Fourth-Party Risk After Synapse: What OCC and FDIC Now Expect from Your Subcontractor Oversight Program

Synapse filed for Chapter 11 bankruptcy on April 22, 2024. Over the next few weeks, customers of Yotta, Juno and other fintech apps found themselves locked out of deposits they believed were FDIC-insured. Customer service lines went quiet. The partner banks, with the Chapter 11 trustee’s help, found a shortfall the trustee estimated at $60–90 million between what the partner banks held and what Synapse’s records said end users were owed, according to the CFPB.

The companies that failed those customers had sponsor bank relationships. They had third-party risk programs. Some had written agreements with indemnification clauses and audit rights. None of it helped.

Synapse sat in the middle of the chain. Fintechs like Yotta contracted with Synapse. Synapse held the relationships with the partner banks that actually held customer money. For those fintechs, the banks were fourth parties they had no direct contract with; for the banks, Synapse’s ledger was the record of which end user owned which dollar. Synapse failed. Customers’ money was stuck behind a ledger nobody could reconcile.

That’s the fourth-party risk problem in its most concrete form.

TL;DR

• Synapse was a layered-dependency failure: fintechs contracted with Synapse, Synapse held the partner bank relationships, Synapse’s ledger collapsed — customers were frozen out of their deposits, and the partner banks, with the Chapter 11 trustee’s help, found a shortfall the trustee estimated at $60–90 million
• July 2024 joint statement from OCC, FDIC, and Fed flagged the elevated risks when deposit products run through fintechs and middleware, and described oversight practices banks may consider adopting
• 26% of financial institutions still don’t assess fourth-party risk at all, per the 2026 Ncontracts TPRM Survey
• OCC and FDIC examiners are now specifically reaching past your vendor list to ask about critical subcontractor dependencies
• The AI supply chain adds a new fourth-party layer most programs haven’t mapped yet
• The minimum examiner expectation: know who your critical vendors depend on, document it, and contract for notification rights if that changes

What Fourth-Party Risk Actually Means

Your TPRM program covers vendors you directly contract with. Fourth-party risk is the risk created by your vendors’ vendors — the subcontractors, cloud platforms, data providers, and technology dependencies that sit one layer beneath your vendor relationships.

You don’t have a contract with fourth parties. You can’t audit them directly. You often don’t know they exist. But if they fail, the disruption flows through your vendor to your operations and your customers.

This is not theoretical risk. It’s the exact failure mode the Synapse collapse exposed:

• Fintechs (customer-facing apps built on Synapse’s platform): Yotta, Juno, Copper
• Middleware (Synapse Financial Technologies — the fintechs’ direct vendor, holding the agreements with the partner banks)
• Partner banks (held the money; fourth parties from the fintechs’ side): Evolve Bank & Trust, AMG National Trust, Lineage Bank

When Synapse’s ledger systems failed, no single institution had an authoritative record of which customer was owed which dollars. The resulting reconciliation gap locked customers out for months.

The interagency TPRM guidance — OCC Bulletin 2023-17 and the parallel FDIC FIL-29-2023 — explicitly expects banking organizations to understand their critical vendors’ subcontracting practices as part of due diligence. What Synapse proved is that the concept isn’t academic: middleware concentration risk is real, it’s material, and it can freeze customer funds overnight.

What Regulators Did After Synapse

The regulatory response unfolded in layers.

June 2024 — Evolve Bank cease-and-desist: The Federal Reserve issued a cease-and-desist order against Evolve Bank & Trust — one of Synapse’s partner banks — citing an ineffective risk management framework for its fintech partnerships and deficiencies in its AML and consumer compliance programs. The order itself doesn’t name Synapse; the Fed’s release says the action is independent of the Synapse bankruptcy proceedings.

July 25, 2024 — Joint statement on bank-fintech arrangements: The OCC, Federal Reserve, and FDIC issued a joint statement addressing what they’d observed in BaaS and bank-fintech structures. Key messages:

• Banks cannot delegate compliance obligations to fintech partners or middleware providers
• Oversight capability must be real and exercisable, not just contractual
• Concentration risk needs board-level visibility
• Banks must be able to wind down fintech programs without harming customers

September 2024 — FDIC custodial accounts proposal: The FDIC proposed a rule (approved September 17, published October 2, 2024, and still a proposal) that would require banks that hold custodial deposits for fintech programs to maintain their own beneficial owner records — not rely on middleware providers to do it. The proposal directly targets the Synapse failure mechanism: pooled FBO accounts where nobody had an authoritative, current record of which end user was owed what.

Each of these actions carries the same underlying message: the bank owns the risk, regardless of how many layers of technology sit between the bank and the end customer.

What Examiners Are Now Checking

Three years into the interagency TPRM guidance, examinations have shifted from checking whether a program exists to checking whether it actually functions. For fourth-party risk specifically, examiners are reaching deeper than the vendor list.

For critical activity vendors, examiners now expect documentation of:

1. Subcontractor identification — Who are the critical subcontractors your core processor, payment platform, and key technology vendors depend on? Not a complete list of every sub-vendor, but the ones that are material to service delivery.

2. Dependency mapping — What does each subcontractor do in the chain? If the subcontractor failed, what’s the impact to your operations?

3. Risk indicators — Are there any known concerns about the subcontractor’s financial health, security posture, or regulatory standing?

4. Notification rights — Does your contract with the vendor require them to notify you if a critical subcontractor changes, fails, or is acquired?

The practical minimum examiners accept is documented evidence that you asked the right questions and got answers. Not a full due diligence workup on every sub-vendor — but enough to show you’ve mapped the dependency and thought through the failure scenario.

