For the past two years, BaaS enforcement has been a federal story. The FDIC issued consent orders against Blue Ridge Bank, Piermont Bank, and Sutton Bank. The OCC targeted Evolve Bancshares. The Federal Reserve went after Column Financial. The pattern was consistent: federal regulators identified BSA/AML deficiencies and inadequate third-party risk management at sponsor banks, and the banks agreed to remediation plans under federal supervision.
In the spring of 2025, California’s Department of Financial Protection and Innovation issued its own consent order against Hatch Bank. Not jointly with a federal agency. Independently. That changes the math for every sponsor bank operating in a BaaS model.
What the Hatch Order Actually Says
The DFPI’s consent order against Hatch Bank targeted the same categories of deficiency that federal regulators have been citing for two years: inadequate enterprise-wide money laundering and terrorist financing risk assessments, insufficient internal controls around alert review and SAR filing, gaps in customer due diligence procedures tied to fintech partner programs, and unstaffed or understaffed compliance functions relative to the risk the bank was taking on.
Hatch was required to redo its enterprise risk assessment within 60 days and overhaul its BSA/AML policies, including internal controls, transaction monitoring model validations, and staffing adequacy reviews, within 90 days. The FDIC issued a separate, simultaneous consent order covering similar ground.
The substance of the findings is not new. What’s new is who issued the order. The DFPI acted on its own authority as a state regulator, not as a co-signer on a federal action. That means state banking departments are no longer just participating in BaaS enforcement. They’re initiating it.
Why State-Level Enforcement Changes the Risk Profile
Federal enforcement actions against BaaS banks have followed a relatively predictable pattern. The examination cycle surfaces the issues. The agency issues the order. The bank negotiates remediation timelines. The process, while serious, is centralized and somewhat standardized.
State-level enforcement introduces a fundamentally different dynamic. A sponsor bank operating fintech programs across 30 states now faces 30 potential enforcement authorities, each with its own supervisory priorities, examination cadence, and legal framework. California’s DFPI has the resources and the statutory authority to act independently. New York’s DFS has been aggressive on financial services enforcement for years. Other states will watch the Hatch precedent and assess whether their own BaaS-exposed institutions warrant similar attention.
The practical implication is that a sponsor bank’s compliance program can no longer be designed exclusively around federal examination expectations. State regulators are looking at the same fintech partnerships, the same transaction flows, and the same BSA/AML controls – but they may be looking at them through a different lens, with different thresholds for action.
The Common Findings Across Every Consent Order
Strip away the agency names and the individual facts, and the 2024–2025 BaaS consent orders tell a remarkably consistent story. The same deficiencies appear in nearly every action.
BSA/AML programs that were built for the bank’s traditional business and never adequately scaled for fintech partner volume. Transaction monitoring systems with thresholds set before the fintech programs launched, generating either too many false positives or too few actionable alerts. CDD procedures that didn’t account for the bank’s inability to directly interact with the end customers its fintech partners were onboarding. Board-level oversight that approved fintech partnerships based on revenue projections without requiring commensurate compliance investment. And staffing models that assumed compliance headcount could remain flat while fintech transaction volume grew by multiples.
Piermont’s 35-page FDIC consent order required the bank to review all transactions dating back to September 2022 to determine whether suspicious activity had gone unreported. Sutton Bank was ordered to designate individual program managers responsible for customer identification, transaction monitoring, and suspicious activity reporting for each fintech partnership separately. These are not abstract regulatory preferences. They’re the minimum operational standards that examiners now expect from any bank running a BaaS model.
What Sponsor Banks Need to Do
Three actions are overdue at most BaaS banks.
First, conduct a state-by-state regulatory mapping exercise. Identify every state in which your fintech partners’ end customers are located, and assess whether the state banking department or financial regulator has independent examination and enforcement authority over your institution or the fintech’s activities. If your compliance program was built around the assumption that only your primary federal regulator was watching, that assumption is outdated.
Second, ensure that your BSA/AML program is scoped to the actual risk profile created by your fintech partnerships – not the risk profile of the bank standing alone. That means enterprise risk assessments that explicitly account for fintech-originated transaction volume, customer types, and geographic exposure. It means transaction monitoring thresholds that were validated against the fintech portfolio specifically. And it means staffing levels that reflect the compliance workload your fintech programs actually create, not the workload your traditional banking business would generate on its own.
Third, document board-level engagement with fintech compliance risk. Every consent order in the past two years has cited board oversight as a deficiency. Boards that approved BaaS partnerships need to be receiving regular, substantive reporting on the compliance performance of those partnerships – not just revenue metrics. If the board can’t articulate what compliance risks the bank’s fintech program creates, that’s the gap an examiner will find first.
The BaaS enforcement cycle is not winding down. It’s expanding. The banks that treated the first wave of consent orders as someone else’s problem are running out of time to get ahead of the second wave – and this time, the enforcers may not be wearing federal badges.
Sources
California’s Hatch Consent Order Suggests States May Be Eyeing BaaS Risks | PYMNTS (May 2025)
The California DFPI Makes a Visit to BaaS Island | Fintech Takes (May 2025)
Piermont, Sutton Banks Hit with FDIC Consent Orders over BaaS | Banking Dive (Feb. 2024)
A Running List of BaaS Banks Hit with Consent Orders | Banking Dive (2024)
FDIC Rebukes Sutton Bank, Piermont Bank over Fintech Partners | American Banker (2024)
