Notice of Proposed Rulemaking on Custodial Deposit Accounts with Transaction Features and Prompt Payment of Deposit Insurance to Depositors

From its founding in 1933, the FDIC has always provided so-called “pass-through insurance,” which allows a person or entity to hold funds in a deposit account for the benefit of others.¹ The FDIC’s enabling statute expressly provided that deposit insurance should be calculated based on the beneficial owners of a deposit account,² regardless of in whose name the account is, and the FDIC first codified this principle in its regulations in 1946.³ In 1984, the FDIC and Federal Home Loan Bank Board issued a joint final rule that restricted deposit insurance for certain types of pass-through arrangements, but this was struck down by the D.C. Circuit the following year for violating the express provisions of the FDI Act.⁴

Today, there exists a vast array of deposit arrangements that qualify for pass-through insurance, ranging from health savings accounts (HSAs) to homeowners association (HOA) accounts to certain clearing services to sweep accounts to prepaid cards to fintechs.  For the most part, consumers benefit tremendously from the availability of pass-through insurance, as it reduces the risk of loss when placing funds with certain third parties, and it has enabled the emergence of a wide variety of innovative financial products over the years.  

At the same time, pass-through arrangements pose certain challenges for the FDIC as the deposit insurer and resolution authority — and, potentially, by extension for consumers.  For example, there are various ways consumers who believe their funds are FDIC-insured can end up losing money and lacking FDIC protection.  To take an extreme example, imagine a person or entity promises to place customers’ funds in an FDIC-insured account, but instead steals the money and disappears.  The FDIC has no authority in such a case to provide insurance to the customers, as the FDIC’s authority only extends to money actually deposited at a bank, and is only triggered when the bank fails.⁵ (The FDIC can take, and has on numerous occasions taken, action against such a scam proactively, but this is only helpful if the FDIC is aware of it in advance.) 

The Synapse bankruptcy appears to involve a different version of a similar story.  Customers of various fintech firms were led to believe their money was being placed in FDIC-insured bank accounts, with the fintechs using Synapse as an intermediary.  But when Synapse failed, tens of millions of dollars was, it appears, missing.⁶ Over 100,000 customers lost access to their accounts, and many could experience significant losses.  This is devastating for those involved, as many personal stories provided to the bankruptcy court have illustrated.⁷

While the Synapse story is still unfolding, these problems could have been identified much sooner if the partner banks maintained better records and conducted frequent, routine reconciliations.  The proposal today would, in part, address these issues by requiring banks with certain types of pass-through accounts to maintain records of end-user depositors⁸ and conduct reconciliations at the close of each business day. 

I am going to vote in favor of the proposal.  I recognize that certain types of pass-through arrangements have become much more complex in recent years, exacerbating the potential risks, and improving recordkeeping and reconciliation practices (1) can reduce the likelihood of another Synapse-like disaster in the event of a third-party failure, and (2) may result in a more orderly resolution in the event the bank fails.   

I appreciate staff’s engagement with me and willingness to accept some of my requested changes to the proposal.  Among other things, I appreciate the removal of a provision that would have required banks to ensure that every beneficial owner’s balance was accurate at the close of business each day, which I don’t think is plausible for a bank with, potentially, millions of end-user depositors and hundreds of thousands of daily transactions.⁹  

Still, I have a number of concerns about the proposal that I hope we will receive comments on and address in a final rule.  First, I strongly believe we should consider a minimum threshold for when the requirements of the rule apply.  Under the proposal, if a bank has one deposit account covered by the proposal, the bank would need to fully comply with all aspects of the rule. This seems excessive, given what could be a substantial compliance burden.  The proposal estimates that between 600 and 1,100 banks could be scoped in,¹⁰ even though only a few dozen are heavily engaged in the type of activity at which the proposal is targeted.  I encourage comments on what type of threshold we should consider – specifically, what metric and at what amount, and why. I also encourage comments on the exemptions – whether they are the correct exemptions, whether there are any additional exemptions that would be appropriate, and why. 

Second, the proposal would require a certification of compliance signed by the CEO, COO, or highest ranking official.  I think this requirement should either be deleted or qualified as was done in Part 370.¹¹ The banking agencies already have authorities to take supervisory or enforcement action in the event of noncompliance, and the certification requirement could be interpreted to impose strict liability in the event any customer balance is found to be inaccurate at any point in time.  It’s hard not to be struck by the dichotomy of an agency that has senior leaders who have repeatedly expressed ignorance of longstanding workforce culture issues at the same time demanding omniscience by the heads of banks we regulate. 

Third, I think we can do more to reduce the burden on institutions while still achieving the proposal’s objectives.  At a minimum, we should delete the requirement that banks establish and maintain written policies and procedures.  While I expect banks will generally update their policies and procedures anyway, codifying it in the regulation encourages examiners to focus on a bank’s documentation and policies and procedures, rather than the actual recordkeeping and reconciliation.  Our Part 370 recordkeeping rule did not include a policies and procedures requirement, and the absence of such a requirement does not seem to have impacted compliance whatsoever.  And as I have said in the past,¹² and as a number of other commenters continue to point out,¹³ supervision should be more focused on core risks and less on process and documentation.            

Finally, while I am voting in favor of the proposal, my view has been that we should not be issuing it now.  Less than two months ago, the banking agencies released a request for information (RFI) soliciting feedback on partnerships between fintechs and banks,¹⁴ and asked several questions directly related to the issues in this proposal, including specific questions related to recordkeeping and reconciliations.  The comment period was scheduled to end at the end of September, and was recently extended an additional month.  I believe we should have waited to issue this proposal until first receiving comments from the RFI – both because the comments we receive might help inform our policymaking, and because preempting the end of the comment period sends a message to the public that it is a waste of time to invest time and resources to provide feedback if the FDIC is going to move forward with its own predetermined policy changes anyway.  But, I think we know why the current leadership does not believe there is time to go through the proper process. 

I want to thank the staff for their work on this, and look forward to the comments to both this NPR and the RFI.