As an increasing number of financial institutions enter into partnerships with fintechs and other vendors, a consortium of financial institutions is making an effort to standardize how banks approach third-party due diligence.

The initiative began after Alloy Labs Alliance membership banks noticed firms were implementing regulatory guidance in slightly different ways, Alloy Labs CEO Jason Henrichs said.

As a result, Alloy Labs Alliance and a dozen of the consortium’s member banks spent the past year working on a framework they hope will help serve as a guide for firms navigating the complexities of bank-fintech relationships. 

Henrichs, who shared an executive summary of the guide with Banking Dive, said the framework isn’t meant to replace existing regulatory guidance, but rather help banks better implement it.

“The challenge, typically, is translating guidance into the practical, ‘What am I doing day to day?’” he said. “That's why, starting from the same guidance, banks can end up in very different places in how they implement it. Think of this as an implementation guide that builds on top of regulation and guidance.”

Alloy Labs and several member banks created the guide after hosting regular, monthly working sessions with business, operations, risk and compliance executives from roughly a dozen institutions.

The participants were divided into eight groups, covering categories ranging from business continuity, incident reporting, operational resilience and assessment of subcontractors, Alloy Labs said.

Bankers shared knowledge and debated best practices in sessions that were facilitated by public accounting, consulting and technology firm Crowe.

The groups developed a list of seven key questions banks need to address so they can assess the level of risk present in a particular third-party relationship.

Questions include: “How does this partner complement or enhance our strategy and align to our culture?”; “What type of customer interaction or data exposure does this partner have?” and “What monitoring and reporting is necessary for ongoing evaluation of the relationship?”

The questions were used to develop a consensus on the expected level of maturity of a fintech partner, Alloy Labs said. 

Based on an assessed level of maturity, the groups established due diligence expectations, requests, ongoing monitoring and triggering events for enhanced due diligence, which the consortium plans to release in subsequent guides throughout 2023.

“This is a bank-driven initiative,” Henrichs said. “Why are we doing this now? Because the banks told us to.” 

As bank-fintech partnerships become more prevalent in the industry, the tie-ups have attracted increased regulatory attention. 

Michael Hsu, the acting head of the Office of the Comptroller of the Currency, called out bank-fintech partnerships in September, saying such tie-ups could put the financial system at risk of a crisis if not properly supervised.

The heightened focus means banks need to make sure their deals with fintechs are thoroughly vetted — not only to the satisfaction of regulators, but also to remain competitive.

Fintechs in the market for embedded banking services may become more selective as regulators step up oversight, Jonah Crane, a partner at financial services advisory and investment firm Klaros Group, told Banking Dive in October.

“They may prioritize resilience and stability and a bank who has committed to getting the compliance piece right over speed, whereas previously, speed to market was a big factor for fintechs looking for bank partners,” Crane said.

Helping banks — mainly community and midsize institutions — remain competitive is a central mission for Alloy Labs.

Since launching in 2018, the consortium has sought to leverage collaboration and the collective knowledge of its membership institutions to help them compete with some of the country’s largest banks.

The group in October released a guide focused on defining the roles and responsibilities in banking-as-a-service partnerships. The consortium’s members comprise about 30% of the market share of banks that offer BaaS, according to American Banker. 

Alloy Labs also launched its own peer-to-peer (P2P) payments network, CHUCK, last year. It manages the platform in partnership with digital payments company Payrailz.

CHUCK has been touted as a competitor to Zelle, the network owned and operated by Early Warning Services — a firm that, in turn, is owned by a group of the nation’s largest banks, including JPMorgan Chase, Wells Fargo and Bank of America.

“Ironically, the biggest banks have done a better job of working together,” said Henrichs, who noted the creation of The Clearing House and Zelle as examples of successful multibank collaborations initiated by the nation’s largest institutions.

But community banks are going through a mindset change, Henrichs added, and efforts like the initiative to standardize best practices for third-party due diligence showcase how smaller firms are “not out of the game when it comes to innovation.” 

“They're reinventing what it means to be that community bank,” he said. “Third-party due diligence might seem mundane, but it's a really important step, because if they're not fixing things like that, they're not going to be positioned to do more interesting and innovative things.”

