Demystifying the Bank Vendor Management Process | Part II

In this two-part series, we share key observations and learnings that aim to demystify the bank vendor management process. Part I shared key observations and considerations to help fintechs better prepare for the bank vendor management process. Part II dives deeply into contract negotiation, particularly the legal terms that regularly hold up negotiations. This post is for informational purposes only and should not be considered legal advice.

Navigating contract negotiations between fintechs and banks can be a daunting and intricate process, especially for early-stage fintech companies with little experience in this arena. The success of these negotiations plays a crucial role in shaping the partnership and establishing a solid foundation for collaboration. At Canapi, we understand the challenges fintechs face in these negotiations. Drawing from experience assisting our portfolio companies, engaging in conversations with our bank partners, as well as our firsthand experience as former operators on both sides of the table, we have gained valuable insights into the intricacies of contractual discussions in the fintech industry.  

In this post, we will delve into 12 key contract terms that frequently pose challenges during negotiations, aiming to shed light on the points that may stall negotiations and offering examples of how they've been resolved. As an exclusive benefit for companies within the Canapi Alliance, we curated an extensive set of in-depth insights and strategies, designed to prepare and guide fintechs through these negotiations.

Before we start, let's establish a foundation with four key points:

1. The intricacies of contract negotiations between banks and fintechs will inevitably differ, influenced by factors such as the types of services involved, the scale of the partnership, the maturity of the fintech, market conditions, and the overall strategic importance of the collaboration, among other considerations.
2. Banks with existing fintech partnerships often work with standardized agreements that align with regulatory expectations. As you approach negotiations, expect to begin with the bank's preferred terms and language.
3. Negotiation decisions are heavily influenced by the risk tolerances of each party involved. Understanding where your fintech stands on risk and choosing one or two battles wisely will be essential in navigating these discussions.
4. Please be aware that the insights shared in this article are drawn from our extensive experience and knowledge, but it is important to note that this information should not be construed as legal advice. 

With these points in mind, let's embark on priming your fintech for fruitful collaboration with financial institutions.

1. SERVICE LEVEL AGREEMENTS

Service level Agreements ("SLAs") are provisions that define the agreed upon performance standards and service levels that the fintech will deliver to the bank. SLAs establish specific metrics, such as response times, uptime, and resolution times, which the fintech must meet to ensure the satisfactory delivery of its products or services. The SLA serves as a key performance indicator, helping the bank assess the fintech's performance and hold them accountable to agreed-upon service levels. The typical challenges between banks and fintechs when negotiating service level agreements include, but are not limited to:

• Performance Metrics and Targets: Banks often seek stringent metrics to ensure top-quality service and minimize any potential disruptions. On the other hand, fintechs may worry about committing to unrealistic targets that could be difficult to achieve, especially if they are early-stage companies or operate in a rapidly evolving market.
• Penalties and Incentives: Banks may want significant penalties to protect their customers and reputation, while fintechs may argue that such penalties could be financially burdensome. Additionally, fintechs may seek incentives for exceeding performance targets, encouraging them to provide exceptional services, but banks may be cautious about offering excessive rewards.
• Scope and Scope Creep: Clearly defining the scope of services covered under the SLA is crucial. Banks may desire a comprehensive SLA that includes a broad range of services, while fintechs may seek a more focused SLA to avoid potential scope creep and ensure they can deliver on their commitments effectively.  

Example Scenario: During contract negotiations between a bank and fintech, the "Support Response Commitment" provision became a focal point. The bank sought a robust and efficient support system to address any technical issues that might arise promptly. They emphasized the importance of quick responses to critical incidents, as even a minor delay could have significant impacts on their operations and customer experience. On the other hand, the fintech recognized the need for prompt support but was concerned about the strain on their resources, especially when dealing with high-priority incidents that required immediate attention. Through further discussion, they established a tiered approach. For critical or high-priority incidents, such as security breaches or major system outages, the fintech committed to respond within one hour, ensuring swift resolution to minimize disruptions for the bank. For less urgent inquiries or lower-priority incidents, the fintech agreed on a response time of up to 24 hours, providing them with reasonable flexibility to manage their resources effectively.

2. INTELLECTUAL PROPERTY

Negotiating intellectual property addresses the ownership, licensing, and usage of intellectual property rights. In most straight-forward agreements, we see the fintech retain ownership of the intellectual property, while the bank is granted limited license to use it. However, the situation becomes much more complex when both parties contribute to the development of solutions. In such cases, banks want intellectual property rights to maintain control over technologies integrated into bank systems, ensuring the ability to customize, modify, and scale the technology to the bank's specific needs. On the other hand, fintechs want to maintain ownership and control over their core assets and the ability to monetize their intellectual property through licensing or partnerships with other financial institutions.

