Compliance in banking

In recent months, banking-as-a-service has been subject to regulatory scrutiny, leading banks to offboard their fintech partners and move away from the business model.

Lineage Bank, for example, in February, received a consent order from the Federal Deposit Insurance Corp. and agreed to implement an enhanced risk management program overseen by its board of directors, increase capital levels and let go of some fintech partners, including Synctera.

Synctera, a BaaS platform that helps bridge the gap between fintech companies and sponsor banks, recently raised an $18.6 million extension to its 2021 Series A round. In March 2023, the fintech announced a $15 million investment led by NAventures, the corporate arm of the National Bank of Canada, to expand its offerings in Canada followed by its first Canadian customer launch in December.

Since its inception during the pandemic in 2020, the San Francisco-based fintech has grown to include nine sponsor banks.

“When we first met with the Lineage team, they were a super innovative crew that had hired a tech team and a compliance team from day one. As we were getting into the market, having an alignment on how to build a relationship was important, just like any relationship in business,” CEO Peter Hazlehurst said. “And like every early-stage company like us, you’re always looking for that first partner, and that for us was Lineage.

Speaking to Banking Dive from the Fintech Meetup in Las Vegas, where he shared the stage with Kevin O’Leary of “Shark Tank” fame, Hazlehurst, former head of Uber Money, discussed bank-fintech partnerships and their challenges, how banks can avoid being under the regulatory radar, third-party and fintech partnerships, and Synctera’s relationship with Lineage Bank.

Editor’s note: This interview has been edited for clarity and brevity.

 

BANKING DIVE: Why do banks like Lineage get hit by consent orders, though they have teams that investigate risk management?

Hazlehurst: Each bank’s circumstances are different, and I don’t think you can say there’s a standard reason why things didn’t work out the way they expected. The general advice we give to our sponsor banks is if you want to go into banking as a service, you have to really commit and have a great team with a deep understanding of what they’re doing and how it’s working; you want to try and keep things as simple as possible. So, you don’t want to have 50 fintechs but have one or two a month at most, that you’re working with and bringing on board. [Also] where we see the most ability to help make things safer and secure or more regulatory compliant, is by coaching and giving advice on how to structure the relationships ... between the bank and the fintech, and making sure that we’ve got the technology to help the bank provide the right level of oversight over the fintech’s activities.

 

BANKING DIVE: What things should banks keep in mind when going for a fintech partnership?

Hazlehurst: The best thing they can do is set up a good plan for how to build the business — just like any startup, or any new line of business at a bank, having a really good understanding of the costs, the economics, the team, the structure, the checks and balances is really important.

The challenge, though, is that if you’re a three- or four-branch bank and you grow at like 100 customers a week and you onboard a fintech that grows at 1000 customers a day, all of your processes don’t scale. And that’s when you need companies like Synctera to give you the technology to do the oversight that you would have done by hand before. The best compliant banks have really efficient technology that helps them scale up much more adequately than if they were just doing branch operations.

 

BANKING DIVE: How does the BaaS landscape look like, right now? And what do you think we should expect to see in the future?

Hazlehurst: I will say that the concepts of BaaS have been around for quite some time. It’s not like something that just came out last month, six months, or 12 months ago. So, think of BaaS effectively as a mini core banking system that sits on the side of the bank’s regular core and helps write an infrastructure for everyone to share the technology — none of that’s particularly brand-new. BaaS as a technology stack is akin to our job to help all sides of the ecosystem have a better way of managing transactions, account balances, risk, fraud and so on. This technology has existed in core banking systems for 50 to 70 years. We’re just modernizing it, making it more contemporary for easier accessibility to new types of companies that want to add these services ... But it doesn’t change anything about how banking works. It just makes it easier to get started.

 

BANKING DIVE: What is your take on regulators’ guidance on third-party/fintech partnerships?

Hazlehurst: The more clarity and definition we can get from the regulators on what they actually want to see and do is awesome. The challenge we have is it’s still unclear what steps are needed to be performed at every stage … In reality, this area and the reason there’s so much opportunity in this space is there’s a lack of clarity of what is required. So, when the Consumer Financial Protection Bureau, the Office of the Comptroller of the Currency, the Federal Reserve, or the FDIC comes along and says this is what we think — that’s great! 