President Joe Biden in October announced an executive action to pardon all prior federal offenses of simple possession of marijuana, and encouraged governors to follow suit with regard to state offenses. 

And in what is largely seen as a major step toward decriminalization, the president said he is asking the secretary of health and human services and the Justice Department to review cannabis’ designation as a Schedule 1 drug, a classification reserved for the most dangerous substances, such as heroin and LSD.

“Too many lives have been upended because of our failed approach to marijuana. It’s time that we right these wrongs,” Biden said in a statement.

The potential for cannabis to be de-scheduled, or taken off the controlled substances list, could be a game-changer for some of the banks that serve the emerging market, industry observers said. 

“De-scheduling would largely remove many, if not all, of the legal hurdles and fears that keep financial institutions from entering this space,” said Sahar Ayinehsazian, a partner at cannabis law firm Vicente Sederberg, where she co-chairs the banking and financial services access group. 

While it is likely that the increased compliance burdens associated with banking cannabis would remain for the time being, fear of federal prosecution would largely be gone, Ayinehsazian said.

“The risk of federal prosecution, combined with the heightened compliance burden and reputational concerns related to cannabis has been the main hurdles to cannabis banking,” she added. “Removing the risk of federal prosecution through de-scheduling should help to lessen the compliance burden and work to eviscerate the discriminatory reputational risks associated with cannabis, thereby vastly increasing access to banking services for legal and compliant cannabis businesses.”

Some cannabis banking analysts, however, said de-scheduling the drug could actually usher in more compliance reporting requirements for banks involved in the space.

“The increased access poses a problem for nefarious capital to enter the financial system,” Mark Lozzi, CEO of cannabis compliance fintech Confia.

While changing cannabis' Controlled Substances Act designation would provide additional comfort to bankers who choose to serve the industry, the existence of the illicit market means banks wouldn’t be absolved from performing their compliance obligations, said Robert Baron, chief experience officer at StandardC, a cannabis banking compliance firm.

“Bankers will still need to perform robust [know-your-customer] and monitoring of their cannabis customers, customers’ clients, and their vendors to mitigate the risk of money laundering that could be injected into the legal cannabis industry from the illicit market,” Baron said. 

Compliance hurdles aside, the prospect of banking the emerging industry free of the current legal implications could be enough to entice some firms that have been on the fence, Ayinehsazian said.

“It may be a bit longer before we see the larger players like Wells Fargo, Citi or Chase coming in,” she said.

Lozzi said he thinks de-scheduling could lead to increased participation from banks, but agreed that the uptake would likely not be mainstream.

“Banks will not be required to have a cannabis program. Managing a cannabis program is expensive and could be distracting to a bank’s core operation,” he said, adding some financial institutions may be wary of the reputational risks associated with operating a marijuana banking unit.

“So while I think there will be increased access for cannabis operators, it will not be the case where you can walk into any bank to open your cannabis account,” he said.

New guidance?

A change in cannabis classification could result in a relaxing of the “Marijuana Limited” suspicious activity reports banks are required to file with the Financial Crimes Enforcement Network, Ayinehsazian said.

Such an action might also force FinCEN to amend or issue new guidance to financial institutions, Baron said.

“When cannabis is no longer illegal by default, which it has been according to its scheduling within the Controlled Substances Act in 1970, the original guidance is no longer needed and could be reissued to contain more risk-appropriate requirements that are less burdensome on financial institutions,” Baron said.

SAFE Banking

Since banks have largely refrained from servicing marijuana-related businesses due to cannabis’ classification as a Schedule 1 drug, many such businesses deal primarily in cash, making them targets of theft, cannabis reform advocates argued.

The Secure and Fair Enforcement Banking Act, a bill that would provide protections to financial institutions that offer services to cannabis-related businesses, has been touted by bank trade groups and cannabis industry stakeholders as the answer to the industry’s cash problem.

However, despite passing in the House seven times, the Senate has yet to vote on the measure.

Rep. Ed Perlmutter, D-CO, praised Biden’s order to review how marijuana is scheduled, but warned a lesser classification would not solve the industry’s banking woes.

“[E]ven if marijuana is moved to a lower schedule on the Controlled Substances Act, we will continue to face banking conflicts between federal and state law,” said Perlmutter, who has introduced the SAFE Act in every Congress since 2013 but isn’t seeking re-election. 

