Risk and Compliance Self-Assessment Tool for Partner Banks

Review critical processes and controls before your next audit or regulatory exam.

Risk and Compliance Self-Assessment

Thanks for your interest in our Readiness Self-Assessment. After supporting Readiness Assessments for a number of banks as they looked to support their first fintech customer (e.g., BaaS, embedded finance, payments, etc.) and as they prepared for upcoming regulatory exams, we wanted to make a free version of our assessment available to all partner banks.

Step 1 of 7

14%

Board Governance

1. Does the Board have a specific committee and documented charter focused on oversight of the Bank’s risk and compliance activities?

Yes

Partially

2. Do Board minutes reflect active participation and effective challenge by the Board in the strategic planning process?

Yes

Partially

3. Does the Board have a defined risk appetite and/or role in approving new Partners?

Yes

Partially

4. Does the Board have at least one Board member with direct AML/CFT experience?

Yes

Partially

5. Does the Board have at least one member with fintech, payments, and/or embedded finance experience?

Yes

Partially

6. Does the AML/CFT officer present monthly written updates that include suspicious activity reporting and sanctions metrics to the Board?

Yes

Partially

7. Do Board minutes reflect a review and discussion of AML/CFT, Consumer Compliance, and TPRM staffing levels and effectiveness at least annually?

Yes

Partially

8. Does the Board receive monthly written TPRM updates from management that includes an inventory of active Partnerships; status of periodic reviews of Partners; status of related audit report findings and corrective actions; analysis of financial performance; and status of related internal and Partner compliance and AML/CFT training?

Yes

Partially

This field is hidden when viewing the form

Board Governance Score (out of 28)

Compliance

1. Do you review Partner-related consumer complaint reports at least monthly and take appropriate corrective measures?

Yes

Partially

2. Do you have record of appropriate and timely resolution of audit findings, consumer compliance risk assessments, and examination findings for consumer protection laws and regulations (i.e., none of these are currently past due and no history of repeat findings within last 12 months)?

Yes

Partially

3. Do you share documented consumer compliance, marketing, and disclosure standards with Partners and have procedures to ensure Partners are meeting the standards?

Yes

Partially

4. Do you have documented service-level standards for consumer compliance services (e.g., dispute handling, complaint response, marketing, disclosures, etc.) provided by Partners and any of their providers or sub-servicers?

Yes

Partially

5. Do you have a documented assessment of staffing levels, qualifications, skills, and training to perform present and anticipated consumer compliance duties?

Yes

Partially

6. Do you have a defined process and owner for updating policies and procedures on an ongoing basis as necessary to incorporate new or changes to existing consumer protection laws and regulations?

Yes

Partially

7. Do you have management information systems and documented processes to identify, manage, and promptly correct consumer compliance weaknesses, including any weaknesses in compliance with consumer protection laws and regulations?

Yes

Partially

8. Do you have records of ongoing, periodic consumer compliance training of personnel, including the board of directors, senior management, and Partners?

Yes

Partially

This field is hidden when viewing the form

Compliance Score (out of 31)

BSA / AML

1. Does your AML/CFT Officer have at least 5 years of AML/CFT leadership experience at a Bank with similarly structured programs and business lines (e.g., BaaS, payments, etc.)?

Yes

Partially

2. Do you have a documented assessment of staffing levels, qualifications, skills, and training to perform present and anticipated AML/CFT duties?

Yes

Partially

3. Is your AML/CFT Officer a member of the executive leadership team (i.e., reports to the CEO)?

Yes

Partially

4. Does your AML/CFT Officer have an unfiltered line of communication to the Board and report to the Bank’s Audit and/or Risk Committee on a regular basis, not less than monthly, with respect to any AML/CFT matters?

Yes

Partially

5. Does your AML/CFT risk assessment methodology identify and assess the risks of all Partner-related business lines?

Yes

Partially

6. Do you have direct access to your Partner’s AML/CFT information systems and records (e.g. identity verification, transaction monitoring)?

Yes

Partially

7. Does your AML/CFT training program include job-specific training (i.e., more than online training) tailored to identifying suspicious activity associated with the products and services of each Partnership?

Yes

Partially

8. Do you share documented AML/CFT standards with Partners and have procedures to ensure Partners are meeting the standards?

Yes

Partially

9. Have you completed a coverage assessment to identify and document all red flag typologies that should be covered within your transaction monitoring systems?

Yes

Partially

10. Have you completed both transaction monitoring and customer risk rating model validations within the last 12 months?

Yes

Partially

11. Do you have a country risk assessment that has been audited within the last 12 months?

Yes

Partially

This field is hidden when viewing the form

BSA/AML Score (out of 45)

Internal Audit

1. Does your internal audit executive directly report to the Board or Chair of the Audit Committee?

Yes

Partially

2. Is your internal audit executive completely independent of other management activities (i.e., no management responsibilities for other functions such as ERM, BSA, etc.)?

