Bank-Fintech AML Oversight: How to Obtain Evidence of Partner Control Effectiveness
Updated: Sep 22
Bank-fintech relationships can expand access to financial products and technology while also creating a challenge for bank risk and compliance leaders: how do you know that a partner's AML controls are actually working?
A contract, questionnaire, certification, or third-party assessment can provide useful information, but none necessarily demonstrates that controls are appropriately designed, implemented, and operating effectively in practice. Banks need sufficient visibility into the controls supporting activities performed by fintech partners, along with a process for evaluating the quality and limitations of the evidence they receive.
Effective partner oversight therefore requires more than collecting documentation. It requires a risk-based framework for identifying the controls that matter, obtaining evidence that those controls are operating as intended, testing or challenging that evidence where appropriate, and escalating weaknesses that could affect the bank's BSA/AML risk profile.
This article examines a practical approach to obtaining and evaluating evidence of fintech-partner control effectiveness, including governance documentation, operational evidence, testing and assurance, data and reporting, contractual access, and management and Board oversight.
Table of Contents
Defining Partner Control Effectiveness
Effective AML oversight of a fintech partner begins with a clear definition of what the bank is trying to achieve. The objective is not to replicate the bank’s internal processes within the partner’s environment but to obtain credible evidence that the partner’s control framework adequately manages the specific risks associated with the products, services, and customers involved in the relationship.
Bank Responsibility and Fintech Accountability
A bank may use third parties to perform certain activities, but it remains responsible for appropriate oversight of those activities and for meeting its applicable BSA/AML program requirements. A bank retains responsibility for appropriate oversight of activities conducted through its fintech partners and for meeting its own BSA/AML program requirements. This distinction is critical. The fintech may be responsible under the relationship and applicable contractual arrangements for executing designated controls, while the bank remains responsible for appropriate oversight and evaluation of the risks associated with those activities.
This oversight should be proportionate to the risk presented by the relationship. The interagency proposed guidance on third-party risk management issued in September 2026, while not yet final, reinforces this long-standing supervisory principle. The proposal emphasizes tailoring oversight activities to the reasonably assessed risk, size, complexity, and nature of each relationship.
What “Control Effectiveness” Means
For the purposes of AML oversight, “control effectiveness” is the demonstrable outcome that a partner’s AML controls are functioning as intended. This can be broken down into four key components:
Appropriate Design: The control is logically constructed to mitigate a specific, identified risk. For example, a transaction monitoring rule is designed to detect a known typology of illicit activity relevant to the partner’s customer base.
Proper Implementation: The control has been put into operation correctly. The transaction monitoring rule is active in the production environment with the correct parameters and data feeds.
Consistent Operation: The control functions consistently and reliably over time. The rule generates alerts as expected when its thresholds are met, and system downtime or data integrity issues do not compromise its performance.
Relevant Outcomes: The control produces meaningful results that contribute to the overall goals of the AML program, such as the identification and reporting of suspicious activity.
Risk-Based Oversight of Fintech Relationships
A risk-based approach requires the bank to calibrate the intensity of its oversight and the depth of its evidence requirements based on the partner relationship’s specific risk profile. Factors that should inform this assessment include:
Products and Services: The inherent AML risk of the products offered through the partnership (e.g., cross-border payments vs. domestic secured lending).
Customer Base: The types of customers onboarded by the fintech and their geographic distribution.
Transaction Volume and Velocity: The scale of financial activity processed by the partner on the bank’s behalf.
Criticality: The importance of the fintech’s activities to the bank’s business objectives and the potential impact of a control failure.
A high-risk, high-volume, critical fintech partner warrants a more rigorous evidence and testing framework than a low-risk, non-critical relationship.
Building an Evidence Framework
To evaluate a partner’s control effectiveness, a bank needs to build a framework for requesting, collecting, and analyzing evidence. This evidence should provide a comprehensive view of the partner’s AML program, from high-level governance to day-to-day operational outputs. It is essential to distinguish between evidence of control design (e.g., a written policy) and evidence of operating effectiveness (e.g., logs showing the policy was followed).
Governance, Policies, and Procedures
This category of evidence demonstrates that the partner has a formal, documented, and approved structure for managing AML risk. It provides insight into the intended design of the control environment.
Key Evidence: The partner’s AML policy, risk assessment methodology and most recent results, organizational charts defining compliance roles and responsibilities, board or management committee reporting, and procedures for key processes (e.g., KYC/CDD, SAR filing, sanctions screening).
