Fintech risk and compliance teams use a monthly bank review to decide whether to keep sending volume to a partner bank, slow a launch, add a backup institution, or brief management. This post gives them a repeatable way to check public bank data, regulator signals, and relationship evidence before the next month of customer activity.
At a glance: identify the legal bank, refresh the latest Call Report and enforcement checks, compare relationship signals against public data, then assign a green, yellow, or red action. The outcome is not a prediction of bank failure. It is a decision record that shows whether the next month of program activity is still supported.
- What to review: capital, deposits, funding mix, liquidity proxies, loan concentration, credit quality, earnings, enforcement activity, and relationship behavior.
- What triggers escalation: capital or liquidity deterioration, sharp deposit movement, CRE or credit stress, new formal actions, stalled approvals, unresolved reconciliation breaks, or changed reserve and settlement terms.
- What follows: green means normal monitoring, yellow means management review and a bank discussion, and red means board notice, contingency planning, legal review, or secondary-bank outreach.
Last reviewed: April 23, 2026. Methodology note: This article summarizes public FFIEC, FDIC, OCC, Federal Reserve, and CFPB materials available at the review date. Verify current filings, guidance, and enforcement updates in the Sources section before relying on the article in a credit memo, board packet, or investor document.
A partner bank under pressure may change risk appetite, tighten program oversight, delay approvals, raise reserves, or reconsider partnerships even when no failure risk is visible. For fintech programs, the warning signs often appear in Call Report schedules, enforcement databases, and third-party-risk guidance before they show up as an account-manager update.
Recent examples make the point. The Federal Reserve Board’s Evolve Bank & Trust action[1], the OCC’s Blue Ridge Bank, N.A. action[2], and the CFPB’s Synapse Financial Technologies, Inc. page[3] point to different failure modes: bank oversight weaknesses, supervisory constraints, and middleware or ledger disruption, including a reported $60 million to $90 million consumer-fund shortfall. The operating lesson is to check the institution, middleware, ledger controls, and regulator in the same review.
Build a monthly scorecard
Start with the bank’s legal identity. Use FDIC BankFind[4] for the institution record and NIC[5] for RSSD, holding-company, and structure context. Then confirm the same entity in your internal records, so the team is reviewing the bank that actually holds the relationship rather than a trade name, processor name, or parent-company shorthand.
Pull quarterly Call Report data from the FFIEC Central Data Repository[6]. The FDIC’s March 2026 Call Report materials[7] list the FFIEC 031, FFIEC 041, and FFIEC 051 forms and say the consolidated instructions were most recently updated December 31, 2025. If a review happens shortly after quarter end, the newest filing may still be inside the normal window, so use the latest filed quarter and label it clearly.
Use filing cadence as a control. FDIC FIL-10-2026[8] says completed Call Reports generally must be submitted no later than 30 days after the quarter-end report date, with an extra five calendar days for certain institutions with more than one foreign office. If a report looks late, check current FDIC letters before treating the blank as a risk signal; FDIC FIL-28-2020[9] is a historical example of a Call Report grace period.
| Scorecard item | Primary source | Monthly trigger |
|---|---|---|
| Capital position | Schedule RC-R, Regulatory Capital | Yellow if any capital ratio falls by 100 basis points quarter over quarter or sits within 200 basis points of the well-capitalized levels in 12 CFR 324.403: total risk-based capital 10.0%, tier 1 risk-based capital 8.0%, common equity tier 1 6.5%, and leverage ratio 5.0%. |
| Deposit and funding mix | Schedule RC-E deposit liabilities and Schedule RC-O deposit-insurance assessment data | Yellow if total deposits fall 10% quarter over quarter, uninsured-deposit share rises by 10 percentage points, or program deposits become a larger share of funding without a matching liquidity explanation. |
| Liquidity proxy | Schedule RC balance sheet and Schedule RC-K quarterly averages | Review cash, balances due from depository institutions, securities, average assets, and average deposits. Ask for management explanation if public liquidity proxies move against relationship updates. |
| Loan growth and concentration | Schedule RC-C loans and leases, Schedule RC-R capital | For commercial real estate, the 2006 Interagency CRE Concentration Guidance[10] flags 100% of total capital in construction, land development, and other land loans, or 300% of total capital in total CRE loans plus 50% CRE growth over the prior 36 months. |
| Credit quality | Schedule RC-N past due and nonaccrual loans, Schedule RI-B charge-offs and recoveries, Schedule RI-C allowances | Yellow if noncurrent loans rise by 50 basis points quarter over quarter, if net charge-offs rise while allowances fall, or if a concentrated loan category deteriorates faster than total loans. |
| Earnings pressure | Schedule RI income statement and Schedule RC-K average balances | Yellow after two consecutive quarters of negative return on average assets or a sharp increase in funding cost that is not matched by asset yield. |
| Public enforcement | FDIC enforcement orders[11], OCC enforcement actions[12], and Federal Reserve enforcement actions[13] | Red if a new order, written agreement, formal agreement, or cease-and-desist order names BSA/AML, consumer compliance, third-party oversight, liquidity, capital, information technology, or board oversight. |
| Relationship signals | Contract log, issue tracker, audit log, compliance request log, reserve schedule, SLA report | Red if approvals stop without a written reason, reconciliation breaks remain open past policy, reserve requirements change by more than 25%, or the bank asks to pause a product line. |
Do not let the scorecard become a pile of ratios. Use this monthly workflow: identify the bank, pull public data, compare peers, scan enforcement, add relationship evidence, and assign an escalation color before the risk meeting. A fintech that only reads the relationship email is not doing bank monitoring; it is doing vendor-status tracking.