[But] most importantly, we need all of those regulatory organizations to agree on the same set of rules. So that, a bank that’s organized under the Fed versus a bank that’s under state law and under the FDIC, they have the same set of parameters by which they’re evaluated, which will then stop what is called regulatory arbitrage of jurisdiction that’s working to launch a product because that just encourages people to find flaws in the ecosystem.

TD has a new chief compliance officer.

Erin Morrow, who joined the Canadian lender from Citi in January, is taking on the role after TD’s previous chief compliance officer, Monica Kowal, left the bank July 2, TD said in an internal memo seen by The Globe and Mail.

The memo did not detail the reasons behind Kowal’s departure. The bank declined to comment on the matter to The Globe and Mail or Reuters.

This means two of the three highest-ranking executives assigned to address deficiencies in TD’s regulatory compliance management framework have left the bank in a matter of days.

Kowal was overseeing remediation on the framework, alongside Denise Morris, a vice president of compliance at the bank, and Emily Jelich, head of compliance at TD Securities, The Globe and Mail reported in May. Jelich retired at the end of June.

TD’s executive switch-up in compliance comes at a critical time for the bank, which faces investigations by three U.S. regulators, the Justice Department and Canada’s Office of the Superintendent of Financial Institutions.

The OSFI ordered TD to fix deficiencies in its regulatory compliance management framework, which the agency found during a recent assessment, The Globe and Mail reported in May. Earlier that month, The Wall Street Journal reported TD is under investigation after Justice Department agents found that criminals used the bank in efforts to launder at least $653 million tied to the drug fentanyl.

TD set aside $450 million in 2024’s first quarter to cover potential penalties from one of the three U.S. regulators investigating the bank’s anti-money laundering systems. (The bank added another $2.6 billion in set-asides in the second quarter.) Analysts have estimated TD’s fines in the matter could total $4 billion, according to Reuters.

Morrow reports to Ajai Bambawale, TD’s chief risk officer.

“A seasoned and respected leader, Erin has more than 20 years of experience in compliance, audit, and risk management,” Bambawale said in the memo, dated June 28. “She has extensive experience working in complex organizations with a global footprint, which will serve her well in this role.”

Morrow “has already made a significant impact within the compliance organization and across the bank, including building the compliance transformation team,” Bambawale added.

Morrow came to TD as deputy chief compliance officer after more than 10 years at Citi — serving as chief auditor, then chief compliance officer for the New York City-based lender’s global consumer bank, and finally chief of compliance testing, according to her LinkedIn profile.

Kowal, meanwhile, leaves TD after nearly seven years — first as a compliance executive in wealth management, then adding other responsibilities before assuming the chief compliance officer role in 2022. Prior to joining TD, she served as general counsel, then vice chair of the Ontario Securities Commission, according to her LinkedIn profile.

Kowal “played a key role developing strategies to mitigate regulatory compliance risks and providing advice, thought leadership and guidance on a broad range of regulatory compliance considerations,” Bambawale said in the June 28 memo.

TD executives said the bank had spent about C$500 million ($366 million), as of May, on hiring, technology and enterprise-wide training, as part of a “comprehensive overhaul” of its AML program in the U.S.

Capital One is bracing for a “significant” undertaking in resolving compliance issues at Discover as it plans its $35.3 billion acquisition of the card network company, the bank’s CEO, Richard Fairbank, said in February.

“We are making the assumption this will be a really significant amount of work,” Fairbank said in response to an analyst’s questions during KBW’s 2024 Fintech and Payments Conference. “We won’t inherit their enforcement action, but we inherit very much the same challenge and necessity to really, really bring them to a very different place with respect to compliance and risk management.”

On top of at least $500 million Discover has said it expects to spend on compliance in 2024, Capital One executives expect to make further regulatory and compliance investments, Fairbank said. The McLean, Virginia-based bank projects it will spend $2.8 billion in integration costs following the deal’s closure, according to Capital One CFO Andrew Young.

Discover’s compliance spending has soared as the company grapples with regulatory scrutiny over multiple issues. The company also spent nearly $500 million on compliance in 2023.