Evaluation Focus: Does the documentation reflect an understanding of the specific AML risks associated with the products and customers? Are roles and responsibilities clearly defined? Is there a formal process for risk assessment and governance oversight?
Control Design and Implementation
This evidence provides specific details on how controls are configured and implemented. It moves from the "what" of the policy to the "how" of the execution.
Key Evidence: A comprehensive control inventory, configuration documents for transaction monitoring scenarios, KYC/CDD process workflows, criteria for enhanced due diligence, SAR investigation and decisioning procedures, and training materials and completion logs.
Evaluation Focus: Are the controls tailored to the identified risks? For example, are transaction monitoring rules calibrated to the expected activity of the partner’s customer segments? Are the tools and systems used fit for purpose?
Data, Reporting, and Information Access
Effective AML oversight depends on the bank’s ability to access relevant data and reporting from the partner. This evidence shows what information is available to monitor performance and identify potential issues.
Key Evidence: Sample management reports, key performance indicators (KPIs) and key risk indicators (KRIs) for the AML program, SAR filing logs (with sensitive information redacted as appropriate), alert and case volume data, and system-generated reports on control performance.
Evaluation Focus: Does the bank have access to sufficient information to independently assess the partner’s performance? Are the partner’s reports clear, accurate, and timely? Can the bank reconcile data provided by the partner with its own records?
Operating Effectiveness and Control Results
Evidence of operating effectiveness is particularly important because it provides insight into whether controls are functioning as intended in practice. It provides proof of performance and outcomes.
Key Evidence: Quality assurance (QA) testing results on alert dispositions and SAR filings, independent testing or internal audit reports on the AML program, system logs, issue management and remediation tracking, and documented outcomes of specific investigations.
Evaluation Focus: Do the QA and testing results show that controls are operating as designed? Do testing results identify errors or exceptions that could indicate weaknesses in critical processes? Are issues identified, tracked, and remediated in a timely manner? Do the outcomes align with the control’s objectives? An effective testing program is crucial for validating these results.
Testing and Challenging Partner Evidence
Obtaining evidence is only the first step. A bank’s AML oversight function should also have a risk-based process for testing and challenging the information provided by its fintech partners. Relying solely on partner attestations, questionnaires, or summary reports may not provide sufficient assurance, particularly for higher-risk relationships.
Due Diligence and Ongoing Monitoring
The process of challenging evidence begins during initial due diligence and continues through ongoing monitoring. Questionnaires, SOC reports, and certifications can be useful starting points, but they should not automatically be treated as sufficient evidence of control effectiveness. The bank should review these documents critically, identify potential gaps, and request follow-up evidence where necessary.
For example, if a SOC 2 report notes an exception in the partner’s change management controls, the bank should inquire about the root cause, the potential impact on AML systems, and the status of remediation.
Independent Testing, Audit, and QA
Independent testing and assurance activities can provide valuable evidence of operating effectiveness, particularly when their scope, methodology, and independence are appropriate to the risk. A bank should review the results of the partner’s own assurance activities, including:
BSA/AML Independent Testing: Review the scope, methodology, findings, and management responses from the partner’s most recent independent AML audit or test.
Internal Audit: If the partner has an internal audit function, review any relevant audit reports covering AML, compliance, or technology controls.
Quality Assurance (QA): Request access to the partner’s QA methodology and summary results for key processes like alert review and SAR decisioning.
The bank should assess the independence, expertise, and scope of these functions. The value of an assurance activity depends on factors such as its scope, methodology, expertise, independence, and relationship to the controls being evaluated.
Risk-Based Direct Testing
For its most critical fintech partners, a bank may determine it needs to conduct its own direct testing of certain controls. This can take several forms:
Sample Testing: Reviewing a sample of the partner’s closed transaction monitoring alerts or customer onboarding files to assess whether decisions were well-documented and consistent with policy.
Walkthroughs: Conducting interviews with the partner’s compliance staff to walk through a process from start to finish, comparing the described steps to written procedures.
Data Reconciliation: Comparing data sets from the partner’s system to the bank’s own records to test for completeness and accuracy.
