Why valid when made left bank-fintech lenders two open questions

The week

On May 29, 2020, the Office of the Comptroller of the Currency turned a long-standing assumption into a formal rule. The OCC is the federal agency that charters and supervises national banks. Its rule said that a loan which was legal when the bank made it stays legal after the bank sells it. The final rule covered loans sold by national banks and federal savings associations. When such a loan is sold, assigned or otherwise transferred, interest that was permissible before the transfer remains permissible afterward. Lawyers call this principle “valid when made.”

A whole way of lending rested on it. Take a small app-based lending company with slick software, a strong brand with younger customers and a model that approves applications in minutes. What it does not have is a bank charter, the license that lets a bank lend across the country under one set of interest rate rules. So it partners with a bank that does. The bank makes the loan, then sells it, or the stream of payments from it, to the fintech or to investors. That arrangement, often called a bank-fintech partnership, had become a common way to bring consumer and small business loans to market.

The case behind the rule

Why did the agency need to say it at all? Because of a 2015 court decision. In Madden v. Midland Funding, the US Court of Appeals for the Second Circuit considered a non-bank that had bought debt originated by a national bank. It held that the buyer could not necessarily rely on the bank’s authority to charge the interest permitted in the bank’s home state. The bank could charge that rate, but the company that bought the loan might not be able to. That ruling cast a shadow over anyone who bought, packaged or financed bank loans.

The facts were ordinary. A New York consumer had a credit card account with a national bank. After she stopped paying, the debt was charged off and sold to a debt buyer, which sought to collect interest at an annual rate of 27 percent. New York’s criminal usury cap is 25 percent. The borrower argued that the debt buyer, as a non-bank, could not shelter behind the bank’s federal authority to charge its home-state rate. The Second Circuit agreed that federal preemption did not extend to the buyer on those facts. In 2016 the Supreme Court declined to hear the case, after the Solicitor General advised against review while describing the appeals court’s analysis as incorrect. The uncertainty therefore stayed in place for New York, Connecticut and Vermont, the states the Second Circuit covers.

What the rule did

The OCC proposed its rule in November 2019, received more than sixty comments and published the final version in the Federal Register in early June 2020, effective August 3. It interpreted the federal statutes that set the interest national banks and savings associations may charge, read together with their power to sell loans. Two statements in the rule’s preamble mattered as much as its text. The OCC said plainly that the rule did not address which entity is the true lender in a partnership. And it said it had consistently opposed predatory lending, including through relationships between banks and third parties, and that the rule did not change that position.

The OCC’s rule was meant to lift Madden’s shadow for national banks. The Federal Deposit Insurance Corporation, which supervises many state-chartered banks, adopted a similar rule for those banks on June 25, 2020. Its rule rested on Section 27 of the Federal Deposit Insurance Act, added in 1980, which lets state banks charge the rate permitted where they are located, much as national banks may. The FDIC had stated the valid-when-made view in a 1998 legal opinion but had never put it in a regulation.

The relief was not universal, though. That summer, California, Illinois and New York sued the OCC, and a group of states challenged the FDIC rule, arguing that both rules let lenders slip around state limits on interest rates. The OCC also turned to the question its first rule had left open, proposing a separate true lender rule in July 2020.

The rule was one piece of a broader OCC agenda on financial technology. In July 2018, the agency had said it would accept applications for special purpose national bank charters from fintech companies. New York’s financial regulator sued to block that plan, and the litigation was still under way in May 2020. Partnerships with existing banks remained the main route for fintech lenders that wanted national reach.

For bank boards and fintech founders, the week brought welcome clarity on one point. The risk was in hearing it as clarity on everything.

Bank-fintech lending programs rest on a simple structure. A bank originates the loan, often under its home state’s interest rate rules, and sells the loan or its receivables to a fintech partner or investors. “Originate” just means the bank is the party that makes the loan in the first place: it signs the contract with the borrower and sends the money. “Receivables” are the payments the borrower still owes, which can be bought and sold like any other asset.

The structure raises three distinct questions. The first is whether the loan keeps its permissible rate after the sale. The second is whether the bank is really the lender. The third is whether the bank can show that it oversees the program it lends its charter to. The OCC’s rule answered the first. For bank boards, chief compliance officers and fintech partners, the risk lay in treating that answer as if it covered all three.

