Carlin McCrory and Nathan Ottinger delve into the current state of the payments marketplace, characterized by heightened regulatory scrutiny and rapid innovation.
In this episode of Payments Pros, Carlin McCrory is joined by Nathan Ottinger, president of Georgia Banking Company's Payments and Technology Banking Group. They delve into the current state of the payments marketplace, characterized by heightened regulatory scrutiny and rapid innovation. Nathan underscores the importance of well-documented risk management strategies for financial institutions and the necessity for businesses to secure proficient legal counsel, particularly in the realm of money transmission.
Nathan shares how Georgia Banking Company strategically focuses on specific industry segments and payment types, consciously avoiding the allure of the latest trends in bank-fintech partnerships. He emphasizes the significance of cultivating direct client relationships, conducting thorough due diligence during the client onboarding process, and maintaining ongoing portfolio management and oversight.
Discussing payment technology innovations, Nathan highlights tools that enhance risk management and streamline processes. He concludes by reiterating the high ethical and regulatory standards required when handling other people's money, stressing the need for alignment between the client, the bank, and regulatory requirements.
Payments Pros – The Payments Law Podcast: Third-Party Risk Management in Bank-Fintech Partnerships: Strategies and Insights
Host: Carlin McCrory
Guest: Nathan Ottinger
Date Aired: June 5, 2024
Carlin McCrory:
Welcome to another episode of Payments Pros, a Troutman Pepper Podcast, focusing on the highly regulated and ever-evolving payment processing industry. This podcast features insights from members of our FinTech and payments practice, as well as guest commentary from business leaders and regulatory experts in the payments industry. I'm Carlin McCrory, one of the hosts of the podcast.
Before we jump into today's episode, let me remind you to visit and subscribe to our blog, TroutmanPepperFinancialServices.com, and don't forget to check out our other podcasts on Troutman.com/Podcasts. We have episodes that focus on trends that drive enforcement activity, digital assets, consumer financial services, and more. Make sure to subscribe to hear the latest episodes.
Today, I'm joined by Nathan Ottinger, President of Georgia Banking Company's Payments and Technology Banking Group, to discuss the current state of the payments marketplace. Nathan is a founding member of the Payments and Technology Banking Group at GBC, and in his role, he supports high-volume payments and corporate banking needs for clients in the payroll, HR services, FinTech, insurance, and medical payment sectors.
Prior to his role at GBC, Nathan served as Head of FinTechs and Payments Banking at Atlantic Capital for more than a decade. He also served as the Senior Vice President of Technology Banking at Silicon Valley Bank. Nathan, thanks so much for joining me today. I'm really looking forward to our conversation.
Nathan Ottinger:
Carlin, thank you. Great to be on and look forward to the conversation today.
Carlin McCrory:
Same here. Well, we'll go ahead and dive right in. My first question for you is, if you could tell me your thoughts about the current state of the payments marketplace and GBC's role within it?
Nathan Ottinger:
Sure. Yeah, happy to. I think one word that I would use to describe the current environment, it's volatile. You use that evolving term in the opening, and we wholeheartedly agree. Most of our clients that our team works with at GBC have some payments need associated with their business model. It's typically a high-volume payments need associated with their business model.
I'm sure, like many on this that are listening to this podcast, have been following the consent orders that have been coming down and following the regulatory scrutiny that's going on in this marketplace. That creates volatility. We believe that this regulatory scrutiny will continue to escalate and rightfully so. We see banks who have jumped into the FinTech and payments world that probably aren't ready and jumped in from a business development standpoint, without fully thinking through the nature of what was needed to support high-volume payments needs. And so, that's creating regulatory scrutiny.
You have FinTechs that have probably been over-invested and over-invested in marketing and under-invested in payments and compliance infrastructure. That's creating volatility. You have regulators that have oversight of what's going on in the banking world. They've really been overrun by innovation and the pace of change. That's creating volatility. We think this uncertainty is going to continue and uncertainty is difficult in this environment, because as you well know, payments require certainty. Payments requires a very repeatable process. You have an environment that has uncertainty, or causing unrepeatable processes. That's something that we as a bank have been very mindful to be thinking about. I guess, the environment, I would use the word volatility.
