Episode summary
Can You Standardize Bank-Fintech Risk?
Fintech Takes
· · 57 min · Hosts: Alex Johnson, Jason Mikula, Jason Henrichs
Summary
The episode argues that the FDIC’s push to standardize third-party risk management is an understandable response to the messiness of bank-fintech partnerships, but that a single top-down standard may be too blunt for a market made up of very different banks, vendors, and business models. The host frames the problem as the collision of community banks with limited resources, fast-moving fintechs, and an uneven negotiating dynamic that emerged as banking-as-a-service grew.
Jason Mikula says the market used to be easier to supervise when core banking was dominated by FIS, Fiserv, and Jack Henry, but that concentration also suppressed innovation and locked banks into long contracts. Jason Henrichs argues that the later BaaS wave created moral hazard on both sides: fintech programs wanted speed and banks wanted fee income, sometimes leading banks to treat basic compliance items as negotiable.
Both guests are skeptical that a certification regime like SOC 2 will solve the problem. They warn that credentials can become a race to the bottom, may not reflect actual implementation, and could give banks false comfort without reducing liability. Their preferred solution is narrower and more operational: specialized examiner expertise, more specific rules for repeatable issues like reconciliation, and better bottom-up supervision rather than a one-size-fits-all framework.
Key takeaways
- Jason Mikula says the old core-provider oligopoly made supervision simpler but also suppressed innovation and left banks with very limited choices.
- Jason Henrichs says BaaS created a moral hazard on both sides, with programs pushing for speed and banks chasing deposits and fee revenue.
- Henrichs argues SOC 2-style credentials can become a race to the bottom if banks treat the badge as a substitute for real diligence.
- Mikula says a certification may help only if it has enough credibility to matter, but it still will not eliminate a bank’s liability.
- The guests favor a dedicated cross-agency examiner group and narrower rules, like a reconciliation requirement, over a broad top-down standard.
- Both guests say not every bank should be able to enter every fintech partnership just because standards exist.
Notable quotes
“the American banking system, uh, as I like to tell my my European brethren, uh, is a very interesting and at times confusing and nonsensical beast”
“I am all in favor for anything that promotes and accelerates responsible innovation. The responsible and the innovation is where the tension lies in doing this”
“The blow up in a post synapse world was really a double-sided moral hazard, right”
“anyone who is serious about security does not care about sock 2”
“I think there are a lot of bottom up solutions that can make this work better”
How the episode opens
This episode is brought to you by Oculus. Better lending starts with better intelligence. A borrower's cash flow only tells half the story, so Oculus fills in the rest with behavior signals and industry benchmarking.
Visit aqualiss.com to learn more. Hello and welcome back to the Fintech Takes podcast. Uh today's episode is a conversation that I've been wanting to have for a while.
It is the standards conversation. Uh, as you likely know if you've been reading the newsletter, listening to the podcast, um, the FDIC is spearheading an initiative to try to create standards around third party risk management in order to reduce the risk and make it more efficient for banks to work with various third parties, most pressingly fintech companies, which as we've seen through all the trials and tribulations in banking as a service, is not always as easy as we might hope that it would be. So the FDIC has embarked on this project which is a very loudable project to figure out how to standardize some of that work and to make it easier and faster while still keeping the level of risk in those partnerships as low as possible.
I've wanted for a while to have like a really focused dedicated conversation with experts about what we know is happening in that space, what we don't know, how we got to a place where we even need standards at all. And so I called my two Jasons off the bench. Uh Jason Mikula, publisher of Fintech Business Weekly, and Jason Henriks uh of Alloy Labs and Breaking Banks.
Jason and Jason are the two most knowledgeable people I know on bank fintech partnerships, banking as a service, uh third party risk management. They've seen every single part of it. They spend a lot of their time in the trenches talking to banks that do this work, talking to fintech programs that do this work.
From the episode’s captions: roughly the first two minutes, lightly cleaned. Keep watching on YouTube →
Topics
- fdic third-party risk standards
- bank-fintech partnerships
- soc 2 assurance debate
- banking vendor lock-in
- cross-agency examiner approach
Companies and tickers mentioned
- FIS
- FISV
- JKHY
- Alloy Labs
- Ocrolus
- FIS
- Fiserv
- Jack Henry
Watch the episode
Watch “Can You Standardize Bank-Fintech Risk?” on YouTube
Summary, takeaways and quote selection by Octagon. Quotes are short excerpts; the full conversation is in the episode.
More from Fintech Takes
-
The Blue Wave Hits Financial Services -
AI Agents, SoFi, & the OCC’s “Irrefutable” Report -
Fintech Takes x C&R presents: The Customer Isn’t the Liability -
Stablecoins IRL (Tempo Edition) -
Fintech Takes x C&R presents: The Business of Lending, Seen From Canada -
Not Fintech Investment Advice: Symphony, Spoolis, Piston, MoneyStack
Fintech Takes, this episode and its artwork belong to Alex Johnson. Octagon is not affiliated with the show; this page is an independent summary.