The sections below start with how charters and partnerships divide the work, then take the three questions in order. They then map each question to the kind of loss it produces, describe how the better programs were run, and close with questions a board can use to test its own partnerships.

Charters, fintechs and who does what

Start with the charter. A bank charter is a license from a state or federal regulator to take deposits and make loans. It comes with heavy obligations: capital requirements, regular examinations, consumer protection duties and anti-money-laundering programs. It also comes with valuable privileges. One of the most important is the ability of a national bank to “export” the interest rate permitted in its home state to borrowers in other states. A bank based in a state with high or no rate caps can lend nationwide at the rates its home state allows.

Where rate exportation comes from

The export power has a long legal history. The National Bank Act lets a national bank charge interest at the rate allowed by the state where it is located. In its 1978 Marquette decision, the Supreme Court held that a national bank could charge that home-state rate to borrowers in other states. In 1996, in Smiley v. Citibank, the Court upheld the OCC’s view that “interest” includes certain fees, such as late fees. In 1980, Congress gave state-chartered banks a parallel power through the law that added Section 27 to the Federal Deposit Insurance Act. The same law let states opt out of that parity for loans made in their state, an option few states used.

The practical result is geographic. Partner banks cluster in states whose laws allow high rates or impose no general cap, and Utah and a handful of other states became home to banks known for partnership lending. A borrower in a state with a 36 percent cap could receive a loan priced well above it, lawfully, because the lender was a bank in another state.

Who does what

A fintech, short for financial technology company, usually has the opposite profile. It is good at software, marketing and customer experience, and it can move quickly. It does not have a charter, and getting one is slow and expensive. Partnering with a bank lets it offer loans nationwide without becoming a bank or getting a separate lending license in every state.

In a typical program the work is split like this. The fintech runs the website or app, attracts customers and often builds the credit model, the set of rules and statistical scoring that decides who gets approved and at what price. The bank formally approves and funds the loan. Within a short window, sometimes days, the bank sells the loan or its receivables to the fintech or to investors the fintech has lined up. The fintech, or a company it hires, then services the loan: collecting payments, answering customer questions and handling hardship requests.

The arrangement works like a restaurant franchise. The customer sees the franchisee’s staff and storefront, but the brand owner’s name is on the sign. When something goes wrong, inspectors and the public look to both.

Money flows in a few directions. The bank earns fees or a share of the program’s revenue. The fintech earns the interest and fees on the loans it buys, minus its costs. Investors may buy pools of loans or fund them through a securitization, which bundles many loans into a security that pays investors from borrowers’ payments. Each of those buyers depends on the loans continuing to earn the rate stated in the contract.

How it differs by institution

The rules differ by charter. A national bank answers to the OCC, which issued the May 2020 rule. A state-chartered bank answers to its state regulator and to either the FDIC or the Federal Reserve, and relies on the FDIC’s rule and Section 27. Many partner banks are small state banks, which means a large national lending program can rest on an institution with a modest compliance staff. Industrial banks, a state charter used mainly in Utah, are supervised by the FDIC and also host partnership programs.

Credit unions are a different case. Federal credit unions are subject to a federal interest rate ceiling set by statute and the NCUA. It is far below the rates many partnership programs charged, so the export model largely does not apply to them. The fintech that skips partnership altogether is another case. It obtains lending licenses in each state, complies with each state’s rate caps and answers to state regulators and the CFPB directly. That route is slower and limits pricing, but it removes the true lender question entirely.

Question one: does the rate survive the sale

Madden created uncertainty in the Second Circuit, which covers New York, Connecticut and Vermont, about whether non-bank buyers of bank-originated loans could keep charging the rate the bank had charged. That uncertainty touched loan sales, securitizations and marketplace lending programs. Investors priced it in, and some programs avoided borrowers in affected states.

“Priced it in” is worth unpacking for a non-specialist. Suppose you are buying a pool of loans, and a court might say you cannot collect the interest written in the contracts. You pay less for the pool, or you demand protections from the seller, or you leave out loans to borrowers in the states where the risk is highest. Each of those responses raises the cost of credit or narrows who can get it.

