A Checklist for Bank Due Diligence | Modern Treasury Journal

A Checklist for Bank Due Diligence

Any company that wants to work directly with a bank must successfully complete the bank due diligence process. This Journal provides an actionable checklist for companies preparing for this process with a bank partner.

Pranav Deshpande/ PMM

Bank due diligence, also known as bank underwriting, refers to the process commercial banks use to assess the risk of partnering with a company that provides financial products or services.

During this process, companies need to demonstrate to banks that:

The bank due diligence process starts with the company gathering materials that represent its operations to the bank, and in particular, describe the company’s ownership structure, business model, and compliance program.

This six-part checklist outlines some of the questions you are likely to encounter during the bank due diligence process. While by no means exhaustive, our hope is that it helps you better prepare for the underwriting conversation with your partner bank.

1. Business Information

You will need to share materials that allow bankers to fully understand your business. These include: basic company information, your company’s financials, your flow of funds, and your product features.

Core Business

Business Model

Financials

2. Legal Information

Incorporation and Ownership

You will need to provide copies of your formation documents (e.g., articles of incorporation and operating agreements) and details for all beneficial owners (typically persons that own more than 25% of the company).

Insurance Policies

This includes copies of all existing insurance policies owned by your business, such as general liability, professional liability, directors’ and officers’ liability, cyber insurance, and more.

Licensing

You will need to show the bank that you have the appropriate licenses required for your business (e.g., FinCEN registration, money transmission licenses, state-specific licensing, etc.).

Investigations

You will need to inform the bank of any pending, threatened, or ongoing investigations or litigation against your company since its founding. You will also need a process for handling Section 314(a) and 314(b) requests.

Legal Team

Some banks may also require you to provide contact details of your legal team, whether in-house or outside counsel.

3. Compliance Program

A compliance program is a set of rules, protocols, and procedures an organization puts in place to comply with government regulations on money movement, such as the Bank Secrecy Act and the Anti-Money Laundering Act of 2020. For bank due diligence, you will need to have a compliance program in place that consists of the requirements listed below.

Compliance Function

Onboarding Processes for Customers

Banks will want to know your processes for onboarding users to your application. They will also want to see a representation of the user interface (UI) and user experience (UX).

Customer Identification and Due Diligence Programs

You will need to share your Customer Identification Program (CIP) which is designed to:

You will need to provide evidence of a Customer Due Diligence (CDD) program. This program demonstrates that you understand the nature and purpose of your user relationships. In particular, it affirms that you understand your users’ businesses and professional activities, the sources of their income or assets, and how they plan to use your product and services. You should also be prepared to demonstrate an enhanced diligence process for users that are considered “high risk” as part of bank due diligence.

Transaction Monitoring

You will need to show banks a process for monitoring transactions to identify unusual or suspicious activity. This involves risk-based processes that evaluate individual transactions and transaction patterns to classify them as high, medium, or low risk with clear procedures for handling each category.

Suspicious Activity Reporting

In some cases, you will need to demonstrate a program for monitoring suspicious activity and filing Suspicious Activity Reports (SARs) to help identify criminal activity. In many cases, this includes documentation such as:

4. Training and Oversight

Employee Training

You will need to confirm to the bank that you have a security and compliance training program for your employees according to their role and privileges.

Vendor and Partner Management

You will need to show banks a documented program outlining your relationships with vendors during bank due diligence. This should include:

Internal Procedures

All compliance policies should be reviewed and approved by the board and senior committee.

Independent Review

You will need to conduct independent testing of your compliance program via an internal audit function or independent third party to confirm your BSA/AML responsibilities every 12-18 months.

Record Retention

For bank due diligence, you will need to outline your record-keeping process (e.g. for transactions and SARs), and affirm that this process complies with relevant laws.

5. Data Privacy

Banks will want to see documentation for your data privacy programs. In particular, you should have policies that:

6. Marketing

In some cases, depending upon your use-case, banks will also ask that you provide materials on your marketing organization and marketing plans. Banks will want to ensure that your marketing materials are within federal and state requirements.