But should Biden’s executive order result in a full de-scheduling of cannabis, some industry observers argued SAFE Banking would no longer be needed.

“Given that de-scheduling would largely solve many of the issues the SAFE Banking Act, in its current iteration, seeks to address, it would make the SAFE Banking Act more of an ancillary action rather than a cornerstone for cannabis banking,” Ayinehsazian said.

Some version of the SAFE Banking Act would likely still be necessary to provide a heightened level of comfort for financial institutions and their chartering, examining and insuring bodies, given that Schedule II drugs are still highly regulated, she added.

Lozzi said he thinks de-scheduling cannabis should be enough to give banks the “air cover they have been waiting for to engage in the space,” but it all depends on what language the de-scheduling entails.

If language calls out banking protections, then the SAFE Banking Act becomes moot, Lozzi said. 

But if it doesn’t, some banks may still be too conservative to engage in cannabis until the banking protections are explicitly stated in legislation, he said. 

“Factors that make de-scheduling and SAFE Banking both helpful is timing, as the SAFE Banking Act is much more likely to get into legislation faster than de-scheduling,” he added.

Proponents for SAFE Banking managed to attach the legislation to the House-passed National Defense Authorization Act in 2022. (It was left out of the final text in December.)

Previous attempts to pass the legislation by folding the text into larger bills have also failed.

Yanire Martes, general counsel of digital-asset banking platform Dinara, said some of the news about the cryptocurrency industry in recent months “shocks the conscience.”

In one of the highest-profile examples of the troubling developments, the crypto exchange FTX filed for bankruptcy and its new CEO claimed the company suffered from a “complete failure of corporate controls.”

Martes said Dinara has responded to the various headlines by remaining in “hunker down and build mode,” particularly when it comes to compliance.

A top priority for the startup company in that regard has been setting itself to operate like a regulated banking entity even though it is not directly required to do so.

“This means a level of rigor and discipline that I think is incredibly important and really represents our commitment to ensuring that this is a safe and efficient platform,” Martes said.

Banking regulations

Dinara is aiming to serve as an integrated banking solution for venture-capital firms and startups that manage and transact in both fiat and crypto assets, but it makes clear on its website it is not a bank.

As a result, Martes said the company is in discussions with a banking partner she did not name.

Given this planned collaboration, Martes said Dinara has launched operations in compliance with the Bank Secrecy Act and its implementing regulations, including those to counter money laundering and the financing of terrorism.

Additionally, Dinara is registered with the Financial Crimes Enforcement Network and is pursuing money transmitter licenses in all applicable states.

Martes said these efforts have been resource-intensive, but can be a key differentiator for Dinara in the largely unregulated digital-assets space.

“It sets us apart as having been proactive around the build-out and the proper establishment of a comprehensive regulatory compliance function,” she said.

Martes, who joined Dinara in August, said its compliance initiatives will also set up the company well to comply with any additional regulations that may be coming down the line.

New role

The compliance work Martes has overseen at Dinara has come during her first experience serving as a general counsel.

Previously, she served as head of legal in the Americas for OANDA, where she was the legal and regulatory lead for the U.S. launch of cryptocurrencies and other crypto products and trading offerings.

Some of her other past legal experiences have included serving as an assistant general counsel at the International Swaps and Derivatives Association and as an Axiom Law attorney at Morgan Stanley.

Though she is not a compliance specialist, Martes said Dinara’s commitment to regulatory compliance in the crypto space attracted her to the position.

“From the get-go, it was explained to me that one of the key initiatives was building a firm with a compliance foundation akin to that of a regulated entity,” she said.

Martes credited the support of the outside consulting firm FS Vector with helping Dinara develop its compliance operations, calling them a “trusted partner for me since day one.”

To date, Dinara has gone live with the digital-asset side of its platform and is working with its banking partner to go live on the fiat side of its business.

Tracking the news

Meanwhile, Martes said one of the benefits of monitoring the recent headlines in the crypto industry, such as the developments at FTX, is understanding what went wrong so that Dinara charts a better path.

