Fintech vendor due diligence questionnaire: what banks and payment partners ask

You sell software or services to a bank, credit union, lender or payment company, and procurement sends a due diligence questionnaire. It is longer than a normal security review because it covers your finances, insurance, subcontractors and resilience as well as your security.

The reason is regulation. Banks must manage the risk of the third parties they rely on, and your answers are evidence in their file. This guide explains where the questions come from, what each section is really checking, and how to word honest answers. Example answers are for a fictional vendor and are labelled. This is not legal advice.

Why banks ask: the third-party risk guidance

In June 2023 the Federal Reserve, FDIC and OCC issued joint Interagency Guidance on Third-Party Relationships: Risk Management ([OCC Bulletin 2023-17](https://www.occ.gov/news-issuances/bulletins/2023/bulletin-2023-17.html); the Federal Reserve published it as [SR 23-4](https://www.federalreserve.gov/supervisionreg/srletters/sr2304.htm)). It describes a lifecycle: planning, due diligence and third-party selection, contract negotiation, ongoing monitoring and termination. Your questionnaire is the due diligence step, and the same bank will come back to monitor you.

The guidance lists what a bank should consider in due diligence. Topics include the vendor's strategic fit, financial condition, operations, legal and regulatory compliance, information security, resilience, incident reporting, reliance on subcontractors and insurance coverage. Read the guidance itself for the exact list; the sections below follow those themes.

Bank examiners also use the FFIEC IT Examination Handbook, including its information security booklet, at [ithandbook.ffiec.gov](https://ithandbook.ffiec.gov/). If a question looks like it came from an exam checklist, that is probably why.

What the questionnaire usually covers

• Company: legal name, ownership, years in business, locations, litigation, regulatory actions.
• Financial condition: audited or reviewed statements, revenue range, funding, going-concern risk.
• Insurance: cyber liability, technology errors and omissions, general liability; limits and carrier.
• Information security: policies, access control, encryption, vulnerability management, logging, testing. Often a security questionnaire is attached.
• Third parties: your own subcontractors and subprocessors, and how you oversee them.
• Resilience: business continuity and disaster recovery plans, recovery targets, when you last tested them.
• Incident response: how you detect and escalate incidents and how fast you tell the customer.
• Compliance: privacy, anti-money-laundering responsibilities if relevant, and standards such as SOC 2 or PCI DSS.
• Data: where it is stored, who can see it, and return or deletion at exit.
• Fourth parties and concentration: do you depend on a single cloud provider or one critical supplier?

Rules behind specific questions

• Incident notice. Under the banking agencies' Computer-Security Incident Notification Rule, banks must notify their regulator within 36 hours of determining that a notification incident occurred. Bank service providers must tell affected bank customers as soon as possible when an incident has materially disrupted covered services for four or more hours. The rule is published by each agency; the [OCC's cybersecurity page](https://www.occ.gov/topics/supervision-and-examination/bank-operations/cybersecurity/index-cybersecurity.html) is a starting point. Expect your contract to ask for much faster notice than you give other customers.
• Safeguards Rule. Non-bank lenders and other financial institutions fall under the FTC's [Safeguards Rule](https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-314), which requires them to oversee their service providers. That is the source of many questions to fintech vendors from non-bank customers.
• Card data. If you store, process or transmit card data, payment partners will ask for your PCI DSS status. The [PCI Security Standards Council](https://www.pcisecuritystandards.org/) publishes the standard. Say clearly whether card data ever reaches your systems or only your payment processor's.

Example answers (fictional vendor)

These examples are for 'Ledger Lane', a made-up invoicing tool for small lenders. They are not Rendro's answers. Replace the brackets with facts from your documents.

Question: Describe your financial condition and provide your most recent financial statements. Example answer: Ledger Lane has operated since [year] and is [profitable / funded through (date) with runway of (number) months]. We can provide [reviewed / audited] statements for [year] under NDA. [If you cannot, say what you can offer, such as a bank reference or investor letter.]

Question: Provide details of your cyber liability and technology errors and omissions coverage. Example answer: Cyber liability: [carrier], [limit] per claim, policy period [dates]. Technology E&O: [carrier], [limit]. Certificates are available on request.

Question: List all subcontractors with access to our data, and describe how you oversee them. Example answer: [Hosting provider] hosts the application in [region]. [Email provider] sends notices that contain customer names. Both are listed at [link]. We review each vendor before onboarding and when its terms change, and we keep a signed data protection agreement with each.

Question: When did you last test your business continuity and disaster recovery plans? What were the results? Example answer: We last tested restoration on [date]. Recovery time was [number] hours against a target of [number]. Follow-up actions are [list]. [If untested, say: 'We have a written plan dated (date) but have not yet run a full restoration test. A test is scheduled for (month).']

Question: How quickly will you notify us of a security incident affecting our data or services? Example answer: We will notify your designated contact without undue delay and within [number] hours of confirming an incident affecting your data or a disruption lasting more than [number] hours, then update at agreed intervals. This will be written into the contract.

Question: Do you hold a SOC 2 Type II report or PCI DSS attestation? Example answer: [Yes: report period and auditor. / No: we do not hold one today. Our controls are documented in (policies), and we can complete your questionnaire and share our policies under NDA.] Card data is [never received by our systems because payment is handled by (processor) / in scope as follows: ...].

Common mistakes

• Overstating. A bank files your answers and may rely on them in an exam. A confident 'Yes' that turns out false is worse than an honest gap with a plan.
• Skipping the financials question. Small vendors often leave it blank. Offer what you can: reviewed statements, a bank reference, funding evidence.
• Forgetting fourth parties. If your cloud provider fails, the bank is affected. Name your critical suppliers.
• Different answers in different forms. The DDQ, the security questionnaire and the contract should agree. Keep one answer library.
• Promising incident timelines in the form that you cannot meet in practice.

A DDQ may also arrive from an investor or acquirer. That is a different document; see our DDQ guide for the other kinds, and your first enterprise security review if this is your first large customer.

Checklist

• Latest financial statements or an alternative you can share under NDA.
• Insurance certificates with limits and dates.
• Policies: information security, access control, incident response, business continuity, vendor management.
• Subprocessor list with locations and what each handles.
• Date and result of your last recovery test, or an honest 'not yet' with a date.
• SOC 2 or PCI status stated exactly, including scope and period.
• One owner who approves answers before they go to the bank.

Where Rendro helps

Rendro lets you choose 'due-diligence questionnaire' as the form type at upload. It drafts answers only from your own documents, with the exact dates, limits and names they state, shows the source for each, and marks anything your documents do not cover as Needs review. That is useful for DDQs because the gaps (a missing insurance certificate, an untested recovery plan) show up before the bank finds them. Your bank's own Excel or Word file comes back filled in; a PDF returns as an Excel answer sheet. Rendro does not work inside bank portals.

Got a bank or payment-partner questionnaire waiting? Send us the blank file and we will fill in the first 25 questions free within 48 hours, so you can judge the quality before you pay. Get the free 25-answer sample. Or [book a 15-minute video call](https://cal.com/franklin-rendro.net/15min) with Franklin. Send only the blank form, never confidential documents. More on the form type: due-diligence questionnaires.