Summary: A sponsor bank that lends through a fintech partner is responsible for those loans as if it had made them itself. The 2023 interagency guidance on third-party relationships, still in force in October 2026, asks the bank to keep evidence of ongoing monitoring: reports from the partner, the bank’s own testing of the loans, complaint trends and periodic reporting to the board. A September 2026 proposal would replace the 2023 guidance, but until it is finalized the 2023 text is what examiners apply.
Where the guidance stands in October 2026
The OCC, Federal Reserve and FDIC issued the Interagency Guidance on Third-Party Relationships: Risk Management on June 6, 2023. It was published in the Federal Register on June 9, 2023 at 88 FR 37920.
On July 25, 2024 the same agencies issued a joint statement on banks’ arrangements with third parties to deliver deposit products and services, plus a request for information on bank-fintech arrangements that covered lending as well as deposits and payments. The statement is explicit about its weight: “This statement reemphasizes existing guidance; it does not alter existing legal or regulatory requirements or establish new supervisory expectations.”
On September 11, 2026 the OCC, Federal Reserve, FDIC and NCUA proposed new third-party risk management guidance (OCC Bulletin 2026-46, published September 15, 2026 at 91 FR 58536). The agencies say they “plan to rescind and replace existing guidance on third-party risk management,” and that “Any finalized guidance would replace the 2023 Guidance and the Supplemental TPRM Resources,” a term that includes the July 2024 joint statement. Their reason: the 2023 guidance “frequently has been interpreted in an overly broad manner and with an insufficient focus on tailoring its risk management principles.” Comments are due November 16, 2026.
So, as of October 2026: the 2023 guidance and the 2024 statement are in force. The proposal is not. It keeps the core principle: “The banking organization remains responsible for complying with applicable laws and regulations, and operating in a safe and sound manner, regardless of a third party’s use of subcontractors.”
The principle behind every section
The 2023 guidance states it early. “Importantly, the use of third parties does not diminish or remove banking organizations’ responsibilities to ensure that activities are performed in a safe and sound manner and in compliance with applicable laws and regulations, including but not limited to those designed to protect consumers (such as fair lending laws and prohibitions against unfair, deceptive or abusive acts or practices).”
The 2024 joint statement names compliance functions directly. When a partner performs “monitoring and reporting suspicious activity, customer identification programs, customer due diligence, and sanctions compliance on behalf of the bank,” the agencies say, “Regardless of whether the functions are shared between the bank and the third party, the bank remains responsible for failure to comply with applicable requirements.”
For a lending program this means the bank owns the disclosures, the fair lending outcomes, the state rate and licensing rules and the adverse action notices on loans a partner originated and serviced.
The life cycle: planning, due diligence, contracts, monitoring
The 2023 guidance organizes its expectations around five stages: planning, due diligence and third-party selection, contract negotiation, ongoing monitoring and termination. A governance layer sits over all five: oversight and accountability, independent reviews, and documentation and reporting.
Two contract points matter most for a loan program. On performance measures, the guidance says to negotiate ones that “do not incentivize imprudent performance or behavior, such as encouraging processing volume or speed without regard for accuracy, compliance requirements, or adverse effects on the banking organization or customers.” A partner paid on originations needs a compliance measure alongside the volume measure. On compliance, “The use of third parties does not abrogate these responsibilities,” and the contract should give the bank “the right to monitor and be informed about the third party’s compliance with applicable laws and regulations, and to require timely remediation if issues arise.”
What ongoing monitoring means for a lending program
The guidance defines the purpose of monitoring in one sentence. It lets a bank “(1) confirm the quality and sustainability of a third party’s controls and ability to meet contractual obligations; (2) escalate significant issues or concerns, such as material or repeat audit findings, deterioration in financial condition, security breaches, data loss, service interruptions, compliance lapses, or other indicators of increased risk; and (3) respond to such significant issues or concerns when identified.”
It then names three typical activities: “(1) review of reports regarding the third party’s performance and the effectiveness of its controls; (2) periodic visits and meetings with third-party representatives to discuss performance and operational issues; and (3) regular testing of the banking organization’s controls that manage risks from its third-party relationships.” Based on risk, the bank “may also perform direct testing of the third party’s own controls.”
Two of the listed monitoring factors describe a lending program’s weak points. One is “The third party’s ongoing compliance with applicable laws and regulations and its performance as measured against contractual obligations.” The other is “The volume, nature, and trends of customer inquiries and complaints, the adequacy of the third party’s responses (if responsible for handling customer inquiries or complaints), and any resulting remediation.”
In practice a sponsor bank turns this into a calendar. Monthly: volume by state and product, APR distribution against program caps, adverse action timing, complaint counts by reason and payment return rates. Quarterly: a loan-level sample tested against the credit policy and the disclosures, plus the partner’s QC results.
Loan-level evidence and summary reports
Examiners read the bank’s documentation, so the documentation list in the guidance is the checklist. The examples it gives include a current inventory of third-party relationships, due diligence results, executed contracts, “Risk and performance reports required and received from the third party as part of ongoing monitoring,” “If applicable, reports related to customer complaint and inquiry monitoring, and any subsequent remediation reports,” “Results of independent reviews,” and “Periodic reporting to the board.”
Management’s own list in the governance section includes “Determining whether the banking organization has appropriate access to data and information from its third parties.”
That last item is where lending programs fail quietly. The 2024 statement flags “Lack of access to records” as an elevated risk. A bank that cannot pull the loan file and the payment history on any loan it funded has not met the monitoring standard, whatever the dashboard says.
An example, with made-up numbers. A program originates 10,000 loans a month. The partner’s report shows 100 percent of adverse action notices sent within 30 days. The bank’s quarterly sample of 60 files finds two sent on day 33. Two in 60 is not a rounding error at 10,000 a month. The bank escalates, requires remediation and records both the finding and the fix.
Questions a sponsor bank should ask every partner
- Can we pull any loan file and payment record on demand, or only a report?
- Which compliance checks run on every loan, and which run on a sample?
- What are the complaint counts by reason this quarter, and what changed in response?
- Does any performance fee reward volume without a matching compliance measure?
How the automated version works
MightyBot is an AI agent platform for lending and finance. Agents run the checks above on every loan in a partner program rather than on a quarterly sample, against rules written in plain English such as the APR cap or the state rule for the borrower’s address. Each finding cites the page or the transaction behind it, and exceptions route to a person at the bank for approval. The output is the loan-level evidence the 2023 guidance asks the bank to keep, produced as the loans are made. See compliance monitoring and the policy engine.
