Sponsor Bank Due Diligence: What Banks Ask For and How to Answer

Last reviewed: October 2026

Before a sponsor bank launches a fintech program, it sends a due diligence request list. It sends another at each periodic review after launch. The list runs across governance, finances, BSA/AML, consumer compliance, technology, and operations. It usually lands on a compliance team that is already stretched.

The list isn’t arbitrary. Most of it traces to the due diligence factors in the agencies’ 2023 third-party risk management guidance (opens in a new tab). The bank is collecting what it needs to show its own examiners that it understood your program before relying on you.

That changes how a fintech should answer. The bank is building a file, and your responses become evidence in it. This reference maps what the bank asks for in each area, the evidence that holds up, and where responses stall. It’s written for fintech compliance leads and the sponsor bank teams who review their answers.

Why does the bank ask what it asks?

The 2023 Interagency Guidance on Third-Party Relationships (opens in a new tab) lists 14 due diligence factors a bank should weigh before entering a relationship. They run from strategies and goals and financial condition to information security, operational resilience, and reliance on subcontractors. The guidance says the scope of due diligence should be “commensurate with the level of risk and complexity” of the relationship.

Behind all of it is one principle. A bank’s use of third parties “does not diminish its responsibility” to meet its legal requirements, as if it had performed the activity itself. When a partner’s onboarding, dispute handling, or ledger fails, examiners treat it as the bank’s failure. The Federal Reserve’s June 2024 action against Evolve Bank & Trust (opens in a new tab) cited the bank for “failing to have in place an effective risk management framework” for its fintech partnerships.

The bank’s reviewer then scores your answers, documents the remaining risk, and takes a recommendation to a committee. Gaps in your file become conditions on the bank’s approval or follow-up items at the next review.

In September 2026, the agencies proposed replacing the 2023 guidance (opens in a new tab). The proposal keeps the responsibility principle. It also lets banks rely on “less-detailed due diligence information or on public or alternative sources” for lower-risk relationships. A fintech that holds consumer funds or runs consumer payments through the bank shouldn’t expect to land in that group. Our piece on the TPRM rewrite covers the proposal in more detail.

What the bank asks for, area by area

The table groups typical requests by area, with the evidence that tends to satisfy a bank’s reviewer. Each bank words and orders its list differently, but most cover these areas.

Area	What the bank wants to know	Evidence that holds up
Ownership, strategy, and management	Who owns and runs the company, and where the program is headed	Org chart, cap table, business plan, bios and background checks for key personnel
Financial condition	Whether you can fund operations, losses, and reserves for the life of the agreement	Audited financial statements, current interim financials, runway and funding commitments
Compliance management system	How you find, fix, and report compliance problems	Board-approved policies, committee charter and minutes, issue log, compliance testing results
Regulatory applicability	Which rules apply to each product, and who owns each one	Regulatory applicability matrix, sponsor bank obligations crosswalk
BSA/AML and sanctions	How you onboard, monitor, and screen customers, and when you escalate to the bank	BSA/AML risk assessment, CIP and CDD procedures, monitoring rules and alert metrics, OFAC screening records
Consumer compliance	How disclosures, disputes, and marketing are controlled	Disclosure inventory, Reg E dispute log, marketing review approvals
Complaints	Whether complaints are captured, classified, and fixed at the root	Complaint log, root-cause analysis, trend reports to the committee
Information security and privacy	How customer data is protected and incidents are handled	SOC 2 Type II report or equivalent, penetration test summary, incident response plan
Operational resilience	Whether the program keeps running through an outage	Business continuity plan, latest test results, recovery objectives
Funds flow and reconciliation	Whether the bank can tie every dollar to an end user	Funds flow diagram, daily reconciliations, break log, end-user ledger access
Subcontractors	Which of your vendors touch the program, and how you oversee them	Vendor inventory, risk tiers, due diligence files for higher-risk vendors
Insurance and history	What has already gone wrong	Certificates of insurance, litigation and regulatory inquiry list, prior audit findings

Areas track the due diligence factors in the 2023 interagency guidance. The evidence column reflects typical requests, not a regulatory list.