Finding a middle ground where both parties benefit is essential. We typically see both sides engage in negotiations to establish exclusivity provisions with reasonable limitations regarding time, geography, and scope. These provisions aim to strike a balance that allows the bank to protect its investment while still enabling the fintech to maintain a fair level of independence.  

Example Scenario: A bank aimed to integrate a chatbot technology into its mobile banking app to enhance customer engagement. Both parties sought intellectual property rights, with the bank wanting control over the technology's integration and customization, while the fintech desires ownership and protection of their core AI-driven chatbot technology for potential future collaborations. Eventually, both parties agreed on a licensing arrangement, under which the bank received a limited, exclusive license to use the chatbot technology in its mobile app while the fintech retained overall ownership. The contract also outlined a framework for future provisions and modifications, ensuring clear definitions of ownership and usage rights in such scenarios.

3. WARRANTIES

Warranties are assurances provided by one party to the other regarding the quality, performance, or functionality of their products or services. While banks typically seek robust warranties to safeguard their investments, fintechs must carefully evaluate their capabilities and potential exposure to risks before committing to warranties. Fintechs might need to settle with certain required bank warranties to gain trust and secure partnerships, especially when dealing with more risk-averse banks. However, they must exercise prudence to avoid agreeing to warranties that are beyond their reasonable capacity to fulfill.

In our experience, typical warranties may include, but are not limited to:  

• The fintech has the necessary rights and licenses to use any intellectual property involved in its products or services and that there are no known infringements on third-party intellectual property rights;
• The fintech adheres to applicable laws, regulations, and industry standards (although, the onus of bank compliance remains with the bank);
• The fintech specifies certain performance metrics or service level commitments that the fintech must meet; and
• The fintech provides assurances that it has implemented appropriate security measures to protect the data it handles.

Example Scenario: A bank and fintech encountered a challenge regarding the scope and duration of warranties for a new AI-driven financial analytics software. The bank, concerned about potential financial risks and customer data accuracy, insisted on comprehensive and long-term warranties covering all functionalities of the software. However, the fintech, being early stage with limited resources, expressed reservations about assuming unrealistic long-term liabilities that could strain their capacity to provide support and updates. Ultimately, a resolution was reached through a compromise. The contract specified warranties for specific critical features relevant to the bank's priority areas, with a reasonable duration and clear metrics for evaluating performance, and the fintech offered enhanced support and a commitment to promptly address any issues.

4. DATA USAGE

Data usage negotiations between banks and fintechs involve defining terms and conditions related to the handling and utilization of customer data and sensitive information. Banks, as custodians of customer data, seek to retain strict control and ownership over the data, determining how and for what purposes it will be used by the fintech. They prioritize data privacy and compliance with regulations, imposing restrictions on the fintech's access to sensitive data and specifying permitted data usage. Conversely, fintechs recognize the value of data-driven insights and may desire access to relevant data to enhance their innovative solutions.  

Negotiations focus on defining clear guidelines for data access, usage, and security measures, considering not only the interactions between banks and fintechs but also the involvement of fourth-party providers. Both parties may collaborate on implementing encryption protocols, data anonymization techniques, and data retention policies to ensure data privacy and protection across all stakeholders. Additionally, discussions may include exclusivity provisions that outline time-bound or geographical limitations on the fintech's access to and use of customer data, enabling banks to safeguard their customers' information while still allowing the fintech to deliver valuable services, including sharing relevant data with approved fourth-party providers.

It is imperative that fintechs consider the regulatory frameworks that govern various types of data. Those who design policies and services with robust data management practices (e.g., collecting and using only necessary data with appropriate consent, implementing data retention limits, and establishing data destruction and disposal protocols) typically fare better during contract negotiations and the larger path to agreement.  

Example Scenario: A bank aimed to enhance customer experience by integrating advanced data analytics capabilities into its mobile banking app. The data analytics fintech sought access to a comprehensive dataset, including customer transactional and behavioral data, to derive valuable insights for personalized services. On the other hand, the bank, conscious of data privacy concerns, was cautious about sharing sensitive customer information and sought to limit access to only aggregated and anonymized data. The parties ultimately agreed upon a data sharing framework that allowed the fintech access to aggregated and anonymized customer data, while strictly prohibiting access to any personally identifiable information. Additionally, robust data security measures, including encryption and access controls, were implemented to safeguard customer privacy.

