Fintech partner oversight, explained.

A bank's name on the loan and a fintech's name on the app: how sponsor bank lending works

One partner loan in five steps, and where oversight sits

1. The bank approves the programDue diligence on the fintech, a program agreement, a credit policy, a pricing grid, approved ads and notice templates.
2. The fintech finds and screens the borrowerIts app, ads and model handle the application; the bank's policy sets the limits.
3. The bank makes the loanFunds it, owns it, often keeps a share and sells the rest to the fintech or investors within days.
4. The bank tests what happenedEvery decision, price, notice, complaint and ad, against the agreement and the law. This is where Fernquill's model change is found, or missed.
5. Findings, fixes and the examRemediation by the partner, escalation to a committee, refunds, and the evidence pack an examiner reads.

Step 4 is the subject of this guide. The bank, partners, people and figures in the example are fictional.

What surprises banks new to fintech partner oversight

Sponsor bank, program agreement, loan tape and adverse action notice

Fourteen terms are defined in the one-page summary.

The fintech runs the app, the model and the letters; the bank answers to examiners for all of them

In shortIn most lending programs the fintech runs the customer side: marketing, the application, the model, the notices, servicing and complaints. The bank approves the credit policy and pricing, makes and funds the loan, and owns the compliance result. The agencies list the jobs most likely to cause trouble: handling complaints, identifying customers, writing disclosures, lending activities and marketing.

The agencies' 2024 request for information on bank–fintech arrangements describes lending programs in which "the parties … may be assigned to perform various core operational functions in connection with lending, including those relating to the processing, underwriting, closing, delivering, or servicing of loans".1 It names the places where risk rises: when the fintech "performs key functions, such as handling end-user complaints, performing customer identification and due diligence, developing and transmitting disclosures, … performing certain lending-related activities, developing and deploying marketing materials, or directly communicating with end users".1

It then adds the sentence every oversight program starts from: "banks remain responsible for compliance with applicable law".1

The pieces of a program agreement that oversight leans on

The request for information also warns about a problem no contract fixes on its own: oversight is hard "where the fintech company has substantial negotiating power relative to the bank or where the bank relies on revenue or liquidity from the fintech company", which "could impede bank staff's ability to provide effective challenge", including on "whether to terminate the contractual arrangement if necessary".1 A small bank whose largest partner brings most of its growth has to be able to say no to that partner, and to show an examiner that it did.

The third-party guidance from 2023 to the September 2026 proposal, and the consumer laws that ride on every partner loan

In shortNo single rule is called "fintech partner oversight". The duty comes from the agencies' 2023 third-party guidance, which is in force and was proposed for replacement on September 15, 2026, and from the consumer laws that apply to every loan the bank makes: Regulation B (credit decisions and decline notices), Regulation Z (truth in lending, including ads), the Military Lending Act, fair lending law, the bans on unfair, deceptive or abusive practices (UDAP and UDAAP), and the Bank Secrecy Act (BSA) against money laundering. The 2026 proposal softens the process and keeps the responsibility.

The 2023 Interagency Guidance on Third-Party Relationships, from the Office of the Comptroller of the Currency (OCC), the Federal Reserve and the Federal Deposit Insurance Corporation (FDIC), replaced each agency's older vendor guidance with one text.2 It describes a life cycle: planning, due diligence, contract negotiation, ongoing monitoring and termination. On monitoring it sets no interval. Monitoring may be "conducted on a periodic or continuous basis, and more comprehensive or frequent" when the relationship supports higher-risk activities.2

A footnote in the 2023 guidance spells out which laws count: those "designed to protect consumers (such as fair lending laws and prohibitions against unfair, deceptive or abusive acts or practices) and those addressing financial crimes".2

On July 25, 2024 the agencies added two documents: a joint statement on arrangements that deliver deposit products through third parties, and the request for information on bank–fintech arrangements in deposits, payments and lending.5,1 The request closed for comment in the fall of 2024 and produced no new rule or guidance.

