In a banking-as-a-service program, the fintech owns the customer experience and the sponsor bank owns the regulatory accountability. That gap is where oversight work piles up: reconciling ledgers the bank does not run, sampling files the bank did not collect, and chasing alerts raised in someone else's system.
This guide is for a sponsor-bank BSA officer or a fintech compliance lead. It covers how responsibilities split, what supervisors have said about these programs, and which oversight jobs an AI employee can carry while people keep the decisions. For the broader banking picture, start with our pillar on AI employees for banking and financial services compliance.
How can AI agents support sponsor bank compliance oversight?
Who is responsible for what between a sponsor bank and a fintech?
The bank stays accountable. The fintech usually runs onboarding, the app, support and often the first line of monitoring. The bank holds the charter, the deposits and the regulatory obligations, and the contract allocates the day-to-day tasks between them.
The regulation is explicit on the bank's side. Under 31 CFR 1020.210, a bank's anti-money laundering program needs internal controls, independent testing, a designated person coordinating day-to-day compliance, training, and risk-based procedures for ongoing customer due diligence. Nothing in that rule lets a bank point at a partner instead.
The interagency third-party guidance says the same thing. The Federal Reserve, FDIC and OCC issued Interagency Guidance on Third-Party Relationships: Risk Management in June 2023 (OCC Bulletin 2023-17). It states that a bank's use of third parties does not diminish its responsibility to meet its safety and soundness and legal requirements to the same extent as if it performed the activity in-house. For the full life cycle, see our checklist on third-party risk management for AI vendors and the glossary entry for third-party risk management.
What have regulators said about bank-fintech arrangements?
On July 25, 2024, the Federal Reserve, FDIC and OCC issued a joint statement on banks' arrangements with third parties to deliver deposit products and services. The OCC's Bulletin 2024-20 lists the risks it highlights: operational, compliance, strategic, liquidity and concentration risk, plus consumer protection concerns, end-user confusion and misrepresentation of deposit insurance coverage. The Federal Reserve's cover letter, SR 24-5, says the statement does not establish new supervisory expectations. It restates the existing ones as applied to these programs.
Enforcement shows what that looks like in practice. In June 2024 the Federal Reserve Board announced an enforcement action against Evolve Bancorp and Evolve Bank & Trust. It said 2023 examinations found the bank lacked an effective risk management framework for its fintech partnerships, and lacked a program and controls sufficient to comply with anti-money laundering and consumer protection laws. For existing partnerships, the Board required stronger risk management, oversight and monitoring, and better recordkeeping and consumer compliance procedures. The release also states the action is independent of the Synapse bankruptcy proceedings.
The takeaway for operations is plain: examiners ask whether the bank can see into its partners' programs and show the evidence.
What is the status of the FDIC custodial account recordkeeping rule?
As of October 26, 2026, we found it only as a proposal. The FDIC published Recordkeeping for Custodial Accounts in the Federal Register on October 2, 2024. It would set recordkeeping requirements for custodial deposit accounts with transactional features, so the FDIC can make deposit insurance determinations promptly if a bank fails. The comment period was extended and a search of the Federal Register by the rule's RIN (3064-AG07) shows no final rule. Check the FDIC's site before relying on any of its terms. Whatever its final form, the work it points at is familiar: ledgers that reconcile and beneficial-owner records that match.
Which oversight jobs can an AI employee carry?
Five jobs account for most of the manual oversight volume. In each, the AI employee assembles the evidence and applies the checks, and a named person decides.
- Ledger reconciliation.
Match the bank's records to the partner's ledger and the program account, flag breaks, and age them. Our post on bank reconciliation automation covers the mechanics. - Partner program monitoring.
Pull each partner's periodic reports, compare them with agreed thresholds and prior periods, and note exceptions. - KYC and CDD file reviews across partners.
Sample onboarding files against the program's CDD procedures. For business customers, see KYB automation for banks and fintechs. - Transaction monitoring alert work.