How the rule works

The OCC rule, and the FDIC’s for state banks, said permissibility is fixed when the loan is made and is not affected by a later transfer. Supporters saw this as restoring a long-standing assumption, one they traced to nineteenth-century case law on the sale of debts. Critics, including several state attorneys general, argued it would let non-banks evade state rate caps. Both sides were arguing about the same mechanism. A state rate cap is a consumer protection; a bank’s ability to export its home-state rate is a federal privilege. The rule decided which one follows the loan after a sale.

The rule’s reach was carefully limited. It applied to loans a bank actually made and then transferred. It did not authorize a non-bank to charge any rate on loans it made itself. It did not decide whether the bank was the true lender. And it said nothing about how a bank should oversee a partner. A loan that passed the rule could still be challenged on each of those grounds.

The strongest case against the rule

The states’ argument deserves a fair hearing. State rate caps exist because high-cost credit can trap borrowers in debt. A rule that lets a loan carry a home-state rate into the hands of a non-bank, which the borrower’s state would otherwise regulate, weakens that protection. If the bank’s role is brief and formal, the borrower experiences a loan from a non-bank priced above the local cap.

The supporters’ answer was about markets. Banks sell loans to manage capital and liquidity. If buyers cannot rely on the rate, every bank loan becomes less liquid, and the cost falls on all bank borrowers, including those paying modest rates. Both arguments are sound on their own terms. The rule resolved the market question in the supporters’ favor and left the consumer protection question to the true lender doctrine and to state law. That allocation is why the second question became the contested one.

Evidence the rule depends on

For secondary markets, the places where existing loans are bought and sold, the rule reduced transfer risk. It did not end the policy debate, and its durability depended on litigation not yet filed. Prudent institutions treated it as a significant improvement rather than a final answer. They also kept the evidence that mattered under the rule: documentation that each loan’s terms were set by the bank at origination, under the bank’s own credit policy, before any sale.

That last point is easy to skip and expensive to neglect. A rule that protects loans that were valid when the bank made them only helps if you can show the bank really made them on its own terms. In practice that means a written credit policy approved by the bank, records showing each loan was decided under it, and a clear timestamp showing the terms were fixed before the sale.

Investors added their own layer. Loan purchase agreements and securitization documents typically carry representations from the seller that each loan was validly originated and complied with applicable law, with repurchase obligations if a representation proves false. Those clauses move the financial consequence of a bad loan back toward the bank or the fintech. They make the origination record a contractual asset as well as a regulatory one.

How markets had worked around Madden

Before the rule, programs that wanted to keep lending to borrowers in the Second Circuit adjusted their structures. Some excluded those borrowers or priced loans to them below the local cap. Others had the bank keep ownership of the loans and sell only an economic interest in them, so that the bank remained the creditor of record. Each workaround had a cost in revenue, capital or complexity. The rule let programs unwind some of them, but the prudent ones kept the record-keeping habits the workarounds had forced on them.

Question two: is the bank the true lender

State regulators and courts had challenged some partnership programs on a separate theory. They argued the non-bank partner, not the bank, was the true lender. The bank, in this view, was a name on the paperwork while the fintech did the real lending. Courts and states looked at who marketed the loans, who designed the underwriting, who bore the economic risk and how quickly loans were bought after origination. If the partner was the true lender, state licensing and rate limits could apply to it directly, regardless of what the bank could have charged.

The valid-when-made rule did not touch that question. A program could satisfy the rule and still lose a true lender challenge. The rule says a valid loan stays valid after a sale. The true lender argument says the loan was never really the bank’s to begin with. One protects the journey of the loan; the other questions its birth.

The tests courts used

Courts did not agree on a single test. Some looked mainly at the face of the transaction: if the bank was named as lender and funded the loan, it was the lender. Others applied a totality-of-the-circumstances analysis, and within that, a predominant economic interest test: whoever bears most of the risk and reward of the loan is the real lender. West Virginia’s highest court applied that kind of reasoning against a non-bank lender in 2014. A federal court in California did so in 2016 in a CFPB case against a lender whose loans were made in the name of a tribal entity rather than a bank. The doctrine was never confined to bank partnerships.

Colorado’s regulator brought true lender and rate-exportation claims in 2017 against two fintech lenders and their partner banks. Those cases were pending when the OCC rule was issued. They were a reminder that the true lender question could be raised by a state administrator as well as by a borrower in litigation. The result could also depend on the state’s own lending code.