Model and Automated-System Risk Where Applicable
Where a fintech partner uses a technology that qualifies as a "model" under the bank's own model risk management framework, additional scrutiny may be appropriate. The April 2026 interagency Revised Guidance on Model Risk Management (SR 26-2) is risk-based and nonbinding and is expected to be most relevant to banking organizations with more than $30 billion in total assets regulated by the Federal Reserve. Its principles may also be relevant to smaller institutions with significant model risk.
It is important to note that this guidance’s definition of a model typically excludes purely deterministic, rule-based processes. If a partner's system falls within the institution's applicable definition of a model, the institution should obtain and evaluate appropriate evidence of model validation, performance monitoring, and governance based on the model's risk, purpose, complexity, and use. This is distinct from the broader BSA/AML independent testing and requires specialized expertise in BSA/AML model risk governance.
Turning Evidence Into Management and Board Oversight
The final component of an effective AML oversight program is translating the collected evidence into meaningful insights for senior management and the Board of Directors. The goal is to provide a clear, risk-based picture of the performance of fintech partnerships and to identify any issues that require executive attention.
Metrics and Risk Indicators
While operational metrics like alert volumes can provide context, management reporting should focus on indicators that signal the health and risk of the partnership. Instead of relying on a single metric like SAR conversion rates, which can be easily misinterpreted, a more holistic dashboard may include:
Control Testing Results: Pass/fail rates from QA or sample testing of the partner’s activities.
Issue and Remediation Status: The number of open issues, their severity, and the aging of remediation plans.
Risk Assessment Changes: Any changes to the inherent or residual risk ratings for the partnership and the rationale behind them.
Significant Event Analysis: Summaries of any significant AML-related events, such as a material system outage or a major law enforcement inquiry.
Issue Escalation and Remediation
The oversight framework should include clear thresholds for escalating issues identified through monitoring and testing. The escalation path should be defined, ensuring that significant control weaknesses or unresolved issues are brought to the attention of senior management. The bank should also have a formal process for tracking the remediation of any identified issues to conclusion, with accountability assigned to specific individuals at both the bank and the partner.
Contractual Rights and Access to Evidence
A bank's ability to obtain evidence and conduct testing is heavily dependent on its contractual agreements with the fintech partner. Contracts should be reviewed by appropriate legal, compliance, risk, and business stakeholders to assess whether they provide the bank with appropriate access to information, testing, reporting, and remediation rights based on the risks of the relationship. The scope of this review should include:
Access to Information: The right to request and receive specific policies, procedures, reports, and other documentation related to AML controls.
Audit and Testing Rights: The right for the bank or its designated third party to conduct audits or testing of the partner’s controls.
Reporting Requirements: Specific requirements for the frequency and content of performance reporting from the partner.
Remediation and Termination: Clear provisions outlining the process for remediating control deficiencies and available remedies, including escalation, remediation, suspension, or termination rights where appropriate.
Board and Senior Management Reporting
Reporting to the Board and senior management should be concise and strategic. The focus should be on material risks, significant trends, and the overall effectiveness of the AML oversight framework for third parties. Rather than detailing every metric, the report should synthesize the evidence to answer key questions:
Are our fintech partnerships operating within our established risk appetite?
Have we identified any material control weaknesses or compliance issues?
What are the key AML risk trends we are observing across our portfolio of partners?
Is our oversight framework providing us with sufficient assurance that risks are being managed effectively?
By focusing on evidence of control effectiveness, banks can make fintech oversight a more meaningful risk-management process that supports informed decisions about the relationship and its associated risks.
Executive Takeaways
Effective AML oversight of fintech partners requires obtaining and evaluating evidence that controls are well-designed, implemented correctly, and operating as intended.
A bank is responsible for the appropriate oversight of activities conducted through third parties; this oversight should be risk-based and proportionate to the risks of each specific relationship.
An evidence framework should distinguish between documentation of control design (e.g., policies) and proof of operating effectiveness (e.g., quality assurance results and independent testing reports).
Banks should not rely solely on partner attestations or questionnaires. A risk-based approach to challenging evidence through independent review and direct testing provides greater assurance.
Contractual agreements are foundational, as they define the bank’s right to access information, conduct testing, and require remediation.
Board and senior management reporting should synthesize evidence to provide a clear view of material risks, trends, and the overall effectiveness of the partner oversight program.
How Versapien Can Help
Versapien helps financial institutions design and implement risk-based frameworks for third-party AML oversight. Our services include developing evidence requirements, creating risk-based testing programs for fintech partners, and enhancing board and senior management reporting to provide clear insights into partner control effectiveness.
Comments