For example, she said Dinara makes clear that clients’ assets belong to them and not Dinara, and that clients’ assets are kept in fully segregated accounts.

Additionally, the company does not engage in rehypothecation, when financial institutions reuse the assets posted as collateral by clients to secure their own borrowings. She said Dinara also does not commingle funds.

“That turns out to be a really key element for us to highlight given what we've learned and what has happened out there,” Martes said. “And I think that if what follows is an actual regulatory requirement for that to be the case, we are positioned for that.”

Crypto bank Anchorage Digital announced eight executive moves in January designed to boost the company’s compliance.

The bank hired Mark duBose to serve as its chief compliance and risk officer. He previously filled similar roles at Circle and Centre, and spent two years as Santander’s Boston-based chief operational risk officer. He also worked for four years as a senior vice president at Bank of America, according to his LinkedIn profile.

Rachel Anderika, previously Anchorage Digital’s chief risk officer, will become the bank’s chief operating officer. In that role, she will manage Anchorage Digital’s day-to-day bank operations, including new asset support, tech infrastructure, model development and planning, the bank said.

Anderika and duBose’s appointments are pending supervisory non-objection from the Office of the Comptroller of the Currency.

Anchorage Digital hired Dustin Palmer to serve as its interim Bank Secrecy Act officer. Palmer comes to the digital bank from Berkeley Research Group, where he serves as managing director of its financial institutions advisory service. Anchorage Digital wants Palmer to further develop its anti-money laundering controls. Palmer has significant legal experience in government, having served as an attorney for the Department of Homeland Security and as a senior adviser to the Treasury Department’s general counsel on financial crimes enforcement, AML and countering the financing of terrorism, according to his LinkedIn profile.

Anchorage Digital also hired Frieder Weichelt as its chief information security officer. Weichelt previously served as chief risk officer at the crypto platform BitGo.

The executive moves come roughly nine months after the OCC ordered Anchorage Digital to overhaul its AML program and hire a BSA officer. The regulator found the bank failed to implement internal controls for customer due diligence and procedures for monitoring suspicious activity. Anchorage Digital also had failed to implement adequate BSA training for its staff, the OCC said.

In a statement, the bank affirmed it has “set out to meet the highest regulatory requirements, and [is] committed to continuing to work aggressively to do so.”

“We’re reinforcing our commitment to strong regulatory standards and controls today by ushering in new leadership and capabilities that advance a forward-thinking path for regulated crypto,” the bank said.

Anchorage Digital became the first crypto firm to receive a national trust bank charter in January 2021.

For his part, Anchorage Digital CEO Nathan McCauley touched on the timeliness of the C-suite changes.

“Recent market events have reaffirmed what we have long believed: that security and regulation are key to increasing trust in the crypto economy,” he said in January. “Selecting a federal charter has been the cornerstone of our mission to best protect our clients, and we believe the addition of these members to our team is just the latest step in our longstanding commitment to compliant, secure-by-design digital asset banking.”

The bank named four other executives to new roles. Mo Abdoolraman, an alum of Chime, Goldman Sachs and Citi, will serve as Anchorage Digital’s interim head of know-your-customer. 

Daniel Sankey will lead Anchorage Digital’s financial intelligence unit. Sankey previously served as head of financial crimes compliance at Brex and has held various BSA compliance, reporting and investigative roles at Coinbase, Square and Wells Fargo. 

Anchorage Digital also named Scott Schwartz as its deputy BSA officer, in addition to retaining his duties as Office of Foreign Assets Control officer. 

Jessica Perkins will become Anchorage Digital’s enterprise risk management lead, expanding on her role overseeing third-party risk management, the bank said.

State Street named Yvette Hollingsworth Clark as its new global chief compliance officer, the bank said in October.

Hollingsworth Clark, for her part, will report to Brad Hu, State Street’s executive vice president and global head of risk.

“Understanding and effectively managing risk in a dynamic environment is absolutely critical to achieving our business goals,” Hu said. “Yvette is a respected professional in compliance risk management, with a strong record of building and leading effective [anti-money laundering] and compliance frameworks at global financial institutions.”

