Quick answer: A sponsor-bank relationship can involve more than the bank and the fintech signing the agreement. Map the parties, activities, data flows, and accountable owners first. “All-party risk” is a useful discussion lens, not a substitute for the bank’s actual risk-management program.
Watch the video
Sponsor-bank qualification and partnership fit
Related discussion with Stacy
In a conversation with Steve Bishop, I raised the complexity of sponsor-bank relationships and the value of considering all the parties involved. That observation is a practical place to start: a two-company sales diagram may hide the people and services the bank depends on.
Start with the activity, then trace the relationships
Ask what the arrangement will do for customers and what must happen for that activity to work. Then trace who provides each step. A fintech may rely on a processor, cloud provider, software component, or another service. The relevant chain depends on the actual arrangement; do not assume every program has the same structure.
The 2023 interagency guidance emphasizes understanding how a third-party arrangement is structured. The practical implication here is to make relationships visible before assigning confidence to the partnership.
Build a map the operating teams can challenge
Illustrative exercise: Draw one row per activity, rather than one row per company. Use it to ask questions, not to certify a program.
- Activity: what service or decision occurs?
- Party: who performs it, and who else do they depend on?
- Information: what data moves, where, and for what purpose?
- Control: who can authorize access, change the process, or stop it?
- Evidence: what shows the control works?
- Exception: who handles a failure, customer issue, or disputed result?
Name the owner of each gap
A map is useful when it reveals an unanswered question and somebody owns the answer. If a fintech says the processor handles a function, ask who at the bank receives evidence of that function and who is responsible when the service fails. A label such as “covered by our partner” does not answer either question.
Use the map to shape the next conversation
Bring the right parties into the review at the right time. A sales meeting cannot settle every security, legal, operational, and compliance question. It can identify those questions, make the dependencies explicit, and stop the deal from advancing on assumptions.
For the fintech side of preparation, see the community-bank diligence checklist.
Guidance context, October 12, 2026: The agencies’ 2023 third-party relationship guidance and 2024 community-bank guide are the background for this discussion. In September 2026, the agencies issued proposed revisions; the OCC describes those revisions as proposed, with application when final. Do not treat a proposal, this article, or a vendor checklist as a binding rule.
Frequently asked questions
Is all-party risk a required regulatory framework?
This article uses it as a discussion lens from Stacy’s source conversation. It does not identify it as a mandated standard or claim that it replaces third-party risk management.
Should we map every supplier in the same depth?
Use the bank’s risk assessment to determine the appropriate depth. Focus attention on dependencies that matter to the activity, data, customer outcome, or continuity of the arrangement.
What should a founder bring to the first review?
Bring a clear description of the service, parties and dependencies, data flow, division of responsibilities, and known gaps. Let the bank identify what additional evidence it needs.
Sources
Continue the conversation
For help translating your product and sales process into a bank-ready decision, explore working with Stacy. For ongoing practical guidance, subscribe to Selling Fintech.
Adapted from Stacy Bishop’s original posts and newsletter with AI-assisted editing. Cover portraits were generated from Stacy’s reference photographs. Illustrative exercises are labeled.