Where responses stall

Most fintechs can answer the questions. The trouble is proving the answers, and the same gaps tend to show up.

Monitoring described, not shown. “We monitor transactions” tells a reviewer nothing. Alert volumes, closure times, and the monitoring rules tied to your risk assessment show that the control runs.

Approvals without a record. The policy says the board approved it, but the minutes don’t mention it, or the committee that approved it has no charter. A reviewer will ask for the minutes, and “we discussed it” isn’t evidence.

A stale risk assessment or map. A BSA/AML risk assessment dated before your last product launch describes a different company. So does a regulatory applicability matrix that still shows the launch product. The bank will compare both with your current products and channels. The free Sponsor Bank Readiness Checklist walks through the 13 areas a bank review covers, so the gaps show up before the request list does.

Disputes and complaints without follow-through. A complaint log that records and closes tickets shows intake. It doesn’t show that anyone fixed the cause. Reviewers want the trend report and the action it led to, and they’ll check whether disputes raised in support reached the dispute log.

Reconciliation that isn’t daily. If customer funds sit in a pooled custodial account, the bank needs to tie every dollar to an end user. Pass-through deposit insurance depends on it. The FDIC recognizes a fiduciary relationship only if it “is expressly disclosed, by way of specific references, in the ‘deposit account records’” of the bank (12 CFR 330.5(b)(1) (opens in a new tab)). A reconciliation that runs when someone has time, with no break log and no second reviewer, won’t hold up.

Answers that contradict the agreement. Your responses on complaint escalation, dispute handoffs, and marketing approval have to match the program agreement. If the agreement requires bank approval of new marketing and your response describes an internal review only, you’ve handed the reviewer a gap.

The periodic review is the same list with a date on it

Due diligence doesn’t end at launch. The 2023 guidance treats ongoing monitoring as its own stage of the relationship, and program agreements usually set a review cycle on top of it.

At each review, the bank compares this year’s answers with last year’s. It looks for what changed: new products, new vendors, new markets, turnover in key roles. It also looks for evidence that went stale. A SOC 2 report from 18 months ago, or a penetration test from before your last major release, will come back as a follow-up request.

That’s why the response file matters more than any single answer. A fintech that rebuilds its response from scratch each year spends weeks on it and still misses things. A fintech that keeps a standing file updates the dates and explains what changed. The Sponsor Bank Review Kit includes a due diligence response binder built on that idea, with an evidence index and refresh dates.

Lead each periodic response with a one-page summary of what changed since the last review: products, vendors, key people, incidents, and open issues. Reviewers read that first, and it shows you know your own program.

How to put it in place

1. Build the response file before the bank asks. List every request you’ve received or expect, grouped by area, with your current response, the evidence, and one owner per item. The compliance lead owns the file, and each area owner keeps their rows current. The evidence is a single binder or workbook the bank could review today.
2. Index the evidence and give every document a refresh date. Record each document’s as-of date, where it lives, and how often it should be refreshed. Flag anything past its refresh date before the bank does. The evidence is an index with nothing stale on the morning the request list arrives.
3. Walk through the list with your bank’s partner oversight team. Ask for the bank’s standard request list and review calendar, then compare them with your file. Settle differences in ownership or format in writing. The evidence is a dated agreement, in an email or meeting notes, on what the bank will ask for and when.

None of this makes a weak program pass review. It makes a sound program easy to verify, which is most of what the bank’s reviewer is trying to do.

The fastest reviews go to fintechs whose evidence is already in one place, dated, and owned.

Sources

• Interagency Guidance on Third-Party Relationships: Risk Management | Federal Reserve, FDIC, OCC, 88 FR 37920 (June 9, 2023) (opens in a new tab)
• Proposed Third-Party Risk Management Guidance | OCC, Federal Reserve, FDIC, NCUA, 91 FR 58536 (Sept. 15, 2026) (opens in a new tab)
• 12 CFR 330.5, Recognition of Deposit Ownership and Fiduciary Relationships | eCFR (current) (opens in a new tab)
• Enforcement action against Evolve Bancorp, Inc. and Evolve Bank & Trust | Federal Reserve (June 14, 2024) (opens in a new tab)