Reconciliation is the first control
Before any policy, a fintech has to show that the money and assets it holds for customers agree across every place they are recorded. Most partner-bank and examiner questions trace back to that. We start by mapping each source of record and the reconciliations between them, then test those reconciliations against the underlying data rather than the summary sheet. A reconciliation that ties every day but carries the same unexplained break for six weeks is recorded as a finding, not a pass.
Three reconciliations we look at first
- Customer balances to bank accounts. The ledger of amounts owed to customers against the custodial or for-benefit-of accounts at the partner bank.
- Settlements to the ledger. Card, ACH and real-time payment settlements against what the ledger expected, with every break aged and owned.
- Wallets to the books. For digital assets, on-chain balances in each wallet against the subledger, and every change to a withdrawal address.
Continuous Controls Monitoring turns these checks into automated weekly tests, with each break routed to a named owner and a monthly exception report. Our list of ten automated tests shows the kind of rules involved.
Publish only what you can prove
Partners and customers increasingly look for evidence before they deposit money or sign an agreement. An Integrity Center puts your governance contacts, published policies, speak-up channel and management attestations on a public page, with the date of the last review and a log of changes. We publish only what the controls behind it support, and keep it current by subscription so it does not go stale.
Payment stablecoin issuers face a stricter version of this from 18 January 2027, when the GENIUS Act takes effect and monthly published reserve reports begin. Those reports must be examined by a PCAOB-registered firm. We do not perform that examination. We help build the reconciliations and controls it will rely on.