How Digital Asset Companies Build Bank Partnerships in a Shifting Regulatory Landscape

When a digital asset company approaches a bank, it usually leads with the product, an integration plan, and the market opportunity. However, the bank is weighing more than the technology; it wants to understand the operating model, the controls around it, and the risk introduced by every company involved in delivering the service.

This matters more as stablecoins, blockchain-based payments, and digital asset services move closer to mainstream financial operations. A working partnership needs a shared approach to compliance, cybersecurity, governance, and incident response. Agreeing on what the product does is only the starting point.

In an Alphapoint webinar moderated by Chris Brodersen, Managing Director of the Blockchain and Digital Assets Group at EisnerAmper, Alphapoint General Counsel Reba Beeson sat down with Grace Navas, Principal at Avane Strategies, who advises startups and founders in emerging markets. Together, they worked through what it takes to set up these partnerships and keep them running.

They covered bank due diligence, third-party risk, the new operational demands of digital assets, and how regulatory developments shape institutional decisions.

‍Key Takeaways

• A bank assesses the product's entire operating environment. Be ready to explain governance, security controls, financial assurance, subcontractor oversight, and operational resilience.
• Due diligence requirements vary by institution; hence, regulatory jurisdiction, internal policies, technology architecture, and risk appetite all shape what a bank needs to see before onboarding a partner.
• On-chain activity brings its own control requirements. Elements like private keys, smart contracts, oracles, and irreversible transfers make it essential to have preventive controls and clearly defined responsibilities.
• Compliance and security conversations should start early. Bringing the right specialists in before an integration is finalized helps surface vulnerabilities and set up incident-response procedures.
• Regulatory developments inform partnership readiness. Fintechs can treat banks’ regulatory obligations as a practical guide when preparing documentation, processes, and controls.

What Does a Bank Need to See Before Partnering With a Fintech?

Banks are expected to run with strong risk management, compliance, and operational resilience. Grace Navas framed the starting point simply: a fintech that wants a banking partner should first look at what the bank has to prove to its own regulators and customers.

That review can include audited financial statements, SOC reports, governance procedures, cybersecurity controls, and evidence that the company can operate reliably inside the bank’s environment. Chris Brodersen pointed out that fintechs often discover these requirements only after talks are well underway, by which point producing the documentation becomes a real obstacle.

A fintech operating through a bank’s platform can introduce risk to the bank, so technical capability is only one part of the review. The bank also needs confidence in the partner’s compliance and infrastructure readiness and its ability to meet obligations over time.

Why Third-Party Risk Extends Across the Technology Supply Chain

Digital asset services typically rely on multiple providers working together. A bank may partner with a fintech whose product depends on other vendors for custody, wallet infrastructure, smart contracts, or data feeds.

The speakers discussed how those dependencies can create vulnerabilities well outside the immediate contract. For example, a smart contract can behave exactly as designed while an external oracle feeding it information becomes the point of compromise. Weaknesses in suppliers or subcontractors can undermine the security of the whole service in the same way.

For banks and fintechs alike, third-party oversight has to reach the underlying operational dependencies. That means knowing who provides each component, where a vulnerability could open up, and what preventive or detective controls sit around it.

How Digital Asset Operations Change Risk Management

Traditional bank processes do not always map cleanly onto blockchain-based transactions. Digital asset systems can run continuously, and an executed on-chain transfer can be hard or impossible to reverse.

The webinar put private key management, governance, and transaction authorization at the front as areas where roles and responsibilities have to be set in advance. Banks and fintechs also need to see how custody arrangements, wallet controls, and smart contract dependencies fit into their own operating models.

These considerations should not be addressed after the product launch; they are foundational to how products are designed, reviewed, and integrated from the beginning.

Why No Two Banking Partnerships Follow the Same Due Diligence Process

Reba Beeson drew on Alphapoint’s experience with institutions to explain why one bank’s approval does not carry over to the next.

Financial institutions differ in their jurisdictions, regulatory obligations, internal requirements, and procedures covering operations, audit, and security. Each new relationship calls for a clear read on the institution’s risk parameters and the points where the proposed service could create exposure.

Reba also described the value of collaborative tabletop exercises early in customer conversations. They let technical, compliance, and operational stakeholders work through potential problems together, see where each party’s responsibilities sit, and agree on a path forward that fits the institution’s needs.

