Summary
The Federal Deposit Insurance Corporation is in preliminary discussions with banking and fintech trade groups to establish a "Banking Innovation Standards Development Organization" (BISDO) — an independent standard-setting body that would certify whether bank tech vendors meet federal regulatory guidelines. Under the proposed framework, a separate independent assessor would evaluate fintech responses to standardized due diligence questions, and passing vendors could receive a certificate that banks accept as proof of passing due diligence. The initiative is particularly aimed at helping community banks that lack resources to vet multiple tech providers.
Key Facts
- BISDO term sheet circulated among trade groups (dated July 21); two meetings held so far
- Independent standard-setting body + conformity assessment (attestation and certification) program
- Participating groups: ABA, ICBA, Bank Policy Institute, Financial Technology Association, American Fintech Council, Consumer Bankers Association, Coalition for Financial Ecosystem Standards
- Certification would allow a provider/solution/controls to be "assessed once, kept current and used by multiple banks"
- Voluntary for both banks and fintech vendors; no safe harbor from regulatory action
- Scope covers third-party risk management, cybersecurity, BSA/AML, governance, due diligence, business continuity
- Modeled partly on FDIC 2023 RFI and similar to PCI Security Standards Council and FDX recognition
- FDIC in preliminary talks with Fed and OCC; neither has officially joined
- Aim: reduce duplication where hundreds of banks ask the same due diligence questions of the same vendors
- Compliance not a safe harbor — evidence of sound risk management only
Why It Matters
This could be one of the most significant developments in federal oversight of bank-fintech partnerships in years. A credible, regulator-backed certification standard would lower the cost of vetting vendors, expand the practical vendor universe for community banks, and reduce the duplication burden across the BaaS ecosystem. But questions remain: governance, funding, whether participation is effectively mandatory, and whether standards keep pace with fast-changing technology. As one expert noted, "infrastructure is judged on execution" — the next months will determine if this becomes a relied-upon standard or "another well-intentioned framework on a shelf."