Indeed, Hollingsworth Clark spent more than eight years at Wells Fargo — first leading the bank’s compliance efforts, and later serving as an executive vice president and regulatory innovation officer, according to her LinkedIn profile. Prior to that, she also served in AML-related roles at Barclays and Citi, and spent two years as a senior examiner and portfolio manager for the San Francisco Fed.

She left the banking sphere for big tech last year, becoming Google’s global head of compliance - trust. 

“Leading financial institutions have opportunities to further strengthen existing compliance risk management practices,” Hollingsworth Clark said in a release. “I am looking forward to working with [State Street’s team] to further build structures and processes that evolve with the global risk landscape.”

Among Hollingsworth Clark’s first big charges, presumably, is helping the Boston-based lender close a proposed $3.5 billion acquisition of Brown Brothers Harriman’s investor services unit. (The parties ultimately terminated the deal in November, citing lack of regulatory approval and a prolonged timeline.) 

State Street said it had been “engaged in discussions” with regulators and had floated changes to the operating model, legal entity structure and approvals needed to get the deal done.

“The regulatory world and the political world has changed significantly since we announced this deal and what we’re looking towards [is] a way to break through and close it in a reasonable time period,” State Street CEO Ron O’Hanley told S&P Global.

The bank said it was even considering modifying the purchase price. State Street and BBH extended talks on the deal, aiming to close it by the end of 2022.

Charlottesville, Virginia-based Blue Ridge Bank named Kirsten Muetzel, a 10-year veteran of the Federal Reserve, as president of its fintech division, the bank announced in January.

The move comes roughly four months after the Office of the Comptroller of the Currency ordered the bank to improve its oversight of third-party fintech partnerships.

Blue Ridge and another Virginia-based bank, FVCB, terminated a planned merger in January 2022, about two months after delaying the transaction over “certain regulatory concerns” the OCC found with Blue Ridge.

“Kirsten is a respected thought leader in the industry, and she brings the perfect combination of banking supervision experience coupled with fintech industry knowledge and business acumen,” Blue Ridge CEO Brian Plum said in a statement. “Kirsten will be instrumental as we continue building the necessary infrastructure to support current partnerships while preparing the foundation upon which to build future success.”

Muetzel served in a host of roles for the Federal Reserve Bank of San Francisco between 2008 and 2019. She specialized in financial sector policy and analysis and counterparty credit risk analysis before serving as chief of staff for the region’s financial institutions supervision and credit unit, and capping her tenure as a central point of contact, according to her LinkedIn profile. 

She later served as head of finance for two fintechs, Metal and EarnUp, and chief risk officer for two more: Synctera and Fundid. Muetzel also spent more than three years focused on capital raising and mergers-and-acquisitions advisory services at Goldman Sachs.

At Blue Ridge, Muetzel is set to manage a portfolio of partners, strengthen regulatory compliance and advance the bank’s banking-as-a-service strategy. 

“There continue to be significant opportunities for banks to develop relationships with fintech firms and create new revenue streams while in turn enhancing products and services to existing customers,” Muetzel said. “Many of these fintech arrangements are focused on improving access to financial services, which can make a real difference in someone’s day-to-day life, and thereby inspires me.”

Under the OCC’s order, Blue Ridge must obtain the regulator’s non-objection before entering into any new contracts with fintech partners or adding new products in cooperation with existing partners.

The bank also agreed to show, in an “action plan,” how it would better monitor suspicious activity, including “high risk customer activity involving … third-party fintech partners.”

A Blue Ridge-appointed compliance committee must also provide quarterly details of corrective actions the bank intends to implement, the timelines to complete them, the names of the people responsible and status updates on those measures.

Hiring Muetzel presumably puts a new name atop that list.

The Commodity Futures Trading Commission is suing crypto exchange Binance and its CEO, Changpeng Zhao, for operating an “intentionally opaque” and allegedly illegal enterprise that violated the Commodity Exchange Act while engaging in “a calculated strategy of regulatory arbitrage to their commercial benefit.”

The CFTC also charged former Binance Chief Compliance Officer Samuel Lim with aiding and abetting the company’s violations.

“For years, Binance knew they were violating CFTC rules, working actively to both keep the money flowing and avoid compliance,” the agency’s chair, Rostin Behnam, said in March. “This should be a warning to anyone in the digital asset world that the CFTC will not tolerate willful avoidance of U.S. law.”