A more effective process involves bringing decision-makers together early in the conversation rather than treating legal, compliance, cybersecurity, and technology as separate discussions.

What Regulatory Uncertainty Means for Stablecoin Adoption

The webinar also looked at the U.S. regulatory landscape as the speakers saw it at the time of recording, including the GENIUS Act, OCC activity, and the wider role of the SEC and CFTC. Reba Beeson drew a line between regulatory guidance and durable legislation, noting that institutions differ in how ready they are to move while legislative questions stay open.

Her practical recommendation was for banks to examine their exposure to stablecoin activity and start building the workflows, operational controls, risk parameters, and vendor approaches to match.

For fintechs, the flip side is to track the requirements placed on banks. Those obligations double as a roadmap for preparing internal processes and documentation before approaching an institutional partner.

Regulatory references in the webinar reflect the speakers’ understanding at the time of recording and are not a current regulatory update or legal advice.

Building a Banking Partnership That Can Operate in Practice

A consistent theme throughout the discussion was that a partnership thrives only when both parties comprehend and manage their shared responsibilities effectively.  

A fintech should know what its product does, where it leans on other providers, which controls it operates, and what evidence it can hand a bank.  In turn, the bank must clearly outline its operational expectations and involve the appropriate specialists before executing any plans.  

For institutions exploring digital assets, the goal is a working operating model with clear oversight, resilience, and accountability behind the new capability.

Alphapoint provides digital asset infrastructure for institutions across treasury, payments, trading, and liquidity, built for the operational and governance demands of regulated financial environments.

Request a demo to learn how Alphapoint's institutional-grade digital asset infrastructure helps banks and fintechs integrate secure, compliant digital asset services with the governance and operational controls they need.

Full Webinar Transcript

[0:12] Chris Brodersen: Welcome, everybody. Thanks for joining us today. I am Chris Brodersen. I'm from EisnerAmper. I'm Managing Director of the Blockchain and Digital Assets Group. That goes across everything that Eisner does: tax, accounting, compliance, you name it. With that, I'm going to hand it over to Grace. Why don't you give us a little bit about yourself, Grace?

[0:33] Grace Navas: Sure. I'm Grace Navas. I provide advisory services to startups and founders in the emerging market space, and I help them build relationships and work with customers, investors, and partners.

[0:47] Chris Brodersen: Great. Reba.

[0:49] Reba Beeson: Hi, I'm Reba Beeson, General Counsel of Alphapoint. Alphapoint has built the financial infrastructure for the digital assets era. Our technology platform facilitates payments, treasury operations, and liquidity management. And my background is that I have pretty much spent my whole career on Wall Street and in the financial services industry.

[1:14] Chris Brodersen: Great. Thanks, Reba. So, welcome, everybody. What we're here to talk about today is the emergence of fintech and technology and the integration into the current financial market ecosystem. Sounds easy, but it's not. So to that end, we brought Grace and Reba here today, as well as some experience that EisnerAmper has in the space, to talk about how companies think about this. Do you license your product? Do you partner with an existing broker-dealer or bank? What's the best way to approach the market from a growth and survivability perspective? So, with that, Reba, why don't you kick us off. Give us a very brief overview of where we are from a regulatory perspective, as a backdrop, which I'm sure will come up again later.

[2:11] Reba Beeson: Sure. I think the best place to start, to provide a high-level overview, would be to talk about the final rule that the OCC issued on October 21. That rule comes into effect January 18 of next year, and it provides a catalyst for the banking industry to coalesce around innovation and the framework for payment stablecoin issuance. The purpose of that OCC framework was to provide strong standards for important key aspects such as reserve backing, redemption, and risk management, all within the context of stablecoin issuance.

[3:00] What it covers is national banks, federal savings associations, federal branches, and all of their subsidiaries. It also covers foreign payment stablecoin issuers, and then state-qualified issuers who have OCC regulatory governance under the GENIUS Act. So the OCC framework addresses items that cover custody, applications for the OCC license, the oversight of foreign issuers, and the state-qualified issuers moving into that framework. But given that the industry is still nascent, the OCC has said it will continue to monitor developments and see if new rulemaking is required or the framework needs to be tweaked as necessary.

