Feature Operational Risk
CFP Fund Flow Testing: The Liquidity Exercise Most Fintechs Skip Until a Regulator Asks
A fund-flow test proves your contingency funding plan actually works — not just on paper. Here's how fintechs should map payment rails, confirm collateral, walk approval chains, and document gaps before a regulator does it for them.
Table of Contents
TL;DR
- A fund-flow test is an operational exercise — not a tabletop. It confirms that the payment rails, collateral mechanics, and approval chains in your CFP actually work as described, in real time.
- Fintechs have a distinct set of contingent funding sources: sponsor bank credit facilities, warehouse lines, sweep account mechanics, and payment rails (ACH, wire, RTP, FedNow) — each with different timing constraints.
- The most common gaps found during fund-flow tests involve settlement timing assumptions, after-hours approval chains, and sponsor bank commitments that aren’t contractually guaranteed.
- Test records — not plans — are what regulators compare against the CFP during examination. If you can’t produce evidence that you tested, you haven’t tested.
Most fintechs have a document that looks like a contingency funding plan. It identifies stress scenarios, lists potential funding sources, and describes escalation steps in general terms. What most fintechs don’t have is a completed fund-flow test that proves any of those sources actually works.
The distinction is significant. A CFP that lists “draw on sponsor bank credit facility” as a Tier 1 contingent source has not answered the real questions: What’s the draw notice period? What collateral is required? Who initiates the draw? What payment rail does the money travel on? How long does it take to arrive? And has anyone confirmed, by actually doing it, that the process works the way the CFP describes?
These are operational questions, not documentation questions. And the only way to answer them is to run a fund-flow test.
Why Fund-Flow Tests Are Not Tabletop Exercises
The confusion between tabletop exercises and fund-flow tests is one of the most consistent gaps in fintech liquidity programs. Both are valuable. They test completely different things.
A tabletop exercise tests decision-making: who decides to activate the CFP, how escalation works, what the governance process looks like at each trigger level. These exercises are important. They don’t tell you whether the execution works once the decision is made.
A fund-flow test tests execution: can you actually initiate a draw on the credit facility, confirm receipt of funds, and complete the operational steps the CFP assumes — in the timeframe the plan describes, on the rails you have access to?
The 2023 Interagency Addendum (OCC Bulletin 2023-25, FDIC FIL-39-2023) issued after the Silicon Valley Bank and Signature Bank failures made this distinction explicit for bank-chartered institutions: institutions must test contingent funding sources operationally, not just document them. For SVB, the gap wasn’t that the discount window wasn’t listed in the CFP. The gap was that SVB had not tested discount window access in the prior year and did not have the operational arrangements to move collateral to the Federal Reserve when the stress event hit.
Fintechs operating on sponsor bank charters face an analogous problem — different rails, same gap. The plan describes the source. The mechanics have never been walked.
Fintech Liquidity Sources Are Different
Before running a fund-flow test, you need to understand what your fintech’s actual contingent funding sources are. They’re structurally different from a bank’s.
Sponsor bank credit facilities. Many fintechs have some form of emergency credit arrangement with their sponsor bank. The question is whether it’s contractually guaranteed (rare), discretionary (common), or implied (worse than nothing, because it creates false confidence). A fund-flow test for this source starts by pulling the contract, reading the draw conditions, and then actually initiating a test draw — or confirming in writing with the bank’s treasury that the facility is operational.
Warehouse lines. Fintechs in lending products often have warehouse credit facilities. In a liquidity stress, these may be constrained if the lender also faces stress or if collateral quality deteriorates. A fund-flow test should walk through the draw process, confirm the counterparty contact is current, and verify the settlement rail and timing.
Sweep account mechanics. Fintechs that hold customer deposits through bank partners often have sweep arrangements. The CFP should describe what happens to sweep mechanics under stress — does the sweep continue? At what rate? Can it be reversed? Does the bank have any override authority? These mechanics need to be confirmed with the bank, not assumed from a contract signed three years ago.
Payment rails for incoming funds. When a contingent source delivers funds, how do they arrive? ACH same-day settles by 5pm ET, but not on weekends. Fedwire settles in real time during business hours, with current cut-offs around 6pm ET. RTP and FedNow settle 24/7/365 with near-instant finality — but only if both the sending and receiving institutions are connected. FedNow launched in 2023 and adoption has expanded significantly, but not every bank or fintech is connected. Your CFP cannot assume a payment rail your counterparty doesn’t support.
