RiskTemplates · The Daily Brief Monday, May 18, 2026

Feature Operational Risk

CFP Fund Flow Testing: The Liquidity Exercise Most Fintechs Skip Until a Regulator Asks

A fund-flow test proves your contingency funding plan actually works — not just on paper. Here's how fintechs should map payment rails, confirm collateral, walk approval chains, and document gaps before a regulator does it for them.

Table of Contents

TL;DR

  • A fund-flow test is an operational exercise — not a tabletop. It confirms that the payment rails, collateral mechanics, and approval chains in your CFP actually work as described, in real time.
  • Fintechs have a distinct set of contingent funding sources: sponsor bank credit facilities, warehouse lines, sweep account mechanics, and payment rails (ACH, wire, RTP, FedNow) — each with different timing constraints.
  • The most common gaps found during fund-flow tests involve settlement timing assumptions, after-hours approval chains, and sponsor bank commitments that aren’t contractually guaranteed.
  • Test records — not plans — are what regulators compare against the CFP during examination. If you can’t produce evidence that you tested, you haven’t tested.

Most fintechs have a document that looks like a contingency funding plan. It identifies stress scenarios, lists potential funding sources, and describes escalation steps in general terms. What most fintechs don’t have is a completed fund-flow test that proves any of those sources actually works.

The distinction is significant. A CFP that lists “draw on sponsor bank credit facility” as a Tier 1 contingent source has not answered the real questions: What’s the draw notice period? What collateral is required? Who initiates the draw? What payment rail does the money travel on? How long does it take to arrive? And has anyone confirmed, by actually doing it, that the process works the way the CFP describes?

These are operational questions, not documentation questions. And the only way to answer them is to run a fund-flow test.

Why Fund-Flow Tests Are Not Tabletop Exercises

The confusion between tabletop exercises and fund-flow tests is one of the most consistent gaps in fintech liquidity programs. Both are valuable. They test completely different things.

A tabletop exercise tests decision-making: who decides to activate the CFP, how escalation works, what the governance process looks like at each trigger level. These exercises are important. They don’t tell you whether the execution works once the decision is made.

A fund-flow test tests execution: can you actually initiate a draw on the credit facility, confirm receipt of funds, and complete the operational steps the CFP assumes — in the timeframe the plan describes, on the rails you have access to?

The 2023 Interagency Addendum (OCC Bulletin 2023-25, FDIC FIL-39-2023) issued after the Silicon Valley Bank and Signature Bank failures made this distinction explicit for bank-chartered institutions: institutions must test contingent funding sources operationally, not just document them. For SVB, the gap wasn’t that the discount window wasn’t listed in the CFP. The gap was that SVB had not tested discount window access in the prior year and did not have the operational arrangements to move collateral to the Federal Reserve when the stress event hit.

Fintechs operating on sponsor bank charters face an analogous problem — different rails, same gap. The plan describes the source. The mechanics have never been walked.

Fintech Liquidity Sources Are Different

Before running a fund-flow test, you need to understand what your fintech’s actual contingent funding sources are. They’re structurally different from a bank’s.

Sponsor bank credit facilities. Many fintechs have some form of emergency credit arrangement with their sponsor bank. The question is whether it’s contractually guaranteed (rare), discretionary (common), or implied (worse than nothing, because it creates false confidence). A fund-flow test for this source starts by pulling the contract, reading the draw conditions, and then actually initiating a test draw — or confirming in writing with the bank’s treasury that the facility is operational.

Warehouse lines. Fintechs in lending products often have warehouse credit facilities. In a liquidity stress, these may be constrained if the lender also faces stress or if collateral quality deteriorates. A fund-flow test should walk through the draw process, confirm the counterparty contact is current, and verify the settlement rail and timing.

Sweep account mechanics. Fintechs that hold customer deposits through bank partners often have sweep arrangements. The CFP should describe what happens to sweep mechanics under stress — does the sweep continue? At what rate? Can it be reversed? Does the bank have any override authority? These mechanics need to be confirmed with the bank, not assumed from a contract signed three years ago.

Payment rails for incoming funds. When a contingent source delivers funds, how do they arrive? ACH same-day settles by 5pm ET, but not on weekends. Fedwire settles in real time during business hours, with current cut-offs around 6pm ET. RTP and FedNow settle 24/7/365 with near-instant finality — but only if both the sending and receiving institutions are connected. FedNow launched in 2023 and adoption has expanded significantly, but not every bank or fintech is connected. Your CFP cannot assume a payment rail your counterparty doesn’t support.

The Fund-Flow Test: Step by Step

A complete fund-flow test for a fintech CFP covers five stages.

Step 1 — Map Every Active Funding Source

Pull the CFP and list every contingent funding source identified, including the tier it sits in. For each source, document: the counterparty, the legal agreement (contract, credit facility, ISDA, program agreement), the contact at the counterparty, and the draw or activation mechanism. If any of this information is missing or out of date, that’s your first finding — you haven’t mapped the source accurately.

