For years, “FBO” has been one the payments industry’s favorite buzz words. The FBO account structure has been a common “best practice” by payments providers seeking to remove themselves from the flow of funds to reduce their risk of being regulated as a money transmitter. As a foundational matter, FBO accounts are merely custodial depository accounts maintained at financial institutions and established “for the benefit of” (FBO) intended beneficiaries of funds in the accounts. The structures of such accounts can vary. Typically, in the payments space, these accounts are structured to be bank-owned and held for the benefit of the payments provider’s customer (often a merchant or sub-merchant), rather than for the payments provider itself, to maximize the protections afforded by removing the payments provider from the flow of funds. Under this model, the payments provider can instruct the bank to move funds in and out of the FBO account as authorized by the payments provider’s customer, without ever taking actual possession or control over the funds.

While this structure remains foundational to countless arrangements between banks and their fintech partners, the risks created by the misuse of this structure has led the Federal Deposit Insurance Corporation (FDIC) to issue a proposed rule which would impose extensive requirements on FDIC insured depository institutions (IDI) with respect to “custodial deposit accounts with transactional features” – FBO accounts included. This proposed rule comes amid heighted scrutiny of bank and fintech arrangements by the federal banking regulators. The requirements set forth in this proposed rule would not only impact the IDIs but would also have a substantial impact on payments providers whose business models and operations rely upon the availability of these types of account structures.

The proposed rule is complex and technical. So, we’ve boiled down the basics here in an FAQ format to demystify the implications this proposed rule would have on the payments industry.

Q:  What prompted the proposed rule?

A:   The proposed rule was ultimately prompted by consumer confusion about whether funds placed with IDIs through arrangements with non-bank payments providers qualify for FDIC protection and concern for their ability to access and recover such funds. In particular, the FDIC cites the bankruptcy of Synapse Financial Technologies, Inc. (Synapse), a technology company that worked with several IDIs and numerous fintechs. The Synapse bankruptcy affected consumers’ ability to access funds placed at IDIs in FBO and custodial accounts for a number of months. In some instances, it was advertised that the funds were FDIC insured. Following the bankruptcy, the IDIs that were holding customer funds had difficulty obtaining, reviewing, and reconciling Synapse’s records to determine the ownership of those funds. This caused detrimental harm to many customers who were unable to receive funds needed to cover daily expenses.

The Synapse bankruptcy was just one prime example provided by the FDIC. It highlighted that the use of “custodial accounts with transactional features” presents significant hurdles and corresponding delays in the FDIC’s ability to make deposit insurance determinations. In recent months, the FDIC has taken action against a number of IDIs seeking to address concerns related to bank/fintech partnerships and now seeks to address the issues it has identified consistently among all IDIs through the proposed rule.

Q: What are the FDIC’s objectives and intentions for the proposed rule?

A:   The FDIC seeks to:

• Strengthen IDI recordkeeping requirements for “custodial deposit accounts with transactional features” (which includes FBO accounts);
• Preserve beneficial owners’ and depositors’ entitlement to the protections afforded by federal deposit insurance;
• Promote the FDIC’s ability to promptly make deposit insurance determinations;
• Enable the FDIC to pay deposit insurance claims “as soon as possible” in the event of a failure of an IDI holding custodial accounts with transactional features; and
• Promote timely access to funds (even in the absence of an IDI failure).

Q: Who does the proposed rule apply to?

A: The proposed rule directly applies to all IDIs, regardless of size, who offer custodial accounts with transactional features (subject to exemptions for specific types of custodial accounts). The proposed rule would apply regardless of how many custodial accounts with transactional features are held at the IDI and regardless of how many beneficial owners funds’ are held within such accounts. The FDIC seeks comment on whether there should be a minimum threshold for applying the requirements of the proposed rule.

If made final, fintechs and other-non bank payments providers will be impacted through operational and contractual changes in their relationships with IDI partners that will be required as a result of the proposed rule.

Q: What is a “custodial deposit account” under the proposed rule?

A: A “custodial deposit account” for purposes of the proposed rule is a relationship where one party is responsible for opening a deposit account at an IDI on behalf of others who may own the funds but do not have a direct relationship with the bank.

Q: What are “custodial accounts with transactional features” under the proposed rule?