[3:56] One of the things that is important to note, though, is that there are other regulatory agencies and branches of the government that still need to finally weigh in on this. So we won't have a final, definitive framework probably until sometime next year. But the rule does give the banks and the fintech partners more certainty. The issues that remain to be determined are how items such as AML and KYC apply to this framework, and the sanctions rules as well. The actual application process, now that the rule has been promulgated, needs more detailed information, and then this whole business about rewards and yields: those items still remain open.

[4:41] So the banks should really start now to think about creating their own workflows regarding stablecoin exposure and the touch points in which they are involved in that ecosystem. And then they should think about updating their operational controls and their risk parameters, and how they deal with fintechs and other vendors in the ecosystem. That way they'll be well prepared to take charge when this rule becomes effective. So with that backdrop, I leave it to Chris and to Grace to provide some more context, real-world examples, or real-world guidelines on what we do from here.

[5:24] Chris Brodersen: Thank you. Thanks, Reba. So there will be plenty of options in terms of stablecoins in the future. There are plenty of things being done out there by various fintechs and technology companies. So, Grace, from your perspective, if I'm a fintech and I'm considering how to enter the market, either on my own or through a partnership with a bank, how am I thinking about that? What are some of the major decision points I'm going to be talking to my board about before I go one way or the other?

[5:54] Grace Navas: Thank you for that question. I really think, if I'm a fintech and I'm interested in working with the banking industry, one thing I would think about is what they require from their end to operate with me. A key thing to think about is that regulators and consumers expect banks to provide a high level of risk management, compliance, and operational resiliency. If I am a bank and I'm going to engage with a fintech, one of the key things I would think about is: can they be a good supplier for me?

[6:36] In other words, can I work with them, because we will have to have shared controls and shared security opportunities, to work together to secure the environment in order to operate. So the key thing to keep in mind is: if I were in their shoes, what would I need in order to accept my organization into their environment?

[7:00] Chris Brodersen: Right. And so, for example, at Eisner, when we're talking to fintech companies, a lot of the things you mentioned, these fintechs don't even think about until they have the relationship almost in play. And what does that bank need to see in terms of the detailed due diligence questions? Those are things around audited financials, SOC 1 and SOC 2, governance controls, all the things you pointed out that make somebody a healthy risk, if you will, to have on the bank platform. Because let's face it, if I'm a fintech and I'm on your platform, then really I'm representing the bank, right? And if something goes wrong, guess who's going to be responsible ultimately?

[7:53] Grace Navas: That's correct. And you also have to take into account your suppliers and subcontractors. You need to have the appropriate oversight to work with them to ensure that they are not bringing upstream risks to you or your client. So it's very important that you think about it almost as an ecosystem. And one of the things that is happening now, you have to also think about: there's this partnership opportunity currently, because we're all learning. We have new products, new realities. For instance, banks now are going to have to operate 24/7, 365, as they think about their fintech products. What does that mean for a bank, and how do you have to think about providing services?

[8:39] The key thing to think about is going to be a new reality of key management, private key management, as you think about digital transactions. You have a password and a signature, and once that's triggered, funds are transferred. So you really have to think, from a bank and a fintech perspective, how do we think about governance and private key management? Because once the transaction happens, it's permanently on the ledger. It's happened. So as you think about your planning, you have to think about roles and responsibilities. In these instances, usually you may engage a custodial function to help you with that.

[9:26] So you may even have to partner with the bank's partners. You want to be a good steward in your practices, and you want to make sure that you're a trusted partner. Other things that come into play that some banks may not be familiar with: you have the smart contract that automates rules. How do you manage that? How do you secure that? You have bridges that provide liquidity and interoperability if you want to create broader outreach. Those are points that could be very vulnerable. You also have wallets to consider, and oracles, or information flows that work with your contracts.

[10:11] So think about what protection can I bring, what resilience can I bring, how do I think about those things, and what are the compliance components? And a key thing to think about, since you trigger an event and it's on the blockchain, you really have to think upfront: what preventive measures and controls can I put into my product, or do I need to discuss with my potential bank client, in order to operate?