Facts that decide it

The relevant facts are found in the program’s contracts and cash flows. The first is who holds the predominant economic interest, meaning who actually makes or loses money if borrowers pay or default. Others are whether the bank keeps any loans or a meaningful share of their risk, and whether it can change the credit model, decline applications or end the program. Banks and partners needed counsel to assess those facts against the tests applied in the states where they lent. They also needed to accept that the answer could differ by state.

Program design could shift the analysis. Some banks retained a share of each loan, approved every change to the credit model and controlled pricing. They were in a stronger position than banks that sold every loan within days and accepted a partner’s model as delivered. Those choices cost the bank capital and attention. They were also the evidence a court would examine.

Some features cut the other way, and programs should look for them. Examples include a guarantee from the fintech to buy every loan regardless of performance, and a bank fee that does not vary with loan quality. A collateral account the fintech funds to cover any bank loss is another. Each suggests the bank bears little risk. Each may have a sound business reason. Together, they tell a story a court can read.

A state-by-state map

The operational answer to a question that varies by state is a map. Counsel builds a matrix of each state in which the program lends: its rate caps, its licensing requirements, its case law on true lender, and any anti-evasion statute. The program then decides, state by state, whether to lend, whether to price under the local cap, or whether to stay out. The matrix needs an owner and a review schedule, because state law in this area changed often after 2020. A program that last checked the map at launch is relying on a document that may no longer describe the law.

What losing would cost

The consequences of a true lender finding vary by state, and that is part of the risk. Depending on the state’s law, loans priced above the cap may be void or unenforceable in part. Borrowers may be owed refunds of interest, and the non-bank may face penalties for lending without a license. The bank may face no direct liability under state law, but it faces supervisory questions about why it lent its charter to a program that a state found to be evasive. Investors holding the loans may find the cash flows they bought are smaller than they paid for.

Two programs, one rule

Consider two hypothetical programs. In the first, the fintech partner designs the credit model, the bank receives a monthly summary, and every loan is sold to the partner two days after funding. The bank earns a flat fee per loan and keeps none of the credit risk. In the second, the bank’s credit committee approves the model and every change to it, and sets pricing bands. The bank keeps a five percent slice of every loan on its own books and can halt originations on notice. Both programs may benefit equally from the valid-when-made rule. Only one of them looks, on the facts, like the bank is doing the lending. The second bank pays for that in capital it ties up and staff time it commits. The first saves that money and carries a risk it may not have priced.

Question three: can the bank prove its oversight

Whatever the answers to the first two questions, a bank that originates loans through a partner remains responsible for the program’s compliance. That covers consumer protection law, fair lending, Bank Secrecy Act obligations and safety and soundness expectations. Third-party risk management guidance applies to the relationship. A partner that runs the customer experience, the underwriting model and servicing does not take on the bank’s supervisory accountability.

A few of those terms deserve a sentence each. Fair lending laws prohibit discrimination in credit decisions, including through models that look neutral but produce unfair outcomes for protected groups. The Bank Secrecy Act, often shortened to BSA, requires banks to know their customers, watch for signs of money laundering and fraud, and report suspicious activity to the government. Safety and soundness is the regulators’ catch-all for whether the bank is being run prudently enough to stay healthy. Third-party risk management is the discipline of supervising vendors and partners as if their failures were your own, because to a regulator they are.

What examiners look for

Proving oversight takes more than a contract clause. Examiners look for evidence that the bank reviews the partner’s marketing before it runs, receives and analyzes complaints, validates and fair-lending-tests the credit model, monitors transactions for suspicious activity and tests the partner’s controls. The bank needs the staff to do that work and the contractual rights to see the data. Oversight costs should be priced into the program’s economics from the start. A partnership whose margin only works if oversight is light is a partnership the bank cannot afford.

Customer identification and suspicious activity

In a partnership, the fintech collects the borrower’s identity information through its app. The bank’s customer identification program obligations do not move with that task. The bank must know what data the partner collects, how it is verified, which vendors do the verification and how exceptions are handled. It must also be able to see transactions well enough to file suspicious activity reports and screen for sanctions. A bank that receives only a monthly file of funded loans cannot meet those duties. It will miss applicants who defaulted on their first payment, and those who applied many times under slightly different names.

