Identity theft red flags rule vendor management for fintech partners

Identity theft red flags rule vendor management is the part of a bank's Identity Theft Prevention Program that covers the service providers who open or service its accounts, and at a sponsor bank the biggest of those are fintech partners whose apps open checking accounts in the bank's name. The rule makes the bank "Exercise appropriate and effective oversight of service provider arrangements" (12 CFR 41.90(e)(4)), and the agencies have said the duty exists so that the bank stays responsible "even if it outsources one or more of its account opening or access activities". In practice the partner does the first look at each applicant, while the bank needs each partner's opening data, a way to see across partners, notice windows written into each agreement, and a rule that nothing about a suspicious activity report ever leaves the bank. Botminds' New Account Fraud Detection is built for that seat: it re-reads each partner's opening files, links accounts across partners and drafts the notices each agreement requires.

The examples use the solution's sample data. Tessaly Community Bank, its 14 fintech partners and their customers are fictional.

Does the red flags rule apply to fintech partners?

Not directly in most sponsor-bank programs; it applies to the bank, and through the bank to the partner's work. The rule binds "financial institutions" and "creditors", and every bank is a financial institution under it. A fintech whose app opens the bank's accounts is, for the bank, a service provider, defined as "a person that provides a service directly to the financial institution or creditor" (12 CFR 41.90(b)(11)). The 2009 interagency FAQs name this case almost word for word: a service provider "that provides an online banking platform permitting account opening or access" is providing services related to covered accounts, and the bank "should take steps to ensure that the activities of such service providers are conducted in accordance with reasonable policies and procedures designed to detect, prevent, and mitigate the risk of identity theft" (Frequently Asked Questions: Identity Theft Red Flags and Address Discrepancies, 2009).

So the question a partner risk manager should ask is not whether the partner is covered, but whether the bank's program can show, for every account the partner opened, that red flags were detected and answered. If the partner's own program is good, the bank may lean on it; the FAQs say the oversight requirement "does not require a service provider to have the same Program", but "a financial institution or creditor must still maintain its own Program".

Who is responsible for identity theft prevention when a partner opens accounts?

The bank. That answer recurs across three sets of guidance. The Red Flags FAQs say the oversight obligation "is intended to ensure that the financial institution or creditor is responsible for complying with the Red Flags Rules, even if it outsources one or more of its account opening or access activities to a third-party service provider". The 2024 joint statement on deposit products delivered through third parties, from the Federal Reserve, FDIC and OCC, lists the compliance functions partners commonly perform, including "customer identification programs, customer due diligence", and concludes: "Regardless of whether the functions are shared between the bank and the third party, the bank remains responsible for failure to comply with applicable requirements" (Joint Statement on Banks' Arrangements with Third Parties to Deliver Bank Deposit Products and Services, July 25, 2024). The general third-party guidance says the same in its own terms; the interagency guidance on third-party relationships is covered in its own series.

The customer identification rule makes the point sharper. A bank may rely on another institution's identity checks only if that institution "is subject to a rule implementing 31 U.S.C. 5318(h) and is regulated by a Federal functional regulator", under a contract and annual certification (31 CFR 1020.220(a)(6)). A fintech app that is not itself a regulated financial institution does not meet that test, so when it collects identity data it does so for the bank, and the bank's program owns the result. What a sponsor bank is, and why it carries this, is explained elsewhere on the site.

Does the red flags rule require a written contract with service providers?

No, but every sensible program uses one. The FAQs answer the question directly: the rules "do not specifically require the financial institution's or creditor's oversight of the service provider to be maintained through a written contract". The interagency guidelines then suggest the contract as the obvious tool: a bank "could require the service provider by contract to have policies and procedures to detect relevant Red Flags that may arise in the performance of the service provider's activities, and either report the Red Flags to the financial institution or creditor, or to take appropriate steps to prevent or mitigate identity theft" (Appendix J to 12 CFR part 41, section VI(c)).

The choice in that sentence, report the flags or act on them, is the design decision of a partner program. A partner that acts on its own, closing accounts in its app without telling the bank, leaves the bank blind to rings that cross partners. A partner that only reports leaves the bank doing all the work at the speed of a feed. Most agreements need both, divided by type of flag and written down.

What should a partner agreement say about fraud?

Five things: what data the partner sends and when, which flags the partner acts on and which it only reports, how fast each side must tell the other, who may tell the customer what, and how performance is measured. The last deserves care. The 2023 interagency third-party guidance warns against "encouraging processing volume or speed without regard for accuracy, compliance requirements, or adverse effects on the banking organization or customers" (Interagency Guidance on Third-Party Relationships: Risk Management, 2023). A partner paid per funded account, measured on approval speed, has every reason to send thin files.