Then the direction changed. On May 19, 2026 the President signed Executive Order 14405, which gives the financial regulators 90 days to find the rules, guidance and orders "that unduly impede fintech firms from entering into partnerships with federally regulated institutions", "balancing innovation interests with the importance of safety and soundness, consumer and investor protection", and 180 days to take steps that encourage innovation.8 On September 15, 2026 the OCC, the Federal Reserve, the FDIC and the NCUA published a proposed replacement for the 2023 guidance, with comments due November 16, 2026.5

What the September 2026 proposal changes, and what it keeps

For a bank whose partners make consumer loans, the proposal changes the tone of an exam more than the work. The laws below apply to each loan whatever the guidance says, and the proposal itself says the agencies "may take action for violations of laws or regulations".5

The consumer laws every partner loan carries

Fewer new orders, many lifted, a narrower definition of unsafe practice: the supervisory climate a sponsor bank works in now

In shortFrom early 2025 the banking agencies brought far fewer formal enforcement actions and lifted many old ones; the number of active formal orders fell about 45% from its 2024 peak. The Fed folded fintech partnerships back into normal supervision, the Consumer Financial Protection Bureau (CFPB) shrank, and the OCC and FDIC narrowed "unsafe or unsound". None of this changed a single consumer law a partner loan must meet.

The changes that matter to a sponsor bank

Klaros Group, which tracks partner banks, tested the obvious hypothesis in August 2025, that "the enforcement environment has gotten a lot better for fintech partner banks". Its answer then: "Not much. Not yet."20 Only six of 38 orders issued that year went to partner banks, and "the other fintech partner banks that got formal orders in recent years? They've still got them."20 Since then many have been lifted, as the next section shows. The practical reading for an oversight team: fewer outside reviewers will look at the program, so the bank's own testing carries more of the load.

What regulators ordered partner banks to fix from 2023 to 2026, and which orders have been lifted

In shortBetween 2023 and 2024 regulators issued formal orders against a run of partner banks. The orders repeat the same demands: an inventory of every fintech and what it does, monitoring scaled to the risk, regulator approval before any new partner, look-backs over past customers, and fair lending monitoring of every partner's credit model. Several orders were terminated in 2025 and 2026; for three others we found no termination in the agencies' releases as of October 2026.

The orders are the most concrete statement of what regulators expect, because they list, item by item, what a bank had to build after its oversight failed. Five read in their own text or the agency's release:

The status column records what we checked. A lifted order appears in the agency's enforcement releases, and a news search on October 31, 2026 found no termination for Cross River, Sutton or Evolve either. Check the FDIC's and the Federal Reserve's enforcement action search before relying on a status.

Others moved too. The FDIC terminated Thread Bank's consent order (announced January 30, 2026) and Hatch Bank's (announced February 27, 2026).28,29 New ones still appear: the OCC released a consent order against Community Federal Savings Bank, a payments partner bank, on May 21, 2026, for anti-money-laundering failures, and the FDIC listed a new consent order against Lineage Bank among its June 2026 actions.30,31

When Synapse, a middleware company that connected fintech apps to their partner banks, failed, the cost landed on customers: the CFPB said Synapse's records and its partner banks' records disagreed by $60 million to $90 million, and took a $1 penalty so its victims fund could pay them.32

The FDIC described the Cross River pattern, without naming the bank, in its March 2024 supervisory highlights: "automated underwriting and pricing models offered by third parties may present fair lending risk if the financial institution does not monitor how these models operate or what criteria are used to make decisions".33 That sentence is the reason a partner's model version belongs on the loan tape, and the reason an unapproved version is a finding before anyone has looked at its results.

Who the real lender is, and which state's rate applies: Madden, valid-when-made and the Colorado opt-out fight

In shortA partner program works only if the bank is the lender and can charge its home state's rate everywhere. Two legal questions threaten that. "True lender" asks whether the fintech, holding most of the economic interest, is the real lender; the Colorado and Oregon opt-outs ask whether a borrower's state can impose its own cap on an out-of-state bank. Both were live in courts in 2026.

State-chartered banks can charge the rate their home state allows, on loans to borrowers anywhere, a power called rate exportation, under section 27 of the Federal Deposit Insurance Act, which Congress added in 1980 through the Depository Institutions Deregulation and Monetary Control Act (DIDMCA) section 521.34,6 A Utah or New Jersey bank can therefore lend to a borrower in a state with a 36% cap at a higher rate.