[10:43] Chris Brodersen: As we talked about in the prep call, smart contracts are neither smart nor contracts. It's really automated business logic. And that automated business logic has some sort of data feed or feeds called oracles. These things happen automatically. So have we, through the use of that smart contract, actually widened the threat aperture to the bank? We need to think about security audits. Does this thing do what it's supposed to do? And it's not just the security of the contract, it's the security of the oracle. So if I'm a bank, I'm looking at the entire supply chain of your offering in terms of where's the threat, where's the weakness for a bad guy to get into the system. Maybe I don't need to hack the smart contract. Maybe I just need to hack the oracle.

[11:37] Grace Navas: That's a very good point. And as a fintech, you need to look at your vendors, your contractors, your suppliers as well, and see where those points of weakness are and how you compose your product. A lot of supply-chain events happen not at the target, the company you want to target. It's usually somewhere along the supply chain. So you have to be very cognizant of what's being asked of you. The bank should turn around and think about asking your suppliers and your subcontractors, because you do not want to be in a situation where you could not prevent something. Anything can happen. So you're responsible for oversight of your subcontractors and suppliers.

[12:14] Chris Brodersen: Exactly. So now let's talk for a minute. Let's say we've gotten to the point where we're talking to the bank about actually coming on board. From an integration perspective, we'll talk about the operational stuff in a second, but what should I be thinking about as that fintech in terms of getting my product whitelisted, or whatever it is, on the bank's platform?

[12:40] Grace Navas: One thing that would be super helpful for a fintech, even very early on in the sales and prospecting stage when you're approaching the bank, is bringing in your specialists, your compliance people, your security people, and not just to the sales meeting, but making that bridge and getting to know internally who those points of contact are, so you can have a conversation with them to really understand what their pain points are, what their vulnerabilities are, where they sit in their risk profile. Those conversations should be happening as you're negotiating contracts, because what you want to do in this very changing landscape, with a lot of threats, especially with AI, is really create a partnership where you're at a good conversation. You feel comfortable planning things together. You should be, in the early stages, talking about having tabletops. How do we handle incident response? What's important to you? Who are the key contacts? Start building up that profile of what you need for risk, compliance, and cybersecurity upfront, because if you have that trust, it's going to move along the relationship and also the integration parts.

[14:01] Chris Brodersen: Sure. So, Reba, on that point, I just want to switch to you for a minute, because Alphapoint is a partner to many institutions. Let's say you go through this compliance due diligence questionnaire, get the okay from firm X. Now you want to talk to firm Y. Maybe you can talk us through the fact that these firms are different, that you need to be prepared to go through this process repeatedly. It's not do it once and you're in. Firms have different levels of compliance, risk, and so on. So walk us through that lens and what we need to be prepared for.

[14:41] Reba Beeson: Yes, absolutely. The way you positioned that question is spot on. Because in our experience, every bank, every financial institution is different, for many reasons. Not the least of which is they're in different jurisdictions with different regulatory governance. And in addition to that, they have their own internal requirements. They have their own internal capital maintenance requirements, regulatory or otherwise. They also have different procedures around operations, audit, security, all these different things. And then, on top of all of that, what they need to really understand is, if they're working with a fintech company such as Alphapoint, what are the touch points where they need to take a risk assessment, vulnerabilities. I like the idea of working together, of tabletop exercises and working through that. We have done that with some of our customers at the initial conversation level, because that really helps navigate through what both parties' issues are, how to resolve them, and how to create the best path forward with the product and service that fits their needs and within their risk parameters. So hopefully that's a little bit of a high-level response to your question.

[16:11] Chris Brodersen: Sure. So in other words, be prepared. Everybody's a little bit different. It's kind of like, trying to think of a good analogy, it's kind of like dating, right?

[16:21] Reba Beeson: Yes.

[16:22] Chris Brodersen: It's the other person, but each one is a little bit different. Each one's going to have their quirks.

[16:22] Reba Beeson: Yes.

[16:22] Chris Brodersen: Each one is going to have their specific questions, and you're going to have to be prepared to answer those questions on a regular basis.

[16:39] Reba Beeson: Yes. And I liked what Grace said in this context about the parties getting together, not in a siloed environment, but bringing all the key decision makers and key components of the business together. So, for example, the CISO perhaps, or the tech team, along with the compliance folks and the like. That's really important, because then that provides what I'd call not just a more efficient process, but something that is far more resilient in the end.