A: A deposit account that:

• Is established for the benefit of beneficial owner(s);
• Holds commingled deposits of multiple beneficial owners; and
• The beneficial owner(s) may authorize or direct a transfer from to a party other than the account holder or the beneficial owner(s) (e.g. to make a purchase or pay a bill).

If funds in the custodial account are only returned to either the beneficial owner or the account holder, and would not be transferred to third parties, the account would fall outside the scope of the types of accounts covered by the proposed rule. However, the FDIC questions whether it should apply the proposed rule’s recordkeeping requirements to all custodial deposit accounts, and not just those with “transactional features.”

Q: How does the proposed rule differentiate between a “beneficial owner” and an “account holder”?

A: A “beneficial owner” would be defined as “a person or entity that owns, under applicable law, the funds in a custodial account.” An “account holder” would be “the person or entity who opens or establishes a custodial account with transactional features with an insured depository institution.” So, in the case of a fintech or other non-bank payments provider that establishes an account at an IDI for the benefit of its customers, even if the account is titled in the name of the IDI itself for the benefit of the fintech’s customers, the fintech would be the “account holder” under the proposed rule because it contracted with the IDI to establish the account.

Q: What types of custodial deposit accounts are exempt from the rule?

A:   The proposed rule exempts certain custodial deposit accounts that already have stringent recordkeeping requirements under applicable law, including custodial deposit accounts which are:

• Only used to hold trust deposits;
• Established by government depositors, such as accounts maintained for the payment of government benefits;
• Established by brokers or dealers under the Securities and Exchange Act of 1934, and investment advisers under the Investment Advisers Act of 1940;
• Established by attorneys or law firms on behalf of clients, commonly known as interest on lawyers trust accounts (IOLTA accounts);
• Used in connection with employee benefit plans and retirement plans;
• Maintained by real estate brokers, real estate agents, title companies, and qualified intermediaries under the Internal Revenue Code;
• Maintained by mortgage servicers in a custodial or other fiduciary capacity;
• Protected by applicable federal or state law prohibiting the disclosure of the identities of the beneficial owners of the deposits;
• Maintained by virtue of agreements to allocate/distribute deposits among participating IDIs in a network for purposes other than payment transactions of customers of the IDI or participating IDIs; or
• Used to hold security deposits tied to property owners for a homeownership, condominium, or other similar housing association governed by state law, and accounts holding security deposits tied to residential or commercial leasehold interests.

The FDIC invites comments on whether there are other categories of custodial deposit accounts that should be exempt from the proposed rule.

Q: Can IDIs still contract with third parties to maintain the beneficial ownership records relating to the custodial account?

A: Yes, an IDI would still be able to contract with a third party (such as, for example, a vendor, processor, software or service provider or similar entity), provided that enhanced requirements are satisfied. These include:

• The IDI having direct, continuous and unrestricted access to the beneficial owner records maintained by the third party, including in the event of the business interruption, insolvency or bankruptcy of the third party;
• The IDI having a business continuity plan in place, including backup recordkeeping for the required beneficial ownership records and technical capabilities to ensure compliance with the proposal’s requirements;
• The IDI implementing appropriate internal controls to:

(a) accurately determine the respective beneficial ownership interests associated with the custodial deposit account with transactional features; and

(b) conduct reconciliations against the beneficial ownership records no less frequently than the close of business daily;

• Annually validating the third party’s records, where such validation is performed by persons or entities independent of the third party, in order to assess and verify that the third party is maintaining accurate and complete records consistent with the proposal’s provisions;
• The third party maintaining the records in a specific electronic file format (as must the IDI if it maintains the records itself); and
• The IDI having a direct contractual relationship with the third party that includes risk mitigation measures.

The additional requirements are intended to promote the integrity of the records and ensure that the IDI has continued access.

Q: What actions would IDIs need to take if the proposed rule is adopted?

A:   The proposed rule would require that IDIs holding custodial accounts with transactional features implement the following:

• Recordkeeping. Maintain records relating to the account using a specific file format. The records would need to identify:
  • The beneficial owners of the custodial account;
  • The balance attributable to each beneficial owner; and
  • The ownership category in which the beneficial owner holds the deposited funds.

Records would also need to be maintained in a specific electronic file format with required fields for records of beneficial owners and their interests in the deposited funds. The specific format is described in Appendix A of the proposed rule.