For BaaS and bank-fintech relationships specifically, examiners are checking whether banks have exercised their oversight rights, not just whether those rights exist on paper. A contract that gives the bank audit rights over a fintech partner is meaningless if the bank has never used them. Examiners want to see evidence of independent review: internal team visits, third-party assessments, reconciliation testing, or at minimum documented attempts to verify the fintech’s representations.

For a deeper look at what examiners are finding in first-tier TPRM programs, our 2026 TPRM Examination Findings analysis covers the full gap inventory.

The AI Supply Chain Problem

Traditional fourth-party risk mapping was hard enough when vendors were using identifiable subcontractors with SOC 2 reports. The AI supply chain makes it significantly harder.

When a vendor embeds a large language model — GPT, Claude, Gemini, or a third-party foundation model — into their product or internal operations, that model provider becomes your fourth party. You likely have:

• No visibility into the model provider’s data handling practices or security posture
• No contractual relationship giving you notification rights if the model provider changes
• No assessment of what happens to your vendor’s product if the foundation model is deprecated or breached
• No documentation of where your data goes when it’s processed by that model

According to Treasury’s AI risk management guidance, AI dependency monitoring is a distinct risk domain that traditional vendor risk programs weren’t designed to surface.

The interagency TPRM guidance’s subcontracting expectations apply directly: when a critical vendor uses AI models from third-party providers, those providers fall within the subcontractor relationships the guidance expects you to assess. Your vendor questionnaire and ongoing monitoring protocol need to surface this.

This connects to the broader cloud concentration risk problem our cloud provider concentration risk analysis covers — when multiple vendors in your critical path all depend on the same foundation model provider or cloud region, you have concentration risk several layers deep.

Building a Minimum-Viable Fourth-Party Program

You don’t need a team of analysts to get fourth-party risk management to an examiner-defensible level. The program doesn’t need to be perfect. It needs to be documented, proportional, and evidence-based.

Step 1: Map your critical vendors

Start with your critical activity vendor list. These are the vendors whose failure would materially disrupt your operations, harm customers, or create regulatory exposure. If you don’t have a documented critical activity list, that’s the prerequisite.

Step 2: Ask about their subcontractors

Add a fourth-party risk section to your vendor due diligence questionnaire and annual review. Key questions:

• Who are your critical subcontractors for the services you provide us?
• Which cloud providers do you depend on for service delivery?
• Do you use AI models or foundation models from third parties? Which ones?
• How would you notify us if a critical subcontractor changed, failed, or was acquired?

Step 3: Contract for notification rights

At next renewal for every critical activity vendor, add a clause requiring them to notify you of material changes to critical subcontractors within a defined timeframe (30 days is a common standard). This gives you a documented, contractual mechanism — and something to show an examiner beyond “we asked.”

Step 4: Document what you know and what you don’t

Not all fourth parties will cooperate. Large technology vendors and cloud providers often resist disclosing their full subcontractor footprints. Document the request, document the response (or non-response), and document your assessment of the residual risk from the gaps. An examiner’s concern is whether you’re aware of the exposure — not whether you’ve solved it.

Step 5: Assess concentration

Across your critical vendors, identify whether multiple vendors share the same critical subcontractors — particularly cloud infrastructure providers. If your core processor, payment platform, and lending origination system all run on AWS us-east-1, that’s a concentration exposure your BCP needs to address.

The TPRM Kit won’t map the whole subcontractor chain for you, but it asks the questions that start the map: subcontractor oversight is one of six due diligence knock-outs, the AI Vendor Assessment asks about foundation-model providers, Contract Provisions checks the subcontracting clause, and the Concentration Risk tab shows when critical vendors share a provider.

DORA’s Fourth-Party Mandate: What It Means for US Firms

If your institution has EU customers, EU subsidiaries, or operates within scope of the Digital Operational Resilience Act, the fourth-party obligation is explicit rather than inferred.

DORA requires financial entities to assess ICT third-party risk including all subcontracting arrangements. It mandates that contracts with critical ICT providers include the right to audit subcontractors and receive notification of subcontractor changes. The DORA standard is more prescriptive than the US interagency guidance — but the direction is the same.

For US firms with any EU footprint, DORA’s fourth-party requirements provide a useful template for what the most rigorous version of the program looks like. For the operational resilience and ICT incident reporting dimensions, our DORA first ICT incident report analysis covers what the first wave of DORA incident data revealed about third-party dependencies.

So What?

The Synapse collapse wasn’t a compliance failure in the traditional sense. The problem was a structural gap: institutions in the BaaS chain relied on middleware they didn’t assess, couldn’t monitor, and had no independent ability to verify — and when that middleware collapsed, the ledger broke.

The 26% of financial institutions that still don’t assess fourth-party risk at all are carrying Synapse-scale exposure without knowing it. The regulators know this. The July 2024 joint statement, the FDIC’s custodial accounts proposal, and the 2026 examination focus on subcontractor mapping are all pointed at the same gap.

You don’t need to audit every sub-vendor. You need to know who the critical ones are, what they do, what happens if they fail, and whether your vendor contracts give you the notification rights to find out when something changes. That’s the examiner’s minimum expectation. Start there.

If you’re building out your fourth-party oversight program and need documentation templates aligned to what examiners are checking, the Third-Party Risk Management (TPRM) Kit covers the program underneath: five-factor tiering, a 48-question due diligence, the 17 contract topics of the 2023 interagency guidance plus 9 US clauses, a Monitoring Tracker and offboarding.