The card network reached a consent agreement with the Federal Deposit Insurance Corp. in September 2023 in connection with a consumer compliance probe at its subsidiary, Discover Bank. Discover also disclosed a card misclassification issue that July that affected merchants and merchant acquirers. The Securities and Exchange Commission is investigating that issue. 

In addition, the company encountered regulatory troubles related to its student loan business. (Discover agreed in July 2024 to sell its private student loan portfolio to investment firms Carlyle and KKR for up to $10.8 billion.)

“It’s a very challenging thing to take on a significant set of enforcement actions like this and what comes along with that,” Fairbank said of Discover’s situation. “It’s part of a journey that pretty much every bank has gone through.”

“We assume it is a lot of work,” and it tends to be more involved than those currently in the thick of it might think, he added. “These can be very big undertakings.” 

Because Capital One is mainly acquiring businesses in areas it already operates in, it’s largely a matter of taking Discover’s issues and bringing them under Capital One’s risk management and compliance umbrella, Fairbank said. One exception is that Capital One doesn’t have a network business, so “that one, we’ll have to build a little bit more from the ground up,” he said. 

Ultimately, we’re “taking the over, in terms of cost and time,” to fully address Discover’s compliance issues, Fairbank said.

Capital One is in a strong position to handle Discover’s compliance concerns because of the investments the bank has made in technology, talent and processes to handle risk management at scale, Fairbank said.

Regulators might agree and prefer that Capital One handles Discover’s compliance issues, Oppenheimer analyst Dominick Gabriele wrote in a Feb. 20 note to investor clients.

Capital One has a bigger capital base to absorb any potential costs such as penalties, Gabriele said in an interview.

“It’s also a fresh face,” he added. An outsider “can kind of arbitrate the situation,” and Capital One will want to resolve the issues as soon as possible, he said.

A combined institution will have more resources, which holds appeal for banks since the fixed costs of dealing with regulators have increased, noted Brian Graham, a partner at advisory firm Klaros Group. 

“There is an argument to be made that an organization with more resources can hire even more people, and better people, and attract the right kinds of folks to tackle whatever the compliance obligations are,” Graham said. 

Capital One and Discover have projected the deal would close in late 2024 or early 2025. 

Citi has filed a counterclaim against its former employee, Kathleen Martin, alleging she was fired for being unable to fulfill her role rather than refusing to fudge records needed by the Office of the Comptroller of the Currency, as she said in her lawsuit in May.

Martin, who was terminated in September 2023 from her role as the bank’s interim data transformation chair after nearly two years at Citi, alleged she was fired for not consenting to Chief Operating Officer Anand Selva’s request that she hide information from the OCC that would make the lender “look bad.”

She filed an amended lawsuit in July, accusing Selva of intentional deceit. Martin claimed Selva “wanted to misreport Citi’s metrics to deceive” the OCC into thinking the bank was compliant with the requirements of a 2020 $400 million consent order the regulator issued over risk management issues.

However, Citi reiterated in August that Martin’s expulsion followed a lack of “requisite leadership and engagement skills to successfully execute in the significant role of interim Data Transformation Chair” — a claim the bank had made in June.

Martin joined Citi in November 2021 as a subject matter expert in data governance and was part of a team of at least five senior managers who reported to Rob Casper, Citi’s data transformation chair at the time. When Casper decided to leave the firm, Citi began a companywide search for his replacement, and Martin was chosen for the role on an interim basis.

However, Martin’s interviews for the position and the assessment conducted by a consulting firm identified the areas she needed to work on, including a “dogmatic nature, lack of innovation and lack of experience driving the execution of complex change across Citi” the bank said. 

When Casper left the company, Martin’s deficiencies became apparent to Citi’s senior leadership, including Selva, Citi said. 

“Unfortunately, as Plaintiff’s former supervisor and mentor Casper stepped away from Citi, it became clear to Citi’s senior leadership, including her new direct supervisor Anand Selva, Citi’s COO who is leading its Transformation efforts, that Plaintiff could not successfully execute the role of interim Data Transformation Chair,” the bank said.

