Acceptable Use Policy framework for fintech compliance teams evaluating high-risk customers and merchants.
Price
$79
One-time. No subscription. Use forever.
Delivered immediately after checkout — your template and guide links are emailed to you with your receipt.
Used by compliance teams at banks, fintechs, and asset managers
◆ Quick buying summary
◆ What's included
Use rights: customize for internal business use and use outputs with your auditors, customers, bank partners, and regulators. Do not resell or redistribute the template files.
◆ Preview
Sales Intake Questionnaire tab — 22 factual-options dropdowns, Sales picks customer descriptions, Risk Rating auto-calculates via formula. Yellow = Sales input. Blue = Compliance-only. Auto-routes to Approve / Conditional / Escalate / Decline.
Tier Master List — 40 customer categories classified as Prohibited / Restricted / Permitted, each with rationale, regulatory anchor (OFAC, FinCEN, OCC, CSA, etc.), and typical sponsor-bank position
Bank Partner Alignment Matrix — your AUP vs. sponsor bank position for 20+ restricted categories, with formula-driven Gap flagging (Aligned / Gap / Material Gap)
● Case file
A material share of 2024 federal banking enforcement actions targeted sponsor banks in embedded finance / BaaS arrangements. The common thread reported in those actions: the bank's oversight had not kept pace with the volume and complexity of fintech activity on its charter. AUP-bank alignment is the structural fix.
OCC consent order cited BSA/AML failures tied to inadequate oversight of fintech programs.
Why it mattersA fintech AUP that does not map to the sponsor bank's rules is a fintech AUP that may not survive contact with the bank's next program review.
Failure to maintain an effective risk management framework for fintech partnerships; inadequate ongoing oversight and monitoring of those relationships.
Why it mattersThe enforcement was not about the initial approvals. It was about failure to monitor after approval — which the Monitoring Trigger Library and Re-Review Calendar are built to prevent.
Largest BSA enforcement action in US history. The order documented backlogs of customers to be exited that "presented unacceptable AML risk" — customers whose ongoing activity had crossed into high-risk territory but were never off-boarded.
Why it mattersExit triggers defined in advance and documented per-customer in the Exception Memo — not improvised at the moment of crisis — are the structural answer.
Every documented decision in this kit produces a defensible record — for the next exam, the next bank partner review, or the next time an exit decision needs to be defended on criteria-based grounds.
◆ Why now
The 2024 enforcement cycle showed that a fintech AUP that is not mapped to the sponsor bank's program agreement is operationally fragile. The Aug 2025 Debanking EO added a second pressure: exits must be criteria-based and documented in advance. FinCEN's CDD framework requires ongoing monitoring commensurate with customer risk. These three currents make a documented, tiered, bank-partner-aligned AUP program a current-cycle priority — not a year-three nice-to-have.
◆ Regulatory alignment
This kit was built to operationalize the documented compliance expectations applicable to BaaS fintech programs in 2026.
Last updated: May 24, 2026
◆ Template guide
How to build a fintech Acceptable Use Policy: sales intake questionnaire, three-tier customer classification (Prohibited / Restricted / Permitted), bank-partner alignment matrix, exception memo, and post-approval monitoring triggers.
◆ FAQ
A generic AUP gives you a list of prohibited industries. This kit gives you the operational backbone: a Sales-facing intake questionnaire that auto-routes deals (so Sales velocity stays intact), a documented approval path (so reviews don't get improvised), a Bank Partner Alignment matrix (because your sponsor bank's rules are the binding constraint), an Exception Memo template with the 10 elements an examiner expects, a post-approval monitoring library with default thresholds, and a populated Worked Example showing the full lifecycle. The PDF guide includes 28 drop-in policy paragraphs you can paste into your own AUP document.
No — and that's the point. The Sales Intake Questionnaire is designed so 80–90% of standard deals get an "Approve" output and proceed to onboarding without compliance review. Only deals that score Conditional / Escalate / Decline route to Compliance. The structured questions ensure that when a deal does need a deeper look, Sales has captured the right facts up front — Compliance doesn't re-ask the same questions.
This v1 is built for fintechs (BaaS programs, sponsor-bank arrangements, payment platforms). The bank-partner alignment, RFI KRI tracker, and the regulatory anchor all reflect the 2024 BaaS enforcement cycle and the Aug 2025 Debanking EO. A banks edition (correspondent-bank-focused, card-network-aligned) is planned separately.
GreenLeaf Payroll — a fictitious licensed Colorado cannabis retailer that wants to use the platform for payroll only (no consumer cannabis sales touch the platform). The example walks through: Sales Intake Questionnaire output, Compliance EDD findings, sponsor bank pre-clearance with conditions (cap, license re-verification, notification), the populated Exception Memo, monitoring baselines set at approval, a six-month volume-drift trigger event with documented investigation and memo update, and the annual re-review with cap increase. Every artifact in the kit is populated so you can see the full lifecycle.
For each of 20+ seeded restricted categories, you enter your AUP position (Prohibited / Restricted / Permitted) and your sponsor bank's position (from the program agreement). The Gap column auto-calculates: Aligned (positions match), Gap (positions differ — manageable direction), or Material Gap (your AUP is more permissive than the bank's — the dangerous direction). Material Gaps must be addressed before any further onboarding in that category. The matrix is reviewed annually and whenever the bank updates its program requirements.
Yes — Tab 8 of the workbook. The memo has 10 sections matching the FFIEC BSA/AML manual's EDD documentation expectations: Customer Identification, Business Category & AUP Classification, Platform Use & Transaction Types, Fund Flow Description, Prohibited/Restricted Analysis, Applicable Controls, Monitoring Plan & Review Schedule, Bank Partner Status, Approval & Sign-Off, and Exit Triggers. The memo is fillable; one customer per memo. The Worked Example tab shows how a populated memo looks.
Track monthly RFIs from your sponsor bank by customer category. The workbook auto-calculates cumulative YTD and a Rising / Stable trend indicator (formula-based comparison to 3-month average). Rising RFI volume in a specific category is the structural early warning of bank partner discomfort — the pattern that preceded the 2024 BaaS consent orders. Escalate Rising trends to TPRM governance before they become formal warnings.
The AUP decides whether the customer or activity is eligible. KYC/CDD decides how closely you review the relationship. Transaction monitoring decides what you flag in ongoing activity. This kit is the AUP layer — it tells you whether you should onboard the customer at all, and what conditions and monitoring apply if you do. KYC/CDD and transaction monitoring sit downstream.
Yes. You can use completed outputs with auditors, customers, bank partners, regulators, and internal stakeholders. Customize the template for internal business use — just don't resell or redistribute the source template files.
Checkout is handled through Stripe. After purchase, you receive the template and guide download link immediately on the confirmation page and by email, along with your Stripe receipt. No account is required.
Email within 30 days for a full refund, no questions asked. The guarantee is meant to remove purchase risk while you evaluate whether the template fits your use case.
● First-time buyer offer
Get 20% off your first template.
Drop your email and we'll send the code.
◆ Not ready to buy?
141 pre-populated fintech risks across 21 categories. ISO 31000 structure.
Download free Risk Register →◆ Related templates
Complete vendor risk management lifecycle from initial due diligence to ongoing oversight.
Contingency funding plan for sponsor-bank fintechs — FBO reconciliation, runway-based triggers, post-Synapse stress scenarios.
132 KRIs with thresholds, data sources, and escalation triggers pre-built for financial services.
◆ Ready when you are
Start building a defensible risk program today.