Now for GBC's perspective, Georgia Banking Company's perspective, we've been trying to stay very focused on industry segments and payment types that we've done for many, many years and time and time again. FinTech, it's very easy to chase the shiny object. That's not the tack that our organization has taken. I think that helps us in this regulatory environment and this environment of volatility. GBC very much plays a treasury role with our clients. Many times, that's around high-volume ACH activities. Again, that's something that our team and our bank and our payments infrastructure is built around. We try to stay very focused with the product types and the product offerings that we deliver to the marketplace. I think that plays well during an era of volatility.
Carlin McCrory:
Something I'd like to follow up on what you just said was, how does GBC engage with its clients in the payments and technology industry? What does that process look like, basically, from everything you just said as it relates to volatility? When you're onboarding a potential new customer, what does that look like through that continuing due diligence that you're doing?
Nathan Ottinger:
Yeah, good question. I think it goes back to the way we've built our team and built our infrastructure to have a very repeatable process. I'll speak to that in just a minute. I would also say, that direct client relationships are very important to the bank and very important just really to our ethos of how we onboard clients. We don't like having an indirect party, or a third party between us and our client. That's been very important to us over the dozen plus years we've been doing this as a team and as an organization.
I would say, fundamentally, we want a direct client relationship with direct agreements, direct underwriting, direct compliance and oversight. That's really important to us. I'll say that from the outset. Then I would say, from getting to the question of how we engage with our clients, probably the best way to answer that is step through the almost sales to onboarding, to portfolio management process. This might be a little lengthy, but I'll go speak to that.
What I would say is really, the steps that we go through is one, from an industry and payment type, we stay focused. We tend to be very focused on ACH. We tend to be focused on very B2B-looking business models. That's how we start the part of our funnel in terms of the client types that we go after and prospects that we go after. Staying focused from an industry and payment type. Then we really go through a term sheet process, where we're collecting due diligence upfront. The due diligence that we collect up front are really four buckets. We have a financial due diligence process, an operational due diligence process, a risk and compliance due diligence process, and then a legal/data due diligence process. We build those buckets upfront and we're collecting information upfront as part of our term sheet process.
Then we construct a term sheet that has general business terms, pricing, what have you. But we're also building out in that term sheet what our expectations are around due diligence and what our expectations are as the program launches around ongoing portfolio management. That term sheet process is really important to us to set those guidelines upfront. Frankly, that's where a lot of the deals die. If there is a client type, or a business model that doesn't meet that upfront screening and due diligence process, it dies there.
I think that's a good thing. It dies early and it dies before we get down the road of where a client might not be able to comply with our portfolio management and underwriting process. Term sheet stage, very important. Then from a diligence process, I talked about those buckets, but from a financial due diligence standpoint, we're collecting things like, financials, we're collecting things like personal financial statement, if it's a closely held business, cap table, those sorts of ownership details.
From an operational due diligence, we're collecting things like flow of funds. We're collecting things like client agreements. Really understanding the nature of the product of the nature of the flow of funds, which is super important. From a risk and compliance bucket around due diligence, we are doing things, like looking at return rates, if it's a ACH-heavy model. Understanding our clients’ onboarding policies and procedures and due diligence that they do on their clients. We're making sure that we get our necessary audits, whether it be a NACHA audit, or financial audit, things like SOC, very important that we dig in on, as we're most often, our client relationships are dealing with other people's money. That oversight and review into policies, procedures and internal control is really important.
Then from a data standpoint, I say data and legal standpoint, we're looking for things, privacy policies, disaster recovery, insurance, third-party risk management, policies and procedures. Those items are detailed in a due diligence package that we give to our clients, again, upfront. That will guide our process through underwriting. Then finally, I'll end at this point. Once we've gathered all of this information for our clients from a banking perspective, all of these clients have cross-functional responsibilities within our organization.
Assembling a cross-functional team that works on every single client relationship, and there's well designated roles and responsibilities across that cross-functional team is really important for us. Once we've gotten to the onboarding stage with our clients, that cross-functional team approach is extremely important, not only to make it for a great client experience that the client has with our bank, but also a repeatable experience and one that can stand the scrutiny of oversight from our regulatory partners.
Carlin McCrory:
Nathan, are you all predominantly onboarding these FinTechs with a new idea and they're just trying to launch? Are you onboarding established businesses, who may just be looking for a new bank partner, or may just be having a different arm of business, let's say, or is it a mix of all of the above?
