Third-Party Risk Manager vs. Partner Oversight Manager, Seat by Seat

“Third-party risk manager” is one job title covering at least four different jobs at a sponsor bank with fintech lending partners, and the confusion is understandable: the title was built for managing vendor contracts, not for a bank whose fintech partners decide thousands of consumer loan applications a week under its charter. At a sponsor bank, fintech partner oversight is not a single analyst role sitting between the bank and its vendors. It is a weekly test run by one seat, signed off by a second, fed to a third when fraud is involved, and audited by a fourth — and every one of those seats keeps its job once software starts doing the testing.

The working example below is Brannock Valley Bank, a fictional sponsor bank with six fintech lending partners and $1.84 billion outstanding, as it runs through Botminds' Fintech Partner Oversight. Its people, its partners and its numbers are invented to show how the four seats actually divide the work; the regulatory language is real.

Why “third-party risk manager” is really four jobs at one sponsor bank

A generic third-party risk manager at most companies tracks vendor contracts, due-diligence questionnaires and renewal dates. At a sponsor bank, the fintech partner is not a vendor the bank buys software from; it is the originator of loans the bank's own charter stands behind. The Federal Deposit Insurance Corporation, the Office of the Comptroller of the Currency and the Federal Reserve say plainly who answers for that work: “A banking organization's board of directors has ultimate responsibility for providing oversight for third-party risk management and holding management accountable” (Interagency Guidance on Third-Party Relationships, 2023). A board cannot test loan tapes itself, so it delegates the work downward — and it delegates different pieces of it to different seats, because the skills do not overlap. Reading a credit model's cash-flow band is not the same job as deciding whether a decline notice is lawful, and neither is the same job as deciding whether a pattern of shared devices belongs in a Bank Secrecy Act referral.

One title, used loosely, hides that split. A “third-party risk manager” job description posted by a regional bank might describe someone who only reviews due-diligence files at onboarding, never touches a live loan tape, and never sees a complaint log. A “third-party risk management analyst” posting at a bank with fintech partners can describe someone who reconciles weekly files for a living. The words are close enough that a candidate, or a reporter, or a new compliance hire reading both will assume they are the same role. They are not, and the difference is exactly the four seats below.

What does a fintech partner oversight manager decide every week?

At Brannock Valley Bank the seat belongs to Dana Okafor, VP of Fintech Partner Oversight, who covers six partners and $1.84 billion outstanding with two analysts. Her week starts with a chart, not a questionnaire: every partner's tests run against its own control limits, and she opens whichever point lands outside them. On the Monday this guide follows, Fernquill's tape arrived late at 08:52 with 4,918 decisions, and by 09:14 one line — the share of funded loans priced above the program grid — had jumped from a centre of 0.3% to 18.5% on the Tuesday before.

Her decisions are not about whether a rule was broken; the tests already say that. Her decisions are about what to do next: which findings to accept, who to assign them to, and which ones are serious enough to escalate past her own desk. “I find out a partner changed its model when the complaints arrive” is how she describes the job before agents test every loan; afterward, she sees the signal the same week it starts, opens the 212 loans behind it, and decides whether Fernquill's explanation holds up. That decision — judgment on a tested fact, not detective work to find the fact — is the oversight manager's seat, and it is the one a generic TPRM job description never quite captures, because a vendor questionnaire has no equivalent of a control chart jumping in week two.

The chief compliance officer's seat: signing what the oversight manager found

Martin Ayres, Brannock Valley's Chief Compliance Officer, chairs the Partner Risk Committee and owns the exam relationship. His seat is not testing; it is accountability for the testing's consequences. When Dana escalates Fernquill's three High findings — the mismatched decline notices, the unapproved credit model and the mispriced loans — it is Martin's signature that goes to the committee, with a recommendation: return to the prior model unless the new one is approved by a set date, correct the notices, reprice the loans, and test daily until the score recovers.

“If the examiner finds it before we do, that's a finding about us,” is how he frames the job, and the Cross River Bank consent order shows what happens when that framing is missing: the FDIC found the bank had been “failing to establish and maintain internal controls, information systems, and prudent credit underwriting practices” for its fintech partnerships, and the order's remedy was a written non-objection requirement before any new partner or credit product. A chief compliance officer's seat exists precisely to be the person who caught the problem first — what that consent order required, line by line, is a case study of what a sponsor bank looks like without one.

Where the BSA officer's seat begins and the oversight manager's ends

Lucia Ferreira, the BSA and fraud officer, owns a narrower but sharper slice of the oversight desk: anything that could be a filing decision. Before agents, she worked from each partner's own summary of fraud and OFAC screening — “show me the accounts, not the partner's summary” is her complaint about that arrangement. Now the BSA and fraud monitor agent hands her referrals with the accounts already attached, such as 38 Pocketrise accounts sharing four devices, and she decides herself whether a Suspicious Activity Report is warranted.

The line between her seat and Dana's is not about severity; it is about subject matter. A mispriced loan or a wrong decline reason stays with the oversight manager, because it is a lending-compliance question the bank's own policy answers. A pattern of shared devices or screening gaps goes to the BSA officer, because only she can decide on a filing, and no agent may make that decision for her. The FDIC's supervisory highlights make the same point about where evidence first shows up: among the practices it lists for overseeing a third party's marketing is “reviewing complaints or inquiries from the third party as these can be the bank's first indicator of compliance issues.” Evidence has to reach a person who can act on it, and which person depends on what kind of action is possible.