5. INDEMNIFICATION

Indemnification is a provision that outlines the responsibility of one party (the indemnitor, typically the fintech) to compensate the other party (the indemnitee, typically the bank) for losses, damages, or liabilities incurred due to specific events or actions. This clause is of utmost importance for banks, as it provides them with a level of protection against potential financial risks and liabilities resulting from the actions or breaches of a fintech. Banks have established reputations, a large customer base, and significant regulatory obligations. Therefore, they seek to safeguard their interests by ensuring that the fintech assumes responsibility for any losses or damages caused by their products, services, or actions. For fintechs, indemnification can be a cause for concern, as banks may push for broader indemnification clauses, holding the fintechs liable for a wide range of potential risks. Fintechs may seek to limit the scope of indemnification to avoid assuming excessive liabilities that could threaten their financial stability and growth. This differing preference can create challenges during negotiations, as both parties aim to protect their interests while striking a fair balance.

Resolving challenges related to indemnification often involves careful negotiation and compromise. A common resolution that we see is the inclusion of carve-outs or exceptions within the indemnification clause, clearly defining the instances where indemnification applies and where it does not.  

Example Scenario: In a contract negotiation between a bank and a fintech specializing in payment processing solutions, a challenge emerged regarding a specific indemnification related to potential intellectual property infringement claims. The bank sought robust indemnification from the fintech, requesting the fintech to assume full responsibility for any intellectual property infringement claims arising from the use of its payment processing technology. However, the fintech, being a young startup, expressed reservations about taking on unlimited intellectual property-related liabilities, fearing that it could impede their ability to grow and innovate freely. Ultimately, they reached a middle ground by crafting a nuanced indemnification clause that specified the fintech's responsibility for intellectual property infringement claims directly resulting from its technology, while also capping the liability to a reasonable financial limit. This resolution provided the bank with the necessary protection while ensuring that the fintech could continue to operate without being unduly burdened by potentially excessive indemnification obligations.

6. LIMIT OF LIABILITY

Limit of liability establishes the maximum amount of financial responsibility that one party is willing to bear in the event of a breach or unforeseen circumstance. It is crucial, as it defines the extent to which the parties can be held accountable for damages, losses, or liabilities that may occur during the contractual relationship.  

Banks typically seek higher or no caps on the limit of liability to minimize potential financial exposure, aiming to protect their interests and assets to the greatest extent possible, while fintechs aim for a lower cap on liability, not a higher one. This is because early-stage fintechs often have limited financial resources and may be concerned that assuming a high financial responsibility through a high liability cap could potentially outweigh their company's value and jeopardize their operations.  

Example Scenario: A bank sought a high cap on liability to protect its interests, while an early-stage commercial lending fintech expressed concerns about assuming extensive liabilities. The fintech proposed a lower cap on liability, highlighting their commitment to strong risk management practices and the implementation of robust security measures to safeguard data and customer information. They also offered to obtain cybersecurity insurance coverage to provide additional protection to the bank. In response, the bank considered the fintech's financial viability and the potential value of their innovative services and agreed to a reduced cap on liability.

7. LIQUIDATED DAMAGES AND PENALTIES

Liquidated damages and penalties language in a contract establishes the predetermined consequences in case of a breach. Banks often prioritize this aspect due to their risk mitigation and financial protection concerns, aiming to ensure the fintech's compliance with contractual obligations and safeguard the bank's interests in case of non-performance or breach. However, fintechs also recognize the necessity of consequences for non-performance while seeking to avoid excessive financial burdens that could hinder their growth and stability. Challenges arise as banks may push for higher liquidated damages and penalties, while fintechs strive for reasonable amounts that are proportionate to the potential harm caused by the breach and consider their financial capabilities.  

We've seen in many cases that the settlement often involves agreeing on a tiered penalty system that scales penalties based on breach severity and duration, striking a balance between providing sufficient deterrence and ensuring that penalties align with the bank's and fintech's risk tolerance.

Example Scenario: During contract negotiations between a well-established bank and an emerging fintech, discussions revolved around the liquidated damages and penalties clause. The bank, concerned about risk mitigation and customer trust, proposed substantial penalties to ensure the fintech's compliance with contractual obligations and safeguard their reputation. However, the fintech, mindful of its early-stage financial position, sought a more balanced approach with tiered penalties based on breach severity. After collaborative discussions, a compromise was reached with a tiered penalty structure that aligned consequences with breach seriousness, satisfying both parties' needs.

8. RIGHT TO AUDIT

Right to Audit outlines the bank's right to perform periodic audits on the fintech's operations, financial records, and compliance practices. This provision aims to ensure the bank's risk mitigation, regulatory compliance, and protection of its reputation by assessing the fintech's adherence to the agreed-upon terms, security protocols, and industry standards.  