Gather the account history and write up the alert for an analyst. See AML alert triage with AI. - Complaint and Reg E dispute oversight.
Check that partner-handled disputes follow the clock in 12 CFR 1005.11: investigate within 10 business days, or provisionally credit and finish within 45 days. Our guide on Reg E dispute investigation automation goes deeper.
What does each oversight job look like end to end?
Oversight job | What the AI employee does | Evidence it leaves | Who signs off |
|---|---|---|---|
Ledger reconciliation | Matches bank, partner and program-account records, ages breaks, drafts the explanation for each | Match report, break aging, reasoning per exception | Bank finance or operations lead; BSA officer if a break involves customer funds |
Partner program monitoring | Compares partner reports with agreed thresholds and prior periods, flags exceptions | Dated comparison, threshold used, exception list | Bank's partner program manager |
KYC and CDD file review | Checks sampled files against the program's CDD procedure and lists gaps | Checklist per file, missing items, source documents cited | BSA officer or delegate; fintech compliance lead fixes gaps |
Transaction monitoring alerts | Assembles account history, screening results and a draft disposition | Alert package, draft narrative, data sources | Alert analyst; BSA officer for any suspicious activity report decision |
Complaint and Reg E dispute oversight | Tracks each claim against the regulatory clock and checks the file for required steps | Clock status, investigation file, decision rationale | Disputes operations lead; compliance for adverse outcomes |
The pattern across rows is the same. The AI employee does the gathering and checking, writes its reasoning where the bank can read it, and stops at the decision. Approval design matters here, and our post on four-eyes approval for AI agents shows how to set it up.
How does a Zamp AI employee run one sponsor-bank oversight job?
Take partner KYC file review. We would write the job as an Agent Operating Procedure, or AOP: the program's CDD procedure, the sampling plan, the sources of truth, what counts as a gap, and who gets each escalation. The AOP deep dive describes what goes in one.
The AI employee gets its own identity with least-privilege access, as set out in our trust and security page. For this job that means read access to the sampled files and write access to the findings log, and no ability to change a customer record, approve an exception or contact a customer.
When a file is missing a document, the data conflicts, or the pattern is unfamiliar, the case goes to Needs Attention. A person receives it with the context already assembled. Before a file is closed as clean, the validate step of the plan-execute-validate loop checks the output against the AOP. The reasoning is written into the bank's own case or GRC system, so an examiner reads it where the bank already keeps its records.
When a reviewer corrects the AI employee, the correction becomes a proposed AOP change: a branch, evals against a golden set, a review, then a merge, with no engineering ticket. Only the AOP changes, never model weights.
Partner programs often run on many portals. In a freight deployment, one AI employee works across 50+ vendor portals with no APIs, at more than 95% browser-agent accuracy (case study). That is freight, not banking, but the mechanism transfers to partner dashboards without an API.
A bank would usually choose a BYOC or on-prem deployment so customer data stays in its own environment. The options are in our deployment models guide.
How should a sponsor bank start?
Pick one oversight job with a written procedure and a measurable backlog, such as partner KYC sampling. Run the AI employee alongside your reviewers first and expect a high share of cases to route to people at the start. That routing is the control working, not a defect. Expand the job only after reviewers agree with its output on a stated share of cases, and record that threshold in the AOP.
Document the arrangement the way an examiner will ask for it: who performs each task, which party holds each record, and where the evidence lives. Our post on what examiners ask about AI in BSA/AML programs lists the questions to expect. For credit unions and smaller institutions with the same oversight needs, see AI employees for credit unions, and for vendor comparisons see best AI agents for banks and credit unions in 2026.
Sources
- 31 CFR 1020.210, eCFR
- 12 CFR 1005.11, eCFR
- Interagency Guidance on Third-Party Relationships, Federal Register, June 9, 2023
- OCC Bulletin 2024-20 and Federal Reserve SR 24-5
- Federal Reserve Board press release, June 14, 2024
- FDIC proposed rule, Recordkeeping for Custodial Accounts, Federal Register, October 2, 2024
