Regulators expect the board, not just the compliance department, to oversee the fintech partner program, and examiners verify that oversight by reading board minutes. Fintech program board reporting therefore has to do two jobs at once: give directors the material they need to govern a portfolio of partnerships, and leave a documented record that governance actually occurred. Most sponsor bank board packages do neither, because they present the program as a revenue line instead of a risk portfolio.
Key Takeaways:
- FDIC FIL-44-2023 and the governance provisions of OCC Bulletin 2023-17 make board-level oversight of third-party programs an explicit expectation
- The board package should cover portfolio composition, growth versus oversight capacity, complaints, findings aging, exceptions, partner scorecards, BSA metrics, and upcoming regulatory change
- A workable cadence: monthly program dashboard to committee, quarterly reporting to the full board, defined immediate-escalation triggers
- Minutes must document discussion, challenge, and decisions, because examiners treat receipt of a deck as no oversight at all
Why Regulators Expect Board-Level Oversight of Fintech Programs
The FDIC's FIL-44-2023, adopting the Interagency Guidance on Third-Party Relationships, assigns the board responsibility for overseeing the bank's third-party risk management processes and holding management accountable. The governance sections of OCC Bulletin 2023-17 are equally direct: the board should receive sufficient information to evaluate whether third-party relationships align with the bank's strategy and risk appetite, particularly for relationships supporting critical activities.
For a sponsor bank, every fintech partnership is a critical activity by construction: the partner operates on the bank's charter, in front of the bank's regulators, at scale. That makes the fintech program a standing board matter, not a topic that appears when a partner makes the news. It sits alongside the broader accountability described in what sponsor bank compliance obligations cover: the board owns the strategy and risk appetite that everything else hangs from.
What the Board Package Must Contain
A fintech program package that supports real governance covers eight areas, consistently, period over period:
- Portfolio composition and concentrations. Active partners, products per partner, deposit and transaction volumes, and concentration measures: share of deposits from the largest partner, share of fee income from the program, reliance on any single middleware provider.
- Growth versus oversight capacity. Partners and accounts added against compliance headcount and testing coverage. A program that added three partners on flat staffing is the single most predictive risk fact in the package.
- Complaint volumes and trends by partner. Rates per active account, movement over time, and Regulation E dispute timeliness, comparable across partners.
- Findings and remediation aging. Open findings from testing, audit, and exams, by partner and severity, with aging. Stale remediation is a governance failure the board is expected to see and act on.
- Exceptions outstanding. Every approved deviation from the bank's published partner standard, with owner, rationale, and review date.
- Partner scorecards. Each partner measured against the bank's published standard, evidence completeness, SLA performance, findings, on one scale so directors can rank the fleet.
- BSA metrics for partner channels. Alert volumes, SAR filings attributable to partner programs, and monitoring coverage, sized against partner transaction growth.
- Upcoming regulatory change. Rules and guidance in the pipeline that touch the program, with the bank's planned response and which partners are affected.
Reporting Cadence: Monthly, Quarterly, and Escalation Triggers
Cadence should match the speed at which the portfolio changes. A structure that holds up in examinations: a monthly program dashboard to the designated committee (risk or compliance committee, depending on charter), covering the metrics above in trend form; quarterly reporting to the full board, adding narrative on partner performance, exceptions, and strategy alignment; and defined immediate-escalation triggers that do not wait for a meeting, regulator contact concerning a partner, a partner's financial distress, a data incident, a BSA matter crossing a defined threshold, or discovery of an unapproved product or marketing campaign.
The triggers matter as much as the calendar. Examiners who find that a significant partner event reached the board two quarters late will read every other page of the package differently.
Presenting Partner Risk Without Drowning the Board
The failure mode in both directions is real: a two-page deck that says "program performing well" gives the board nothing to govern with, while a 90-page operational appendix guarantees nothing gets discussed. The working principle is that directors need comparatives and exceptions, not transactions.
Scorecards do the compression. When every partner is measured against the same standard, one table shows the fleet ranked, and discussion time goes to the outliers: the partner whose evidence completeness dropped, the remediation aging past its date, the exception up for renewal. Our guide to writing a board compliance report covers the mechanics; the fintech-program addition is simply that comparability across partners is what makes a portfolio governable at all.
Board Minutes Are Examination Evidence
Examiners read minutes to answer one question: did the board oversee the program, or merely receive information about it? Minutes that record only "the fintech program report was presented and accepted" fail that test regardless of how good the deck was.
Minutes should reflect substance: the specific risks discussed, questions directors raised and the answers given, decisions made, approvals, denials, conditions, directives to management, and follow-ups assigned with owners. When the board challenges management, say, declining a new partner until compliance staffing catches up, the minutes should say so, because that recorded challenge is precisely the evidence of effective governance FIL-44-2023 contemplates. Treat the minutes as part of the exam file from the day they are written, which is also the posture that makes preparing the board for a regulatory exam an exercise in review rather than reconstruction.
How Sponsor Banks Build Board Reporting with Canarie
Because Canarie evaluates every partner against the bank's single published standard, the board package assembles itself from data that already exists: partner scorecards on one scale, evidence completeness by partner, findings and remediation aging, exceptions with review dates, and regulatory changes mapped to affected partners. The compliance team stops rebuilding spreadsheets each quarter, and the board sees the same portfolio view examiners will ask for.
See how sponsor banks produce a regulator-ready portfolio view →
Frequently Asked Questions
What do regulators require boards to do about fintech partner programs?
FDIC FIL-44-2023 and OCC Bulletin 2023-17 assign the board responsibility for overseeing third-party risk management: approving the strategy and risk appetite, ensuring management allocates adequate resources, receiving reporting sufficient to evaluate the program, and holding management accountable. For sponsor banks, whose partners operate on the bank's charter, examiners apply these expectations at full strength and verify them through board materials and minutes.
How often should the board review the fintech partner program?
A defensible baseline is a monthly dashboard to the responsible committee, quarterly reporting to the full board, and immediate escalation for defined trigger events such as regulator contact about a partner, a data incident, or partner financial distress. The right cadence scales with the program: a bank adding partners quickly or running high-risk products should report more frequently, because oversight is judged against the program's pace, not the calendar's.
What metrics belong in a sponsor bank's board package?
Portfolio composition and concentrations, growth versus compliance capacity, complaint rates and trends by partner, findings and remediation aging, outstanding exceptions to the bank's partner standard, partner scorecards on a single scale, BSA metrics for partner channels, and upcoming regulatory changes with affected partners identified. Consistency period over period matters as much as the metric list, because trend breaks are what boards govern against.
Do examiners actually read board minutes on fintech oversight?
Yes, routinely. Minutes are how examiners verify that reported oversight occurred: they look for documented discussion, director challenge, decisions, and assigned follow-ups. Minutes recording only that a report was received are treated as evidence of passive governance, and passive governance over a fintech program is itself an examination finding under the interagency guidance.