Fair lending, servicing and protected borrowers

The credit model is usually the partner’s, but the lending decision is legally the bank’s. That means the bank owns the fair lending analysis, including testing for disparate outcomes and checking that decline reasons sent to applicants match what the model weighed. Servicing raises its own obligations. Servicemembers have protections under the Military Lending Act and the Servicemembers Civil Relief Act, and collection practices are subject to rules on unfair, deceptive or abusive practices. A bank should be able to show that the partner identifies covered borrowers and applies those protections correctly.

Testing the partner’s controls

Reviewing documents is different from testing controls. A bank that tests will pull a sample of applications and trace each one from the app through the decision to the funded loan, checking that the approved credit policy was applied. It will place test calls to the partner’s customer service line, read a sample of collection notes and check that hardship requests were handled as the policy says. It will compare the partner’s complaint log with complaints that arrived at the bank directly. Differences between what the partner reports and what the tests find are the most useful oversight information a bank can have.

Marketing and disclosures

Marketing is where a partnership most often looks like the fintech’s product and least like the bank’s. The bank should approve advertising, website copy, app screens and scripts before they are used, including material placed through social media and affiliates. Disclosures must name the bank as lender where the law requires it and meet Truth in Lending Act requirements. A review log showing what was submitted, what the bank changed and when it approved it is the evidence examiners ask for. It is also evidence on the true lender question, since control of marketing is one of the facts courts weigh.

Data is the heart of oversight

Data access is the practical core of oversight. The bank should receive loan-level application, decision, pricing, servicing and complaint data on a schedule it sets, in a format its own staff can analyze. “Loan-level” matters: it means the record of every individual application and loan, not averages and totals. With that, a bank analyst can check whether approval rates differ by neighborhood, whether pricing drifted from the approved bands or whether complaints cluster around one collection practice.

Relying on the partner’s summary dashboards leaves the bank seeing only what the partner chooses to show. A dashboard is a curated view; it may be accurate and still omit the one pattern an examiner will find.

Contract rights

The contract should also cover the bank’s right to audit, to require remediation and to suspend originations if controls fail. It should spell out what happens to customers and records if the relationship ends. Each of these terms is easier to win before launch than after a supervisory finding. Once a program is live and profitable, every new right the bank asks for becomes a negotiation about money.

When the partner fails

Fintech partners are often young companies funded by investors, and some will fail. The bank needs a plan for that day before it arrives. A backup servicer, or at least a tested arrangement for moving servicing to one, keeps payments flowing and borrowers informed. Copies of loan-level records, held by the bank or in escrow, let the bank prove what each borrower owes and has paid. Prepared customer communications avoid weeks of confusion. These provisions are cheap to write at launch and very expensive to improvise during a partner’s collapse.

Who pays for oversight

Oversight is a fixed cost that grows with the number of partners as well as with loan volume. A small bank with several partners needs compliance, BSA, model risk and complaint staff for each program, plus systems to receive and analyze each partner’s data. Some banks recover the cost through a minimum monthly fee from the partner; others build it into the revenue share. The method matters less than the principle: the program’s pricing should be set after the oversight budget is known, not before.

Three questions, three kinds of loss

For a bank, a partnership program can be an attractive source of fee income and growth with modest upfront investment. That is precisely why the three questions matter. Each one maps to a different kind of loss.

• Rate risk hits the value of the loans. If a court says buyers cannot collect the contract rate, loan pools lose value and investors become harder to find.
• True lender risk hits the legality of the whole program in particular states. A finding that the partner was the real lender can expose the partner to licensing violations and rate-cap claims, and drag the bank into the dispute.
• Oversight risk hits the bank’s relationship with its own supervisor. Weak oversight can lead to enforcement actions, growth restrictions, required lookbacks and remediation, and reputational damage that reaches far beyond the program.

How the losses interact

The three losses are distinct, but they can arrive together. A program with weak oversight produces poor records. Poor records make it harder to prove the bank set each loan’s terms, which weakens the bank’s position on the first question. They also make it harder to show the bank controlled the program, which weakens it on the second. Oversight is therefore the question whose answer supports the other two. A bank that invests in it gains evidence for every dispute it might face.

