The Cross River Bank Consent Order: What It Ordered, Line by Line

The Cross River Bank consent order is the FDIC's March 8, 2023 order, FDIC-22-0040b, against a New Jersey bank that lends through fintech partners. It found unsafe or unsound practices in the bank's fair lending compliance, and it barred the bank from signing any new fintech partner or offering any new credit product without the FDIC Regional Director's written non-objection. It is one of the most-mentioned actions in partner banking and one of the least quoted, which matters, because the operative paragraphs are where the requirement lives. This guide reads them directly. The working example comes from Botminds' Fintech Partner Oversight, which tests every decision on a partner's weekly loan tape against the bank's approved program, the kind of evidence the order asks a bank to be able to produce.

What did the FDIC find at Cross River Bank?

The FDIC found that the bank engaged in unsafe or unsound practices related to fair lending compliance, and tied the finding to a Consumer Compliance Report of Examination dated May 3, 2021. In the order's words, the bank "engaged in the unsafe or unsound banking practices related to its compliance with applicable fair lending laws and regulations by failing to establish and maintain internal controls, information systems, and prudent credit underwriting practices" in conformance with the safety and soundness standards in Appendix A of 12 CFR Part 364, along with the violations of the Equal Credit Opportunity Act and the Truth in Lending Act described in the examination report. The bank's board signed a stipulation consenting to the order on March 8, 2023, and the FDIC issued it under section 8(b) of the Federal Deposit Insurance Act the same day. The bank neither admitted nor denied the findings.

That sentence does two things at once. It names fair lending compliance, not fraud or credit losses, as the subject of the action. And it blames the failure on infrastructure — internal controls and information systems — rather than on any single bad loan. The remedies match that diagnosis: almost every paragraph of the 34-page order requires the bank to build or prove a system, and none of them imposes a money penalty.

The FDIC later described the case in more detail without naming the bank. Its March 2024 Consumer Compliance Supervisory Highlights recount a 2023 finding against "an institution that partnered with third-party lenders to offer unsecured consumer loans," in the same words as the order, and list what examiners saw: the fair lending program "did not consider the institution's lending volume or the scale of its third-party relationships", compliance staff "were not provided access to all variables used in the pricing and underwriting models," and "material changes to pricing and underwriting model criteria were made without review or approval from institution management." The last of those is the failure most sponsor banks fear, described by the regulator itself.

The order's core requirement: non-objection before any new partner

The best-known provision is paragraph 2.D, and it is worth quoting exactly, because paraphrases tend to soften what it bars. The order first freezes a baseline: within 30 days the bank lists every current credit product and every partner offering one. Anything not on that list is "new". Then it says the bank will not:

(i) execute a binding commitment or agreement with a New Third Party; (ii) allow a New Third Party to offer a Credit product through, or in conjunction with the Bank; and/or (iii) offer a New CRB Credit Product, either directly or indirectly, without first receiving the Regional Director's written non-objection to do so.

FDIC, In the Matter of Cross River Bank, Consent Order FDIC-22-0040b, paragraph 2.D

In plain terms, the bank cannot sign a new fintech partner, and cannot let an existing partner offer a product that was not on the baseline list, until the FDIC's New York regional office has reviewed the bank's own analysis and said in writing that it does not object. The order also sets the regulator's pace: once the Regional Director deems a request substantially complete, it will act on it within 45 days. A bank under this clause plans a partner launch around a federal review window, not around the partner's marketing calendar.

The clause is narrower than it is often described. It covers new partners and new products. It does not, in its own words, require regulatory sign-off for every change a partner makes to its credit model. The model is reached another way: through the risk assessments the bank must do before a launch and at least once a year after it, and through the information systems the bank must have to see what a partner's model is doing. That distinction matters for any sponsor bank reading the order as a template. The regulator's approval is a check at the door; the bank's own monitoring is what covers everything that happens after.

What a "New Third-Party Risk Assessment" must contain

The order defines a New Third-Party Risk Assessment in paragraph 5.H.2 as "an initial thorough and well-documented review and assessment of risks associated with the New Third Party." It must cover the partner's internal controls for consumer protection compliance, including its information systems and internal audit procedures, credit policies and procedures, any models or systems "including any variables or weightings" used for the proposed product, application forms, marketing materials, and its oversight of any merchants that offer the product. It is then repeated: "periodic, but not less than annual, risk assessments" of the same controls.

Three items on that list are about evidence the bank holds, not judgements it makes: the partner's data, its model variables, and its marketing. A bank that relies on a partner's summary report for any of them cannot complete the assessment the order describes, which is why the information systems provisions come first in the order's sequence.

Why fair lending, not fraud, was the finding

A sponsor bank's most visible exposure to a partner is fraud or credit loss; the Cross River order is evidence that the regulator's concern is often quieter. The FDIC's supervisory highlights put the mechanism plainly: "automated underwriting and pricing models offered by third parties may present fair lending risk if the financial institution does not monitor how these models operate or what criteria are used to make decisions." A model can run exactly as its developer intended and still produce a disparate outcome the bank never tested for, because the bank never had the access or the process to look.

The same document gives the consequence of missing records in one line: "Since the institution did not have access to these records, it was unable to accurately assess fair lending risk, perform adequate monitoring, prudently underwrite credit transactions, or ensure compliance with fair lending laws and regulations." A bank that cannot pull its partner's transaction-level data cannot test it, however good its policies look on paper.

