Data Privacy vs. Bank Secrecy: Regulating the Flow of Information Within Bank-Fintech Partnerships (IF13168)
Summary
A Congressional Research Service In Focus, IF13168, dated February 25, 2026, titled "Data Privacy vs. Bank Secrecy: Regulating the Flow of Information Within Bank-Fintech Partnerships," by Andrew P. Scott. It explains how banks manage customer information under the Bank Secrecy Act (P.L. 91-508), the Gramm-Leach-Bliley Act privacy provisions and the Bank Service Company Act (P.L. 87-856) when partnering with fintechs. It describes Customer Identification Program requirements, a banking-as-a-service example, and June 2025 and July 2025 regulator orders letting banks obtain TIN information from a third-party source. It closes with policy questions on identity verification and a possible gap in protecting consumer information at account opening.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Cite this document
“Data Privacy vs. Bank Secrecy: Regulating the Flow of Information Within Bank-Fintech Partnerships (IF13168).”
Original at www.congress.gov. Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/if13168-1-ce60d5a7b7/
, SHA-256 a2ffb0a7f7297d89d093674e8582c42987aab282bd8b0afdbfa4386476858953.Full text
February 25, 2026
Data Privacy vs. Bank Secrecy: Regulating the Flow of
Information Within Bank-Fintech Partnerships
Banks are increasingly interconnected with nonbank The CIP requirements in the BSA generally apply to all
financial technology. As this trend continues, policy financial institutions, including banks, credit unions,
responses to update regulatory frameworks may be broker/dealers, insurance companies, exchanges, money
proposed. transmitters, and several others. Financial technology firms
are not explicitly covered, but Section 5312(a)(2) does
Bank-nonbank relationships—particularly ones involving include “any business or agency which engages in any
data transfers—are often subject to different regulatory activity which the Secretary of the Treasury determines, by
requirements across a range of legal frameworks. When regulation, to be an activity which is similar to, related to,
policymakers change or update one set of rules for banks, it or a substitute for any activity in which any business
could cause confusion, inconsistencies, or even conflicting described in this paragraph is authorized to engage” and
incentives among market participants. “any other business designated by the Secretary whose cash
transactions have a high degree of usefulness in criminal,
For example, financial institutions, including depository tax, or regulatory matters.” Further, BSA policy is broadly
institutions such as banks and credit unions, are required to developed by the Financial Crimes Enforcement Network
understand whom their customers are and what their (FinCEN), the bureau in Treasury responsible for AML.
purposes are for establishing accounts. This serves as a However, the CIP regulations are implemented by the
foundational element of the anti-money laundering (AML) various financial regulators. These policies may change
regulatory framework in the U.S. financial sector. with changes in agency leadership.
Concurrently, banks are required to protect consumer
nonpublic personal information (NPI). Further, banks are Gramm-Leach-Bliley
responsible for ensuring that any partnerships they engage In the financial system, data privacy is governed by Title V
in comply with relevant banking laws, including AML and of the Gramm-Leach-Bliley Act (GLBA, 15 U.S.C. §6801
data privacy provisions. et seq). Financial institutions, including banks, are required
to develop and give notice of their privacy policies to their
This In Focus explains how banks manage information in a own customers and must give notice and an opportunity for
manner that complies with three laws—the Bank Secrecy a consumer to “opt out” before disclosing any personal
Act (P.L. 91-508), the Graham-Leach-Bliley Act (P.L. 106- financial information to an unaffiliated third party. The
102), and the Bank Service Company Act (P.L. 87-856)— provision also requires financial regulators to issue
particularly in light of increased partnership activity regulations to safeguard personal financial information.
between banks and nonbank financial technology
companies (fintechs). The privacy provisions in GLBA apply to institutions that
engage in “activities that are financial in nature.” While
Anti-Money Laundering financial technology is not explicitly listed as an activity
The statutory foundation for AML policies was established that meets this definition, the statute requires regulators to
in the 1970s in the Bank Secrecy Act (BSA, 31 U.S.C. consider “changes … in the technology for delivering
§5311 et seq). At a general level, this framework requires financial services” and “whether such activity is necessary
financial institutions to keep certain records and report or appropriate to allow [a bank] to compete effectively with
certain transactions. Over time, the regulations any company seeking to provide financial services [or]
implementing this framework have been updated to reflect efficiently deliver information and services that are
new ways of conducting transactions and to include novel financial in nature through the use of technological means.”
business models. Further, in 2003, bank and credit union
regulators jointly issued the Customer Identification Further, under the Consumer Financial Protection Bureau’s
Programs (CIP) rulemaking, which implemented provisions 2024 open banking rulemaking (12 C.F.R part 1033,
of the USA PATRIOT Act (P.L. 107-56) by setting subparts B and C), authorized third parties that seek access
“standards for financial institutions regarding the identity of to covered data on behalf of a consumer to provide a
the customer that shall apply in connection with the product or service that the consumer requested must satisfy
opening of an account at a financial institution.” the applicable safeguard rules under GLBA. For more on
Essentially, a depository institution is responsible for the open banking rule, see CRS In Focus IF13117, Access
obtaining, at a minimum, the following information from a to Consumer Financial Data: Open Banking and the
customer prior to opening an account: the customer’s name, CFPB’s Section 1033 Rule, by Karl E. Schneider.
date of birth, address (for an individual), and Tax
Identification Number (TIN) or Social Security Number.