The internal auditor who tests the testers, not the partner

Ray Takahashi's seat, internal audit, is deliberately read-only. He does not test Fernquill's loans, and he does not decide what happens to a finding. His job is to test the oversight program itself twice a year: did the tests that were supposed to run actually run, is the evidence dated, and does every finding carry what it rests on. “I need dated evidence for every test you say you ran” is the standard he holds the desk to, and it is also what an examiner asks for.

This is the seat a generic third-party risk manager job description almost never separates out, because most companies do not have a dedicated internal-audit function testing their vendor-management program specifically. At a sponsor bank it matters more, not less, once testing is automated: a chart that updates itself every Monday is only trustworthy if someone independent of the oversight manager can confirm it actually ran, on the right data, every week. On the morning this guide follows, Ray's exam pack showed 45 of 48 evidence items current — 94% — with three named gaps: two Hearthway findings past due and one committee minute outstanding. Read-only does not mean passive; it means his seat exists to check the other three, not to join them.

What does the partner's own team see and do?

The fifth seat belongs to the partner, not the bank, and it is easy to leave out of an oversight org chart entirely. At Fernquill, that seat is Jordan Pike, Head of Bank Partnerships, whose job before agents was answering the bank's requests after the fact: “tell me exactly what to fix and by when” is how he puts the gap. Once Dana accepts a finding, Jordan sees it, its evidence and its due date in the partner portal the same morning — the unapproved model, the 412 applicants needing corrected notices, the 212 loans to reprice, the ad to take down.

This seat changes the oversight relationship from adversarial to operational. A partner that only hears from the bank during the next quarterly review has every incentive to treat each finding as a negotiation. A partner that sees findings land with evidence attached, the same week they are caught, treats them as a to-do list instead — not because the relationship got friendlier, but because there is no ambiguity left to negotiate over.

How a sponsor bank's org chart compares with a generic TPRM team

A general third-party risk management team is usually organized around the relationship, not the output: one analyst per vendor or per category of vendor, escalating to a manager when a contract issue or a security questionnaire fails. A sponsor bank's fintech oversight desk is organized around the kind of evidence, because that is what determines who can act on it. Loan-level pricing and underwriting findings go to the oversight manager. Anything that could become a filing goes to the BSA officer. Anything serious enough to change the relationship goes to the chief compliance officer. And whether any of that actually happened, on schedule, with evidence, is internal audit's question alone.

That difference explains why a job posting titled “third-party risk manager” at a sponsor bank can mean something much narrower, or much broader, than the same title at a company managing office-supply vendors. What a sponsor bank actually is, and why its charter is the reason this structure exists at all, is the subject of its own guide.

The oversight manager's seat: every partner on its own control chart

What changes in each seat once the testing runs itself

None of the four seats disappears when agents take over the testing, and that is worth saying plainly, because “AI for compliance” is often pitched as headcount reduction. What changes is the proportion of each week spent finding problems versus deciding about them. Dana's two analysts no longer spend days sampling loans in spreadsheets; they spend the time opening what a chart already flagged. Martin signs escalations with evidence attached instead of chasing down what happened. Lucia gets referrals with the accounts named instead of working from a partner's own summary. Ray reads a pack that updates itself instead of rebuilding one from scratch twice a year.

The oversight reporter agent that drafts scorecards, findings and the examiner pack is deliberately barred from the one thing that would collapse these seats into one: it never accepts, closes or escalates an issue itself. What happened when a sponsor bank's partner held the only record of who owned which deposit is a case where no seat was watching closely enough, and it is the clearest public argument for keeping these four jobs distinct rather than compressing them into a single automated check.

What the Chief Compliance Officer signs

Questions people ask

What does a third-party risk manager do?

At most companies, a third-party risk manager tracks vendor relationships: due-diligence questionnaires, contract renewals and risk ratings at onboarding. At a sponsor bank with fintech lending partners, the title can instead mean the person who runs the weekly test of a partner's actual loan decisions, notices, complaints and ads — a different and narrower job than the title suggests elsewhere.

What is a partner oversight manager, and how is it different from a generic third-party risk manager?

A partner oversight manager owns the weekly cadence of testing a fintech partner's loan-level output against the bank's own program and policy, and decides what to do with what the tests find. A generic third-party risk manager more often owns the relationship's paperwork — the contract, the questionnaire, the renewal date — without testing the partner's underlying transactions at all.

Who is responsible for fintech partner oversight at a bank?

No single person. The Interagency Guidance on Third-Party Relationships puts ultimate responsibility with the board of directors, which delegates the work to at least four seats in practice: an oversight manager who tests and decides week to week, a chief compliance officer who signs what gets escalated, a BSA officer who owns fraud and sanctions referrals, and internal audit, which tests whether the first three are actually doing their jobs.

What does a BSA officer do in fintech partner oversight?

The BSA officer reviews referrals tied to potential money-laundering, fraud or sanctions risk in a partner's data — such as accounts that share devices or identities — and decides whether a Suspicious Activity Report is warranted. That decision belongs to the BSA officer alone; an oversight tool may flag the pattern, but it may never file on a bank's behalf.

Does compliance or risk own fintech partner oversight?

In practice, both, divided by subject matter rather than by department label. Lending-compliance questions — pricing, underwriting, adverse action notices — usually sit with an oversight or compliance function reporting toward the chief compliance officer. Anti-money-laundering and fraud questions sit with the BSA officer, who may report through a separate line. Which department each seat sits in varies by bank; which question it answers does not.

How many people work in bank compliance?

The Bureau of Labor Statistics counted 436,400 compliance-officer jobs across the U.S. economy in 2025, a category that includes the oversight managers and analysts described in this guide as well as compliance staff with no third-party or fintech responsibility at all — the government does not track “fintech partner oversight” as its own separate occupation.