U.S. banks ask fintech vendors for SOC reports because the 2023 interagency guidance on third-party relationships makes the bank, not the vendor, responsible for managing the risk, and a SOC report is a convenient, independent way to review a vendor’s controls. No rule requires a fintech to hold a SOC report, but a bank’s due diligence often makes it a condition of the contract.
What is the interagency guidance on third-party risk?
The Interagency Guidance on Third-Party Relationships: Risk Management is a June 6, 2023 statement from the Federal Reserve Board, the FDIC and the OCC on how banks should manage risk from third parties. It replaced the agencies’ earlier guidance, including OCC Bulletins 2013-29 and 2020-10.
The agencies say it promotes consistency in their supervisory approach and clarifies that not all third-party relationships present the same level of risk or criticality to a bank’s operations. It applies to banking organizations supervised by the agencies, not directly to vendors.
Does the guidance require vendors to have SOC 2?
No. The guidance does not require a vendor to hold a SOC report, and the text we reviewed does not mention SOC 2 by name. It says a banking organization may review System and Organization Control (SOC) reports when relevant and available, and should check that their scope and results fit the activity.
In practice, banks turn that expectation into contract requirements. The guidance also refers to whether a third party’s controls are covered by effective audit assessments and to concerns identified in audits, internal compliance reviews or other independent tests, which is the kind of assurance a SOC report provides.
How does the third-party life cycle affect vendors?
The guidance describes a risk-management life cycle of five stages: planning, due diligence and third-party selection, contract negotiation, ongoing monitoring and termination. A fintech meets the bank mostly in due diligence and ongoing monitoring.
| Stage | What the bank does | What a fintech should have ready |
|---|---|---|
| Planning | Decides whether the activity is critical and what risks it adds | A clear description of your service and data flows |
| Due diligence and selection | Evaluates your controls, financial condition and risk management | Current SOC 1 and/or SOC 2, security questionnaire answers |
| Contract negotiation | Sets responsibilities and expectations in the agreement | Defined scope, service commitments and subservice organization list |
| Ongoing monitoring | Reviews the relationship during the contract | A new report each cycle, plus bridge letters between reports |
| Termination | Plans for the end of the relationship | Data return and deletion procedures |
Which SOC report does a bank want: SOC 1 or SOC 2?
Banks want SOC 1 when your service affects their financial statements and SOC 2 when they are assessing security, availability or data protection. Many fintechs and payment processors are asked for both.
- SOC 1: controls relevant to the bank’s financial reporting, such as transaction processing, settlement and reconciliation. See SOC 1 audit guide and SOC 1 for payment processors and fintech.
- SOC 2: security and related Trust Services Criteria, usually Security plus Availability. See SOC 2 audit guide.
- SOC 3: a public summary that supports your trust page but does not replace the full report in diligence.
The bank is responsible for its own conclusion. The guidance says using third parties does not diminish a bank’s responsibility to operate safely and comply with laws, so expect questions beyond the report.
How should a fintech prepare for bank due diligence?
A fintech prepares by having a current report with the right scope and by answering the questions a bank reviewer will ask about it. Delays usually come from stale reports, unclear scope or unanswered subservice questions.
Bank due diligence readiness
- A SOC report that covers the product the bank will use, with a recent period end date.
- A management-signed bridge letter if more than a few months have passed since the period end.
- A list of subservice organizations, how each is handled, and copies of their reports where permitted.
- Your complementary user entity controls explained in plain language for the bank's team.
- Responses to any exceptions in the report, with root cause and remediation.
- A security questionnaire answer set consistent with the report.
Our guide on how to read a SOC 2 report shows what reviewers check, and the SOC 2 roadmap shows how to time renewals.
What if you are not ready for a SOC report yet?
If you are not ready, tell the bank what you have and when you will have it. Banks often accept a roadmap, a readiness assessment or a Type I report as an interim step, but that is each bank’s decision, not a regulatory rule.
Start with the scope your bank customers actually need, and get the report that fits. See SOC 2 cost and how to choose a SOC 2 auditor to plan the engagement.
Next Assurance helps fintechs and payment processors define the scope bank reviewers ask for. See our SOC 1 audit service and SOC 2 audit service.
Frequently asked questions about bank vendor SOC reports
Why do banks ask fintech vendors for SOC reports?
Because the 2023 interagency guidance holds the bank responsible for managing third-party risk. The Federal Reserve, FDIC and OCC say a bank may review SOC reports when relevant and available, and should check their scope and results. A SOC report gives the bank independent evidence about your controls without auditing you itself.
Is SOC 2 required by U.S. banking regulators?
No regulation requires a fintech to hold SOC 2. The interagency guidance is directed to banks and does not require a specific report from vendors. It mentions SOC reports as something a bank may review. Banks often make a SOC report a contract or onboarding condition, but that is the bank’s policy, not a regulator’s rule.
Do banks want SOC 1 or SOC 2 from fintechs?
It depends on the service. SOC 1 addresses controls relevant to the bank’s financial reporting and fits payment processing, settlement and similar services. SOC 2 addresses security, availability and related criteria and fits technology and data-handling reviews. Many fintech and payment companies are asked for both, so confirm with each bank which it needs.
What is the interagency guidance on third-party relationships?
It is a June 6, 2023 statement from the Federal Reserve Board, the FDIC and the OCC describing how banks should manage risk from third parties across five life-cycle stages: planning, due diligence, contract negotiation, ongoing monitoring and termination. It replaced OCC Bulletins 2013-29 and 2020-10 and is directed to supervised banking organizations.
What happens if my SOC report is out of date?
Banks may ask for a more recent report or a management-signed bridge letter covering the gap between the period end and today. Buyers commonly treat a report as current for about 12 months from the end of the audit period. Keep your next audit window starting where the last one ends so coverage stays continuous.
Can a Type I report satisfy a bank?
Sometimes, as an interim proof point while a Type II observation period runs. A Type I shows control design at one date, while a Type II shows operation over a period, which banks generally prefer. Whether a Type I is enough is each bank’s decision, so ask early and share your timeline to the Type II.
Sources
Facts checked against primary sources on October 7, 2026. The guidance is directed to banks; this page is general information, not legal advice.
- OCC – Bulletin 2023-17: Third-Party Relationships: Interagency Guidance on Risk Management (June 6, 2023): issuing agencies, rescinded bulletins 2013-29 and 2020-10, and the guidance’s purpose.
- Federal Register – Interagency Guidance on Third-Party Relationships: Risk Management (June 9, 2023): life-cycle stages, the reference to reviewing SOC reports and the scope of application.
- AICPA & CIMA – System and Organization Controls: SOC Suite of Services: the AICPA’s overview of SOC 1, SOC 2 and SOC 3 reports.
