On March 8, 2023, the FDIC issued a consent order against Cross River Bank of Teaneck, New Jersey, after a consumer compliance examination found fair lending deficiencies in the loans the bank originates through its fintech partners. The Cross River Bank consent order, docketed as FDIC-22-0040b, requires the bank to rebuild its fair lending compliance program and bars it from adding new fintech partners or new credit products without the FDIC’s written non-objection. The order remains in effect.
Why the FDIC Took Action
Cross River is one of the country’s largest “banking-as-a-service” providers, supplying the bank charter and infrastructure that dozens of fintech companies use to originate loans. The FDIC concluded that the bank was engaged in unsafe or unsound practices tied to its fair lending compliance program. Specifically, its internal controls, information systems, and credit underwriting practices were not adequate to ensure that lending done under its charter complied with the Equal Credit Opportunity Act and Regulation B.
Regulation B prohibits discrimination in any aspect of a credit transaction, from marketing and application processing through the terms a borrower receives and how the loan is serviced.1Consumer Financial Protection Bureau. Regulation B – Equal Credit Opportunity Act The bank is legally responsible for every loan made under its charter, even when a fintech partner designs the credit model and runs the customer-facing experience. The FDIC found that Cross River’s compliance management system was not equipped to detect statistically significant disparities in lending outcomes based on prohibited factors such as race, national origin, or sex. When a bank cannot show it is monitoring for discriminatory patterns in algorithm-driven lending, the regulator treats that gap itself as an unsafe practice, whether or not intentional discrimination occurred.
What a Consent Order Is
A consent order is a legally binding directive the FDIC issues when it concludes that a bank is engaged in unsafe or unsound practices or is violating the law. The bank neither admits nor denies the findings but agrees to follow every corrective action in the document. Because Cross River consented, the order took effect immediately rather than after the 30-day waiting period that applies to contested orders.2Office of the Law Revision Counsel. 12 USC 1818 – Termination of Status as Insured Depository Institution It stays in force until the FDIC formally terminates it, and violating it can trigger civil money penalties and further enforcement.3Federal Deposit Insurance Corporation. FDIC Enforcement Decisions and Orders – Types of Action
What the Order Requires Cross River to Do
The order mandates changes to governance, compliance infrastructure, and third-party oversight.
Board and Management Oversight
The Board of Directors must increase its direct supervision of management, particularly over internal controls, information systems, and credit underwriting. A Board-level compliance committee must be established to monitor adherence to the consent order, and the Board must submit progress reports to the FDIC on a set schedule.
Independent Review of Systems and Partners
Cross River must hire an independent firm acceptable to the FDIC to evaluate whether the bank’s data and information systems allow it to determine, for each credit product, each fintech partner, and each credit model, whether the lending complies with fair lending laws. The reviewer must also assess whether the bank can access, collect, and analyze loan-level data on a timely basis. That data-access question is where many banking-as-a-service arrangements fall short: the bank often does not have direct visibility into the granular records its partners generate.
The order also requires an independent fair lending assessment of every fintech partner that has offered a credit product for six months or more. Going forward, Cross River must conduct at least annual assessments of whether each partner offered products in compliance with fair lending requirements during the prior calendar year.
Fair Lending Compliance Program
The bank must develop and implement a written fair lending compliance program covering all credit products, with policies, procedures, and internal controls designed to monitor every third-party partner. It must conduct a risk assessment of all credit products and partners, and submit a written corrective plan for any violations to the FDIC for review.
The Restriction on New Fintech Partners and Products
This is the provision that reached furthest into the fintech industry. Cross River had to submit a complete list of its current credit products and every third party offering them to the FDIC. From there, the bank cannot enter any agreement with a new third party or offer a new credit product without first receiving the FDIC’s written non-objection. Every prospective partner has to clear not just Cross River’s internal due diligence but the FDIC’s independent evaluation before a single loan is originated.
Existing partnerships are not automatically terminated, but they carry enhanced due diligence and risk-assessment obligations and must align with the bank’s strengthened fair lending standards. In practice, that means additional reporting from partners, potential audits of their credit models, and less flexibility to change product terms without the bank’s compliance team signing off.
What It Means If You Have a Loan Through Cross River
The order does not, by itself, require Cross River to pay restitution or change individual loan terms. It targets systemic compliance deficiencies rather than specific harm to identifiable consumers. If you have a loan originated by Cross River or one of its fintech partners, the order does not change your interest rate, repayment schedule, or any other term of your agreement. Your loan remains enforceable as written.
The fair lending risk assessments the order requires could surface evidence of discriminatory pricing or lending patterns, which would be handled through separate corrective action. Borrowers who believe they experienced lending discrimination can file complaints with the FDIC or the Consumer Financial Protection Bureau. Under the Equal Credit Opportunity Act, lenders who violate the law can face regulatory penalties and private lawsuits from affected borrowers seeking actual and punitive damages.
When the Order Ends
A consent order has no automatic expiration. It stays in effect until the FDIC formally lifts it, and the bank has to satisfy the regulator that the underlying problems are corrected. In September 2025, the FDIC updated its enforcement manual so that termination can be considered when a bank has achieved “substantial compliance” with the order’s terms, or when the order is no longer applicable to the bank’s circumstances, rather than requiring full compliance with every provision.4Federal Deposit Insurance Corporation. FDIC Updates Its Enforcement Actions Manual Regarding Minimum Standards for Termination of Cease-and-Desist and Consent Orders Under the earlier standard, a single unresolved provision could keep an order alive indefinitely.
Cross River’s order is still active. The bank has not announced a termination, and the FDIC’s enforcement database continues to list it.