Dive Brief:

• Evolve Bank & Trust was hit with a Federal Reserve enforcement action Friday over shortcomings in the bank’s anti-money laundering, risk management and consumer compliance programs.
• An examination last August revealed West Memphis, Arkansas-based Evolve, a partner bank of bankrupt fintech middleware firm Synapse, engaged in unsafe and unsound banking practices “by failing to have in place an effective risk management framework” for its fintech partnerships, the Fed said in a Friday release.
• The Fed, which noted the enforcement action is independent of Synapse’s bankruptcy proceedings, is requiring Evolve to address potential compliance and fraud risks by enhancing oversight and monitoring of its relationships with fintechs. That includes stronger procedures around record-keeping and consumer compliance programs, the Fed said. The order was issued jointly with the Arkansas State Bank Department.

Dive Insight:

As a banking-as-a-service provider, Evolve partners with fintechs and offers those firms deposit accounts and payment processing services. Those fintechs then offer their end customers access to banking products and services.

The order, “similar to orders received by others in the industry,” doesn’t affect the bank’s existing business, customers or deposits, an Evolve spokesperson said in an email. Evolve “remains well-capitalized” and the order reflects the bank’s agreement “to take certain measures to further bolster our compliance oversight and enterprise risk management functions.”

Under the 23-page cease-and-desist order, Evolve’s board must draft a plan to strengthen board oversight of the bank’s management and operations and its compliance with Bank Secrecy Act/AML requirements and Office of Foreign Assets Control regulations.

The bank also must submit a plan to enhance its risk management framework around its fintech partnership division, featuring policies and procedures to identify risk associated with partners and programs; steps to ensure staff have sufficient expertise and independence, and that staffing levels are adequate; steps to quickly identify and report risk exposures related to Evolve’s fintech partners, programs or services; and measures to make sure the bank’s board gives approval in writing before Evolve takes on new fintech partners or adds products or programs with those partners.

Evolve was also instructed to tap an independent third party to review its fintech partner program for compliance with consumer laws and regulations. That third party will draft a report with its findings and recommendations. 

Additionally, Evolve must design a written plan to improve its capital risk management in consideration of its fintech partnerships and activities. The plan needs to evaluate the adequacy of the bank’s capital, and include measures to improve the bank’s capital planning framework, accounting for its “elevated risk profile” and fintech partners, according to the order, dated Tuesday.

Evolve was also instructed to come up with a plan to improve its liquidity risk management, with respect to fintech partner activities “and significant funding concentrations.” 

The order included conditions mandating that the bank improve its lending and credit risk management policies related to its fintech partnerships; enhance its interest rate risk management practices; correct IT and information security deficiencies; and bolster its internal audit program. 

Evolve failed to maintain a risk management program or controls sufficient to comply with AML and consumer protection laws, the Fed said. The order included a number of stipulations requiring the bank to bolster its BSA/AML compliance programs and enhance its customer due diligence program.

“We've made significant investments in technology and personnel in our Enterprise Risk Management, Compliance, and BSA/AML departments to strengthen oversight and enhance the risk framework,” the Evolve spokesperson said Friday.

Evolve joins a growing list of banking-as-a-service providers that have seen orders demanding better policing of their fintech partnerships. Blue Ridge Bank, Cross River Bank and First Fed Bank have all faced penalties over the past two years as regulators push for stricter oversight of the tie-ups.

The frequency of such orders has accelerated this year as Lineage Bank, Piermont Bank and Sutton Bank have also been hit with consent orders over their relationships.