Examiners do not grade whether your fintech oversight happened. They grade whether you can prove it happened, and most sponsor banks discover the difference three weeks before an exam, when the file for a two-year-old partner relationship turns out to be a folder of undated screenshots and a policy PDF. Third party oversight evidence has definable quality attributes, and a bank that specifies them up front never assembles an exam response from memory.
Key Takeaways:
- Examination-ready evidence is source-anchored, dated, attributable, complete for the period, and retrievable on demand
- Evidence sits in a hierarchy: self-attestation is weakest, produced artifacts are stronger, system-generated records are strongest
- The most common examiner flags are undated screenshots, retroactively assembled files, policies offered as proof of operation, and missing periods
- An examination support package ties requirement, control, owner, monitoring history, evidence per cycle, and findings closure into one retrievable record
The Five Attributes of Examination-Ready Evidence
Evidence quality is not a matter of taste. Across the Interagency Guidance on Third-Party Relationships (OCC Bulletin 2023-17) and the FDIC Consumer Compliance Examination Manual, the documentation expectations reduce to five testable attributes.
Source-anchored. Each artifact is tied to the specific requirement it satisfies. A transaction monitoring report proves nothing by itself; a transaction monitoring report attached to the bank's requirement that partner activity be screened monthly proves the control operated.
Dated and timestamped. The artifact shows when the underlying work occurred, not when the file was saved. Evidence created during the control's execution carries weight that evidence created afterward never recovers.
Attributable. The record shows who produced the artifact and who reviewed it. Anonymous evidence invites the question of whether anyone with authority actually looked.
Complete for the period. Every cycle in the review period is present, not a sample of good months. A monthly control with nine artifacts across twelve months is a finding, not a near miss.
Retrievable on demand. The bank can produce the artifact within the exam's timeline without asking the partner to regenerate it. Evidence the fintech must recreate on request is evidence the bank never controlled.
The Evidence Hierarchy: Attestation, Artifact, System Record
Not all evidence carries equal weight, and banks that treat a partner's signed attestation as equivalent to a system log misjudge how examiners will read the file.
Self-attestation is the floor: the partner asserts the control operated. It is acceptable only for low-risk requirements where independent verification would be disproportionate, and it should never stand alone for anything touching BSA/AML, error resolution, or consumer disclosures.
Produced artifacts, review memos, completed checklists, annotated file pulls, show that a human performed the work. They are the workhorse of partner oversight, and their weakness is manufacturability: an artifact can be created after the fact, which is why dating and attribution matter.
System-generated records, monitoring alerts, case management timestamps, access logs, ticket histories, are the strongest tier because they are produced as a byproduct of the work itself and are expensive to falsify. Where the bank has direct data access, system records should anchor the file, with produced artifacts layered on top for judgment-based controls. The FFIEC BSA/AML Examination Manual reflects this preference throughout: examiners test what systems recorded, then ask people to explain it.
Evidence Failures Examiners Flag Most Often
The same defects appear in exam findings across sponsor bank portfolios:
- Undated screenshots of dashboards or settings, which prove a state existed at some unknowable moment
- Retroactive collection, files assembled in the weeks before the exam, visible in file metadata and uniform creation dates
- Policies offered as proof of operation, a complaint-handling policy documents intent; only complaint records document performance
- Missing periods, gaps in a recurring control's history with no exception or explanation on file
- Mismatched evidence, an artifact attached to a control it does not actually demonstrate, such as a marketing calendar offered as proof of marketing review
Each failure traces back to the same root cause: the bank never specified what acceptable evidence looked like, so the partner submitted whatever was convenient and the bank filed it.
What an Examination Support Package Contains
For any partner relationship, the bank should be able to produce a single package that answers the examiner's questions in order, without a scramble. A complete examination support package contains six layers:
- The requirement, the regulatory or policy obligation, stated as the bank defined it
- The control, what activity satisfies the requirement, at what cadence
- The owner, who at the bank and at the partner is accountable
- The monitoring history, every scheduled cycle with its completion status
- The evidence per cycle, the artifact satisfying each cycle, meeting the five attributes above
- Findings and closure, anything that went wrong, the remediation, and proof it closed
This is the same structure examiners bring to any request for proof: show me the obligation, show me the control, show me it ran, show me what happened when it failed. A package organized any other way forces the examiner to build that chain themselves, and examiners charge for that work in findings.
Running an Evidence-Quality Review Across the Fleet
A bank with one partner can inspect its evidence file directly. A bank with twelve needs a repeatable review that treats evidence quality as a measurable property of each relationship. The practical approach is to score every partner on the same dimensions each quarter: percentage of cycles with conforming evidence, count of attestation-only controls that should have artifacts, average age of open evidence gaps, and time-to-retrieve for a sampled artifact.
Scoring the fleet on identical dimensions does two things. It surfaces the weakest file before an examiner does, and it feeds the oversight metrics examiners actually care about into board reporting without a special project. The annual partner review then starts from a known evidence position instead of an archaeology dig.
How Sponsor Banks Manage Evidence Quality with Canarie
Canarie treats the evidence specification as part of the requirement itself. The bank defines its standard once, each requirement carries the artifact type, cadence, and attribution it demands, and every partner's submissions are evaluated against that specification continuously. Evidence completeness is scored on the same scale across the fleet, so the bank sees which partner files would survive an exam and which would not, months before the request letter arrives.
See how sponsor banks keep every partner file exam-ready →
Frequently Asked Questions
What makes evidence "examination-ready" in a fintech partner relationship?
Examination-ready evidence satisfies five attributes: it is anchored to the specific requirement it demonstrates, dated from when the work occurred, attributable to a producer and reviewer, complete for every cycle in the period, and retrievable by the bank without the partner's help. An artifact missing any of these invites the examiner to discount it, and a file built from discounted artifacts reads as an oversight program that exists on paper.
Is a fintech partner's self-attestation ever acceptable evidence?
Yes, but only at the bottom of the risk range, and never alone for material obligations. Attestations are reasonable for low-risk administrative requirements where independent artifacts would cost more than the risk justifies. For BSA/AML controls, Regulation E error resolution, and consumer disclosures, examiners expect produced artifacts or system-generated records, because those obligations belong to the bank regardless of who performs the work.
Why do examiners reject policy documents as evidence?
A policy proves the bank or partner intended a control to exist; it says nothing about whether the control operated during the review period. Examiners test operation, which requires records generated by the activity itself: completed reviews, logs, case files, dated approvals. Offering a policy where an operating record was expected is one of the most common findings in third-party oversight exams.
How often should a sponsor bank review partner evidence quality?
Quarterly scoring across the fleet is a workable baseline, with continuous tracking of evidence completeness for high-risk partners. The goal is that no evidence gap is discovered first during exam preparation. Banks that score all partners on identical dimensions each quarter also get their board reporting and annual review inputs from the same data, rather than running three separate collection exercises.