Selva tried to help the plaintiff by setting up one-on-one meetings and working groups to facilitate better collaboration and improved working relationships with stakeholders. Selva and his HR team also gave her a senior mentor to support her development, Citi said.

In May 2023, leadership discussed a plan to improve Martin’s performance. In July, Selva conveyed her midyear review before Martin raised any concerns regarding Selva’s behavior. Soon after, she contacted HR and informed the office of her fears about her job.

Martin “felt her position was at risk,” Citi said.

However, the ex-employee claimed in her lawsuit that internal documents showed that she “exceed[ed] expectations” and that CEO Jane Fraser commended Martin for her “gravitas” and her skills in building “strong relationships” at the bank.

Failing to heed the feedback provided, Martin was removed from her role as the data transformation chair, Citi said.

“Defendants [assert] that Plaintiff failed to develop the executive level relationships needed to execute Citi’s Data Transformation, that various constituencies at Citi did not view Plaintiff as a leader, and as a result, she was failing to perform in her role as interim Data Transformation Chair,” the bank said.

“Citi was compelled to replace Plaintiff as Data Transformation Chair — the role of Data Transformation Chair was too important for Citi to tolerate Plaintiff’s underperformance,” the bank added. 

Citi confirmed that Martin was part of a team that met and responded to questions from the OCC related to the consent order but denied that Martin protested that a key metric must be reported accurately or that Selva objected to it. The lender also said Selva and Martin met in September 2023 to discuss how to report certain metrics in red, amber and green reporting scales.

The OCC and the Federal Reserve fined Citi $135.6 million for failing to make adequate progress toward resolving data quality, risk management, and internal control issues while Martin was the interim data transformation chair at the bank.

Martin's attorney, Valdi Licul of Wigdor LLP, acknowledged the lawsuit's legal validity and discussed his plan to seek depositions from Citi’s executives, including Fraser.

"We look forward to conducting the depositions of Ms. Fraser and Mr. Selva to show that they fired Ms. Martin only because she complained about illegal activity," Licul told Reuters.

In March, Synovus Bank named Jonathan O’Connor its first-ever chief third-party payments officer, and CEO of its wholly-owned fintech subsidiary, Maast.

He now leads the bank’s third-party payments business, including merchant services and sponsorships, in an effort to expand growth opportunities in the payments space; and at Maast, he looks to push its banking-as-a-service and embedded finance solutions nationwide.

O’Connor has spent 15 years fully immersed in the fintech space, with time spent as U.S. CEO and group chief commercial officer at U.K.-based payments service provider Trust Payments and as adviser to the CEO at Minneapolis-based payments solutions company Deluxe Corp.

He also spent 13 years at financial services firm First Data, acquired by Fiserv in 2019; there, he held several commercial leadership roles.

At Maast, O’Connor has taken the reins from co-founder and former CEO Tom Bell, who after two years said he “couldn’t be more pleased” to pass the business over to a new leader, according to a LinkedIn post.

“The foundation has been built, the addressable market is clear, the pipeline is growing, and the teams are poised to take the industry by storm,” wrote Bell, who was also previously executive director of third-party payments.

O’Connor spoke with Banking Dive on his new roles and what he predicts in the fintech world moving forward.

Editor’s note: This interview has been edited for brevity and clarity.

BANKING DIVE: What action items are on your list, and what are you most excited about, as Synovus’ chief third-party payments officer?

JONATHAN O’CONNOR: Top of mind is showcasing how the combined offerings of [independent sales organization] sponsorship, merchant services and Maast can be a beacon for innovative new offerings; growing the bank while becoming the regulatory and compliance gold standard in the industry; and earning the right for business every day with consistent client support and easy integrations, a challenge every company faces and one that we will prove to be the leaders in the ever-changing BaaS and payments industry.

The third-party payments team at Synovus is unique in the industry. It’s the only place I can think of that touches every stage of a transaction’s lifecycle and has the potential for breakthroughs in settlement, instant funding and linking ISO sponsorship with BaaS.

How about as Maast CEO?

The reason I joined to lead this amazing team is to position Maast as an industry leader in the reshaping BaaS landscape as we all go through this period of transformation and player repositioning.