In 2015 the Second Circuit, in Madden v. Midland Funding, held that a debt buyer who bought a national bank's loan could not rely on the bank's rate authority. The OCC and FDIC answered with "valid-when-made" rules in 2020: interest permissible when the bank makes a loan stays permissible after it is sold.35,34 The OCC also adopted a "true lender" rule in October 2020, saying the bank is the lender if it is named in the loan agreement or funds the loan; Congress disapproved it under the Congressional Review Act, and the OCC removed it on August 5, 2021.36

That leaves true lender to the states and the courts. Several states have written tests into law. Illinois's 2021 Predatory Loan Prevention Act, with a 36% cap, treats a company that holds "the predominant economic interest" in a loan made by an exempt bank as the lender; Maine adopted a similar test the same year.37 Since late 2025 lawmakers in Wisconsin, Rhode Island and New York have proposed more.38

In court, the largest recent test went the industry's way: a Los Angeles trial court rejected California's true lender theory against the fintech OppFi, finding that its partner, FinWise Bank, originated and funded the loans with its own capital, controlled underwriting, kept an ownership interest and oversaw the program, so the loans were valid when made. California's regulator appealed on July 21, 2026.39

The opt-out fight is newer. Section 525 of DIDMCA lets a state opt out of the rate-exportation rule for loans "made in such State". Colorado did so in a 2023 law for consumer credit.6

Bank trade groups sued. In 2024 a district court barred Colorado from enforcing its rate limits on loans by the plaintiff groups' member banks. On November 10, 2025 a Tenth Circuit panel reversed, holding that a loan is made in a state if either the borrower or the lender is there. On April 2, 2026 the full court agreed to rehear the case, which vacated the panel's judgment and restored the injunction while the court decides.6,7

Oregon enacted its own opt-out in April 2026 for consumer finance loans of $50,000 or less, with a 36% cap, joining Colorado, Iowa and Puerto Rico.6,40

Why this belongs in an oversight guide: a program's lawful rate can change with the borrower's state, the partner's economics can make the fintech look like the lender, and both show up in data the oversight team already has. The state-bank programs in the chart above are the ones Colorado's law would reach.41

A bank needs to know, from its own tapes, which states its partners lend in, at what rates, and how much of each loan it keeps. In the example, Brannock Valley Bank keeps a 5% participation and sells 95% to Fernquill on day three, the structure a true lender challenge looks at first.

Pricing every funded loan against the program grid: the arithmetic that a 36% cap test misses

In shortThe pricing grid in the program agreement sets one rate for each score band, term and amount. Testing price means joining every funded loan to its cell in the grid and comparing the rate charged. A cap test asks only whether a rate is legal; the grid test asks whether it is the rate the bank approved. Errors here are pure consumer harm, and they cost interest every month until a loan is repriced.

Take one of Fernquill's loans from the example. Loan 2610-30418 was funded on Tuesday, October 6: $12,000 for 48 months to an applicant with a 702 score. Exhibit C of the agreement puts a 702 in tier B, at 14.99% APR. Fernquill charged 18.49%, 3.5 points more. At 14.99% the monthly payment on $12,000 over 48 months is about $333.90; at 18.49% it is about $355.60. The difference, about $21.70 a month for 48 months, is roughly $1,040 of extra interest if the borrower pays to term.

Across the 212 loans priced above the grid, the example's arithmetic gives $2,531,800 funded, an average of 3.4 points over the grid, and about $173,600 of extra interest over the loans' lives.

How the test is built

1. Load the grid as data: each score band, term range, amount range and APR, with its effective date and version.
2. Join every funded loan on the tape to its cell, using the score, term and amount the decision used.
3. Compare the APR charged with the grid APR, with a tolerance the bank sets (zero in the example).
4. Value the gap loan by loan: points over and extra interest to term, so the remediation has a number.
5. Chart the share above the grid each day or week, against the partner's own history, so a step change shows the day it starts.

The last step is what turns a test into early warning. In the example, the share of Fernquill's funded loans priced above the grid normally runs around 0.3% a week, with an upper control limit of 0.8%, the highest weekly level its own recent history counts as normal (section 12 explains how the limit is drawn). On Monday, October 5 it was 0.0%. On Tuesday it was 18.5%, 52 of 281 loans, and it stayed between 19% and 22% for the rest of the week.

The cause was in another field on the same tape: from 7:00 am Tuesday the pricing engine read a cash-flow band that model version 7.2 added, and the bank's grid had no such band.

Adverse action notice testing: checking that every decline letter gives the reason the model used

In shortRegulation B requires a notice within 30 days of a completed application, with the specific principal reasons for a decline. The reasons must describe the factors the creditor actually considered or scored. In a partner program, a model and a letter template are maintained separately, so a model change can quietly break the mapping from reason codes to letter text. A timeliness test will not see it; a reason-match test will.