The CFTC alleged that Binance has both offered and executed commodity derivatives transactions for customers in the U.S. since July 2019, and for much of that time didn’t require identity verification for those trading on the platform, despite a legal duty to do so.

After Binance said it would restrict U.S. customers from certain trading, the company allegedly instructed them “on the best methods for evading Binance’s compliance controls” and communicated with U.S. customers on an app set to automatically delete messages, avoiding a paper trail aligned to its U.S. customer retention efforts, the CFTC said.

Additionally, Binance acted as a designated contract market or swap execution facility based on its role in facilitating derivatives transactions, but did not register with the CFTC, the commission alleged.

Gretchen Lowe, CFTC’s enforcement division principal deputy director and chief counsel, alleged that Zhao and others’ own emails and chats reflect the “sham” nature of Binance’s compliance efforts and profits-over-law mindset.

To Binance, however, the filing was “unexpected and disappointing.”

“[W]e have been working collaboratively with the CFTC for more than two years,” a spokesperson told Banking Dive. “Nevertheless, we intend to continue to collaborate with regulators in the US and around the world. The best path forward is to protect our users and to collaborate with regulators to develop a clear, thoughtful regulatory regime.”

Over the past two years, the company has bolstered its compliance team from 100 to 750 people to make sure U.S. users aren’t active on its international platform, the spokesperson said. It’s also spent an additional $80 million on external partners — including know-your-customer vendors, transaction monitoring, market surveillance and investigative tools — which the company taps to support its compliance programs.

Behnam, however, told CNBC that the CFTC had clear documentation of Binance’s intention to dodge the law, noting, "This seemed to be a pretty clear case of evasion and something that we needed to step in aggressively with and do it as quickly as possible because this was an ongoing fraud, going back to 2019, and ongoing violation of the Commodity Exchange Act.”

Court filings include internal chats allegedly from within Binance. In one message to an employee in February 2020, Lim allegedly said, “On the surface we cannot be seen to have U.S. users but in reality we should get them through other creative means.”

Some Binance customers have fled the platform following the announcement of the lawsuit, pulling 3,400 Bitcoin off the platform in the 24 hours that followed, Cointelegraph reported.

On the firm’s official blog, Zhao said the CFTC’s complaint “appears to contain an incomplete recitation of facts.”

“We intend to continue to respect and collaborate with US and other regulators around the world,” Zhao said.

Wells Fargo will pay $97.8 million to resolve U.S. government sanctions related to inadequate oversight of its compliance risks from 2010 to 2015.

The Federal Reserve and the Treasury Department's Office of Foreign Assets Control announced in March that they were imposing $67.8 million and $30 million penalties respectively against Wells Fargo for enabling the violation of federal sanctions against Iran, Syria and Sudan.

The Fed and OFAC said the bank's deficient oversight “enabled it to provide a trade finance platform to a foreign bank that used the platform to process approximately $532 million in prohibited transactions.”

OFAC’s announcement said that, starting in 2008, Wells Fargo and its predecessor Wachovia Bank provided a foreign bank with software that allowed that bank to process 124 transactions involving countries and entities prohibited by OFAC.

The Fed and OFAC do not identify the foreign bank. The trade finance platform was identified as Eximbills.

In an email to Banking Dive, a Wells Fargo spokesperson said the bank was “pleased to resolve this legacy matter involving conduct that ended in 2015, which we voluntarily self-reported and fully cooperated with OFAC and the Federal Reserve Board to address.”

According to OFAC’s public announcement, the bank’s senior management had no direct knowledge of this activity until 2015, and that it “was not a result of a systemic compliance breakdown within the broader Wells Fargo organization.”

Wells Fargo has been subject to billions in federal penalties in the last year, including a $3.7 billion penalty in December to settle with the Consumer Financial Protection Bureau over a slew of consumer abuses related to auto loans, mortgages and deposit accounts.

Carrie Tolstedt, the executive who served as Wells Fargo’s retail-banking chief at the time of its 2016 fake-accounts scandal, was ordered, in recent weeks, to pay $17 million to the Office of the Comptroller of the Currency in connection with the scandal.