The good news is that BaaS has weathered the storm and is on the path to showcase its dynamic growth and adaptability in the ever-changing industry and regulatory and compliance landscape. At the core of BaaS lies innovation, offering cutting-edge solutions that cater to the evolving demands of consumers and respond adeptly to market trends.

As technology, regulatory frameworks and strategic alliances continue to play pivotal roles, Maast is poised for a metamorphosis that prioritizes innovation and client-centric solutions. Unlike other players, Maast is backed by Synovus Bank with a more than 130-year heritage of innovation and security and $60 billion in assets.

Together, we stand at the forefront of a revolution that promises to shape a future where banking innovation, client-centricity, maturing compliance/regulatory frameworks and strategic partnerships harmonize to drive unprecedented value and prosperity in the realm of embedded finance.

What lessons did you learn from your positions at Trust Payments and First Data that you bring to Synovus and Maast?

I’m an accountant with a master’s in IT and a passion to win on the commercial playing field. When you bring these three pillars together, what you have is a 360-degree view of business. Over the past 30 years, I’ve been fortunate to witness and participate in the global payments and banking landscape. In the last five years, it’s been exciting to see how much has changed in the payments industry.

The lessons I bring to Synovus and Maast have been cultivated into playbooks for how to manage growth, change and innovation while protecting and layering controls to limit residual operational and reputational risk.

What do fintech executives need to keep in mind in the current regulatory environment?

Compliance is not just a requirement — it's an opportunity to showcase integrity and build trust. We embrace regulatory standards with enthusiasm and diligence, which sets us apart as industry leaders, demonstrating our commitment to transparency, security and ethical practices.

By staying agile, proactive and innovative in navigating regulatory landscapes, we can turn challenges into advantages, ensuring sustainable growth, fostering credibility and inspiring confidence in our stakeholders.

By championing compliance as a cornerstone of our operations, we can pave the way for sustainable success, shape industry best practices and position ourselves as trailblazers in the ever-evolving fintech landscape.

It's not just about meeting regulations; it's about setting new benchmarks, shaping the future of fintech, and leading with unwavering integrity and accountability. Remember, in this dynamic regulatory environment, our commitment to compliance isn't just a mandate — it's a strategic advantage that propels us toward enduring prosperity and leadership in the financial technology sector.

What do you see as some of the most interesting innovations in fintech today?

We are witnessing a convergence of previously disparate financial products coupled with groundbreaking technologies such as AI, neural network, global views on fraud and risk management solutions, blockchain and data analytics. This is fueling a wave of transformative solutions that revolutionize how we interact with money, investments and transactions. These innovations not only enhance efficiency and convenience but also democratize access to financial services, empowering individuals and businesses worldwide.

By embracing these cutting-edge advancements with vision and passion, we are unlocking unprecedented opportunities, enriching client experiences and driving a new era of financial empowerment and prosperity. The most exciting innovations in fintech are not just about what they achieve today, but the limitless potential they hold to shape a more inclusive, dynamic and prosperous financial landscape for tomorrow.

Expense management firm Brex has snagged a veteran of Affirm and American Express to lead its compliance program and build out its current risk frameworks. 

Sibongile Ngako joined Brex in July as the fintech’s chief compliance officer, after a three-year stint at buy now, pay later provider Affirm, where she served as vice president of compliance. Prior to that, she spent nearly a decade at card company Amex and a handful of years at the New York Fed as a bank examiner and analyst. 

When Brex announced her appointment July 22, CEO Pedro Franceschi called Ngako’s industry expertise “invaluable” as the fintech strives to innovate while maintaining compliance in an “increasingly complex regulatory landscape.” Ngako spoke to that balance, and what Brex can take away from the Synapse collapse, during a recent interview with Banking Dive.

Editor’s note: This interview has been edited for clarity and brevity. 

BANKING DIVE: With fintechs increasingly on regulators' radar, how will your regulatory experience inform your compliance focus at Brex? 

SIBONGILE NGAKO: With my decades of experience in the fintech and banking sectors, I’ve gained a deep understanding of the complex and evolving regulatory landscape and the challenges and opportunities it presents for the industry. My long-term goal is to ensure that Brex continues to operate with integrity and transparency, providing our customers with the highest level of trust.