[17:08] Chris Brodersen: Sure. So, having said all that, to the audience, I think Grace sort of undersold herself. She was at the Federal Reserve, worked on the FedNow project, has seen multitudes of fintech offerings out there in the marketplace. So through that lens, Grace, I'm a fintech.

[17:30] Chris Brodersen: How do I prepare for that approach to a bank or another vendor? What's going to separate me from my competition, that's going to make me look more attractive to a bank, to at least start that conversation and start moving down that road?

[17:30] Grace Navas: I'm glad you asked, because this is a question I love addressing with my clients. I think what's really important is to understand your product. What I would suggest you do is look at what the regulators require, and also what they're looking at for guidance. For instance, there is interagency guidance being reviewed right now that you can look up online and say, what do the regulators require for the bank? And then you think about it. Okay, this is a general idea of where I have to look at my ecosystem and see where it fits in and where it doesn't. Not every product is high risk, but generally, think about yourself as a higher-risk product and service, only because it's really new and it could be very impactful. Reverse-engineer the things they're looking at. There are very reputable organizations like OWASP and NIST. They're giving out guidance. I would benchmark my operations against that. I would think about starting a SOC process, showing that you are engaged in some sort of maturity. I would look at my vendors.

[19:01] Chris Brodersen: Grace, can I just stop you there real quick? Would you please explain, for the uninitiated in the audience, SOC, because we have SOC and then we have SOX, and those are two very different things?

[19:12] Grace Navas: Absolutely. So SOC 2.

[19:16] Chris Brodersen: Sorry about that.

[19:17] Grace Navas: SOC 2, I'll explain. It's an assessment of your operations and controls, which gives a baseline of the condition of your operation that's shared with your customer. It's like a third-party assessment. And I say baseline only because it could get stale. It's point in time. You may be able to use it for a time and do what they call a bridge letter to see if things have changed, just to give a level of comfort to the banks you're working with. That said, it's usually coupled with sharing information about your monitoring and controlling, what you do ongoing, and how you handle remediations. So it's sort of a point-in-time snapshot and evaluation done by a third party, to give comfort in terms of your operational resiliency. Is there anything you want me to add to the definition?

[19:56] Chris Brodersen: No, that's great. Continue with where you were. I'm sorry to interrupt, but a lot of people say that word and they don't know if they're talking about security or Sarbanes-Oxley.

[20:25] Grace Navas: Yeah, it's clear.

[20:26] Chris Brodersen: It's like the Good Housekeeping Seal.

[20:31] Grace Navas: You'll never forget it with that analogy. But yeah, absolutely. So look at what they're doing and benchmark: do we meet this? If you don't meet it, you may want to consider, if you want to strengthen your opportunities, partnering with someone that does provide that. For instance, you may want to pair up with a compliance company to approach a bank, or put it within your product and services suite that automates AML and BSA. Ensure that you are regularly reviewing your stack and being very transparent about what you do, what you don't do, and what's in your SBOM when you're talking, even in early conversations, because it shows you want to do a partnership. And there's a secondary benefit to that, and that's concentration risk. Concentration risk means you may be talking to a client, and you want to understand if they have a lot. They may want to know what kind of product offerings there are, and if there's a lot of that within their ecosystem, so you could start having conversations. But the most important thing is building up that trust and partnership early on, and building those relationships. The technology could be very good, but if there isn't trust and openness, especially in this industry that's a bit nascent, you're not going to be ahead of the competition.

[22:01] Chris Brodersen: So let's talk about competition and the shifting landscape. But before we go there, Reba, you talked about GENIUS. We're in rulemaking right now with Treasury and the OCC. Most people on this call are going to be very aware that Clarity, the market infrastructure bill, failed. So we now find ourselves in a place where we don't have legislation, but we have the SEC offering guidance. So what does that look like? Because now that ground is a little shakier. And then I want Grace to explain to people how they should be thinking about where the puck is going, as opposed to following it.