• Internal Controls. Implement and maintain internal controls to ensure that account balances are accurate. Such internal controls should be tailored to the individual IDI based on its unique circumstances, including its size and the scope of its risk appetite, but must include:
  • Maintaining accurate account balances, including the respective individual beneficial ownership interests associated with the custodial deposit account; and
  • Reconciling account balances against beneficial ownership records no less frequently than as of the close of business daily.
• Written Policies and Procedures. Establish written policies and procedures to achieve compliance with the proposed rule’s requirements.
• Annual Certification and Report. Annually complete and submit to the FDIC and to the IDI’s primary regulator:
  • A certification confirming the institution’s compliance with, and testing of, the proposed requirements
  • A report that:
    • Describes material changes to information technology systems relevant to compliance with the rule;
    • Lists account holders that maintain custodial deposit accounts with transactional features, total balance of the custodial deposit accounts and the total number of beneficial owners;
    • Sets forth the results of the institution testing of its recordkeeping requirements; and
    • Provides results of independent validation of any records maintained by third parties.

As a result of actions required by the proposed rule, the IDI would also need to review and update its contracts with its existing fintech partners.

Q: What happens if an IDI does not comply with the proposed rule, if adopted?

A: IDIs would be subject to examination by their primary federal regulator and enforcement actions for failures to comply that could result in cease-and-desist orders and civil money penalties.

Q: What does the proposed rule mean for the IDIs’ non-bank partners?

A: Fintechs and other non-bank partners that contract with IDIs and assume the recordkeeping responsibilities of the IDI will need to provide the IDI with additional and continuous access to records and submit to review and verification by an outside, independent entity on an annual basis. IDIs will increase scrutiny on fintechs and other non-bank partners and make these types of accounts available to a fewer number of well-established fintech and non-bank partners. The costs associated with these account types will also likely increase.

Q: Would the rule apply retroactively to FBO accounts that were established before the proposed rule became effective?

A: Yes. The proposed rule would apply to custodial deposit accounts with transactional features regardless of when the account was established (before or after the proposed rule’s effective date). Thus, current agreements between IDIs and their fintech partners with respect to these types of accounts would need to be updated accordingly.

Q: What should IDIs do now in anticipation of the proposed rule becoming final?

A: IDIs can prepare by:

• Reviewing the nature of their relationships with non-bank companies to determine whether such non-bank companies have custodial deposit accounts at the IDIs that fall under the scope of the proposed rule;
• Analyzing the anticipated costs and benefits of accepting and maintaining custodial deposit account relationships with non-bank companies if the proposed rule is adopted;
• Investigating the technical requirements of having data transmitted from account holders in the format required by the proposed rule;
• Developing a recordkeeping system for maintaining required data;
• Assessing capabilities of existing platforms or core processing systems to satisfy the requirements of the proposed rule;
• Developing or procuring data interface systems, where necessary;
• Submitting comments to the proposed rule, if desired, before the deadline;
• Collecting agreements with third parties in anticipation of updating obligations and responsibilities if the proposed rule is adopted; and
• Identifying which existing policies and procedures may be impacted.

Q: What should IDI partners do now in anticipation of the proposed rule becoming final?

A: IDI partners relying on FBO accounts at IDIs should:

• Consider whether to submit a response to the proposed rule;
• Identify any gaps between current operations, processes, and technical capabilities against the requirements of the proposed rule;
• Evaluate existing internal systems, policies or procedures; and
• Review business arrangements with other partners and fintechs.

Q: What is the future of FBO Accounts?

A: Regardless of whether this proposed rule becomes final, we can anticipate that there will be changes to FBO and custodial account models given recent events that put a magnifying glass on risks that can arise. While there will certainly be more hoops to jump through for many of the FBO account structures in use today, if the rule becomes final, the use of FBO and custodial accounts in IDI and fintech relationships will still be viable. However, we can reasonably anticipate that as the regulators increase scrutiny of these account structures (and bank-fintech arrangements, generally), IDIs will follow suit and further limit the availability of these products and increase costs to fintech partners as part of their own risk mitigation.

Q: What does this proposed rule mean for you?

A: Whether you are an IDI, fintech, or non-bank payments provider that leverages an FBO or custodial account as part of your operations, this proposed rule will have significant impact on you if made final. If you would like to understand the impact to your specific operations or if you are looking for guidance on the comment letter process, please reach out to a member of Taft’s Paytech and Payment Systems Team directly.