Nathan Ottinger:
It's a little bit of a portfolio approach, I would say, over the years. We'll have established businesses that are maybe looking for a second, or third, or fourth banking partner to their bank syndicate for ACH processing, let's say. There may be established businesses that are launching a new product and haven't been in the payment world before. That is a prong that that we’ll focus on from time to time. Then I would say, less likely, but occasionally, we'll focus on a startup that has a new product and maybe it's a management team that's been in the payments world and have started a new business and received venture funding to start that business.
We take a portfolio approach to the clients that we work with. But I would tell you, more often than not, it is an established business that may not be a FinTech company, but it might be a business services company that has a high-volume payment need that needs a bank to clear those transactions through. To answer your question, it's really an approach.
Carlin McCrory:
Then going back to something we mentioned earlier, if you can discuss some of the important due diligence and ongoing oversight and compliance requirements that these payment companies need to think about when they engage with a bank, that would be really helpful for our audience, especially in light of all of the consent orders that we're seeing. It's definitely a focus from the regulators as well.
Nathan Ottinger:
Yeah. I would say, it goes back into those buckets. I'll say, from a financial standpoint, we're looking at going concern risk, and making sure that the company is a going concern and has sufficient, either profitability, or funding behind them to maintain as a going concern. It's not like underwriting a loan, a corporate loan, but there is meaningful financial due diligence that's done on that. That is a cross-functional effort between the business development team here and our credit risk partners on within the bank. That financial due diligence is an important characteristic.
I would say, we spend most of our time on the operational and compliance diligence that our clients have. That takes various forms based on the nature of the business model. Our bank does a lot in the payroll and HR space. I'll use that as probably a primary example. The operational due diligence that we'll do is around their software and their system of how they're going to get those payment instructions to us on a daily basis. Then the compliance and oversight that our client’s software system that they're using to send those transactions to us is well-known and well understood and well documented.
That takes various forms as it relates to review of SOC, review of policies and procedures that our clients have to send data to us to make payment instructions out of. It gets into ACH audit. It gets into BSA, AML policies and procedures. That operational piece is the most important, I guess, gateway, or toll booth for a client to onboard. What I would tell you is when we are calling on businesses, if they don't have those policies, procedures, documents, audits in place, it's going to be really difficult for them to engage with us.
Now, there might be other banks doing other things, but I would say, we want a client that's thought through the risk management aspects of their particular business, their particular client base, and them coming to us with the answers to the questions we're going to ask. Sometimes there's tweaks around policies and procedures. Sometimes there's additional scrutiny around policies and procedures. Most of the clients that we work with welcome that, because again, they're dealing with other people's money. But them coming to us with that documentation, with those risk management tools in place, I would say is very important. That operational due diligence is where we spend most of our time. I would say, most of the document flow is back and forth.
The third piece of that is really an ongoing portfolio management process that we have with our clients. We think about that is once a program is launched, make sure we're having regular check ins on activities that where their business model may change, or they may be doing a new product, or management changes, whatever it might be. Regular check ins, very important. I would also say, ongoing review of policies, procedures, documentation, audits, financials flows through from that upfront due diligence process that we're doing to an ongoing portfolio management process that we're doing.
Showing consistency of, okay, you've onboarded them, you knew these things at onboarding and documented as such and approved it as such as a new client relationship for the bank, making sure that they're doing those things in an ongoing manner and updating as appropriate, policies, procedures, documentation is an important part of our process. I think we'll withstand and has the regulatory scrutiny that's going on right now, because I don't know how well and widely adopted that has been across banking industry as it relates to banking FinTechs, or non-FinTechs that have a have a money movement need.
Carlin McCrory:
Yeah. That's really good stuff. We've definitely seen, you mentioned the payroll industry, and I know you all are big in that space, there's been a lot of changes in the past what, couple years now as it relates to money transmission and payroll. That's something we're definitely seeing bank partners scrutinize as well as it relates to the payroll industry. I'm not sure if you have any specific thoughts on that.
Nathan Ottinger:
Yeah. I think the first part is get good legal counsel, because it is. I go back to that word volatile. This is a 50-state process that our clients are dealing with. Having good legal counsel that's minding the ship on those matters is really important, because it changes. There are industry associations and industry groups that are monitoring and communicating different aspects of money transmission. Being in touch with those and being deep within those organizations is really important. It goes back to my view of staying narrowly focused on industry segments and product types, allows you to navigate some of these choppy waters, because it's not like you're learning a new business model every single time, or a new set of regulatory requirements every single time you're onboarding a client. The money transmission issue is an issue we stay focused on, because our clients have to stay focused on it.
