• Compliance performance over the period: testing results, attestation completion rates, training records, and evidence delivery timeliness against contractual SLAs
• Complaint trends: volumes normalized to account growth, category shifts, regulatory complaints, and resolution timeliness
• Findings status: every open finding from prior reviews, audits, or examinations, with age and remediation trajectory
• Risk re-rating: an explicit decision to confirm or change the partner's tier, with rationale — growth, new products, and new geographies all move risk
• Contract compliance: whether the partner is honoring its terms, including reporting obligations, staffing requirements, and marketing pre-approval
• Fourth-party changes: new or replaced vendors in the partner's stack since the last review, and the partner's diligence on them

The output is a written assessment with a conclusion the board committee can act on: maintain, escalate oversight, restrict growth, or begin exit planning.

Scoping the Review by Risk Tier: Deep Dive vs. Desk Review

Not every partner earns the same review, and pretending otherwise guarantees shallow work everywhere. Scope should follow the risk rating assigned at onboarding and updated since.

A deep dive means the bank independently verifies; a desk review means the bank examines what the partner produces. The distinction should be written into the review procedure so examiners see a deliberate design, not inconsistent effort. Managing this across a fleet is a capacity question as much as a design question — see our analysis of managing fintech partner compliance at scale.

The Evidence Refresh: What Expired Since Last Year

A year is long enough for a partner's evidence base to quietly rot. The review should systematically re-collect and re-date every artifact with a shelf life:

• SOC 2 reports past their period end, including bridge letters for the gap
• Insurance certificates lapsed or renewed at lower coverage
• Policies past their review dates — a policy last approved three years ago is evidence of a control not operating
• Stale attestations — annual certifications that were due, chased, or quietly skipped
• Licenses and registrations the partner holds directly, where applicable

Collecting a document is not the same as evaluating it, and examiners increasingly distinguish between the two. A folder of unread SOC reports fails the same way a missing one does — the question is what the bank concluded from the exceptions inside. For a deeper treatment of that distinction, see our guide to evidence quality in fintech partner oversight.

Carrying Findings Forward and Validating Closure

Prior-cycle findings are the first thing a good reviewer opens and the last thing many reviews mention. Every finding from the previous review, internal audit, or examination should appear in the current review with one of three dispositions: closed with validation evidence, open within its remediation deadline, or overdue with an escalation decision.

Closure requires validation, not assertion. A partner reporting "remediated" is a claim; the review either tests the fix or documents why testing waits until next cycle. Findings that reappear across cycles are the single strongest predictor of eventual enforcement attention, and they should trigger the escalation paths defined in the partnership agreement. What happens after the review — tracked remediation with owners and deadlines — determines whether the review was oversight or paperwork, a topic we cover in what happens after the vendor review.

The Signals That Should Flow Between Annual Reviews

If the annual review is the checkpoint, continuous signals are the monitoring. Between reviews, the bank should be receiving and reacting to:

• Complaint spikes — volume or category anomalies against the partner's own baseline
• Transaction anomalies — volume surges, return-rate changes, geographic shifts inconsistent with the approved program
• Negative news and legal events — litigation, regulatory actions, executive departures, funding difficulties
• Missed evidence deadlines — the quietest and most reliable early signal; partners in trouble stop producing evidence before they stop anything else

Each signal needs a defined response path, not just a dashboard. When these flows exist, the annual review becomes confirmation: the re-rating formalizes what the signals showed, and nothing in the review file is a surprise. That is the posture the guidance describes, and it is also the posture that keeps a twelve-partner portfolio manageable.

A Realistic Annual Review Timeline

Banks running several partners should stagger review cycles across the year rather than stacking them in Q4, both for team capacity and so lessons from one review sharpen the next.

How Sponsor Banks Run Annual Reviews Without the Scramble

The worst weeks of an annual review are usually spent reconstructing the year: chasing evidence, rebuilding complaint trends from exports, and rediscovering findings everyone forgot. None of that is analysis — it is archaeology.

Canarie eliminates the archaeology. Because every partner executes against the bank's standard year-round, the review period's evidence, attestations, testing results, and findings already sit in one place, dated and attributable. Expired artifacts surface before the review instead of during it, continuous signals are logged as they fire, and the reviewer starts with a year of organized record rather than an empty request list. The review becomes what the guidance intends: a judgment on a monitored year, documented in a portfolio view the bank can hand to its examiners.

See how sponsor banks keep every partner review-ready all year →

Frequently Asked Questions

Is an annual review enough to satisfy regulators for fintech partners?

No. The interagency guidance describes ongoing monitoring as continuous throughout the relationship and commensurate with risk, and fintech partnerships that place regulated activity under the bank's charter sit at the high end of that risk spectrum. The annual review is a necessary checkpoint for re-rating and formal assessment, but it must sit on top of continuous flows — complaint data, transaction monitoring, evidence deadlines, and adverse news — that operate between reviews.

What should an annual fintech partner review include?

Seven areas: a financial condition refresh, compliance performance over the period, complaint trend analysis, the status of all prior findings, an explicit risk re-rating decision, verification of contract compliance, and a check for fourth-party changes. Each area should end in a documented conclusion, and the full review should end in a recommendation the board or its committee can act on. A review that collects documents without concluding anything from them will not hold up in examination.

How should banks scope reviews differently for high-risk and low-risk partners?

High-risk partners — lenders, high-volume programs, partners with open findings — warrant a deep dive with independent testing: transaction sampling, complaint file review, and interviews with the partner's compliance leadership. Lower-risk partners can receive a structured desk review built on the evidence refresh and metrics. The scoping rules should be written into the bank's review procedures so the difference in depth reads as deliberate risk-based design rather than uneven attention.

What happens if a partner's prior-year findings are still open?

Overdue findings need an escalation decision, not another year on the register. The review should document why remediation slipped, whether the contractual escalation triggers apply, and what changes — restricted growth, enhanced reporting, revised deadlines with consequences — the bank is imposing. Findings that persist across multiple cycles are among the strongest predictors of examination criticism, because they demonstrate the bank identified a risk and then failed to compel its correction.