Cybersecurity Policy Report, Congressional report examines challenges of regulating bank-fintech partnerships, (Feb 26, 2026)

By A. Bryan Gerepka

The report questioned whether a bank can effectively verify the identity of a potential customer when there is no in-person interaction.

As banks become more interconnected with nonbank financial technology institutions (fintechs), policymakers face increasing challenges in reconciling existing and conflicting regulatory frameworks governing information sharing and compliance with the Bank Secrecy Act (BSA), the Gramm-Leach-Bliley Act (GLBA), and Bank Service Company Act (BSCA), according to an “In Focus” report released by the Congressional Research Service. The report also questioned regulators’ ability to examine bank-fintech operations.

Bank-nonbank relationships—particularly ones involving data transfers—are often subject to different regulatory requirements across a range of legal frameworks, the report found. Moreover, when policymakers change or update one set of rules for banks, it could cause confusion, inconsistencies, or even conflicting incentives among market participants, the report stated. The potential gaps in the regulatory framework could mean that a consumer who relies on fintech enterprises to enter the banking system could be exposed to vulnerabilities in the security of their nonpublic information (NPI), the report warned.

Inconsistencies in the current regulatory framework. The report highlighted various inconsistencies, conflicts, and vague arrangements in the current regulatory frameworks and the compliance challenges that arise when traditional banking institutions partner with fintechs.

Many bank-fintech collaborations feature a “banking as a service” business model—the fintech is consumer-facing, while the traditional bank provides core banking services. Under the BSA, which governs anti-money laundering rules and customer identification programs (CIP), financial institutions, including depository institutions such as banks and credit unions, are required to verify customer identity and understand the purposes for which customers open accounts.

Customer vs. consumer. Data privacy is governed by Title V of the Gramm-Leach-Bliley Act (GLBA, 15 U.S.C. §6801 et seq). The GLBA requires banks to protect consumer NPI, but the data privacy regulations only apply to “customers” and not “consumers.” Privacy concerns are elevated when sensitive information is used, and significant NPI can be exposed during the opening of a bank account, the report noted. The statutory and regulatory language implementing Title V of GLBA suggests that the data privacy and safeguard provisions apply only to a customer, defined as a “consumer who has a customer relationship” with the financial institution. According to 12 C.F.R. § 1016.3, this definition does not appear to include the consumer onboarding process, the report stated. This distinction is potentially important in protecting the flow of information at account opening, as it may leave the account holder unprotected during the onboarding process, the report concluded.

While banks are responsible for ensuring that their partnerships comply with relevant banking laws, including AML and data privacy provisions, the report questioned whether a bank can effectively verify the identity of a potential customer when there is no in-person interaction.

In both the BSA and GLBA frameworks, there is no explicit reference to applying these laws to fintech arrangements, although there is some implied application of the laws under the Department of the Treasury’s role to regulate financial activity. Further, BSA policy is broadly developed by the Financial Crimes Enforcement Network (FinCEN), the Treasury bureau that governs AML. However, CIP regulations are implemented by the various financial regulators, and these policies may change with changes in agency leadership, the report noted.

Under the BSCA, regulators examine banks for safety and soundness as well as for compliance with certain banking laws, and supervise the banks’ relationships with third parties. The provisions under this law apply to permissible bank service company activities, including check and deposit sorting and posting, bookkeeping, accounting, statistical, or other related activities. There is no explicit reference to fintech activities, although fintechs often perform these functions, the report noted.

Technology interface presents barrier to effective compliance. The report highlighted several questions that can arise when a layer of technology sits between a fintech and a bank, and the impact it may have on the bank’s ability to comply with various laws. In addition to questions about a bank’s ability to accurately verify the identity of a fintech account holder and protections for transmission of a client’s NPI, the report also asked whether a bank can rely on the secure transmission of information through a fintech app. In addition, the report questioned whether the technology that connects the bank to the fintech is secure enough to adequately safeguard the customers’ NPI, and whether the bank and its regulators examine the operations of the partnership.

LegislativeActivity: BankingOperations BankSecrecyAct CyberPrivacyFeed DataPrivacy DataSecurity FinancialIntermediaries FinTech Privacy