https://crsreports.congress.gov
Data Privacy vs. Bank Secrecy: Regulating the Flow of Information Within Bank-Fintech Partnerships
Bank Service Company Act agencies the authority to exempt financial institutions from
Banks often partner or contract with other firms to facilitate these regulations.
certain services. For example, a bank may use a data
processor to help manage its marketing with clients. Bank In June 2025, the Office of the Comptroller of the
regulators examine banks for safety and soundness as well Currency, the Federal Deposit Insurance Corporation, the
as for compliance with certain banking laws. They also National Credit Union Administration, and FinCEN jointly
supervise the relationships banks hold with third parties issued an order that would exempt banks from needing to
pursuant to their authorities under the Bank Service directly obtain TINs from customers. Instead, they could
Company Act (12 U.S.C. §1861 et seq.). “use an alternative collection method to obtain TIN
information from a third-party source rather than the
The provisions under this law apply to permissible bank customer.” In July 2025, the Federal Reserve joined the
service company activities, including check and deposit other regulators in issuing a similar exemption order.
sorting and posting, bookkeeping, accounting, statistical, or
other related activities. There is no explicit reference to These agencies believe that the “importance of collecting
fintech activities, though fintechs often perform these TIN information from the customer rather than through
functions. another method for identification and verification purposes
has lessened … particularly in light of the availability of
Regulating Bank-Fintech Partnerships new methods that a bank can use alongside TIN
Consumers can interact with banks directly through local information to form a reasonable belief that the bank knows
branches or online through the internet or banking apps. the true identity of each customer.”
Similarly, consumers can use fintechs to access various
financial services. Sometimes, a consumer interacts with a Relevant Policy Issues
fintech to obtain banking services, and behind the scenes a Several questions arise over how or whether the layer of
bank is performing the banking service, while the fintech is technology that sits between a fintech and a bank makes it
running the consumer interface. easier or more difficult for the bank to comply with various
laws. For example:
Banking as a Service
One way banks and fintechs work together is in a model • Can a bank effectively verify the identity of a potential
referred to as “banking as a service.” In this model, a customer when there is no in-person interaction?
fintech pays a bank to provide core banking services, and
those services are effectively white labeled for consumption • Can the bank rely on the transmission of information
on the fintech’s platform. through a fintech app?
Consider the following example: A customer uses a fintech • Is the technology that connects the bank to the fintech
app to open a checking account and deposit a cash balance secure enough to adequately safeguard the customers’
that was previously held in a digital wallet. To open the NPI?
bank account, the bank now faces a number of regulatory
requirements: • Can the bank and its regulators examine the operations
of the partnership?
• The bank must be able to verify the customer’s identity
and purpose for opening the account. Privacy concerns are elevated when sensitive information is
used, and the bank account initiation process is one where
• The bank must be able to disclose its privacy policies to significant NPI can be exposed. Further, data privacy
the customer and provide the customer with an regulations under GLBA only apply to “customers” and not
opportunity to opt out of certain third-party disclosures. “consumers”—this distinction is potentially important in
protecting the flow of information at account opening.
• The bank relationship with the fintech(s) is subject to
supervisory oversight by the bank regulators. The statutory and regulatory language in the
implementation of Title V of GLBA suggests that the data
If the customer later wants to apply for a personal loan, the privacy and safeguard provisions apply only to a customer,
fintech app may use a data aggregator to highlight certain defined as a “consumer who has a customer relationship”
credit options that the customer could qualify for. While the with the financial institution. According to Title 12, Section
data aggregator may rely on publicly available data, it may 1016.3, of the Code of Federal Regulation, this definition
be able to draw insights that serve as a proxy for sensitive does not appear to include the consumer onboarding
information. process.
Exceptions to Bank CIP Requirements To the extent this is true, the potential gap in the regulatory
Typically, a bank must obtain CIP information from the framework could mean that a consumer who relies on
customer except with respect to credit card accounts, where fintech enterprises to enter the banking system could be
banks are allowed to obtain such information “from a third- exposed to vulnerabilities in the security of consumer NPI.
party source prior to extending credit to the customer.” (See
31 C.F.R. §1020.220(a)(2)(i)(C).) The BSA (as amended by Andrew P. Scott, Specialist in Financial Economics
Section 326 of the USA PATRIOT Act) provides financial
IF13168
https://crsreports.congress.gov
Data Privacy vs. Bank Secrecy: Regulating the Flow of Information Within Bank-Fintech Partnerships
Disclaimer
This document was prepared by the Congressional Research Service (CRS). CRS serves as nonpartisan shared staff to
congressional committees and Members of Congress. It operates solely at the behest of and under the direction of Congress.
Information in a CRS Report should not be relied upon for purposes other than public understanding of information that has
been provided by CRS to Members of Congress in connection with CRS’s institutional role. CRS Reports, as a work of the
United States Government, are not subject to copyright protection in the United States. Any CRS Report may be
reproduced and distributed in its entirety without permission from CRS. However, as a CRS Report may include
copyrighted images or material from a third party, you may need to obtain the permission of the copyright holder if you
wish to copy or otherwise use copyrighted material.
https://crsreports.congress.gov | IF13168 · VERSION 1 · NEW
File and source
- File
- IF13168.1.pdf
- Size
- 254,954 bytes
- SHA-256
- a2ffb0a7f7297d89d093674e8582c42987aab282bd8b0afdbfa4386476858953
- Our copy
- IF13168.1.pdf
- Original
- www.congress.gov