- Confirm the institution in FDIC BankFind and NIC, including charter, primary regulator, RSSD ID, and holding-company context.
- Pull the latest Call Report from FFIEC CDR and label the report date, form type, and filing status.
- Map each metric to its schedule: RC-R for capital, RC-E and RC-O for deposits, RC-C for loans, RC-N for past due and nonaccrual loans, RI for income, RI-B for charge-offs, RI-C for allowances, and RC-K for averages.
- Compare peers for outliers, not just direction of travel. A 9% deposit decline matters more if similar banks are flat.
- Keep the source schedule next to the metric, so a board memo can show where the number came from.
- Attach relationship facts: open audit findings, unresolved reconciliation items, new bank requests, onboarding delays, contract amendments, reserve changes, and incident history.
Watch for changing risk appetite
A bank does not need to be near failure to change posture. New management, a regulator exam, rapid deposit movement, weak earnings, a BSA/AML finding, or a third-party-risk remediation plan can make it slow approvals, narrow product scope, ask for more transaction data, or require higher reserves.
The June 2023 Interagency Guidance on Third-Party Relationships: Risk Management[14] is the baseline. It says third-party use does not remove the bank’s responsibility to operate safely and comply with law. If the bank asks for more fintech data, testing, complaint reporting, or control over marketing claims, treat the request as a risk-appetite signal, not just compliance intake.
Deposit programs need their own lens. FDIC FIL-45-2024[15] announced a joint statement on bank arrangements with third parties that deliver deposit products and services. The statement did not create new expectations, but it named the practical risks regulators are watching: operational breakdowns, compliance gaps, consumer harm, and whether the bank can know and control the deposit relationship.
BSA/AML requests should not be dismissed as paperwork. FDIC FIL-42-2024[16] announced the AML/CFT program requirements proposal and related interagency statement. For a fintech program, the action step is simple: if the bank asks for more KYB evidence, transaction-monitoring data, sanctions testing, or customer-risk segmentation, log the request as a change in oversight expectations.
Past enforcement wording shows why the categories matter. The Evolve action named anti-money laundering, risk management, consumer compliance, and fintech partnership oversight.[1] The Blue Ridge action named BSA/AML, capital ratios, capital and strategic planning, liquidity risk management, and information technology controls.[2] Those topics map directly to launch risk, even when the fintech is not named in the order.
Common false positives and false negatives
Two issues show up often in real reviews. A seasonal deposit drawdown can look like funding stress when program balances leave after a payroll, tax, or benefits cycle; do not escalate on percentage change alone if the bank can reconcile the movement to expected client flows and liquidity remains stable. The more dangerous false negative is behavioral drift: relationship emails say launches are on track while approvals slow, reserves increase, and compliance asks for new transaction fields. Treat the pattern as a signal even when public metrics are stale.
Create escalation thresholds
Monitoring is useful only if it changes decisions. Set thresholds before the review starts, and write down who gets notified. The first version can be simple: green means no action beyond monitoring, yellow means management review and bank discussion, and red means board notice, contingency planning, secondary-bank outreach, or legal review.
Use external thresholds where regulators have already drawn lines. For capital, 12 CFR 324.403 is a practical anchor for FDIC-supervised institutions because it defines the well-capitalized category at 10.0% total risk-based capital, 8.0% tier 1 risk-based capital, 6.5% common equity tier 1, and 5.0% leverage ratio. For CRE concentration, the 2006 interagency guidance gives the 100%, 300%, and 50% screens. Your internal trigger should fire before the bank crosses those lines, not after.
Use relationship thresholds for items public data cannot show. Escalate if the bank delays a previously approved launch by more than one review cycle, if a reconciliation issue remains unresolved past policy, if compliance requests expand into new data fields without a written scope, or if reserves, prefunding, or settlement terms change by more than 25%. Those are not Call Report ratios, but they are bank-health signals for a fintech operator.