Regulation B is direct. The creditor must notify the applicant of action taken within 30 days after receiving a completed application. A statement of reasons "must be specific and indicate the principal reason(s) for the adverse action", and statements that the decision rested on internal standards or a failed score "are insufficient".11

The official commentary adds that the reasons "must relate to and accurately describe the factors actually considered or scored by a creditor", and that more than four reasons "is not likely to be helpful".11 When a third party sends the notice, it "shall disclose the identity of each creditor on whose behalf the notice is given", which in a partner program means the bank.11

In May 2025 the CFPB withdrew its 2022 and 2023 circulars that applied these rules to complex models and to the sample forms.17 The rule's text did not change. A notice that names income when the model declined for irregular deposits fails the commentary's plain test whatever any circular said.

How the reason test is built

The example shows how the break happens. Version 7.2 added three cash-flow attributes from linked bank accounts, among them CF-03. Fernquill's notice template had no wording for CF-03, so it fell back to the old income reason. 84, 88, 80, 86 and 74 wrong notices went out Monday to Friday. Each was sent on time, with the credit score disclosure and the bank's name, so every other notice test passed.

Reading partner complaints as an early warning: themes, spikes and the 15-day clock

In shortComplaints arrive at the fintech, at the CFPB's portal, at the bank and at its regulator. The bank needs all of them, themed, so a new problem shows as a rising theme within weeks. Complaints that mention third parties are rising: the FDIC counted 6,356 in 2025, up 48% in a year, and CFPB personal loan complaints about unexpected fees or interest rose 82%.

The CFPB counts a company's response as timely if it comes within 15 calendar days of the complaint being sent, or within 60 days if the company asked for more time.42 The Bureau received about 13,500 personal loan complaints in 2025. Its most common issue was "Charged fees or interest you didn't expect", whose monthly average rose 82% on the prior two years; complaints about installment loans rose 70%, and consumers complained more about loans obtained online than in a store.42

The FDIC sees the third-party side directly. Complaints it handled that involved one or more third-party providers, non-bank companies doing work for banks, rose from 3,800 in 2023 to 4,282 in 2024 and 6,356 in 2025.43,44 Writing about third parties' claims of deposit insurance, its 2024 highlights asked banks for "a comprehensive complaint management program" with "timely corrective action, tracking, and trend analysis for all complaints, including those received by third parties", advice that fits a lending program as well.33

Three practices make complaints useful for oversight. Theme every complaint the same way across partners, so the bank can compare. Watch each theme against its own average, so a doubling stands out: in the example, double-debit complaints at Fernquill went 9, 14, 22 and 31 a week after it moved payment processing on September 14, and 1,186 accounts were debited twice on October 1. And keep every portal complaint on a 15-day clock: three of Fernquill's were past it, the oldest at 21 days.

Testing live ads against the approved library and Regulation Z's advertising rule

In shortA fintech can publish hundreds of ads a month across social, search, email and affiliates. The bank should test what is actually live, matching each creative to its approved library and to the rules: a rate stated as an APR, trigger terms followed by the required terms, no claim the product does not deliver. The FDIC found banks and fintechs advertising credit-building results they could not support.

Regulation Z's advertising rule for closed-end credit is short. "If an advertisement states a rate of finance charge, it shall state the rate as an 'annual percentage rate,' using that term." If an ad states a triggering term, "the number of payments or period of repayment", "the amount of any payment", a down payment or a finance charge, it must also state the down payment, the terms of repayment and the APR.14

Beyond Regulation Z, deception law covers claims: "no credit check" on a product that pulls a full credit report is a statement the bank, as lender, has made.

The FDIC's March 2024 highlights describe a real pattern. Banks "collaborated with fintech companies on credit building products" and "advertised that these products would improve the consumer's credit score by an average or a specific amount" without analysis to support it; one bank relying on a third party claimed a 60-point increase drawn from a study of products unlike its own. It also found products advertised as credit building that "had no positive impact on the consumer's credit score".33

A bank may add its own standard on top of the rule, such as showing the full APR range wherever a "from" rate appears. Regulation Z does not require the range; a bank that requires it should say so in its marketing policy and test against that policy, so that a finding names the right authority.