The Treasury Department warned of the potential risks to the banking sector as financial institutions continue to use cloud-based technologies, according to a report released in February.

The report cautions against letting a growing number of financial institutions rely on a relative handful of cloud providers to support remote work and promote innovation through artificial intelligence, for example.

Such partnerships can reduce costs, rapidly deploy new information technology assets, lessen the development time for new products and services. But the benefits come at a cost. Risk can vary based on how much of an institution’s IT infrastructure depends on one provider, or how complex the interplay is for a large institution that may use a mix of public and private cloud services along with their own data centers.

Though cloud-computing services are offered by many tech firms, Amazon Web Services, Microsoft Azure and Google Cloud Platform are among the most sought-after.

“A large system failure or data breach at one of these [cloud-service providers] could impact multiple financial institutions or U.S. consumers, though there are open questions about the extent of that impact,” the Treasury Department noted.

The responsibility of cloud providers in case of a breach of banking data has been hotly debated. Lawmakers, banks and cloud providers all seemed to offer differing perspectives on the breakdown of responsibilities in the wake of the 2019 Capital One breach. (The bank uses Amazon Web Services as its cloud provider.)

In the same year, an investigative report by The Wall Street Journal found that China’s intelligence service allegedly stole volumes of intellectual property records from scores of companies for many years. The hackers apparently entered through cloud service providers, where companies thought their data was in safe hands.

But companies like Google and Microsoft vouch that their cloud services are very secure.

“We’re committed to working with financial services customers and regulators to provide them with controls and assurances on risk management, data locality, transparency, and compliance,” a Google spokesperson told The Wall Street Journal.

Financial regulators from various government agencies are expected to discuss the Treasury report at an upcoming meeting of the Financial Stability Oversight Council, headed by Janet Yellen.

The report noted some significant challenges, such as how to increase transparency to support better due diligence and monitoring by financial institutions. The report also cited gaps in the talent pool deploying cloud services, limited negotiation on contracts given the cloud providers’ market concentration, and the prospects for global regulatory consensus.

Treasury will launch an interagency Cloud Services Steering Group within the next year to handle most of the issues identified in the report — namely, closer domestic cooperation among U.S. regulators on cloud services and development of best practices for cloud adoption frameworks and cloud contracts.

Officials from Treasury, the Office of the Comptroller of the Currency, and the Consumer Financial Protection Bureau will be part of the group, a Treasury official told The Wall Street Journal.

Though the report neither endorses nor discourages the use of cloud computing services, it tries to evaluate the risks associated with the limited number of providers.

“There is no question that providing consumers with secure and reliable financial services means greater demand for cloud-based technologies,” said Wally Adeyemo, deputy secretary of the Treasury. “Treasury is committed to working with financial regulators, industry partners and cloud service providers to drive greater collaboration and transparency.

“By building trust, cooperation, and collaboration at the outset, we can promote safe and effective migration for financial institutions that choose to adopt cloud services,” he said.

Apto Payments, the San Francisco-based card issuer, teamed up with Sardine, a fraud prevention, compliance and settlement company headquartered in Miami, to enable clients to launch card programs with fraud prevention capabilities, according to a March press release.

The partnership will let Apto customers issue cards “with support from comprehensive transaction monitoring tools to identify and prevent fraudulent behavior,” according to the press release.

Sardine’s fraud and compliance technology, including its real-time risk-scoring engine, will help Apto generate revenue while reducing risky transactions, Sardine CEO Soups Ranjan said in the statement.

The partnership with Sardine is part of Apto’s efforts to build high-end developer tools and comprehensive card management services for its customers, the company noted. The deal follows Apto’s October announcement that it was partnering with Patriot Bank to help clients issue cards. 

“We are focused on ensuring that our customers can be successful with their card programs, even in the most challenging, highly evolving environments,” Apto Payments CEO Meg Nakamura said in the statement. “Partnering with Sardine allows us to bolster our own fraud and risk engines, resulting in the best cardholder protections in the industry.”

The deal between Sardine and Apto Payments follows a $51.5 million investment funding round for Sardine, with money flowing from Andreessen Horowitz’s Growth Fund, card giant Visa, tech behemoth Google’s venture arm and other investors, TechCrunch reported. The company raised $19.5 million in February 2022.