The monthly decision table should be short enough to use in a risk meeting.
| Status | Trigger | Action |
|---|---|---|
| Green | No new enforcement action; capital, deposits, credit quality, and earnings are stable; relationship issues are inside agreed SLA. | Record review date, report quarter, and owner. Continue normal monitoring. |
| Yellow | One public metric breaches an internal watch level, a bank request changes program economics, or a regulator source raises a new topic relevant to the program. | Send management note, ask the bank for written context, update the contingency plan, and recheck the item next month. |
| Red | New formal action names BSA/AML, consumer compliance, third-party oversight, liquidity, capital, or IT controls; capital falls below a well-capitalized screen; or the bank pauses approvals. | Notify executive risk owner, prepare board note, contact secondary-bank candidates, review termination and customer-notice obligations, and freeze new dependency on the bank until the issue is understood. |
The end product is not a perfect prediction of bank failure. It is a repeatable decision record. If the bank changes posture next month, the fintech should be able to show what changed in RC-R, RC-E, RC-O, RC-N, RI, a regulator action, or the relationship log, and what the team did about it.
Tools we use
DDV tooling is useful when the review needs a clean entity trail. Use the bank search and profile view to reduce legal-entity mismatches, peer comparison to separate bank-specific deterioration from sector movement, and the public-data context view to keep each metric tied to its source schedule.
Recap
- Identify the exact bank and holding-company context before reviewing numbers.
- Use the latest filed Call Report, but do not ignore monthly relationship and enforcement signals.
- Separate expected movement from unexplained movement with peer checks and bank context.
- Escalate before a regulatory line is crossed, not after the problem is already visible to everyone.
- Record the decision, owner, evidence, and next action so next month’s review starts from the same facts.
FAQ
How can this be monthly if Call Reports are quarterly?
Public financial data is quarterly, but enforcement actions, regulatory guidance, bank requests, contract changes, issue remediation, reconciliation breaks, and approval delays can change any month. Refresh Call Report metrics when a new quarter is filed, and refresh relationship and enforcement signals every month.
Should a fintech leave after any enforcement action?
No. Read the action and map it to the program. An order about BSA/AML, consumer compliance, third-party oversight, liquidity, capital, IT controls, or board oversight is more relevant to fintech operations than an unrelated individual prohibition order.
Can public monitoring replace sponsor-bank due diligence?
No. Public data tells you whether the bank’s disclosed condition and regulatory posture are changing. It does not prove operational readiness, ledger accuracy, compliance ownership, customer-funds controls, or contract enforceability. Those still require direct diligence and ongoing bank oversight.
Sources
- Federal Reserve Board enforcement release: June 14, 2024 Evolve Bank & Trust action. URL: https://www.federalreserve.gov/newsevents/pressreleases/enforcement20240614a.htm
- OCC enforcement release: February 15, 2024 Blue Ridge Bank, N.A. action. URL: https://www.occ.gov/news-issuances/news-releases/2024/nr-occ-2024-15.html
- CFPB enforcement page: Synapse Financial Technologies, Inc. action and bankruptcy/shortfall description. URL: https://www.consumerfinance.gov/enforcement/actions/synapse-financial-technologies-inc/
- FDIC BankFind: institution records and bank identity lookup. URL: https://banks.data.fdic.gov/bankfind-suite/
- FFIEC National Information Center: RSSD, structure, and holding-company records. URL: https://www.ffiec.gov/NPW
- FFIEC Central Data Repository: Call Report filing access. URL: https://cdr.ffiec.gov/
- FDIC Call Report materials: current-quarter forms, instructions, and related materials. URL: https://www.fdic.gov/bank-financial-reports/current-quarter-call-report-forms-instructions-and-related-materials
- FDIC FIL-10-2026: Consolidated Reports of Condition and Income for first quarter 2026. URL: https://www.fdic.gov/news/financial-institution-letters/2026/consolidated-reports-condition-and-income-first-quarter
- FDIC FIL-28-2020: historical Call Report grace-period example. URL: https://www.fdic.gov/news/inactive-financial-institution-letters/2020/fil20028.html
- OCC Bulletin 2006-46: Interagency CRE Concentration Guidance. URL: https://www.occ.gov/news-issuances/bulletins/2006/bulletin-2006-46.html
- FDIC enforcement orders database. URL: https://orders.fdic.gov/s/
- OCC enforcement actions index. URL: https://www.occ.gov/topics/laws-and-regulations/enforcement-actions/index-enforcement-actions.html
- Federal Reserve enforcement actions page. URL: https://www.federalreserve.gov/supervisionreg/enforcementactions.htm
- FDIC FIL-29-2023: Interagency Guidance on Third-Party Relationships: Risk Management. URL: https://www.fdic.gov/news/financial-institution-letters/2023/fil23029.html
- FDIC FIL-45-2024: joint statement on bank arrangements with third parties to deliver deposit products and services. URL: https://www.fdic.gov/news/financial-institution-letters/2024/agencies-issue-statement-bank-arrangements-third-parties
- FDIC FIL-42-2024: AML/CFT program requirements NPRM and related interagency statement. URL: https://www.fdic.gov/news/financial-institution-letters/2024/issuance-anti-money-launderingcountering-financing