July 22, 2025

Sponsor Banks Can Now Collect TINs from Third Parties - Here’s What That Means for Fintechs

FinCEN just changed the rules for how some banks and credit unions can collect a customer’s Taxpayer Identification Number (TIN). It’s a targeted shift, but it could ripple into your onboarding flows – especially if you rely on a sponsor or FBO relationship bank.

Let’s unpack what changed, who it applies to, and why Fintechs should be watching closely.

Why This Matters

Fintechs don’t operate in a vacuum. When your sponsor bank rewires its CIP process, you may be expected to change your flows too, but that can break your IRS reporting, introduce data conflicts, or expose you to backup withholding penalties.

What the FinCEN Order Says

FinCEN now allows certain regulated banks and credit unions to collect a customer’s TIN from a third party – not directly from the customer – before account opening.

But there are guardrails. This new flexibility only applies if:

• The institution is regulated by the OCC, FDIC, or NCUA
• TINs are collected before the account is opened
• The process is risk-based, documented, and preserves a “reasonable belief” in customer identity
• There’s no added risk of money laundering, terrorist financing, or other illicit activity

Read the full Order: FinCEN Permits Banks to Use Alternative Collection Method for Obtaining TIN Information

Who’s In and Who’s Out

Covered by the Order:

• OCC-regulated banks
• FDIC-insured banks
• NCUA-supervised CUs

Not Covered:

• Fintechs
• MSBs
• Non-bank FIs

If you’re a Fintech registered as a Money Services Business (MSB) – which includes most prepaid, neobank, and remittance models – this Order does not apply to you directly.

You’re still bound by:

• 31 CFR §1022.220 (MSB CIP rule)
• IRS tax reporting obligations under IRC §§ 3406 and 6109

Real-World Scenario: Where This Gets Messy

Let’s say your partner bank collects a TIN upstream from a third-party vendor.

Later, your user updates their profile with a self-reported TIN – one that doesn’t match. Now you’ve got:

• Conflicting data
• Broken audit trails
• And a 1099 that could trigger a 24% backup withholding penalty under IRC §3406

Visual Breakdown: What’s at Stake with Mismatched TINs

What Fintechs Should Do Now

• Don’t change anything yet: Stick with your current TIN collection and CIP flows unless a regulated bank partner formally requests changes.
• Talk to your sponsor banks: Ask if they plan to adopt the new framework – and under what written procedures.
• Clarify ownership: Who owns IRS tax compliance? Where’s the source of truth for the provided TIN?
• Track your data lineage: If a TIN comes from a third-party source, tag it. Preserve traceability for audits and disputes.
• Prepare for mismatches: What happens if the TIN collected by the bank doesn’t match the one you get later? Build a fallback plan.
• Check with tax counsel: Ensure you’re protected under backup withholding rules if you process reportable payments.

Final Word

This isn’t a regulatory green light for Fintechs but it is a flexibility granted to banks – under strict controls – that might cascade into your onboarding stack.

Unless your regulated partner makes a move, don’t change your flows. But be ready if they do.

And no, this isn’t legal advice. But it’s exactly the kind of thing your compliance and ops teams should be tracking closely.