Who bears each loss

For customers, the stakes are concrete. Borrowers care whether they were priced fairly, treated well in collections and protected if the partner fails. For regulators, the concern is that a bank charter, a public trust backed by deposit insurance, is being rented out without the bank doing the job the charter requires.

For the fintech partner, the point is the mirror image. Its business model depends on the bank’s charter staying in good standing. A partner that resists data requests or treats bank oversight as friction is undermining the asset it most needs.

Investors bear the rate and true lender losses most directly, and they priced both. After Madden, some excluded loans to borrowers in the affected states. After the 2020 rules, many continued to ask for state-by-state analysis and for indemnities against true lender claims. Their diligence questions are a useful checklist for a bank, because investors ask them with money at stake.

The counter-argument from scale

One objection to this approach is that it favors large banks. A community bank with a few compliance staff cannot oversee several fintech partners to the standard described here. The demands therefore push partnership lending toward fewer, larger banks or toward fintechs obtaining their own charters. The objection is partly right. The response is that a bank which cannot afford to oversee a program cannot afford its consequences either. A smaller bank can take on fewer partners, cap volumes until oversight is proven, and grow only as fast as its control functions.

How the better programs were run

A well-run program tends to share a handful of traits:

• The bank’s board approved the program with a clear-eyed view of all three questions, beyond the legal status of the rate.
• The bank owns the credit policy in writing, approves the model and every material change to it, and can show records that each loan was decided under that policy before sale.
• The bank has considered keeping a share of loans or risk, and has made that choice deliberately rather than by default.
• Oversight is staffed and budgeted, with named people who review marketing, analyze complaints, test the model for fair lending and monitor for suspicious activity.
• The bank receives loan-level data on its own schedule and in its own format, and actually analyzes it.
• The contract gives audit, remediation and suspension rights, and an exit plan that protects customers and records.

A sensible sequence

The order of work matters. A bank considering a new program can start with its board setting a risk appetite: which products, which rate ranges, which states and how many partners. Counsel’s state-by-state analysis comes next, before any contract is signed. Then the bank writes or adopts the credit policy, decides how much of each loan it will keep, and specifies the data it needs and the systems that will receive it. Only then does it negotiate the contract. A launch with volume caps, lifted as oversight evidence accumulates, protects the bank while the program proves itself.

Measures the board should see

Board reports work best when they show the program’s behavior alongside its revenue. Useful measures include approval and pricing by segment, complaint volume and themes, and the number of model changes approved in the period. Exceptions to the credit policy, early-payment defaults and the results of the latest marketing and fair lending reviews belong there too. A sudden change in any of them is a reason to ask the partner a question before an examiner does.

Roles and owners

Programs that held up named their people. On the bank side, a program executive owns the relationship and its results. The compliance officer owns marketing review and complaint analysis, the BSA officer owns customer identification and suspicious activity monitoring, and the model risk function owns validation. Third-party risk management owns due diligence and ongoing monitoring, and internal audit tests all of it independently. The fintech names counterparts for each. A joint committee that meets monthly, with minutes and an action log, turns those names into a working governance process that an examiner can follow.

The failures

The failures are the inverse. One is hearing “the rule resolved our legal risk” and relaxing on everything else. Another is pricing the program on its revenue and treating compliance as overhead to be squeezed. A third is accepting the partner’s model “as delivered” because the partner’s data scientists know more than the bank’s. A fourth is relying on summary dashboards. And a fifth is negotiating oversight rights only after an examiner has asked why the bank does not have them.

Board reporting should keep the three questions apart. Each deserves its own owner and evidence: the legal status of the rate, the true lender analysis, and the oversight record. A board told that the new rule had resolved the legal risk heard an answer to one question. The same separation applies to any arrangement in which a bank lends its charter to a product it does not fully operate, including deposit and payments programs.

Testing a partnership from the boardroom

These questions are written for a director, CEO or general counsel who is not a lending specialist. Good answers will be specific and backed by documents. The board should ask for the documents, not a summary of them, at least for one partner each year.

1. For every partnership loan, can we show that its terms were set by us at origination, under our own credit policy, before it was sold?
2. Which states do our partner programs lend in, and has counsel assessed true lender exposure in each of them separately?
3. Who holds the predominant economic interest in these loans, and do we keep any of them or a meaningful share of their risk?
4. Do we receive loan-level data on application, decision, pricing, servicing and complaints, on our schedule, and who analyzes it?
5. If the partner failed tomorrow, what would happen to customers, their money and their records?

