Why are third party products a UDAAP concern? The partner's screen

Third party products are a UDAAP concern because the law treats what a partner does on the bank's behalf as the bank's own conduct, while the partner, not the bank, designs the screens, writes the marketing and changes both at its own pace. A fintech app offering the bank's deposit account can promise "always free", fold its fees out of sight or make closing harder than opening, and the unfair, deceptive or abusive practice is the bank's to answer for. The risk is growing: complaints to the FDIC involving third-party providers rose by nearly half in 2025. And it is hard to see, because the bank usually reviews what the partner sends rather than what customers meet. Botminds' UDAAP Risk Assessment was built for sponsor banks in that position: its agents walk the partner's staging app as a customer would, test every claim against the account agreement, the fee schedule and the program agreement, and pin each risk on the partner's screen for the bank's compliance officer to decide.

"[T]he bank remains responsible for the actions or omissions of a third party conducting activities on the bank's behalf."

OCC Comptroller's Handbook, UDAP and UDAAP, v1.1

Is a bank liable for a fintech partner's marketing?

Yes, for products offered through it. The OCC's handbook says compliance risk "can increase when a bank offers products or services through, or outsources origination, servicing, or operational processes to, third parties", naming "financial technology partners" among them, and that "The bank is responsible for clear and accurate disclosures even when disclosures are prepared by a third party" (OCC Comptroller's Handbook, UDAP and UDAAP). The FDIC's procedures, updated in October 2025, give the deceptive version as their first example of third-party compliance risk: "some third parties may engage in product marketing practices that are deceptive in violation of Section 5 of the Federal Trade Commission Act" (FDIC Consumer Compliance Examination Manual, VII-4).

The CFPB's last full supervisory report before its 2025 change of course shows how the reasoning runs. Buy now, pay later lenders' merchant partners advertised incorrect loan costs. "The lenders exercised control and approval rights over these advertisements. Thus, the lenders engaged in a deceptive act or practice when its merchant partners ran advertisements on their behalf that included false representations." The fix included refunds and an enhanced "marketing review process across merchant partners" (CFPB Supervisory Highlights, Issue 37). A sponsor bank whose program agreement gives it approval of every partner screen is in the lenders' position.

"In many of these arrangements, the third party is positioned directly between the financial institution and the customer and is closely involved in product and service delivery, often with unfettered access to consumers."

Federal Reserve, Consumer Compliance Outlook, 2015

What does the third-party guidance say about consumer protection?

That the bank's duties do not shrink when a third party performs the work. The interagency guidance of June 2023, still in force, holds a bank exactly as responsible for an activity a third party performs as if the bank had done it in-house (the interagency guidance on third-party relationships sets out the whole framework). It makes clear that the requirements include "prohibitions against unfair, deceptive or abusive acts or practices" (Interagency Guidance on Third-Party Relationships, 88 FR 37920).

On September 15, 2026, the OCC, the Federal Reserve, the FDIC and the NCUA proposed to rescind and replace that guidance, the 2024 joint statement on bank-fintech deposit arrangements and the 2024 community bank guide, saying the 2023 text "frequently has been interpreted in an overly broad manner." Comments close on November 16, 2026. The proposal keeps the core line, in almost the same words, adding that it applies "including where the third-party relationship involves affiliates, service providers that are themselves highly-regulated entities, or subcontractors." It also says partner relationships "may raise additional consumer compliance considerations that may be relevant to, but that are not directly addressed in, this proposed guidance" (Proposed Third-Party Risk Management Guidance, 91 FR 58536). Lighter process expectations, in other words, do not move UDAAP responsibility off the bank.

How many complaints involve third parties?

More every year, on the FDIC's count. "One or more third-party providers (TPPs) were identified among 6,356 consumer complaint cases in 2025, representing nearly a 48 percent increase from 2024 when 4,282 complaints involved one or more." The FDIC defines a TPP as a non-bank company performing services on behalf of banks, "such as credit card servicing and processing, payment processing, and transaction error dispute resolution", and it found a violation of a federal consumer protection regulation in 34 of those cases (FDIC Consumer Compliance Supervisory Highlights, March 2026).

Complaints are also how the 2023 guidance expects banks to watch partners: its monitoring list includes "The volume, nature, and trends of customer inquiries and complaints, the adequacy of the third party's responses ... and any resulting remediation." The Federal Reserve's staff add a planning point: institutions "utilizing fintech products or offering deposit accounts with higher-risk add-on features ... should explicitly include them in their risk assessment" (Consumer Compliance Outlook, 2023).

Can a fintech say it is FDIC insured?

Only with care, and the rule is the FDIC's own. Under subpart B of Part 328, a non-bank that says a product is insured misrepresents deposit insurance unless it names, clearly and conspicuously, the insured bank or banks that hold the deposits (12 CFR 328.102(b)(5)(i); the rule's text and the FDIC's demand letters are quoted in the not FDIC insured disclosure guide). In January 2024 the FDIC demanded that five entities stop implying that they were themselves insured and "failing to clearly identify the insured depository institutions with which they have a relationship for the placement of customer deposits" (FDIC, January 2024).

