The Federal Deposit Insurance Corporation has issued consent orders against Piermont Bank, headquartered in New York City, and Sutton Bank, based in Attica, Ohio, for failures in the oversight of their banking-as-a-service programmes. Both orders were issued in February 2024 and found that inadequate third-party risk management and Bank Secrecy Act and anti-money laundering controls had exposed the institutions to unsafe and unsound banking practices. The orders concern the bank-fintech partnership model, in which community and mid-tier banks provide chartered banking services to fintech companies that distribute products under the sponsoring bank's licence.
PIERMONT BANK CITED FOR UNSAFE PRACTICES
Piermont Bank was found by the FDIC to have engaged in unsafe and unsound banking practices related to the oversight of its BaaS programme. The consent order requires the bank to address deficiencies in how it supervises its fintech partners' customer-facing activities, including controls governing the onboarding of end customers and the ongoing monitoring of transactions conducted through the BaaS infrastructure. Piermont is a digital-first institution established to serve small and medium-sized businesses.
SUTTON BANK AML REQUIREMENTS
The FDIC directed the Ohio institution to implement a revised AML and counter-financing of terrorism programme within 180 days, covering all fintech partnerships within the bank's BaaS portfolio. The bank is also required to designate individual programme managers for each fintech partnership, with those managers responsible for overseeing know-your-customer procedures, transaction monitoring systems, independent testing, and suspicious activity report filing across their assigned programme.
The order additionally requires Sutton Bank to conduct a lookback review of all prepaid card customers onboarded since 1 July 2020 to verify true customer identities and ensure compliance with its Customer Identification Programme requirements. Both consent orders are publicly available through the FDIC's enforcement actions database.