The answers should drive action. A partner whose answers are weak on one question can be put on a remediation plan with dates. A partner whose answers are weak on several should have its volumes capped until they improve. The board should also see how the answers change from year to year. A program that was well controlled at launch can drift as it grows, as staff change and as the partner’s own priorities shift.

A leadership team that can answer these crisply is managing a partnership. One that cannot is renting out a charter and hoping.

With hindsight

The valid-when-made rules survived. The OCC rule took effect in August 2020 and the FDIC’s soon after. In February 2022, a federal court in California upheld both rules against the states’ challenges, finding that the agencies had acted within their authority. For loan buyers and investors, that confirmed the main benefit of the week: the rate a bank lawfully set at origination would travel with the loan.

The true lender question went the other way. The OCC’s separate true lender rule, finalized in October 2020, would have treated a national bank as the lender if it was named as lender in the loan agreement or funded the loan. It did not survive: Congress repealed it under the Congressional Review Act, and the repeal was signed in June 2021. The Congressional Review Act is a law that lets Congress overturn a recently issued agency rule by a joint resolution. With that rule gone, true lender risk stayed with courts and states. Banks could not point to a single federal answer.

States filled the space. In August 2020, Colorado settled its long-running cases against two fintech lenders and their partner banks, with terms that limited the rates charged to Colorado borrowers. In 2021, Illinois enacted the Predatory Loan Prevention Act, which capped consumer loans at a 36 percent all-in rate. It included anti-evasion provisions that can treat a non-bank as the lender if, among other tests, it holds the predominant economic interest in the loan. Several other states adopted similar provisions in the following years. In 2023 Colorado passed a law opting out of the federal provision that lets out-of-state state-chartered banks export their home-state rates, using the option Congress had written into the 1980 law. Industry groups challenged the opt-out in court before it took effect.

Some fintech lenders concluded the cleanest answer to the true lender question was to become banks. LendingClub completed its acquisition of a bank in early 2021, and SoFi received approval for a national bank charter in early 2022. A charter removes the partnership question for the lender’s own loans, at the price of full bank supervision.

Oversight turned out to be the question that mattered most. From 2022 onward, federal regulators took a series of enforcement actions against banks with fintech partnership programs, often focused on BSA compliance, fair lending and third-party oversight. Among them were an OCC formal agreement with Blue Ridge Bank in 2022, later replaced by a cease-and-desist order. The FDIC entered a consent order with Cross River Bank in 2023, and the Federal Reserve issued a cease-and-desist order against Evolve Bank & Trust in 2024. The FDIC issued further consent orders in 2024 to smaller partner banks, among them Lineage Bank and Thread Bank. In June 2023 the federal banking agencies issued joint guidance on third-party relationships, replacing their separate earlier guidance.

The 2024 collapse of the middleware firm Synapse showed how poor recordkeeping in partnership arrangements can harm end users. Middleware is the technology layer between a bank and the apps that customers use, passing instructions and keeping track of who owns what. When those records are incomplete or do not match the bank’s, ordinary people can find it hard to prove which money is theirs. In July 2024 the federal banking agencies issued a joint statement on the risks of bank-fintech arrangements for deposit products and asked for public comment. In September 2024 the FDIC proposed a recordkeeping rule for custodial accounts held for the benefit of a fintech’s customers.

Federal policy on fintech charters also settled into a pattern. The New York challenge to the OCC’s special purpose charter was dismissed in 2021 without a ruling on the merits, and the charter saw little use for lending. The route that fintech lenders actually took to their own charters was acquisition or a full national bank application, as LendingClub and SoFi did.

Looking at the three questions together, the record is clear. The rate question was answered and the answer held. The true lender question was never answered at the federal level and became more state-specific after 2020. The oversight question, which no rule could answer, drew most of the supervisory attention and most of the enforcement.

The rule gave certainty on one question; the other two did more to shape the market. Legal permission to do something is different from being able to show you did it well. In any arrangement where your license or brand sits on a product someone else runs, the questions that eventually decide your fate are who is really in charge and what records prove it. Boards that kept those questions separate in 2020 were better prepared for what followed.