Step 2 — Trace the Payment Rail for Each Source

For each funding source, identify the specific rail by which funds move from the source to your accounts. Confirm:

  • Rail type: ACH, wire, RTP, FedNow, internal book transfer
  • Settlement timing: Same-day ACH by 5pm ET, next-day ACH by following business day, Fedwire real-time during operating hours, RTP/FedNow near-instant 24/7
  • Cut-off times: Fedwire credit transfer cut-off is currently 6pm ET; ACH same-day cut-off varies by originating bank
  • Weekend/holiday availability: ACH and Fedwire don’t settle on weekends. RTP and FedNow do, but only if both endpoints are enrolled.

This step frequently surfaces the most significant CFP assumption errors. A plan that assumes a “same-business-day” draw on a source that routes via next-day ACH is not operationally accurate.

Step 3 — Confirm Collateral Mechanics

If any funding source requires collateral — a pledged account, securities, receivables — confirm the pre-positioning process:

  • Is the collateral already pledged, or does it need to be pledged at draw time?
  • What’s the process to pledge? How long does it take?
  • What haircut applies?
  • Who at the counterparty confirms collateral acceptance?

A common CFP weakness: the plan describes collateral that’s available but not pre-pledged. In a stress event, the time required to pledge collateral may make the source effectively inaccessible at the moment it’s needed.

Step 4 — Walk the Approval Chain

For each source, identify exactly who is required to approve a draw. Then test the approval chain:

  • Are all required approvers currently in their roles?
  • Are their contact details current (cell phone, not desk phone)?
  • Is there a documented backup for each approver?
  • Does the approval chain function outside business hours, on weekends, and during holidays?

This step is frequently where fund-flow tests surface their most uncomfortable findings. The CFP requires CFO approval, but the CFO is in Asia on a weekend, has no backup listed, and the CFP doesn’t specify an alternate escalation path. The source exists on paper. In practice, it can’t be activated at 9pm on a Saturday, which is exactly when a liquidity event might require it.

Step 5 — Document the Gaps

Every fund-flow test should produce a findings log: sources tested, gaps identified, and remediation steps. Gaps might include:

  • Rail timing assumptions that don’t match actual settlement windows
  • Counterparty contacts that are out of date
  • Contracts that don’t guarantee availability the CFP assumes
  • Collateral that needs pre-pledging
  • Approval chains with single points of failure
  • Sources that require advance notice longer than the CFP’s assumed activation timeline

These gaps should feed directly into the CFP triggers framework — if a source requires 48 hours of lead time, the trigger that activates it needs to fire at least 48 hours before the projected need.

What the Evidence Package Should Contain

A completed fund-flow test leaves behind an evidence file. For each source tested:

  • Test record: Date, source, amount confirmed or tested, rail used, timing from initiation to confirmation, participants
  • Counterparty confirmation: Written confirmation (email is sufficient) from the counterparty that the facility is operational and the contact information is current
  • Collateral confirmation: Confirmation of collateral status — pre-pledged, available, and haircut terms
  • Approval chain verification: Documentation that each required approver has been confirmed in role, with backup contacts
  • Gap log: Any discrepancies between the CFP description and operational reality, with remediation status and owner

This evidence package is what a regulator or examiner will compare against the CFP description during review. If the CFP says a source is available within four hours via same-day ACH, the evidence should show you confirmed that’s accurate — not just that you wrote it in the plan.

The CFP evidence binder should include fund-flow test results alongside other CFP documentation. An evidence binder that contains board minutes and trigger review notes but no fund-flow test results tells an examiner that testing hasn’t happened.

Common Gaps Found in Fintech Fund-Flow Tests

In practice, fintech fund-flow tests consistently surface the same categories of gaps:

Rail timing mismatches. The CFP was written assuming same-business-day funding availability, but the actual rail is next-day ACH. The plan is operationally inaccurate by at least one business day.

Sponsor bank commitments that aren’t contractual. The CFP lists a sponsor bank emergency credit facility. The contract language says “subject to bank approval at the time of request.” That’s a discretionary line, not a committed facility — and in a stress event, the bank may not approve. The CFP language needs to match the contract.

After-hours approval chains with no backup. Two of three required approvers have no documented backup. The CFP can’t activate without them.

Settlement rail not connected. The CFP assumes FedNow-based receipt of funds, but the counterparty institution isn’t enrolled in FedNow. The assumption is invalid.

Contact information that routes to departed employees. The bank’s treasury liquidity desk number goes to a person who left 14 months ago. The relationship contact has changed twice. Testing surfaces this immediately; an actual stress event surfaces it at the worst possible moment.

So What? Turning Test Results into Plan Updates

A fund-flow test is not a compliance checkbox. It’s a diagnostic. The findings are the point.

Every gap the test surfaces is a risk that exists right now in your liquidity plan. Each one should be assigned an owner, a remediation target, and a follow-up review date. For gaps that can’t be remediated quickly — like a discretionary credit facility that can’t be converted to committed — the CFP triggers and contingency actions need to account for the true availability of that source, not the assumed availability.