The Fund-Flow Test: Step by Step
A complete fund-flow test for a fintech CFP covers five stages.
Step 1 — Map Every Active Funding Source
Pull the CFP and list every contingent funding source identified, including the tier it sits in. For each source, document: the counterparty, the legal agreement (contract, credit facility, ISDA, program agreement), the contact at the counterparty, and the draw or activation mechanism. If any of this information is missing or out of date, that’s your first finding — you haven’t mapped the source accurately.
Step 2 — Trace the Payment Rail for Each Source
For each funding source, identify the specific rail by which funds move from the source to your accounts. Confirm:
- Rail type: ACH, wire, RTP, FedNow, internal book transfer
- Settlement timing: Same-day ACH by 5pm ET, next-day ACH by following business day, Fedwire real-time during operating hours, RTP/FedNow near-instant 24/7
- Cut-off times: Fedwire credit transfer cut-off is currently 6pm ET; ACH same-day cut-off varies by originating bank
- Weekend/holiday availability: ACH and Fedwire don’t settle on weekends. RTP and FedNow do, but only if both endpoints are enrolled.
This step frequently surfaces the most significant CFP assumption errors. A plan that assumes a “same-business-day” draw on a source that routes via next-day ACH is not operationally accurate.
Step 3 — Confirm Collateral Mechanics
If any funding source requires collateral — a pledged account, securities, receivables — confirm the pre-positioning process:
- Is the collateral already pledged, or does it need to be pledged at draw time?
- What’s the process to pledge? How long does it take?
- What haircut applies?
- Who at the counterparty confirms collateral acceptance?
A common CFP weakness: the plan describes collateral that’s available but not pre-pledged. In a stress event, the time required to pledge collateral may make the source effectively inaccessible at the moment it’s needed.
Step 4 — Walk the Approval Chain
For each source, identify exactly who is required to approve a draw. Then test the approval chain:
- Are all required approvers currently in their roles?
- Are their contact details current (cell phone, not desk phone)?
- Is there a documented backup for each approver?
- Does the approval chain function outside business hours, on weekends, and during holidays?
This step is frequently where fund-flow tests surface their most uncomfortable findings. The CFP requires CFO approval, but the CFO is in Asia on a weekend, has no backup listed, and the CFP doesn’t specify an alternate escalation path. The source exists on paper. In practice, it can’t be activated at 9pm on a Saturday, which is exactly when a liquidity event might require it.
Step 5 — Document the Gaps
Every fund-flow test should produce a findings log: sources tested, gaps identified, and remediation steps. Gaps might include:
- Rail timing assumptions that don’t match actual settlement windows
- Counterparty contacts that are out of date
- Contracts that don’t guarantee availability the CFP assumes
- Collateral that needs pre-pledging
- Approval chains with single points of failure
- Sources that require advance notice longer than the CFP’s assumed activation timeline
These gaps should feed directly into the CFP triggers framework — if a source requires 48 hours of lead time, the trigger that activates it needs to fire at least 48 hours before the projected need.
What the Evidence Package Should Contain
A completed fund-flow test leaves behind an evidence file. For each source tested:
- Test record: Date, source, amount confirmed or tested, rail used, timing from initiation to confirmation, participants
- Counterparty confirmation: Written confirmation (email is sufficient) from the counterparty that the facility is operational and the contact information is current
- Collateral confirmation: Confirmation of collateral status — pre-pledged, available, and haircut terms
- Approval chain verification: Documentation that each required approver has been confirmed in role, with backup contacts
- Gap log: Any discrepancies between the CFP description and operational reality, with remediation status and owner
This evidence package is what a regulator or examiner will compare against the CFP description during review. If the CFP says a source is available within four hours via same-day ACH, the evidence should show you confirmed that’s accurate — not just that you wrote it in the plan.
The CFP evidence binder should include fund-flow test results alongside other CFP documentation. An evidence binder that contains board minutes and trigger review notes but no fund-flow test results tells an examiner that testing hasn’t happened.
Common Gaps Found in Fintech Fund-Flow Tests
In practice, fintech fund-flow tests consistently surface the same categories of gaps:
Rail timing mismatches. The CFP was written assuming same-business-day funding availability, but the actual rail is next-day ACH. The plan is operationally inaccurate by at least one business day.
