A bank partner reviewing a fintech typically wants dated, specific evidence of how software is built and changed. Prepare a short pack covering access control, change control, dependency inventory, vulnerability handling, key management and incident response, each tied to a date, an owner and a record.
Why partners ask
The 2023 interagency guidance on third-party relationships, issued by the FDIC, the Federal Reserve Board and the OCC, describes a risk based approach for banking organizations across the life cycle of a third party relationship. The FDIC summary lists the stages: planning, due diligence, contract negotiation, ongoing monitoring and termination. It also states that a bank's use of third parties does not diminish or remove its responsibility to operate in a safe and sound manner, including regarding security of customer information.
That guidance is addressed to banking organizations, and this post is not legal advice. It is a useful map of when a bank partner might ask you questions, and what you can have ready. Ask your partner what it needs rather than assuming.
An evidence pack by stage
| Stage | Questions you may hear | Evidence to prepare |
|---|---|---|
| Planning and due diligence | How is your software developed and secured? | Short description of your development process, access model and review rules |
| Due diligence | How do you manage dependencies and vulnerabilities? | Current dependency inventory, scan results with dates, written patching expectations |
| Due diligence | How are keys and secrets handled? | Key inventory, rotation approach, audit trail description |
| Contract negotiation | What will you notify us about, and how fast? | Incident response outline, contacts, escalation path |
| Ongoing monitoring | How do you keep us informed? | Regular summary of open vulnerabilities and closed items |
| Termination | What happens to our data? | Data deletion and export process description |
The last two rows are our suggestions about what to have ready, not requirements drawn from the source.
Make the evidence specific
Vague answers read as weak ones. Replace "we review code" with "changes to payment paths require approval from the owning team through a repository rule, and here is the setting." Replace "we scan dependencies" with "we generate an inventory on each build, and the latest results are dated."
Keep three properties for every item: a date, an owner and a source of truth, such as a repository setting export, a scan report or a ticket.
Be careful with certifications
Do not describe an audit or attestation as complete if it is not. If you are working toward one, say so plainly and offer the controls you operate today with evidence. Buyers and partners generally prefer an accurate "in progress" to a claim that unravels. Never imply a certification you do not hold.
A short preparation routine
- Pick the six areas above and write one page for each, in plain language.
- Export or screenshot the underlying settings and store them with dates.
- Run a mock review: ask a colleague outside engineering to challenge each page.
- Fix gaps before the partner finds them.
- Refresh the pack on a schedule, and not just when a partner asks.
Link it to your daily work
Evidence is cheapest when it is a by-product of normal work. Required reviews, deployment approvals and dependency checks leave records automatically. Our other posts on two-person review, environment protections and dependency review explain controls that generate such records.
Where Safeguard fits
Safeguard's compliance and evidence automation can collect dated records from your pipeline, and its SBOM and dependency scanning supplies the inventory. This is evidence support, not an attestation or certification. A free scan is available at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen.
Click a control and see how a piece of evidence can map to more than one framework requirement.
Quick check
Does the interagency guidance apply directly to my startup?
It is guidance for banking organizations. A bank partner may apply its principles to you through contracts and reviews, so ask them what they expect.
Should I claim a certification if an audit is in progress?
No. Say it is in progress and share the controls you operate today with evidence.
Sources
- FDIC, Interagency Guidance on Third-Party Relationships: Risk Management (June 2023)
- OWASP Software Supply Chain Security Cheat Sheet
Last reviewed: 19 October 2026.