Yes

Partially

3. Does your independent auditor have at least 5 years auditing similar high-risk areas of banking?

Yes

Partially

4. Does your most recent audit plan include evaluation of risk controls managed by Partners?

Yes

Partially

5. Does your most recent audit plan include independent reviews to assess internal controls as well as IT and operational risks associated with Partnerships?

Yes

Partially

6. Does your audit plan include an assessment of the adequacy and effectiveness of your Partnership risk management program and related controls?

Yes

Partially

7. Does your Board and/or Audit Committee receive audit issue tracking status reports at least quarterly?

Yes

Partially

This field is hidden when viewing the form

Internal Audit Score (out of 21)

Third-Party Risk Management

1. Do you have a documented Third-Party Risk Management Program (TPRM) that specifically addresses risk posed by Partnerships (e.g., embedded finance, deposits obtained through third parties, third party payment providers and processors, etc.)?

Yes

Partially

2. Do your TPRM policies and procedures contain due diligence and risk assessment criteria for selecting and approving Partners?

Yes

Partially

3. Do your TPRM policies and procedures include a process for addressing Partners’ activities identified as non-compliant or in violation of applicable laws and regulations?

Yes

Partially

4. Do you have management information systems (MIS) that produce accurate and timely reporting capabilities to facilitate Partner oversight?

Yes

Partially

5. Do you have procedures for daily reconciliation oversight of customer balances ledgered on all systems including your Partners’ systems?

Yes

Partially

6. Do you have standard contract templates and contract assessment checklists that have been created and/or approved by qualified outside counsel?

Yes

Partially

7. Do you have a documented assessment of staffing levels, qualifications, skills, and training to provide appropriate oversight and management of relationships with Partners and the compliance with all laws and regulations?

Yes

Partially

This field is hidden when viewing the form

TPRM Score (out of 24)

Liquidity and Funding

1. Does the bank maintain a funding and liquidity plan (Funding Plan) that addresses all Partnership types (e.g., BaaS, merchant processing, digital wallets, TPP, lending, etc.)?

Yes

Partially

2. Does the Funding Plan identify and analyze all current and projected liquidity risks, including but not limited to liquidity risks posed by partnerships?

Yes

Partially

3. Does the Funding Plan provide for active monitoring and control of liquidity risk exposures and funding needs, including but not limited to liquidity risk exposures and funding needs attributable to any and all liabilities, contingent or otherwise, associated with or related in any way to the Partnerships?

Yes

Partially

4. Does the Funding Plan include cash flow projections, diversified funding sources, a cushion of liquid unencumbered assets, and a Board-approved contingency funding plan?

Yes

Partially

5. Do your Contingency Funding Plan and liquidity stress testing processes specifically address the impact and risks associated with Partnership deposit concentration, alternate sources and cost of replacing these deposits, and specific action steps management will take to address reductions in Partner funding sources?

Yes

Partially

6. Does the Funding Plan contain appropriate strategies and procedures to reduce any funding concentrations if needed?

Yes

Partially

7. Does the Funding Plan contain quarterly targets for concentrations expressed in dollars and as a percent of Total Assets?

Yes

Partially

8. Does management provide monthly Funding Plan monitoring to the Board?

Yes

Partially

N/A

This field is hidden when viewing the form

Liquidity and Funding Score (out of 24)

Strategic Planning

1. Does your strategic plan include all major lines of business and short and long-term (up to three years) goals?

Yes

Partially

2. Does your strategic plan include staffing needs?

Yes

Partially

3. Has your Strategic Plan been approved by the Board of Directors within the last 12 months?

Yes

Partially

4. Do you maintain documented Strategic Plan Policy and/or Procedures that includes input from front-line units, independent risk management, and internal audit?

Yes

Partially

5. Does your Board receive regular (at least quarterly) updates that allow them to effectively evaluate the Bank’s performance in relation to the Strategic Plan?

Yes

Partially

6. Does your strategic plan include an assessment of growth and volume of each line of business in relation to the Strategic Plan, including analysis of any deviations from the Strategic Plan?

Yes

Partially

7. Does your strategic plan include financial goals, including pro-forma statements for asset growth, capital adequacy, and earnings along with specific plans to achieve and maintain capital levels at or above specified limits?

Yes

Partially

8. Does your strategic plan include an assessment of associated risks (e.g., strategic, credit, operational, transaction, market, compliance, legal, regulatory, reputation, counterparty, third-party, and concentration) and the development of risk mitigation strategies for each area?

Yes

Partially

9. Does your strategic plan include assumptions used to develop the plan?

Yes

Partially

This field is hidden when viewing the form

Strategic Planning (out of 27)

This field is hidden when viewing the form

Total Score

This field is hidden when viewing the form

Percent Score