Take a sample journey to see how quietly it happens; the companies are fictional. Fernway, a fintech partner of Tessaly Community Bank, ran an ad in version 2 that ended "Banking services provided by Tessaly Community Bank, Member FDIC." Version 3 says only "FDIC insured." Nothing else on the ad changed. A review of the partner's description of the change would not have caught it; a screen-by-screen comparison did, and the note was rated deceptive, Medium.

How do banks review fintech partner apps?

Most review what the partner sends: a screen deck, a staging link, a description of what changed. The stronger method is to walk the partner's actual build, as a customer, and compare it with the version the bank approved. The OCC's principles for new products warn that inherent risk "may be elevated when using turnkey and white label products or services that are designed for minimal involvement by the bank", and that "management should not overly rely on the service provider's assertions" (OCC Bulletin 2017-43).

UDAAP Risk Assessment for sponsor banks: every partner, its journeys, notes and complaints

The last oversight review found nothing in March 2026; the problem arrived with a version change in October, which is why changes trigger reviews.

How often should partner journeys be reviewed?

On every change, and on a schedule set by the partner's risk. The sample bank reviews each partner on a cycle by tier, with Fernway's next oversight review due in March 2027, but the schedule is the backstop. The trigger that matters is a new version: in October 2026 Fernway submitted version 3 of a journey approved in September, with a new headline, a folded fee list, a paid default and a phone-only close. Five of ten screens had changed; those five were reopened.

Complaints are the third trigger, and the cheapest. In the sample settings, five complaints on one theme within 30 days reopen a launched partner journey. On the sample complaint screen, 14 customers of another partner, Ollarby, said a savings product's monthly fee went up without notice, pointing to a pricing screen that still showed the old fee; the review reopened on October 14.

Who approves a partner's marketing, and what does the partner see?

The bank approves, under the program agreement; one named person sends the result. The FDIC's procedures ask examiners to check due diligence on "Marketing materials to determine how the institution's name will be associated with the product" and the partner's websites, and whether the board approves material third-party arrangements before the bank enters them (FDIC manual, VII-4).

In the sample review, the compliance officer required five changes and accepted one risk with a condition; the chief compliance officer signed. The Fintech Partnership Program Manager then sent change request CR-26-117-01 through the partner portal, and Fernway's product lead acknowledged it, with an answer due a week later. The partner sees each change, the reason in plain words and the clause behind it. It never sees the bank's ratings, the agents' readings, reason codes or any confidential flag.

Required changes sent to the partner in words its designers can use

Where UDAAP Risk Assessment fits in third-party oversight, and where it does not

The solution covers the customer-facing part of partner oversight: the journeys, the claims, the fees, the exits and the complaints, partner by partner, with each partner's journeys, open notes, complaints, tier and next review on one screen beside its program agreement clauses. Its examiner pack includes the third-party oversight evidence for each journey: the clauses tested, the last oversight review and the complaint path.

It is not a full third-party risk management system. Financial condition, information security, BSA/AML controls, business continuity and contract negotiation stay with the bank's vendor and partner management program. How the partner's risks are scored is set out in the UDAAP risk assessment matrix, and the screen designs partners most often get wrong in dark patterns in banking apps. To walk one of your partners' journeys, start from UDAAP Risk Assessment.

Questions people ask

Does the September 2026 proposal change who is responsible for UDAAP?

No. The proposal would replace the 2023 guidance with a more tailored, risk-based approach, but it repeats that a bank's use of third parties does not diminish its responsibility, and says consumer compliance considerations are relevant though not directly addressed. Comments close November 16, 2026; until a final version, the 2023 guidance stands.

Can a bank rely on a fintech partner's own compliance review?

Partly, if it has tested that review. The OCC's risk-management worksheet rates oversight as strong when due diligence includes "assessing the appropriateness of the third party's compliance program and whether the bank can rely on the third party's program". Reliance is a conclusion the bank reaches and documents, not a default.

What is the risk of a white-label or turnkey product?

The OCC says inherent risk may be elevated for turnkey and white-label products "designed for minimal involvement by the bank in administering the new activities." The less the bank touches the product day to day, the more its review of the customer's journey has to carry.

Should a sponsor bank collect complaints made to its partners?

Yes. The 2023 guidance suggests contracts that give the bank "prompt notification from the third party of any complaints or inquiries received by the third party" where the bank is responsible for responding, and the OCC expects complaint analysis across third parties and channels.

Do the same UDAAP standards apply to a partner's screen and the bank's own?

Yes. The tests are the same; what differs is control. The bank designs its own screens, while a partner's change can reach customers without the bank seeing it, which is why version comparison and complaint mapping matter more for partners.