Fair lending, anti-money-laundering and model changes: the program tests a sample rarely reaches

In shortSome tests need the whole population: approval and pricing comparisons between groups, shared devices across many identities, and a change of model version that touches every decision from one day on. These are the tests regulators wrote into the orders, and the ones a quarterly sample is least able to run. Credit results are diverging too: charge-offs on other consumer loans at partner banks reached 4.5% in 2025.

Fair lending. The Cross River order required "statistical analysis and/or transaction testing" that considers "actual underwriting and pricing factors", and investigation of any disparities.21 Since 2025 the OCC and FDIC no longer examine for disparate impact,13,18 and the CFPB's July 2026 amendments to Regulation B narrowed it further; disparate treatment remains illegal and examined.12

A bank still needs approval and pricing comparisons by group, with a threshold it sets for itself, to find treatment problems and model drift. In the example, the bank's own floor is a ratio of 0.80 between approval rates by age band, and Fernquill's lowest ratio was 0.91.

Anti-money-laundering and sanctions. The Sutton and Blue Ridge orders show what examiners ask a partner bank to know: which program manager, the fintech that runs a program's customer side, does which part of customer identification, monitoring and reporting, and evidence that each did it.26,24 Population tests suit this work: every applicant screened, devices or identities shared across accounts, referrals worked within a set time. A person decides on any suspicious activity report.

Models. The interagency model risk guidance of April 2026 covers vendor and other third-party models, which includes a partner's credit model; it is aimed mainly at banks with more than $30 billion in assets, and it leaves generative AI and AI that acts on its own to the bank's own governance.19 A smaller sponsor bank still answers for the model's results under the third-party guidance and the consumer laws.2 The simplest model control in a partner program is a field: the model version on every decision, checked against the bank's list of approved versions.

Credit. Klaros compared net charge-offs on "other consumer loans", the reporting bucket for consumer loans other than mortgages, cards and auto loans, where personal loans sit, at fintech partner banks and at the ten largest bank lenders in that category. Through 2022 partner banks ran 1 to 1.5 points higher; by 2025 their rate had reached 4.5%, "roughly four times the level at the top bank lenders", which Klaros reads as different products, "weaker credit risk management in the partner bank channel, or both".45

Why each partner gets its own control limits, and how a step, a run or a trend becomes a signal

In shortA control chart plots a measure over time against limits drawn from that partner's own recent history. A point outside the limits, a long run on one side of the center, or a steady climb is a signal that something changed, often before any legal threshold is crossed. It suits partner oversight because programs differ: a 27% approval rate is normal for one partner and alarming for another.

The method comes from manufacturing quality control. Take a measure, say the share of funded loans priced above the grid, compute its center (the average) over a recent window, here the last 12 weeks, and draw limits at the center plus and minus three standard deviations. A stable process stays inside. Common rules for a signal: one point outside the limits; seven points in a row on one side of the center; six points in a row rising or falling. Each is unlikely by chance and likely when something real changed.

Why each partner's own limits: a personal-loan fintech, a point-of-sale lender and a credit-builder program have different normal approval rates, complaint rates and price patterns. One fixed threshold for all would be loose for some and noisy for others. Limits drawn from each partner's history flag change in that partner's behavior.

In the example, the bank charts five measures for each of six partners: share priced above the grid, approval rate, notice accuracy, complaints per 10,000 accounts, and the fair lending ratio. Fernquill shows four signals in one week; its fair lending ratio, 0.91, stays inside its limits of 0.90 to 0.98.

A chart does not say whether anything is illegal. It says where to look. The value is that the loans behind a point are a click away: the 52 loans behind Tuesday's 18.5%, the 84 notices behind Monday's dip, the 31 complaints behind the week's spike.

How many lending programs run through partner banks, and how many of those banks have been under orders

In shortUnsecured personal loans reached a record $281 billion in mid-2026, growing almost 10% a year. Klaros counted 1,574 partner bank programs by 777 companies in 2025, and found more than a quarter of lending programs running through banks under formal enforcement actions at the time. Since then enforcement has eased, and fintechs have begun seeking their own charters.

No public figure gives the number of sponsor banks, the number of people working in partner oversight, or the cost of a program. Klaros's counts come from its own database and are the best published ones. The direction since 2025 is clear: fewer new orders, many lifted, an executive order and a proposed guidance that invite more partnerships, and a growing personal loan market. More programs, with less outside review, put more weight on each bank's own testing.