Banks, driven by increased regulatory focus on third-party risk management, seek extensive but reasonable audit rights to maintain oversight over the fintech's operations and to protect their interests. On the other hand, early-stage fintech companies are wary of providing banks with too much audit access, as they fear it may be intrusive and disruptive to their agile and innovative processes. Additionally, fintechs may have concerns about safeguarding their proprietary technologies and sensitive business information from being exposed during audits, which could potentially compromise their competitive advantage.

To resolve these challenges, banks may agree to limit the scope and frequency of audits to avoid excessive interference with the fintech's operations while still ensuring adequate oversight. Fintechs, on their part, may agree to provide sufficient access and transparency to the bank, demonstrating their commitment to compliance and risk management.

Example Scenario: A bank under intense regulatory scrutiny insisted on extensive audit rights to ensure rigorous compliance and risk management. Understanding the regulatory landscape, the fintech anticipated the bank's position and recognized the importance of aligning with industry standards. However, to safeguard their innovative processes and proprietary technologies, the fintech aimed to limit audits to once a year, arguing that frequent disruptions could hinder their progress. While the bank initially pushed for unrestricted audit access, they eventually agreed to an annual audit compromise, acknowledging the fintech's commitment to compliance.

9. SUBCONTRACTING AND OFFSHORING

The subcontracting and offshoring clause addresses the parties’ ability to engage fourth-party contractors or transfer obligations to offshore entities. For fintechs, this clause can be crucial for scaling their operations and accessing resources that may not be available in-house. It enables them to tap into a broader network of talent, technology, and infrastructure to support their services. Banks, on the other hand, may have concerns about the potential risks associated with subcontracting or offshoring, such as data security, regulatory compliance, and service quality. As such, they seek to impose limitations and safeguards on subcontracting and offshoring activities to protect customer data, maintain regulatory compliance, and ensure uninterrupted service delivery.

Interagency guidance makes it clear that banks are responsible for the risk brought on by fourth-party subcontractors or offshore entities leveraged by the fintech; so, although banks typically acknowledge that fintechs may need to utilize subcontractors and offshore entities, it is now commonplace for banks to include certain provisions that allow them to monitor that risk. Such provisions may cover timely notification of subcontractor arrangements, bank notification (and sometimes approval) prior to the outsourcing of the fintech's obligations; and requirements to report on the subcontractor's adherence to performance measures, periodic audit results, and compliance with applicable laws and regulations.

‍Example Scenario: During contract negotiations, a bank expressed concerns about the potential risks associated with subcontracting sensitive customer data management to fourth-party providers and the possibility of offshoring data processing tasks to foreign countries. The bank emphasized the importance of data security, privacy, and compliance with local regulations. On the other hand, the fintech sought the flexibility to leverage specialized fourth-party providers for certain data processing tasks, including cloud-based services, to enhance their service offerings and scale efficiently. The fintech also saw cost benefits in exploring the option of offshoring certain non-sensitive tasks. To address these concerns, both parties engaged in discussions to establish strict criteria for subcontractors' selection, ensuring they meet stringent security and compliance standards. The bank sought assurances that subcontractors would adhere to data protection measures, while the fintech committed to conducting thorough due diligence on potential providers. Additionally, the parties agreed to limit offshoring to specific non-sensitive tasks and only to countries with robust data protection laws.

10. INSURANCE

The insurance clause addresses the parties' obligations and requirements regarding insurance coverage. Banks often use this clause to protect themselves from financial losses and liabilities that may arise from the services provided by the fintech. They may require the fintech to maintain specified types and amounts of insurance (e.g., professional liability insurance and cybersecurity insurance), notify the bank of material changes to coverage, and provide evidence of coverage. These insurance requirements align with regulatory guidance, which emphasizes the importance of insurance as a risk mitigation strategy.  

Conversely, insurance requirements in contracts can pose challenges for early-stage fintechs due to their limited financial resources and potentially higher insurance costs. These fintechs often find it difficult to meet the specific insurance coverage and amounts demanded by the banking organizations. Insurance premiums can be substantial, especially for emerging fintechs that may be deemed higher risk by insurers.  

Ultimately, we find that negotiations between banks and early-stage fintechs require a risk appetite assessment from both parties. Banks need to assess the business risk resulting from a fintech's lack of insurance coverage, while early-stage fintechs need to evaluate the financial viability of securing required insurance coverage.

