Switching Sponsor Banks: Compliance Work Nobody Plans For

Fintechs change sponsor banks for plenty of reasons. Some are leaving a bank whose consent order has slowed or frozen new program growth. Some want a second bank for resilience. Some got a better deal.

Whatever the reason, the pattern tends to repeat. The commercial and legal work takes months. The compliance work gets squeezed into the last few weeks: customer notices, card reissuance, record migration, and BSA handoffs. That’s where transitions go wrong, and customers are the ones who feel it.

Why a Migration Is a Compliance Event

From the customer’s point of view, nothing should change. Same app, same login, same card design. Legally, the account may be moving to a different institution under a new account agreement, sometimes with new account and routing numbers and a new card.

Each of those changes triggers rules, and the clock on several of them starts well before cutover.

Both banks are on the hook. The 2023 interagency guidance on third-party risk management treats termination as a stage of the relationship life cycle, not an afterthought. Your outgoing bank has a stake in an orderly exit. Your incoming bank will want to see the plan before it takes on your customers.

Where Transitions Break

Customer notices go out late. If the move changes account terms, notice rules apply. Under Regulation E, a change that increases fees or liability, reduces the types of transfers available, or tightens transfer limits needs written notice at least 21 days before it takes effect (12 CFR 1005.8(a)). For deposit accounts, Regulation DD requires at least 30 calendar days’ notice before a change that may reduce the APY or adversely affect the consumer (12 CFR 1030.5(a)).

Those are minimums. Your agreements with either bank may require more. Work backward from cutover, and remember that drafting and approving a notice with two banks takes time too.

The new card may not count as a “renewal.” Regulation E limits sending unsolicited access devices. One exception covers a device issued “as a renewal of, or in substitution for, an accepted access device whether issued by the institution or a successor” (12 CFR 1005.5(a)(2)). The official interpretation describes a successor as an entity that replaces the original institution, such as through a merger, or that “acquires accounts or assumes the operation of an EFT system.” Whether your new bank fits that description depends on how the move is structured. Don’t assume it does. Get the answer from counsel and both banks early, because it drives your whole card reissuance plan.

Pass-through insurance depends on the records. If customer funds sit in a pooled custodial account, pass-through coverage depends on the bank’s records. The FDIC recognizes a fiduciary relationship only if it is “expressly disclosed, by way of specific references, in the ‘deposit account records’” (12 CFR 330.5(b)(1)). During a migration, funds may sit at two banks at once, in accounts opened in a hurry. Get the new account titling and the end-user ledger right from day one, and reconcile the ledgers at both banks through cutover. The agencies’ July 2024 joint statement on bank-fintech deposit arrangements is a useful checklist for what your new bank will expect here.

BSA/AML history doesn’t move with the accounts. Your new bank becomes responsible for customers it didn’t onboard. Expect it to ask how you verified them, how you’ve monitored them, and which accounts carry elevated risk. You also need a plan for open investigations and accounts under review at cutover. SAR confidentiality limits what can be shared and with whom, so get both banks’ BSA officers and counsel to agree on that process early. Don’t improvise it the week of cutover.

Disputes and complaints fall through the gap. A customer who disputes a transaction the week before cutover still has Regulation E rights the week after. Decide which bank owns open disputes, how provisional credits move, and how complaint records follow the customer.

Direct deposits and autopays break quietly. If account or routing numbers change, every employer direct deposit and biller autopay pointed at the old account eventually fails. Decide how long the old account stays open, how you’ll forward or return payments, and how you’ll help customers update their payers.

How to Plan It

First, start compliance planning when the term sheet is signed. Give compliance its own workstream and timeline, built backward from cutover. Map every notice deadline, the card reissuance decision, account opening and titling at the new bank, and ledger reconciliation milestones.

Second, write a three-party handoff plan. Put your outgoing bank, your incoming bank, and your own team in one document. Cover customer data and records, BSA history and open investigations, disputes, complaints, and who answers customer questions during the transition. Get all three to sign off.

Third, run a test migration. Move a small group of accounts first, ideally employee or friendly-customer accounts. Reconcile balances to the penny, confirm direct deposits land, and check that disputes and statements work. Fix what breaks, then move everyone else.

A sponsor bank migration is one of the riskiest things a fintech does, and it usually gets the least compliance planning. None of the rules involved are new or obscure. They just all come due at the same moment, with two banks watching.

The transitions that go smoothly are the ones where compliance had a seat at the table when the term sheet was signed, not when the cutover date was already on the calendar. An outside review of the plan at that stage costs far less than cleaning up a botched cutover.