A quarterly review by hand: a few dozen sampled loans, six steps and about thirteen working days per partner

In shortA small oversight team collects each partner's files, samples loans and notices in spreadsheets, reads the complaint log and a folder of ads, and writes findings and a committee pack. Third-party risk keeps the due diligence file, the BSA officer reads the program manager's reports, and internal audit tests the program. Most of the time goes into collecting and re-performing tests by hand.

Oversight manager, CCO, BSA officer and the fintech's partnerships lead

Five hands on a quarterly partner review before committee

Sampling and re-testing loans fill most of a partner review

A quarterly rhythm has a second weak spot. A model change, a broken template or a new ad can start the week after a review and run for three months. A sample of a few dozen loans a quarter, drawn from tens of thousands, may not include one affected loan. The guidance asks for monitoring scaled to risk;2,5 for a high-volume consumer program, that points toward testing every decision and charting it weekly.

Spreadsheets, audit firms or loan-level testing platforms for partner oversight

From a late Monday tape to a signed escalation in 28 minutes: Fernquill's week of October 5

In shortThis is the example from the top of the page, inside the product. On Monday morning, October 12, Dana Okafor, the bank's vice president of fintech partner oversight, charts Fernquill's late tape. Six agents run 24 tests on all 4,918 decisions; the pricing chart jumps its upper limit on Tuesday; the agents draft five findings with the loans behind them. Dana accepts all five and escalates three, and the chief compliance officer, Martin Ayres, signs at 9:20 am.

1

Five partners charted, one tape late

The weekly run started at 6:00 am with five of six tapes in. The agents charted Brackenly Pay, Nimbleleaf, Cindervale, Pocketrise and Wrenfield Auto, 120 tests and one signal, and drafted two findings for Dana's review. Fernquill's tape for October 5 to 9 arrived at 8:52 am: 4,918 decisions, 1,342 funded for $14,612,400, 3,576 declined.

The home screen opens on Fernquill's control chart for pricing: 12 weekly points to October 2, the partner's own center line at 0.3% and upper limit at 0.8%, and an empty "this week by day" panel waiting for the tape.

2

Tuesday's point jumps the limit

Dana presses "Chart Fernquill's week" and the days land one by one. Monday is 0.0%. Tuesday is 18.5%, 52 of 281 funded loans priced above the grid, and the next three days stay between 19% and 22%. The callout reads "212 loans priced above the program grid since Tuesday".

The panel on the right shows what is behind the point: the loans, the grid rate against the rate charged, and the cause the agents traced. From 7:00 am Tuesday the pricing engine read model v7.2's cash-flow band, which the grid does not have. Every APR is under 36%, so the cap test passed; the grid test did not.

3

The 212 loans, one by one

"Open the 212 loans" goes to Fernquill's loan tape. Each loan shows its funding day, amount and term, score, grid tier, grid APR, APR charged, points over and extra interest over its life. Loan 2610-30418, $12,000 for 48 months at a 702 score, should have been 14.99% and was 18.49%: $1,040 of extra interest.

The footer adds it up: $2,531,800 funded, 3.4 points over the grid on average, about $173,600 of extra interest over the loans' lives, highest APR 35.99%. It names the authority too: program agreement §5.2 and Exhibit C.

4

412 letters with the wrong reason

The same tape, another view. The adverse action checker compared all 3,576 declines with the notices that went out. On 412 the decision's principal reason is CF-03, "Irregular deposits in linked bank account", and the notice says "Income insufficient for amount requested". Every one of the 412 was decided by model v7.2.

Each row shows the application, the decision date, the model, the principal and second reasons, the reason on the notice and when it was sent. All were sent within 30 days; none says why the applicant was really declined.

5

Accept five, escalate three, signed

The scorecard shows the week in one place: score 68, down 16 from 84; 16 of 24 tests passed; five findings drafted, three High. Dana accepts all five; Jordan Pike, Fernquill's head of bank partnerships, sees them in the partner portal.

She escalates the three High findings, the notices, the unapproved model and the pricing, to the Partner Risk Committee with a recommendation: return to model v7.1 unless v7.2 is approved by October 16; corrected notices to the 412 and the 212 loans repriced by October 26; daily testing until the score is back above 70.

Martin Ayres signs the escalation at 9:20 am. The committee meets on Thursday, October 15.

The solution's design target is every decision on each tape tested every week. Monday, October 12, 2026 is Columbus Day, a federal holiday; in the example the bank's team works that morning, the tape covers October 5 to 9, and due dates count business days from October 13.