Given the rapidly evolving regulatory landscape, how do you aim to ensure Brex stays responsive and light on its feet? 

Brex already has an established compliance program, which is the most critical first step and one of the main things that drew me to join the team. Effective compliance risk management is about striking the balance between a risk-based approach and responsible agility. As the compliance program continues to evolve, it will be increasingly effective at supporting Brex’s business, which will in turn help Brex continue to be nimble while remaining compliant. 

How does a fintech like Brex balance wanting to move quickly with innovative products and services and regulatory compliance?

Brex’s core mission is to make every dollar count for businesses around the world, which means that from day one the team has been handling some of the most sensitive and consequential data a company can have — financials and employee information. Any research and development work at Brex keeps compliance and customer protection front and center. If it's moving too quickly for customer protection to keep pace, it’s not happening. 

Moreover, I would maintain that laying the foundation of a regulatory compliance framework actually helps a company move more quickly and ensures that everyone is on the same page when key decisions are being made that impact compliance risk management. 

Brex has leaned into use of artificial intelligence. With compliance in mind, what does the company need to practice when it comes to employing AI? 

The bar is incredibly high across the board when it comes to handling money, and that's especially true for AI. It’s a foundational part of the Brex platform, which has been leveraging AI since inception across underwriting, fraud, receipt matching, merchant categorization and other product areas. That’s led to guardrails and protocols being established to ensure the safety, privacy and security of our customers, which I'm looking forward to continuing to build upon. Privacy is paramount: For example, customer data is protected by strict security protocols and is not used to improve third-party AI models. 

More broadly, what kind of lessons can a company like Brex learn from the recent fallout of middleware provider Synapse? 

Some companies are heavily reliant on third-party vendors like Synapse, Evolve and others, making them more susceptible to incidents like these. This news highlights the extreme importance of building as much of your payment rails and financial infrastructure as feasible in-house — something Brex does and takes very seriously. 

Controlling as much of the financial infrastructure as possible allows Brex to process and settle transactions faster (and more securely) and ship new products and features in a more nimble and efficient way. Similar to our approach to AI, the bar is incredibly high when it comes to partnering with anyone who would be interacting with our customers — we invest in trust first and foremost, and hold ourselves to the highest standard possible. That applies to how we develop our products, and it also applies to the select third-party partners that we do work with.

The banking and finance sector should develop a shared responsibility framework with their artificial intelligence partners to address fraud, scams and ransomware attacks arising from AI, Acting Comptroller of the Currency Michael Hsu said in June.

While speaking at the Financial Stability Oversight Council’s AI Conference, Hsu highlighted how AI’s use can threaten financial stability.

“From a financial stability perspective, AI holds promise and peril from its use as a tool and as a weapon,” Hsu said. “The controls and defenses needed to mitigate those risks vary depending on how AI is being used. At a high level, though, I believe having clear gates and a shared responsibility model for AI safety can help.”

Cloud computing’s shared responsibility model could be used as a blueprint, Hsu said.

“In the cloud computing context, the ‘shared responsibility model’ allocates operations, maintenance and security responsibilities to customers and cloud service providers depending on the service a customer selects,” he said. “A similar framework could be developed for AI.”

The newly established U.S. Artificial Intelligence Safety Institute, within the National Institute of Standards and Technology, can devise a shared responsibility framework from its consortium of more than 280 stakeholder organizations.

Hsu’s remarks come as Treasury Secretary Janet Yellen warned that using AI in finance could lower transaction costs but carries “significant risks.” 

“Specific vulnerabilities may arise from the complexity and opacity of AI models, inadequate risk management frameworks to account for AI risks, and interconnections that emerge as many market participants rely on the same data and models,” Yellen said in June.

The Treasury Department is seeking public comments on the use of AI in the financial sector.

Hsu, meanwhile, used electronic trading as an example of technology that starts as a novelty and slowly becomes more trusted. AI follows a similar path, he said, because it was first used to produce inputs for human decision-making, then as a co-pilot to enhance human actions, and finally as an agent executing decisions on humans’ behalf.

However, banks adopting AI must now set up “clear and effective gates” between phases to ensure safety.

“Before opening a gate and pursuing the next phase of development, banks should ensure that proper controls are in place and accountability is established,” Hsu said.

