Why valid when made left bank-fintech lenders two open questions

The week

On May 29, 2020, the Office of the Comptroller of the Currency issued a final rule on loans sold by national banks and federal savings associations. When such a loan is sold, assigned or otherwise transferred, interest permissible before the transfer remains permissible afterward. The rule responded to uncertainty created by the 2015 decision of the US Court of Appeals for the Second Circuit in Madden v. Midland Funding. That decision held that a non-bank buyer of debt originated by a national bank could not necessarily rely on the bank’s authority to charge interest permitted in its home state. The FDIC adopted a similar rule for state-chartered banks the following month. Several states later challenged both rules in court.

Bank-fintech lending programs rest on a simple structure. A bank originates the loan, often under its home state’s interest rate rules, and sells the loan or its receivables to a fintech partner or investors. The structure raises three distinct questions. Does the loan keep its permissible rate after the sale? Is the bank really the lender? And can the bank show that it oversees the program it lends its charter to? The OCC’s rule answered the first. For bank boards, chief compliance officers and fintech partners, the risk lay in treating that answer as if it covered all three.

Does the rate survive the sale

Madden created uncertainty in the Second Circuit, which covers New York, Connecticut and Vermont, about whether non-bank buyers of bank-originated loans could keep charging the rate the bank had charged. That uncertainty touched loan sales, securitizations and marketplace lending programs. Investors priced it in, and some programs avoided borrowers in affected states. The OCC rule, and the FDIC’s for state banks, said permissibility is fixed when the loan is made and is not affected by a later transfer. Supporters saw this as restoring a long-standing assumption. Critics, including several state attorneys general, argued it would let non-banks evade state rate caps.

For secondary markets, the rule reduced transfer risk. It did not end the policy debate, and its durability depended on litigation not yet filed. Prudent institutions treated it as a significant improvement rather than a final answer. They also kept the evidence that mattered under the rule: documentation that each loan’s terms were set by the bank at origination, under the bank’s own credit policy, before any sale.

Is the bank the true lender

State regulators and courts had challenged some partnership programs on a separate theory. They argued the non-bank partner, not the bank, was the true lender. Courts and states looked at who marketed the loans, who designed the underwriting, who bore the economic risk and how quickly loans were bought after origination. If the partner was the true lender, state licensing and rate limits could apply to it directly, regardless of what the bank could have charged.

The valid-when-made rule did not touch that question. A program could satisfy the rule and still lose a true lender challenge. The relevant facts sit in the program’s contracts and cash flows. Who holds the predominant economic interest? Does the bank keep any loans or a meaningful share of their risk? Can the bank change the credit model, decline applications or end the program? Banks and partners needed counsel to assess those facts against the tests applied in the states where they lent. They also needed to accept that the answer could differ by state.

Program design could shift the analysis. Some banks retained a share of each loan, approved every change to the credit model and controlled pricing. They were in a stronger position than banks that sold every loan within days and accepted a partner’s model as delivered. Those choices cost the bank capital and attention. They were also the evidence a court would examine.

Can the bank prove its oversight

Whatever the answers to the first two questions, a bank that originates loans through a partner remains responsible for the program’s compliance. That covers consumer protection law, fair lending, Bank Secrecy Act obligations and safety and soundness expectations. Third-party risk management guidance applies to the relationship. A partner that runs the customer experience, the underwriting model and servicing does not take on the bank’s supervisory accountability.

Proving oversight takes more than a contract clause. Examiners look for evidence that the bank reviews the partner’s marketing before it runs, receives and analyzes complaints, validates and fair-lending-tests the credit model, monitors transactions for suspicious activity and tests the partner’s controls. The bank needs the staff to do that work and the contractual rights to see the data. Oversight costs should be priced into the program’s economics from the start. A partnership whose margin only works if oversight is light is a partnership the bank cannot afford.

Data access is the practical core of oversight. The bank should receive loan-level application, decision, pricing, servicing and complaint data on a schedule it sets, in a format its own staff can analyze. Relying on the partner’s summary dashboards leaves the bank seeing only what the partner chooses to show. The contract should also cover the bank’s right to audit, to require remediation and to suspend originations if controls fail. It should spell out what happens to customers and records if the relationship ends. Each of these terms is easier to win before launch than after a supervisory finding.

Board reporting should keep the three questions apart. Each deserves its own owner and evidence: the legal status of the rate, the true lender analysis, and the oversight record. A board told that the new rule had resolved the legal risk heard an answer to one question. The same separation applies to any arrangement in which a bank lends its charter to a product it does not fully operate, including deposit and payments programs.

With hindsight

The valid-when-made rules survived. In February 2022, a federal court in California upheld both the OCC and FDIC rules against the states’ challenges. The OCC’s separate true lender rule, finalized in October 2020, did not: Congress repealed it under the Congressional Review Act, and the repeal was signed in June 2021. True lender risk stayed with courts and states, and some states moved to tighten their own rules on partnership lending and rate exportation.

Oversight turned out to be the question that mattered most. From 2022 onward, federal regulators took a series of enforcement actions against banks with fintech partnership programs, often focused on BSA compliance and third-party oversight. The 2024 collapse of the middleware firm Synapse showed how poor recordkeeping in partnership arrangements can harm end users. Among them were consent orders against Blue Ridge Bank in 2022, Cross River Bank in 2023 and Evolve Bank & Trust in 2024. The rule gave certainty on one question; the other two did more to shape the market.