All six partners on one grid, the model log, complaints, an unapproved ad and the examiner pack

In shortBeyond the morning's walk-through, the screens cover the whole program: a grid of every partner and every measure, the model version by day, the full list of tests with their populations, complaints themed across partners, the live ad that was never approved, the remediation request, the issue log, the examiner pack and the settings the bank owns.

Select any screen to open it larger. The bank, partners, people, loans and ads are fictional.

What each agent may do with a partner's tape, and the three signatures it cannot replace

In shortEach agent has one job and limits it does not cross. None edits partner data or a decision, approves an ad, answers or closes a complaint, or files a suspicious activity report. The partner oversight manager accepts, assigns and closes findings; the chief compliance officer signs every escalation; the BSA officer decides on any filing.

Six agents test tapes, decline letters, complaints, ads and BSA signals

The oversight manager, CCO and BSA officer behind each partner finding

Thresholds, limits and approvers are versioned settings. Every agent step and every human decision is on the audit trail, and partners see their own findings, owners and due dates in the partner portal.

Dana Okafor's oversight desk at Brannock Valley Bank

What a partner sends each week, what the bank already holds, and what comes back: charts, findings and an examiner pack

In shortThe solution reads what partners already send and what the bank already holds: weekly loan tapes, decline notices, complaint logs and the CFPB portal feed, live marketing, and the program agreements, pricing grids and credit policies. It returns control charts per partner and measure, findings with the loans behind them, remediation requests, an issue log, an examiner pack and a board report.

Partner file feeds, core, complaint and BSA systems to connect

For each, check whether it offers an API, a file feed or only screens, and who owns it at the bank and at each partner.

Every partner decision tested weekly against its own history

How a partner's pricing or notice error grows each week it runs, and what finding it a quarter late costs your bank

In shortThe cost of a late finding grows every week it runs: more loans to reprice, more letters to resend, more complaints, and a larger look-back. Found by an examiner, it can become an order that limits new partners, as several did in 2023 and 2024. Most of these costs are not published, so start from your own numbers.

Find your bank's own partner oversight costs

Unsigned new partners, unexplained declines and other uncounted costs

Analyst hours released and borrower harm stopped sooner: a return calculator for weekly partner testing

In shortPut in your own numbers. The calculator values the review hours released and the consumer harm avoided by finding a pricing error weeks sooner, less what the tool and your testing cost. Every default is an assumption to replace; exam findings and orders avoided are left out because they cannot be priced in advance.

Findings ready to decide, errors stopped the next Monday

Price weekly loan tape testing on your own partners

A bank that already tests every decision weekly by other means will see little time released; its gain is in harm cut short and evidence. A bank with one small partner may find a quarterly review enough. The inputs show which you are.

Eight questions on tapes, data rights, approvals and escalation that score your partner program from 0 to 16

In shortPick the answer closest to your program today. Eight questions score 0 to 2; the last is for reflection. The meter adds up your score as you go, and each question says why it matters and what a strong answer sounds like.

Next step for your partner program: explore, pilot or implement

Before a vendor demo: sixteen questions about tapes, grids, decline letters, live ads and evidence

In shortAsk every vendor the same questions, us included. The answers show whether a tool tests each partner's actual decisions, prices, notices, complaints and ads, or stores due diligence documents and the partner's own reports: what it reads, what it tests, how it finds change, what evidence you keep, and who decides.

Start with your largest partner: thirteen closed weeks charted, then four live weeks beside your current review

In shortSecure the data first, then chart thirteen closed weeks and four live weeks of your largest partner beside your current review, then decide with four numbers. None of these steps commits you to a vendor.

1. Write down your program: the current grid, credit policy, approved model versions, notice wording and approved ads for one partner.
2. Ask for the evidence: thirteen weeks of tapes with reason codes and model version, the notices as sent, complaint logs and live ad samples.
3. Chart the past: thirteen closed weeks, and compare with what your last review found.
4. Run live in parallel for four weekly cycles, with your manager deciding every finding.
5. Decide with four numbers: findings each method found, hours per cycle, days from tape to decided finding, and evidence an auditor can re-perform.

Findings found, coverage and days to a decided finding

Sponsor bank compliance FAQ: partner liability, testing frequency, true lender, Colorado and the 2026 proposal

In shortThe questions sponsor banks, fintechs and auditors ask most about partner oversight, each answered on its own.