Hsu noted the unexpected or unintended consequences of over-reliance on AI.

He cited Jake Moffat, who, in November 2023, took a chatbot’s help to find the bereavement rate on Air Canada’s website when his grandmother passed away. Moffat was booking a flight to Toronto. The chatbot suggested he book a flight and ask for a refund within 90 days, Hsu said. However, Air Canada prohibits retroactive refunds for bereavement flights. Moffat sued the airlines, but Air Canada argued it “cannot be liable for the information provided by a chatbot.” Moffat won the case, Hsu said.

With chatbots, companies can struggle to identify who is liable for what and how to fix it, Hsu said. The same questions arise when AI is used in credit underwriting, and consumers are denied credit cards based on an AI algorithm — a decision that is hard to explain, he said.

“With AI, it is easier to disclaim responsibility for bad outcomes than with any other technology in recent memory. The implications for trust are significant,” Hsu said. “Trust not only sits at the heart of banking, it is likely the limiting factor to AI adoption and use more generally.”

Hsu also noted the proliferation of deepfakes that have evolved from simple voice tricks, as well as more sophisticated deceptions used in big-ticket heists.

Though these incidents have been manageable, they could have a more significant financial impact as criminals become more advanced in using AI, Hsu said.

In December 2023, Sens. Mark Warner, D-VA, and John Kennedy, R-LA, introduced legislation mandating that the FSOC coordinate regulatory efforts aimed at protecting markets from the potential disruptive impacts of deepfakes, trading algorithms and other AI tools that could destabilize the financial system. Yellen backed the legislation in February.

“An increase in AI-powered fraud could sow the seeds of distrust more broadly in payments and banking,” Hsu said. 

Credit unions are bracing for expanded rulemaking on compliance — and perhaps examinations — as the National Credit Union Administration board now has a Democratic majority.

Speaking at America’s Credit Unions’ Governmental Affairs Conference in March, some credit union CEOs said the focus of the agency will likely be altered, and increased consumer protection issues might be on tap.

“I would suspect that you’ll see a much greater focus on compliance and consumer protection in the coming years as I know that those topics are near and dear to [NCUA] Chairman [Todd] Harper’s heart,” said CEO Kendall Garrison of Austin, Texas-based Amplify Credit Union.

The Senate in December 2023 confirmed Tanya Otsuka as the newest member of the NCUA’s board, giving Democrats a majority of the three-person panel for the first time in seven years.

In a letter to credit unions that outlines the 2024 supervisory priorities for the NCUA, the agency said its examiners will continue an expanded review of credit unions’ overdraft programs, including website advertising, balance calculation methods and settlement processes. 

The NCUA said it will also continue to evaluate adjustments credit unions made to their overdraft programs to address consumer compliance risk and potential consumer harm from unexpected overdraft fees.

Mark Treichel, a former executive director of the NCUA who now runs Credit Union Exam Solutions, speculated on his podcast ahead of the conference that Harper might soon roll out separate consumer compliance exams and scores for credit unions. 

Harper told the Brookings Institution recently that “problematic overdraft programs and nonsufficient funds alerts include fees that aren’t reasonable and proportional.” 

Some CEOs at the conference said they expect the NCUA to line up more closely with the Consumer Financial Protection Bureau on many issues.

Examiners are warning credit unions to start thinking about other alternatives to NSF fees, a couple of CEOs at the conference told Banking Dive.

CEO John Holt of Rocky Hill, Connecticut-based Nutmeg State Financial Credit Union said he believes the NCUA board may lean toward eliminating or modifying “junk fees” including NSF fees and overdraft fees.  

“While I understand that some fees may appear to be junk, if this happens, my concern is that members may not like it and financial institutions will need to find creative ways to make up for those fees,” Holt said.

The $585 million-asset Nutmeg State in took in $7.3 million in fees in 2023, compared with $11 million the year before. 

While compliance and regulation can be burdensome and take resources away from credit unions, the risks, including cyberattacks, are real, Holt said.  

“We must continue to do everything we can to protect our members while finding efficient and easy ways to address compliance and regulation,” Holt said. 

