OCC says Blue Ridge in 'troubled condition' over BaaS

Blue Ridge Mountains at Shenandoah National Park
Blue Ridge Bank CEO Billy Beale said the consent order with the OCC, made public this week, was based on an exam by the regulator from June 2023.
Catherine Leffert

Blue Ridge Bank has been hit with its second regulatory action in less than 18 months, this time taking heat for failing to correct previously reported problems related to its fintech partnerships.

The Martinsville, Virginia, bank has been deemed to be in "troubled condition" by the Office of the Comptroller of the Currency, which entered the consent order on Wednesday. Billy Beale, CEO of the $3.3 billion-asset bank, said in a written statement to American Banker that the consent order is based on the OCC's findings from a June exam, and is "not reflective of the significant progress that has been made since June."

The regulatory action marks another blow to the banking-as-a-service industry, which has become subject to mounting regulator scrutiny over the last year and a half. On Friday, the Federal Deposit Insurance Corporation also published two other consent orders related to fintech partnerships. The orders, which took effect in mid-December, charged First & Peoples Bank and Trust Company in Russel, Kentucky, and Choice Financial Group in Fargo, North Dakota, with violating parts of the Bank Secrecy Act. 

Jonah Crane, a partner at Klaros Group, said he expects that every bank with a large BaaS program will see some type of regulatory action over the next year. He said many banks originally jumped into the business after seeing a chance to increase deposits and fee revenue through fintech partners. However, maintaining a compliant partner bank is "much more costly and intensive to run" than institutions have historically expected, Crane said, requiring extensive resources, staffing and technology investments.

"My hypothesis has been, really since [the failure of Silicon Valley Bank], that regulators would be a lot quicker to pull the trigger on public enforcement actions," Crane said. "When they identify issues, and something bad happens, they don't want to have to answer the question, 'Why didn't you do anything about it?'"

The latest order against Blue Ridge, which supersedes its previous agreement with the OCC from August 2022, requires the bank to ramp up its anti-money-laundering controls, capital position and third-party management, all of which allegedly contributed to unsafe or unsound practices. The OCC claims that the bank didn't establish and maintain a sufficient BSA/AML compliance program, as it was directed in the previous agreement. The regulator also imposed higher capital requirements for the bank in the fall.

In November, Blue Ridge said in an investor presentation that it had begun offboarding dozens of fintech partners. Beale also told American Banker in an October interview that the bank had jumped into BaaS "up to its clavicles." Blue Ridge also secured a $150 million capital infusion through a private placement.

The banking-as-a-service pioneer has been reeling from the business since an enforcement action from a federal regulator last year.

November 17

Banks can use consent orders as a blueprint for what not to do in BaaS, Crane said. He added that he expects regulators to issue additional guidance at some point in the future, but in the interim the regulatory actions provide some insight as to what folks should keep in mind. The OCC and FDIC have dinged financial institutions, including Blue Ridge, Cross River Bank and First Fed Bank, for infractions like delegating too much compliance to fintech partners or lacking access to data. 

The FDIC's action against First & Peoples Bank, related to an April 2023 examination, requires the bank to recover losses from and limit exposure to a third-party loan program, maintain certain capital levels and develop a liquidity and asset/liability management plan. The bank must also maintain a sufficient AML/countering the financing of terrorism program and create a profit plan and budget. First & Peoples Bank did not respond to a request for comment.

Choice Financial Group was charged with enhancing and overseeing its AML/CFT plan, including adding staff and resources, and conducting a look-back review to ensure compliance with AML/CFT.

A Choice spokesperson said: "Choice Bank maintains a cooperative relationship with both the FDIC and North Dakota Department of Financial Institutions and are working closely with them to fulfill our obligations, both now and in the future."

Crane said he thinks fewer banks will be as involved in BaaS over time because of the investment it takes to manage compliance. He added, though, that those who can "stick it out" have an opportunity to be successful.

"You might expect that banks already had strategic plans [for BaaS], but I think clearly what the OCC is saying is, either they didn't or the ones they had were not really rigorous enough," Crane said. "If banks take a much more strategic approach, they're less likely to end up with a bunch of risks that they maybe didn't anticipate."

Update
This article has been updated to add a statement from Choice Financial Group.
January 29, 2024 1:10 PM EST
For reprint and licensing requests for this article, click here.
Fintech Regulation and compliance Technology Bank technology
MORE FROM AMERICAN BANKER