Sponsor Banks Can Now Collect TINs from Third Parties

Sponsor Banks Can Now Collect TINs from Third Parties - Here’s What That Means for Fintechs

WEB_KYB-Tarrif_2025-06_Blog-Graphics_Thumbnail

Why Tariffs Matter to Fraud and Risk Teams: A 2025 KYB Wake-Up Call

FinCEN’s Deepfake Alert: How Socure Is Already Ahead of the Curve

How to Achieve Regulatory Compliance: Safeguarding Your Business in a High-Stakes Environment

<p>FinCEN just changed the rules for how some banks and credit unions can collect a customer’s Taxpayer Identification Number (TIN). It’s a targeted shift, but it could ripple into your onboarding flows &#8211; especially if you rely on a sponsor or FBO relationship bank.</p>
<p>Let’s unpack what changed, who it applies to, and why <a href="https://www.socure.com/industries/fintechs">Fintechs</a> should be watching closely.</p>
<h3>Why This Matters</h3>
<p>Fintechs don’t operate in a vacuum. When your <a href="https://www.socure.com/industries/sponsor-banks">sponsor bank</a> rewires its <a href="https://www.socure.com/glossary/customer-identification-program">CIP process</a>, you may be expected to change your flows too, but that can break your IRS reporting, introduce data conflicts, or expose you to backup withholding penalties.</p>
<h3>What the FinCEN Order Says</h3>
<p>FinCEN now allows certain regulated banks and credit unions to collect a customer’s TIN from a third party &#8211; not directly from the customer &#8211; before account opening.</p>
<p>But there are guardrails. This new flexibility only applies if:</p>
<ul>
<li>The institution is regulated by the OCC, FDIC, or NCUA</li>
<li>TINs are collected before the account is opened</li>
<li>The process is risk-based, documented, and preserves a “reasonable belief” in customer identity</li>
<li>There’s no added risk of money laundering, terrorist financing, or other illicit activity</li>
</ul>
<blockquote>
<h4>Read the full Order: <a href="https://www.fincen.gov/news/news-releases/fincen-permits-banks-use-alternative-collection-method-obtaining-tin-information" target="_blank" rel="noopener">FinCEN Permits Banks to Use Alternative Collection Method for Obtaining TIN Information</a></h4>
</blockquote>
<h3>Who’s In and Who’s Out</h3>
<p><strong>Covered by the Order:</strong></p>
<ul>
<li>OCC-regulated banks</li>
<li>FDIC-insured banks</li>
<li>NCUA-supervised CUs</li>
</ul>
<p><strong>Not Covered:</strong></p>
<ul>
<li>Fintechs</li>
<li>MSBs</li>
<li>Non-bank FIs</li>
</ul>
<p>If you&#8217;re a Fintech registered as a Money Services Business (MSB) &#8211; which includes most prepaid, neobank, and remittance models &#8211; this Order does not apply to you directly.</p>
<p>You&#8217;re still bound by:</p>
<ul>
<li>31 CFR §1022.220 (MSB CIP rule)</li>
<li>IRS tax reporting obligations under IRC §§ 3406 and 6109</li>
</ul>
<h3>Real-World Scenario: Where This Gets Messy</h3>
<p>Let’s say your partner bank collects a TIN upstream from a third-party vendor.</p>
<p>Later, your user updates their profile with a self-reported TIN &#8211; one that doesn’t match. Now you’ve got:</p>
<ul>
<li>Conflicting data</li>
<li>Broken audit trails</li>
<li>And a 1099 that could trigger a 24% backup withholding penalty under IRC §3406</li>
</ul>
<h3>Visual Breakdown: What’s at Stake with Mismatched TINs</h3>
<table style="border-collapse: collapse; width: 100%;">
<tbody>
<tr>
<td style="width: 34.7574%; text-align: center;"><strong>TIN Status</strong></td>
<td style="width: 20.2752%; text-align: center;"><strong>Reporting Risk</strong></td>
<td style="width: 44.9674%; text-align: center;"><strong>Withholding Risk</strong></td>
</tr>
<tr>
<td style="width: 34.7574%; text-align: center;"><span style="font-weight: 400;">✅ Valid and matches IRS</span></td>
<td style="width: 20.2752%; text-align: center;"><span style="font-weight: 400;">None</span></td>
<td style="width: 44.9674%; text-align: center;"><span style="font-weight: 400;">None</span></td>
</tr>
<tr>
<td style="width: 34.7574%; text-align: center;"><span style="font-weight: 400;">⚠️ Invalid or mismatched</span></td>
<td style="width: 20.2752%; text-align: center;"><span style="font-weight: 400;">1099 error</span></td>
<td style="width: 44.9674%; text-align: center;"><span style="font-weight: 400;">24% backup withholding required</span></td>
</tr>
</tbody>
</table>
<p>&nbsp;</p>
<h3>What Fintechs Should Do Now</h3>
<ul>
<li>Don’t change anything yet: Stick with your current TIN collection and CIP flows unless a regulated bank partner formally requests changes.</li>
<li>Talk to your sponsor banks: Ask if they plan to adopt the new framework &#8211; and under what written procedures.</li>
</ul>
<p><em>Socure has built an <a href="https://www.socure.com/products/graph-intelligence">identity graph</a> that leverages a hybrid approach of rules and machine learning to solve a thorny, common problem: making sense of third-party identity data like credit headers. Our sophisticated methodology ensures that every verified good identity is tied to a single, accurate, and unique identifier, making the complex task of managing diverse data streams not just manageable, but clear.</em></p>
<ul>
<li><strong>Clarify ownership:</strong> Who owns IRS tax compliance? Where’s the source of truth for the provided TIN?</li>
<li><strong>Track your data lineage:</strong> If a TIN comes from a third-party source, tag it. Preserve traceability for audits and disputes.</li>
<li><strong>Prepare for mismatches:</strong> What happens if the TIN collected by the bank doesn’t match the one you get later? Build a fallback plan.</li>
<li><strong>Check with tax counsel:</strong> Ensure you’re protected under backup withholding rules if you process reportable payments.</li>
</ul>
<h3>Final Word</h3>
<p>This isn’t a regulatory green light for Fintechs but it is a flexibility granted to banks &#8211; under strict controls &#8211; that might cascade into your <a href="https://www.socure.com/use-cases/onboarding">onboarding</a> stack.</p>
<p>Unless your regulated partner makes a move, don’t change your flows. But be ready if they do.</p>
<p>And no, this isn’t legal advice. But it’s exactly the kind of thing your <a href="https://www.socure.com/blog/regulatory-compliance">compliance</a> and ops teams should be tracking closely.</p>


Sponsor Banks Can Now Collect TINs from Third Parties - Here’s What That Means for Fintechs

Josh Linn

Related Posts