Banks repeatedly perform similar due diligence on technology providers, and an industry-standards effort involving the federal regulators would make portions of that work reusable across institutions.
A July 21 draft term sheet outlines a possible framework for reducing some of that duplication. It calls for a voluntary public-private Banking Innovation Standards Development Organization, or BISDO, paired with a certification program known as Risk-Assessed, Manageable Partnerships, or RAMP. The framework would standardize portions of third-party risk management so information could be assessed once, refreshed and used by multiple banks.
The proposal by the Federal Deposit Insurance Corporation (FDIC) comes as FinTechs are expanding relationships with smaller financial institutions, including credit unions.
The framework could have implications for the range of providers banks are willing to evaluate, particularly as FinTechs pursue more relationships with smaller financial institutions.
Credit unions offer one example of that broader trend. PYMNTS Intelligence found that 48% of FinTechs offering end-user products or services through third parties partnered with credit unions last year, compared with 40.3% in November 2024. Partnerships with digital-only banks rose to 66.7% from 61%. At the same time, national-bank partnerships fell to 16% from 36.4%, and regional-bank partnerships declined to 14.7% from 41.6%.
The data come from “Credit Union Innovation Readiness Index: How FinTechs Are Shifting Their Partnership Strategies,” a PYMNTS Intelligence and Velera collaboration. Among FinTechs already serving credit unions, 38% cited slow buying decisions as an impediment, 34% cited complicated regulations and 32% cited lengthy implementation. Only 16% cited technology infrastructure as an impediment.
We note that the BISDO concept is not limited to community banks or credit unions. The draft describes a framework for banks generally and says its mature scope could encompass “any category” of third-party provider or outsourced banking activity for which reusable standards and independent assurance provide value.
Community banks are singled out for a different reason. The term sheet says duplicated reviews can be particularly burdensome for institutions with limited personnel, technical expertise, negotiating leverage and resources to evaluate complex or novel arrangements. It separately says community banks “may benefit in particular” from standardized certification.
From Vendor Qualification to Vendor Choice
BISDO would establish or recognize common standards, while RAMP would certify providers or individual solutions against them. Independent assessors would conduct the underlying reviews.
The term sheet describes a RAMP certification as potentially serving as a “green light to consider,” particularly for community banks that might otherwise lack the resources or expertise to evaluate multiple providers or solutions.
“Consider” is the operative word.
The document does not propose outsourcing the bank’s vendor decision. Institution-specific analysis, contracting, integration, monitoring and oversight remain with individual banks. The reusable portion is the information and assessment that can be standardized across institutions.
That separation could affect an earlier stage of competition among technology providers.
An established vendor that already serves banks has existing relationships, documentation and experience responding to bank risk reviews. A prospective provider has to clear those requirements before its product can be evaluated alongside the incumbent. The term sheet specifically identifies repeated and inconsistent information requests as a cost borne by third-party providers and says the proposed framework would allow assessment costs to be spread across multiple client institutions.
The proposal could reduce one recurring cost attached to pursuing additional bank customers. Whether it changes actual vendor selection would depend on how much of the standardized assessment banks can reuse. If the final framework permits banks to use an independently completed assessment for defined portions of vendor diligence, providers could take the same evidence to multiple prospective bank customers instead of repeatedly producing variations of it. Banks would still decide whether a provider suits their own operations and risk profile.