Speaking at the conference, Otsuka did not address consumer protection but said she will focus on making sure credit unions — especially small, low-income and minority depository institutions — can continue to stay competitive and provide affordable financial services to their members in a constantly evolving financial system.

President Joe Biden announced Otsuka's nomination in September 2023. Her term on the NCUA board, alongside Harper and Vice Chair Kyle Hauptman, will run through Aug. 2, 2029. 

But consumer protection was not the only regulatory issue discussed at the conference. 

The $1.4 billion-asset Amplify recently completed its regulatory exam, and Garrison said liquidity and interest rate risk remain “very high priorities” for the regulatory agencies.

Otsuka said the increasing number of large credit unions with CAMELS 3 scores is a “concerning trend,” and added that she is watching it closely. 

“Broader economic challenges come on top of external pressures to adopt cutting-edge technology to compete with banks and fintech while ensuring you can prevent the next cybersecurity breach,” she said. 

In addition, she said America’s Credit Unions’ small credit union committee spoke with her about cybersecurity challenges and the potential for increased delinquencies. 

“I’ve also heard about the increasing cost of funds and a slowdown in lending growth, which has put pressure on earnings,” she said. 

Geoff Bacino, a credit union consultant and former NCUA board member, said it is critical for credit unions to keep lines of communication open with the regulator’s exam staff and its regional director.

But Carrie Hunt, America’s Credit Unions’ chief advocacy officer, did not pull any punches during her presentation. She said both the NCUA and CFPB need better oversight.

“We support efficient regulation, not unchecked authority,” she said.

Embedded finance platform Unit Finance invested in strengthening its bank oversight products this year to help banks respond to an uptick of regulatory scrutiny of third-party partnerships, CEO and founder Itai Damti said.

Unit's oversight suite provides banks tools for managing compliance, reconciliation, and third-party risk; and aims to give banks real-time data access, greater transparency, and improved controls to mitigate risk and perform oversight over programs.

“We're at a point in time where the bar for operating in the space is rising quickly for banks, and Unit wants to be well-positioned to serve those banks and grow our partner bank network,” Damti told Banking Dive.

Regulators have had bank-fintech ties under a microscope for the past two years, handing out consent orders to several banks — Blue Ridge Bank, First Fed Bank and Piermont Bank to name a few — over issues within their fintech programs. And recently, the Federal Reserve, the Office of the Comptroller of the Currency and the Federal Deposit Insurance Corp. jointly released third-party risk management guidance for community banks.

As regulators try to play catch up with the fast-moving world of fintech, “banks have to answer more questions as part of their exam cycles, and the better we are at helping them answer those questions, the more they are well-positioned to provide in the space,” Damti said.

Questions banks face from regulators “move in seasons,” he said: After the Russia-Ukraine war started, banks faced more questions related to IT and security; and after the collapse of Silicon Valley Bank, they faced more questions on deposit stability.

“By staying attuned to the needs of the bank partners and to the type of questions that they might have about their audiences, we can build more tools that make them successful and make them answer [regulator] questions at higher quality. We don't believe that tech can be a replacement for risk management, but tech can enhance risk management, and make things more efficient for the bank partners,” Damti said.

He sees regulatory scrutiny as a sign of a maturing ecosystem – and overall, a good thing, even if it means some players within the system see it as a time to step away.

“Historically, these things happen when ecosystems become more important. And historically, the result of elevated scrutiny is more clarity,” he said.

Clarity, he said, “leads to companies and banks operating with more confidence and the understanding that regulators want to sustain the space, they just want to sustain it in the best way, as opposed to being fearful that there is a future event that might take the ecosystem back.”

The pendulum between investing in the future, as with the bank oversight investment, and seeking more immediate lucrative results is constantly swinging, Damti said. Based on the company’s existing balance sheet, Unit can “eventually become profitable without additional fundraisers,” he said.

He stopped short of providing a timeline, noting that investors can choose to invest more, thus delaying profitability.

“If there's an opportunity that presents itself or set of opportunities that present themselves, we want to be able to make those judgments in real time and not bind ourselves now to a timeline that we decide on today,” Damti said. “But we are definitely trying to be thoughtful about our business success, revenue growth and margins of the company.”