The highlights also list the controls the FDIC has seen work. Two of them belong in every partner agreement, order or no order: the bank's "right to access data and information, including lending criteria, in a timely manner," and its "right to approve changes in processes and systems that affect work performed by the third-party service provider on the bank's behalf before implementation." A contract with both gives the bank something to enforce when a model changes; a contract with neither leaves it to find out from complaints.

The study that asks whether software can carry the load

The Fair Lending Resources Study in paragraph 4.B is the most specific requirement in the order, and the most useful for any bank sizing its own oversight. An independent third party must assess the bank's resources against its size and growth plans, the current and anticipated number of credit products and partners, the number of merchants offering those products, and "the volume of decisions made by the Bank or on behalf of the Bank by a Third Party in connection with an Application" — underwriting, the credit transaction and the terms used in marketing.

The study must also review what the order calls "Non-Staff Fair Lending Resources": "software, automated systems, and/or other technology." It has to assess whether those tools are adequate and effective, not only whether they exist. A bank that wants to rely on automated testing to meet this kind of standard has to show that the tool's coverage scales with the partner's decision volume. One partner deciding about 4,900 applications a week makes roughly 63,000 decisions a quarter; a quarterly review sampling 25 to 60 of them, the manual sample size we assume in our own estimates, tests less than a tenth of one percent.

How does a bank prove a model change had its approval?

A bank proves it with two records: the approval itself, dated before the change went live, and evidence that every decision since was made by an approved version. The first is a governance record — a risk assessment that covered the model's variables and weightings, a sign-off, and, for a bank under an order like Cross River's, the Regional Director's non-objection when the change amounts to a new product. The second is data, and it is the part most banks cannot produce on demand, because it lives in the partner's systems.

In Fintech Partner Oversight, the loan tape tester produces the second record each week. Every decision on the tape carries the model version that made it, compared with the bank's approved-model list, and the pricing of every funded loan is compared with the program grid. In the sample data below — a fictional sponsor bank, Brannock Valley Bank, and a fictional partner, Fernquill — a model version the bank had not approved went live on Monday 5 October, and by Friday 212 loans had been priced above the program grid.

A model version live without the bank's sign-off, caught on the weekly tape

What other sponsor banks have faced similar orders?

Cross River's order is the most cited because it is unusually specific, but the pattern recurs. On June 11, 2024, the Federal Reserve and the Arkansas State Bank Department issued a cease and desist order against Evolve Bank & Trust and its holding company, after examinations found deficiencies in the risk management of the bank's Open Banking Division, which offers deposit accounts and payment services to fintech partners, and in its anti-money-laundering compliance. Where Cross River's order puts the regulator at the door, Evolve's puts the bank's own board there: the bank must ensure that its board or a committee gives "written approval prior to implementing, distributing, or marketing new products, programs, services, business lines, or onboarding of new fintech partners or customers" through that division.

The common thread is the one the FDIC drew in its highlights: a bank that cannot access or test its partner's underlying data cannot oversee the partner, whatever its policies say. The Synapse bankruptcy shows the same root cause — a bank relying on a partner's records instead of its own — on deposits rather than loans.

What a consent order means for an already-signed partnership

The order does not void existing contracts or require the bank to exit a partnership. Partners and products on the baseline list keep operating. What changes is everything around them: the order requires periodic, not-less-than-annual assessments of whether each partner that offered a product for six months or more in the prior year did so in compliance with fair lending law, semi-annual fair lending monitoring reports, and fair lending internal controls reviewed at least annually. A product an existing partner did not offer on the baseline date is a New CRB Credit Product and needs the full non-objection request.

That matters even for a bank with no order against it. An examiner can ask any sponsor bank whether it has an approval process for new partners and products, a risk assessment on file for each one that covers the model's variables, and a way to show the model running today is the one it approved. The order is a published answer to what a complete file looks like. What a sponsor bank is responsible for sets out the rest of that file, and who on the bank's side does the weekly work shows how the seats divide it.

Questions people ask

Did the FDIC fine Cross River Bank?

No. The 2023 consent order imposes no civil money penalty; it is a set of required corrective actions. The underlying finding was that Cross River engaged in unsafe or unsound practices related to fair lending compliance, by failing to establish and maintain the internal controls, information systems and underwriting practices required by the FDIC's safety and soundness standards.

What is a bank non-objection requirement?

It is a condition requiring a bank to get a regulator's written non-objection before a specific action. In Cross River's order it covers signing a new fintech partner, letting a new partner offer credit, and offering any credit product not on the bank's baseline list, and the Regional Director acts within 45 days of deeming a request substantially complete.

Is Cross River Bank still under the FDIC consent order?

The order says its provisions remain effective and enforceable until the FDIC modifies, terminates, suspends or sets it aside in writing; it sets no expiry date. Whether it has since been lifted is a question for the FDIC's current enforcement records, not the order's text.

Did Cross River admit wrongdoing?

No. The order records that the bank neither admits nor denies the FDIC's determination, and that it consented to the order through a stipulation its board executed on March 8, 2023. That is the usual form of a consent order.

What does the order require for a partner's credit model?

The bank's risk assessment of a new partner must cover "any models or systems, including any variables or weightings," and be repeated at least annually. The order also required an independent review of whether the bank's information on every credit model was complete, accurate and accessible enough to monitor fair lending compliance.

What happens when a bank violates a consent order?

The Federal Deposit Insurance Act lets the agency apply to a federal district court to enforce an outstanding order, and makes violating a final order grounds for civil money penalties against the bank (12 U.S.C. 1818(i)). The agency can also issue further, more restrictive orders.