[22:45] Reba Beeson: Well, that's a really important question. And I think there are divergent views in the market about what to do about all that. So, for context, the Clarity Act didn't get through the Senate. We can talk about the reasons why, but the really important part is that what we're now left with is an overarching digital assets regulatory framework, primarily being driven by the SEC and the CFTC. They have been prolific in releasing rulemaking, and I believe there's a lot of momentum behind that by market participants to get on board and to be able now to innovate and to offer products and services around that. So I think that for the entrepreneurs, the innovators, the fintechs, this development by the regulators is being embraced and is very helpful. At the end of the day, though, that doesn't substitute for good legislation, sound legislation that can translate into something to govern one administration to the next, to the next. So that instead of having something that could be viewed as more temporal, we have something that's sound, a framework the major institutions would feel much more readily able to embrace. Because on the risk spectrum, the largest institutions might sit on the sidelines and wait for certain things to get more solidified from a legislative perspective, while those who maybe have a higher risk appetite are willing to jump in now and act upon what the regulatory agencies have come forth with.

[24:48] Chris Brodersen: And I would argue that in a shifting landscape outside of legislation, this market moves at the speed of light. Things are constantly changing, and then you have the uncertainty on top of it. So I would argue that means things like strong governance, strong controls, and other things that address risk become even more important in this environment for those that want to partner with a larger institution.

[25:24] Grace Navas: And you really have to think about something I want to touch on that Reba said. There are going to be loss leaders. There are going to be people who sit on the sidelines. As a fintech, you have a lot of opportunity here to go out and just have conversations, not even sales calls, more just have conversations with banks. People are curious. This is a good time to talk to people and collect that intel, connect what people are thinking, and then really focus on where these opportunities are coming from. This has generally been part of a sales cycle for a very long time, so this is ripe for opportunity. Again, also coming to a bank with a risk-management mindset, as Chris just said, is going to really help you accelerate narrowing down on who is ready now and who's not, and who you should put on your radar down your pipeline for when you may want to engage with them again. And they'll recognize your name, because you actually went in there to talk to them, not necessarily to sell them anything. There are also other opportunities. Fintechs, please go out to conferences. There are a lot of conferences where you can have very informal conversations with leaders that could build into proper, formal appointments at organizations you'd like to target. I hope that helps, Chris.

[27:10] Chris Brodersen: Yeah, sure does. So I see we're coming up on time. Let's go around the horn and give some final thoughts. Grace, Reba, and then I'll give mine, and we'll catch up with people later if they have questions.

[27:23] Grace Navas: Again, I cannot stress enough: knowing your environment, knowing your contractors' environments. You're all part of an ecosystem when it comes to actually providing services to the banks. So don't just look at the banks. You have to also look behind, to ensure that you have safety and soundness in your practices. Also, go out and prospect. Talk to people. This is a great time to harvest opportunities. Go out to conferences, regionally and nationally, and have conversations to really figure out what's important to the banks. As Reba pointed out, everyone has different priorities. They're thinking differently on this, so that helps you really create your pipeline.

[28:18] Chris Brodersen: Great. Thanks, Grace. Reba, any closing thoughts?

[28:22] Reba Beeson: I think what Grace said was really excellent, and I would only add, in addition to going out there and talking and attending conferences, look at the developments on the regulatory side as well as on the bank regulatory side. Because, as Grace mentioned earlier, the requirements being imposed upon the banks include what I'd call a menu of what fintechs should look at and follow and embrace and be prepared to address when they have those conversations.

[28:59] Chris Brodersen: And I would add, in closing, my advice to founders is don't ignore the boring and mundane. And what I mean by that is: have a roadmap. Understand what the banks are going to need in terms of your compliance, audits, audited financials, whether that's for a bank or maybe even a licensing infrastructure. We have seen it time and again at Eisner, where a company comes to us and says, we need audited financials, or we need SOC Type 1, Type 2, or both. And the reason is they're either raising money, filing for a license, or trying to sign a licensing deal with a larger organization that needs this documentation to get past their due diligence. And they suddenly find themselves way behind the eight ball, not realizing the amount of time and effort it takes to get there. So I'm not saying run out tomorrow and hire folks like Eisner, but at least have a conversation, have a roadmap, understand what your responsibilities are going to be when you get to that juncture. So with that, I see we're right at time. I want to thank everybody for your participation, and if you have any follow-up questions, please reach out. Happy to talk at any point. Thank you.

[30:19] Grace Navas: Thank you.

[30:19] Reba Beeson: Thank you.