Prior to engaging in a BaaS relationship, the chief compliance officer (“CCO”) of the bank, along with senior management, at a minimum, should be involved in understanding the provider's and platform’s services, customers, and the impact that entering into a BaaS relationship will have on its risk profile and the BSA/AML Compliance and third–party risk management functions. In most cases, the platform’s customers become the sponsoring bank’s customers, so it is crucial for the sponsoring bank to understand the magnitude of risk presented by the platform and consider the nature of controls which may need to be implemented or enhanced to mitigate such risks. Thus, sponsoring banks should consider which roles, responsibilities, and risk mitigation control functions are outsourced to the BaaS provider or platform and the additional contract terms that are critical to establishing the roles and responsibilities of the parties. To reduce risk exposure, sponsoring banks may consider limiting the outsourcing of essential responsibilities. For instance, sponsoring banks may consider limiting the outsourcing of AML and sanctions compliance related functions. Even functions such as record retention can lead to regulatory issues if not supported by clearly defined contractual obligations. The more roles that are outsourced to the BaaS provider or platform, the less control sponsoring bank has over compliance related functions, driving a need for increased oversight, which may prove challenging in outsourcing arrangements. Additionally, BaaS providers and platforms may not have employees with the requisite BSA/AML subject matter experience, which further increases the risk of non-compliance with regulatory requirements and expectations. Sponsoring banks should also require a risk assessment of both providers and platforms before entering into a BaaS partnership. Moreover, a sponsoring bank will need to know how to incorporate all the risks presented by the BaaS relationship into its own AML and sanctions risk assessment and customer risk rating model. A risk assessment should be a regular exercise for BaaS partnerships to promote due diligence and should focus on identifying key risks, assessing control gaps, and implementing risk mitigation measures. BaaS providers typically do not want to undertake performing risk assessments due to associated costs and resource constraints; so, it would behoove sponsoring banks to include risk assessments in contractual negotiations. Required risk assessments would improve identification of risks, an understanding of control deficiencies, and oversight of issue management, all from onset of the BaaS relationship.
Throughout the lifecycle of the BaaS relationship, the sponsoring bank should contractually require information sharing between the sponsoring bank, platform, and BaaS partner to ensure the sponsoring bank’s Board of Directors (“BoD”) regularly receive risk updates from the BaaS partners. It is essential for sponsoring banks to oversee risks. Additionally, they must report key performance and risk indicators to the bank's oversight function and senior management. Effective reporting includes trend analysis and reporting to highlight the significant risk and necessary risk mitigation efforts, which many sponsoring banks may not currently be adequately managing. Regular information sharing can assist in mitigating risks by increasing the visibility sponsoring banks have into platform and promoting potential issue identification, remediation, and validation. Additionally, sponsoring banks should stipulate that the BaaS provider have ongoing independent testing of outsourced AML and sanctions functions performed by qualified independent third parties. Independent tests should occur throughout the course of the relationship to identify vulnerabilities, prevent financial crimes, and mitigate concerns early, the results of which should be available to the sponsoring bank. Of course, all of these obligations of the sponsor and platform, as well as the bank, should be clearly established by the terms of the contract.
BaaS partnerships offer significant advantages such as providing improved service offerings for merchants and individuals, a more streamlined user experience, and revenue growth. However, there are risks inherent in BaaS partnerships. Acting Comptroller of the Currency, Michael Hsu, stated that BaaS relationships can “create and distribute risk in unclear ways – with the public unwittingly expecting banks and bank regulators to cover problems no matter where they occur in the chain”14. To promote management of AML-related risks, it is important to define strong roles and responsibilities, receive regular BoD reporting, and review risk assessments and independent testing reports. By partnering with reputable BaaS providers and effectively managing AML risks, banks can leverage BaaS partnerships to drive innovation, promote growth, increase revenue streams, and maintain the compliance standards that banking regulators demand.
