Perhaps much or none. Please first contact your primary examiner and get a written answer to your question. Next, get your legal counsel's written opinion regarding your question. Third, get your insurance company's written opinion. You may need each of these things before you proceed. Don't take anyone's verbal comments at face value -- get things as important as this question in writing.
if the finance company is viewed as part of the bank, I believe that you must develop and implement the same baseline Security Program as you have for the rest of the bank. if the finance company is not viewed as part of the bank, you may not need to do anything to become in compliance with the BPA. Strategically speaking, however, you still have to insure the safety and well-being of all persons and all assets on the premises as part of the bank's overall operations program.