What reports should a partner send the bank?

The FTC's guide to the rule lists the options plainly: "Other ways to monitor your service providers include giving them a copy of your program, reviewing the red flag policies, or requiring periodic reports about red flags they have detected and their response" (FTC, Fighting Identity Theft with the Red Flags Rule). The guide is written for businesses under the FTC's jurisdiction, but the rule text it explains is the same as the banking agencies'. For new accounts, periodic is not enough on its own: the bank needs the opening files continuously and the summaries monthly.

Can a fintech partner see a SAR?

No, and a well-run program makes sure a partner cannot infer one. The SAR rule forbids a bank and any "agent" of the bank from disclosing a SAR or anything that would reveal one; what it allows is sharing "The underlying facts, transactions, and documents upon which a SAR is based" for specified purposes (31 CFR 1020.320(e)). The safe line for a partner notice is therefore facts and actions: which accounts are restricted, what the partner must do in its app, what the customer may be told. Never whether, or that, the bank's BSA team is looking.

The risk is not malice; it is a sentence written in a hurry. In the sample, the notice agent drafted Fernway's notice under section 7.3 of its agreement and struck one line before anyone approved it: "The accounts have also been referred to our BSA team for review." The fintech partner risk manager sees the internal draft with the strike; Fernway's portal shows only the cleaned notice, and only the partner risk manager can approve and send it.

The partner notice: what Fernway sees, and the sentence it never receives

How a sponsor bank oversees new account fraud, partner by partner

With a few measures per partner, read every month and acted on when they move. The sample bank's partner screen shows each of its 14 partners with openings, the share that reached review, restrictions, file quality against the agreement, feed status and notices owed. Fernway, the largest, opened 1,412 accounts in October; 71, or 5.0%, reached review; and its files were missing the device identifier on 12% of openings, a field section 4.2 of its agreement requires. That last number matters more than it looks: without the device, the link agent cannot connect a Fernway account to a ring at another partner.

A restriction rate is not a quality grade on its own. A partner with a high rate may attract more fraud, or may simply send the bank better data so more of its fraud is found; a partner with a low rate may be clean, or blind. Read it beside file quality and the feed, and beside how many of each partner's restrictions were later reversed.

Fourteen partners on one screen: file quality, feed and notices owed

When a partner's feed goes quiet

A late feed is a fraud risk, not just an operations ticket, because accounts keep opening while the bank cannot read them. The 2024 joint statement names "Lack of access to records" as a risk in deposit arrangements with third parties, where the bank lacks access to "the deposit and transaction system of record and other crucial information and data maintained by the third party". In the sample, Tidewell's files, expected every 15 minutes, stopped arriving at 4:10 am. The 22 accounts opened since were held in restricted funding until their files arrived and were re-read, and the partner risk manager's screen offered to retry the feed or notify the partner.

That rule, no file, no funding, is the bank's choice, not a regulatory requirement, and some programs will set it differently. What a program cannot do is let accounts it cannot see behave like accounts it has checked. The red flags rule in banking page sets out the program those duties sit in; the program template shows where the service provider section goes. To see the partner screen on your own program, start from New Account Fraud Detection.

Questions people ask

Does the partner need its own identity theft prevention program?

Not under the banking agencies' rule, unless it is itself a financial institution or creditor. The bank may use a partner that has its own program "as long as the service provider's Program is sufficient to meet the financial institution's or creditor's obligations", in the agencies' words, but the bank must still keep its own program, including oversight of the partner.

What is service provider oversight under the red flags rule?

It is the fourth administrative duty in 12 CFR 41.90(e): the bank must exercise appropriate and effective oversight of any service provider that performs an activity in connection with covered accounts. It is not limited to fraud detection vendors; it covers anyone opening accounts, providing account access or servicing them on the bank's behalf.

How should the annual report to the board cover partners?

The interagency guidelines list "service provider arrangements" among the issues the annual compliance report should evaluate. For a sponsor bank that means each partner's file quality, flags detected and responses, restriction and reversal rates, and any partner whose onboarding changed during the year.

Can a partner close an account itself?

If its agreement allows, a partner can stop service in its own app, but the account is the bank's, and the bank decides on restriction, closure and funds. A closure by the partner that the bank does not hear about promptly breaks the bank's view of rings across partners and its SAR timing.

How fast should a partner be told about a restriction?

As fast as its agreement says, and the agreement should say it in business days. In the sample, notice windows are one or two business days depending on the partner, and the solution escalates to the partner risk manager when half the window has passed without approval.