Example Scenario: During contract negotiations, a bank expressed concern about the fintech's lack of cyber security insurance. The bank required that the fintech acquire cyber security insurance coverage, and although the fintech initially hesitated due to the expense to obtain such insurance, the fintech realized that it was a necessary cost of doing business. However, understanding that the fintech was still in its early stages and might face challenges in obtaining immediate insurance coverage, the bank proposed a restructured engagement process. In the short term, the bank required the fintech to implement additional security measures and best practices as a condition for the partnership. These measures included regular vulnerability assessments, multi-factor authentication, encryption protocols, and constant monitoring of their systems, with particularly enhanced precautions taken for personally identifiable data. The bank also mandated that the fintech regularly update their security policies and procedures to align with industry standards.

11. DISPUTES

The disputes clause outlines the procedures and mechanisms for resolving conflicts or disputes that may arise during the partnership. It helps ensure that disputes are resolved in a timely and cost-effective manner, minimizing disruptions to business operations. Negotiations regarding this clause often center around selecting the appropriate dispute resolution method, defining the governing law and jurisdiction, and specifying any mandatory pre-dispute procedures, such as good-faith negotiations and mediation. Both banks and fintechs seek to protect their interests and ensure a fair resolution process that aligns with their respective legal obligations, risk tolerance, and resources.  

In addition to defining dispute resolution methods, the disputes clause typically includes clear escalation procedures. These escalation mechanisms are essential for ensuring that disputes are addressed at the appropriate levels within the partnership hierarchy. Having a well-defined escalation process helps prevent minor disagreements from escalating into major conflicts and allows both parties to resolve issues more efficiently.  

Example Scenario: A bank insisted on a structured escalation process involving multiple levels of escalation within their organization, including engagement with the Chief Technology Officer and Chief Operating Officer. However, the fintech, with a small and agile team, argued for a more streamlined process to avoid bureaucratic delays. To address this challenge, both parties agreed on an efficient escalation process where technical issues would be escalated to the respective project managers and any unresolved matters would be quickly addressed in a direct meeting between the CEO of the fintech and the relevant executive team at the bank.

12. TERMINATION

Termination refers to the circumstances and procedures for ending their contractual relationship. It is an important consideration for both parties as it affects the duration and flexibility of their partnership. The typical challenges that arise between banks and fintechs when negotiating termination include:

• "Termination for Convenience" vs. "Cause": One challenge is determining the grounds for termination. Banks typically prioritize the inclusion of a "Termination for Convenience" clause, allowing either party to terminate the contract without specific cause. Banks value this flexibility to adapt to changing business needs and market conditions. On the other hand, fintechs may seek to include a "Cause" provision, specifying specific reasons for termination, such as non-performance or breach of contract. Fintechs prioritize this clause to protect their interests and contractual obligations, ensuring they are not unfairly terminated without valid cause.
• Deconversion Fee: Another challenge is the inclusion of a "Deconversion Fee" in case of termination. This fee refers to charges imposed on the fintech for transitioning its services away from the bank's platform. Banks may insist on this fee to recoup the significant resources invested in onboarding and integrating the fintech. However, fintechs may resist this provision, seeking lower or waived deconversion fees to minimize financial impact when leaving the partnership.
• Auto-Renewal and Notice Period: Determining whether the contract automatically renews at the end of its initial term and specifying the termination notice period are other challenges. Auto-Renewal can provide stability and continuity of services, but both parties must agree on the renewal term and conditions. The termination notice period sets the advance notice required from either party to terminate the contract. Banks may prefer longer notice periods to plan for a smooth replacement process, while fintechs may favor shorter notice periods for increased flexibility.

Example Scenario: During negotiation of the termination clause, a bank insisted on imposing a substantial deconversion fee in case the fintech decided to terminate the partnership. They argued that the fee was necessary to recover the substantial resources invested in integrating the fintech's solutions. However, the fintech sought to negotiate lower or waived deconversion fees to avoid potential financial strain. After considering the fintech's financial capacity and the bank's investment, they agreed to a tiered deconversion fee structure. The fee would be waived entirely if the fintech provided a certain notice period before termination. If the notice period was not met, the deconversion fee would be implemented on a sliding scale, reducing the burden on the fintech based on the time of termination.

IN SUMMARY

Navigating contractual language with banks is a critical undertaking for fintechs, and it is essential to approach these discussions armed with knowledge and insight from those that have been there before. This post equips fintechs with insights into the typical challenges that arise during contract discussions. By leveraging our expertise on key contract terms, fintechs can optimize their agreements, forge robust partnerships with banks, and position themselves for success in the ever-evolving fintech landscape.

‍