Dive Brief:

• A Federal Deposit Insurance Corp. consent order issued to Rogersville, Tennessee-based Thread Bank specifically calls out the lender’s banking-as-a-service business, with the regulator ordering Thread Bank to ensure its third-party risk management program addresses the level of risk and complexity of fintech partners in the bank’s BaaS program.
• The order, dated May 21 and made public Friday, also requires the bank to implement a documented risk assessment of fintech partners. The bank’s board must approve risk tolerance thresholds for individual fintech partners “based on an enterprise-wide financial analysis of each FinTech partner’s financial projections under expected and adverse scenarios,” the order stipulates.
• The bank is “dedicated to meeting all obligations,” Thread Bank CEO Chris Black said in a statement, “and we have already made substantial investments to improve our policies, processes, procedures and controls over the past three years — all in collaboration with the FDIC and the Tennessee Department of Financial Institutions.”

Dive Insight:

The 10-page consent order stipulates that Thread Bank’s BaaS and loan-as-a-service program policies and procedures address third-party partner and customer approval requirements, due diligence processes, growth and stress modeling, ongoing anti-money laundering/countering the financing of terrorism compliance monitoring and steps to unwind third-party business lines, “including FinTech partners.” 

Thread Bank must implement documented customer due diligence and suspicious activity monitoring processes for its BaaS program, and ensure information systems associated with its fintech partners offer timely and accurate information, according to the consent order.

The lender also needs to make sure anti-money laundering/counterterrorism financing staff are adequately trained to spot suspicious activity, that such activity is reported in accordance with regulatory deadlines, and that third-party partners are meeting the bank’s AML/CFT program requirements. 

Additionally, Thread Bank is required to ensure beneficial ownership information is documented and maintained. That’s an issue in the spotlight amid bankruptcy proceedings for fintech middleware firm Synapse: Customers are owed $65 million to $96 million more than what’s being held for them in partner banks’ accounts, according to the bankrupt company’s trustee, former FDIC Chair Jelena McWilliams. But Synapse and Evolve Bank & Trust — one of Synapse’s partner banks — disagree over which company holds the funds.

Thread Bank also must develop an exit plan that lays out how to monitor fintech relationships — including third-, fourth- and fifth-party providers — for service interruptions . The bank must also detail response steps; outline staffing requirements; define customer notification of service disruptions and how the bank will respond; and detail how regulators and external stakeholders will be notified.

“We will continue to invest in our teams and services to ensure we meet the needs of, and provide strong protection for, our customers and partners as we move forward,” Black said in the statement. 

It’s the latest enforcement action against a bank engaging in BaaS, which has drawn more regulatory scrutiny in recent months. Evolve, Blue Ridge Bank, Piermont Bank, Sutton Bank and Lineage Bank have all faced enforcement actions over BaaS programs of late, as regulators scramble to get a handle on the size and scale of lenders’ third-party partnerships. 

Still, the order “is much broader than BaaS,” requiring updates to the bank’s strategic plan, enterprise risk management and BSA/AML, noted Margaret Tahyar, head of the financial institutions group at law firm Davis Polk.

Thread Bank was also ordered to enhance its liquidity management policy, and set formal goals and lay out strategies to bolster the bank’s earnings as part of a profit plan. 

It’s not the first time the lender, formerly known as Civis Bank, has faced regulatory pressure. In 2015, the bank was hit with an FDIC consent order, requiring it to draft a plan aimed at improving earnings and increase its capital ratios.

Renamed Thread Bank in 2022, it has partnered with middleware firm Unit, and supports some 35 fintech programs, according to Fintech Business Weekly. A spokesperson for Thread Bank declined to comment on the bank’s fintech partnerships. 

“The regulators draft a broad order like this one when they want to send a stern message, typically of a lack of confidence in the board and management,” Tahyar said in an email. “Feels like they want a total change in the business model.”