Sponsor bank commitments that aren’t contractual. The CFP lists a sponsor bank emergency credit facility. The contract language says “subject to bank approval at the time of request.” That’s a discretionary line, not a committed facility — and in a stress event, the bank may not approve. The CFP language needs to match the contract.
After-hours approval chains with no backup. Two of three required approvers have no documented backup. The CFP can’t activate without them.
Settlement rail not connected. The CFP assumes FedNow-based receipt of funds, but the counterparty institution isn’t enrolled in FedNow. The assumption is invalid.
Contact information that routes to departed employees. The bank’s treasury liquidity desk number goes to a person who left 14 months ago. The relationship contact has changed twice. Testing surfaces this immediately; an actual stress event surfaces it at the worst possible moment.
So What? Turning Test Results into Plan Updates
A fund-flow test is not a compliance checkbox. It’s a diagnostic. The findings are the point.
Every gap the test surfaces is a risk that exists right now in your liquidity plan. Each one should be assigned an owner, a remediation target, and a follow-up review date. For gaps that can’t be remediated quickly — like a discretionary credit facility that can’t be converted to committed — the CFP triggers and contingency actions need to account for the true availability of that source, not the assumed availability.
Banks and fintechs that run fund-flow tests and update their CFPs accordingly have a qualitatively different relationship with their liquidity plans than those that don’t. The plan becomes operational — something people trust because they’ve seen it work — rather than a document that might work when the moment comes.
The July 2024 joint statement on bank-fintech arrangements from the OCC, Federal Reserve, and FDIC placed explicit emphasis on banks understanding and managing liquidity risks in their fintech programs — including rapid growth, deposit concentration, and fintech-controlled customer bases. Sponsor banks are now asking their fintech partners harder questions about liquidity resilience. A completed fund-flow test is the most direct way to answer them.
The Financial Risk Management Kit at risktemplate.com includes contingency funding plan templates, fund-flow test checklists, and evidence binder frameworks designed for fintechs and community banks building exam-ready liquidity programs.
◆ Need the working template?
Start with the source guide.
These answer-first guides summarize the required fields, evidence, and implementation steps behind the templates practitioners search for.
◆ Related template
Financial Risk Management Kit
Credit risk, liquidity, concentration, and capital adequacy templates built for fintechs.
◆ FAQ
Frequently asked questions.
What is a fund-flow test in a contingency funding plan?
Do fintechs without bank charters need a contingency funding plan?
What payment rails should a fintech include in a fund-flow test?
What does a regulator look for when reviewing CFP fund-flow testing?
What are the most common gaps found in fintech fund-flow tests?
How often should fintechs run fund-flow tests?
Author
Rebecca Leung
Rebecca Leung has 8+ years of risk and compliance experience across first and second line roles at commercial banks, asset managers, and fintechs. Former management consultant advising financial institutions on risk strategy. Founder of RiskTemplates.
◆ Related framework
Financial Risk Management Kit
Credit risk, liquidity, concentration, and capital adequacy templates built for fintechs.
◆ Keep reading
Related posts.
Operational Risk
Key Risk Indicators Examples: 40 KRIs for Operational and Financial Risk Teams
40 ready-to-use KRI examples for operational and financial risk programs — each with risk measured, data source, owner, threshold idea, and escalation path.
May 17, 2026
Operational Risk
Contingency Funding Plan Triggers: How to Set Liquidity Thresholds You Can Defend to Regulators
Vague CFP triggers don't survive examiner scrutiny. Here's how to design Green/Yellow/Red liquidity thresholds with specific metrics, documented rationale, and clear ownership — so your CFP activates before it's too late.
May 16, 2026
Operational Risk
Funding Sources Aren't Real Until Tested: How to Prove Your Contingency Funding Plan Works
Most CFPs list contingent funding sources without proving they're accessible. Here's how to run fund-flow tests, build an evidence file, and show regulators that your liquidity plan actually works when it needs to.
May 15, 2026
◆ Immaterial Findings · Weekly
Sharp risk & compliance insights practitioners actually read.
Enforcement actions, regulatory shifts, and practical frameworks — no fluff, no filler.
◆ Practitioners from banks, fintechs, and asset managers · Delivered weekly