Carlin McCrory:
Yeah, that's great. Lastly, I just want to ask about some of the payment technology innovations that are reshaping the way that payments are made that you all are seeing.
Nathan Ottinger:
I would tell you, we tend to be a follower as it relates to payment types. We were fine in that role, because – I use the term, chasing the shiny object down the hall. Too many times, you can get distracted as an organization chasing the greatest and the latest thing. Georgia Banking Company, we are a 1.8 billion asset size bank. We need to stay focused on those things that we’re good at. For us, that has been ACH and risk management, underwriting and compliance around large ACH programs.
I would tell you from an innovation standpoint, things and tools that can help us as a bank manage our risk are most important and most interesting to us. Some of those are offered through core bank providers. Some of those are offered directly to a bank from non-core providers. Some of those are offered to our client partners for them to utilize within their software, within their process.
Those tools and those offerings in market to reduce fraud, or to allow for transaction monitoring, to allow for ease of client onboarding, I think, those buckets of product categories are really interesting to a bank our size that acquires most of its product capabilities from our core provider, but don't see those tools as often available from our core provider that speak to specific industry segments. I think payroll, in particular, transaction monitoring is an important tool there. Onboarding in a remote environment. KYB, KYC tools around onboarding remote businesses are important tools there. That's where my mind goes in terms of innovation. It's making process and procedure easier, but also making risk management more efficient. That's where I think about versus payment types.
I mean, obviously, we are focused on RTP and FedNow and the capabilities offered by those payment rails. We do see specific use cases around those payment types within the client base that we serve. I would tell you, that's not driving our investment activities and that's not driving, really, the asks and requirements from our clients on a grand scale.
Carlin McCrory:
Yeah, that all makes a lot of sense. Many of those orders that we've seen that have come out have a BSA, AML component to them. Having that software vendor in place that can help assist in that process seems like it would really be crucial for the bank to make sure not only on its side, but that its partners also have those sufficient tools in place.
Nathan Ottinger:
Yeah, without a doubt. He read through those orders and that is a common theme. I would also say, making sure that the organization, I mean, the banking organization is ready to take on that task of oversight around BSA and AML requirements from a downstream party, and making sure that there's alignment between what the client is doing, what the bank is doing today, and what the bank requires as part of our relationship with the underlying client moving the money. There needs to be no daylight there. Making sure that there's documentation that speaks to that from a bank standpoint is highly important.
Carlin McCrory:
Yeah, we've certainly seen some pitfalls in that area as well. Nathan, any other thoughts before we wrap up for today?
Nathan Ottinger:
I think the only thing that's, I guess, guidance, or advice, or commentary that I'll provide is we think about day in and day out that we're dealing with other people's money. I've said this a couple of times in the discussion. When you're doing that, the bar is very high. I say that the regulatory bar is very high. The ethical bar is very high. Then I would say, the social and ethos bar is very high as it relates to clients in this space. That's on a journey of making sure you're aligned. You're aligned between what your client is doing, what the bank is doing, and then what your other constituents require and need.
Those three areas need to be well aligned. That's not an overnight journey. That's a journey that takes a long time to do. When I read some of these consent orders that are out there and for learning purposes, I'm thinking about, is our organization well-aligned around that high bar of dealing with other people's money from a client relationship standpoint, a internal bank standpoint, and a regulatory standpoint? Those are the things I think about when I read those. Just given the volatility of the world right now, that's what's top of mind.
Carlin McCrory:
That's all really great insight. Nathan, thank you so much for joining me today. Thank you to our audience for listening to today's episode. Don't forget to visit our blog, TroutmanPepperFinancialServices.com. And subscribe, so you can get the latest updates. Please make sure to also subscribe to this podcast via Apple Podcast, Google Play, Stitcher, or whatever platform you use. We look forward to next time.
Copyright, Troutman Pepper Hamilton Sanders LLP. These recorded materials are designed for educational purposes only. This podcast is not legal advice and does not create an attorney-client relationship. The views and opinions expressed in this podcast are solely those of the individual participants. Troutman Pepper does not make any representations or warranties, express or implied, regarding the contents of this podcast. Information on previous case results does not guarantee a similar future result. Users of this podcast may save and use the podcast only for personal or other non-commercial, educational purposes. No other use, including, without limitation, reproduction, retransmission or editing of this podcast may be made without the prior written permission of Troutman Pepper. If you have any questions, please contact us at troutman.com.