Banks and fintechs that run fund-flow tests and update their CFPs accordingly have a qualitatively different relationship with their liquidity plans than those that don’t. The plan becomes operational — something people trust because they’ve seen it work — rather than a document that might work when the moment comes.

The July 2024 joint statement on bank-fintech arrangements from the OCC, Federal Reserve, and FDIC placed explicit emphasis on banks understanding and managing liquidity risks in their fintech programs — including rapid growth, deposit concentration, and fintech-controlled customer bases. Sponsor banks are now asking their fintech partners harder questions about liquidity resilience. A completed fund-flow test is the most direct way to answer them.

The Financial Risk Management Kit at risktemplate.com includes contingency funding plan templates, fund-flow test checklists, and evidence binder frameworks designed for fintechs and community banks building exam-ready liquidity programs.

◆ Need the working template?

Start with the source guide.

These answer-first guides summarize the required fields, evidence, and implementation steps behind the templates practitioners search for.

◆ FAQ

Frequently asked questions.

What is a fund-flow test in a contingency funding plan?
A fund-flow test is an operational exercise that confirms each contingent funding source listed in your CFP can actually deliver funds when needed — through the specific payment rail, collateral process, and approval chain the CFP assumes. It's distinct from a tabletop exercise, which tests decision-making. A fund-flow test tests execution: can you initiate the draw, move the collateral, confirm receipt, and document what happened, in the timeframe the CFP assumes?
Do fintechs without bank charters need a contingency funding plan?
Fintechs that operate on a sponsor bank's charter are not directly subject to the OCC's or FDIC's CFP requirements — but the bank is. And under the 2024 Joint Statement on bank-fintech arrangements, banks are expected to understand and manage liquidity risks arising from their fintech programs, including rapid growth, deposit concentration, and dependency on fintech-controlled customer bases. A fintech that cannot demonstrate liquidity resilience to its sponsor bank creates regulatory risk for the bank — and program risk for itself. Most mature fintech compliance programs include some form of liquidity stress planning, even without a charter requirement.
What payment rails should a fintech include in a fund-flow test?
It depends on which rails are actually in your funding model. Common fintech rails include ACH (same-day or next-day), wire transfer via Fedwire (with cut-off time constraints), RTP (real-time payments via The Clearing House, 24/7/365), and FedNow (Federal Reserve's instant payment service). If your contingency plan assumes you can move funds within four hours on a weekend, but your primary rail is next-day ACH and your wire access has a 5pm cut-off, that assumption is wrong. A fund-flow test surfaces those gaps.
What does a regulator look for when reviewing CFP fund-flow testing?
Regulators — including OCC examiners and Federal Reserve supervisors of bank-fintech programs — look for evidence that testing actually occurred, not documentation of a plan to test. That means records confirming dates, amounts, counterparties, rails used, collateral steps completed, and findings. For fintechs in bank-supervised programs, the bank examiner may ask the sponsor bank to produce evidence that fintech-dependent liquidity assumptions have been tested. If no test has occurred, that's a finding for the bank and a program integrity concern for the fintech.
What are the most common gaps found in fintech fund-flow tests?
The most common gaps: (1) rail timing mismatches — the plan assumes faster settlement than the rail supports; (2) approval chains that don't function outside business hours — the CFP requires three signatures but two signatories are unreachable on weekends; (3) sponsor bank dependencies that haven't been confirmed — the plan says the bank will provide emergency credit but the contract doesn't guarantee it; (4) collateral that isn't pre-pledged — the plan assumes collateral availability but no pre-positioning agreement exists; (5) contact information that's out of date — the bank's liquidity desk number routes to a person who left 18 months ago.
How often should fintechs run fund-flow tests?
For each material contingent funding source, annually at minimum. Quarterly for your highest-priority sources — the ones you'd reach for first in an actual liquidity event. When you change payment processors, switch sponsor banks, add new product lines, or materially change your deposit or funding structure, the fund-flow test for affected sources should be re-run to confirm the new mechanics work. Test results, including gaps found and remediation steps, should be retained and reviewed as part of the annual CFP update cycle.
Rebecca Leung

Author

Rebecca Leung

Rebecca Leung has 8+ years of risk and compliance experience across first and second line roles at commercial banks, asset managers, and fintechs. Former management consultant advising financial institutions on risk strategy. Founder of RiskTemplates.

◆ Related framework

Financial Risk Management Kit

Credit risk, liquidity, concentration, and capital adequacy templates built for fintechs.

◆ Immaterial Findings · Weekly

Sharp risk & compliance insights practitioners actually read.

Enforcement actions, regulatory shifts, and practical frameworks — no fluff, no filler.

◆ Practitioners from banks, fintechs, and asset managers · Delivered weekly

Immaterial Findings · Newsletter

The brief, in your inbox.

Enforcement of the week, a framework breakdown, and the prompts that are actually worth running. Delivered to your inbox. Free.