The California Department of Financial Protection and Innovation (DFPI) has issued a Consent Order against Hatch Bank, a state-chartered, FDIC-insured, Banking as a Service (BaaS) sponsor bank, requiring its Board of Directors to strengthen its supervision and direction of bank management, and its monitoring of the bank's AML/CFT program. The order results from a March 2024 Report of Examination by the DFPI and FDIC that identified unsafe or unsound banking practices, reportedly connected to the bank's third-party-fintech business model.
The case is of importance as it may be one of the first times that a state has pursued a state-chartered BaaS bank on its own, instead of jointly with a federal agency involved. In this case, the order was issued only by the California DFPI. To date, no parallel enforcement action has been issued by the FDIC. In addition, the timing for remediation in the order is very short compared to what we have traditionally seen.
The bank is ordered to revise its written AML/CFT risk assessment to accurately reflect the bank's fintech partnerships, customer types, volumes, and geographies within 60 days. Within 90 days, it must also improve its policies for internal controls, transaction alert review and SAR processes, customer due diligence, monitoring model evaluations, and staffing adequacy.
The bank must also make periodic reviews of every vendor or fintech partner that provides BSA functions such as customer due diligence, monitoring, case management, etc.