Maintenance
Part of Digital account guide: banks, nonbanks, balances, insurance, and access
Finance app due diligence: operations, support and exit
Finance app due diligence beyond custody: size the job, review operational capacity, test support and plan the exit before you rely on the service.
What to take away
- Scale exposure to what you can verify and recover.
- Define the job firstwhich functions, which amounts and which deadlines the app must carry.
- Review operations, data access, complaints, migrations, and account closure before relying on the service.
- Test support and the exit route while the balance is small.
- Record each decision by use case, not as a permanent rating of the company.
Finance app due diligence is not a hunt for a perfect app. It is a structured decision about which functions and amounts a product can safely carry for one user or business. Who holds and protects the money has its own checks; this review covers capacity, support and exit.
Start from the job the app must carry
A product acceptable for occasional shared expenses may be unsuitable for payroll or operating reserves. Define the job before you read a single record, because every later check is a comparison against it.
- List the features you plan to use.
- Estimate average and maximum balance.
- Record monthly transaction count and size.
- Identify payments that cannot be late.
- Decide how long an access interruption is tolerable.
- Name an alternate account or payment route.
- Separate personal, business, and client money.
The list gives every later check a pass mark. A short interruption means little for a shared dinner and much on payroll day. Separating personal, business and client money matters because a client or business balance carries obligations that a personal one does not, and a mixed account hides them. Rails and recipient controls sit in the payment product checklist.
Review operational capacity
Operational capacity is what keeps the service running when volume, a partner or a regulator changes something. Check it from public records and from how the product behaves, and accept that silence limits what can be verified.
- Check years in operation and material ownership changes.
- Identify dependence on one bank, processor, or cloud service where disclosed.
- Review enforcement records from the relevant regulatorOCC enforcement actions, FDIC enforcement decisions and orders, CFPB enforcement actions, SEC enforcement actions, and applicable state regulator orders.
- Review material litigation.
- Look for audited financial information if relevant and available.
- Review uptime and incident history without assuming a status page is complete.
- Examine reserves, holds, or negative-balance policies.
- Check whether rapid growth could strain support or reconciliation.
The OCC's guide to bank due diligence on fintech companies notes variation in operational history and governance and organizes review around business experience, financial condition, legal and regulatory knowledge, risk management, information security, resilience, and operational capability.
Although written for community banks, the fintech due-diligence categories supply useful questions for judging a service on more than interface design. Silence is not evidence of weakness, but it limits what can be verified.
Dependence on one partner is a question of access, not blame. If the bank, the processor or the cloud service has a bad day, so does the app. Note which of your deadlines sit behind that single point, and whether the product sits on bank and nonbank accounts, which changes who you call.
Judge resilience and access
Security claims need scope. A certified cloud component does not establish end-to-end account safety, so test the parts you can reach yourself and note which ones you cannot.
- Confirm supported authentication methods.
- Protect recovery email and phone.
- Enable transaction, login, and profile alerts.
- Find device and session management.
- Review lost-device and takeover procedures.
- Confirm backups and alternate access channels where disclosed.
- Identify the official status page and incident contacts.
- Test statement download and support without exposing credentials.
Resilience is the part of this review that tells you whether the alternate route you named in the first step is actually needed, and how quickly you would reach for it.
Test how the product treats customers
Support is part of the product. Compare its hours with your payment deadlines, and test whether it can name the legal provider and the partner bank before you need it for a dispute.
- Find the formal error-notice route.
- Compare support hours with payment deadlines.
- Test whether support can identify the legal provider and partner bank.
- Read freeze, termination, and appeal terms, including partner-bank confusion and inaccessible funds.
- Check accessibility and language support.
- Search the CFPB complaint database for recurring documented issues, then verify them independently.
- Preserve all case numbers and promised dates.
Put the first support question in writing so you keep the answer. A reply that names the provider, the partner bank and the escalation path is better evidence than a friendly tone, and a vague reply shows what a dispute will feel like. Know the escalation route from the product's official status record before a problem starts.
Product status / Complaint route
- Within CFPB scope
- The CFPB complaint process
- National bank
- The OCC Customer Assistance Group
- Matter within the FDIC's remit
- The FDIC Consumer Response Center
- Federally insured credit union
- The NCUA Consumer Assistance Center
- State-licensed nonbank
- The relevant state banking or financial services regulator
The Consumer Financial Protection Bureau's advisory on funds stored in payment apps distinguishes nonbank app balances from traditional insured accounts and urges users to understand where funds are held. Use that distinction before relying on customer-service assurances.
Read the economics behind the service
Fees and revenue explain how long a service's terms are likely to last. An unsustainably generous promotion is not proof of misconduct. Treat it as a prompt to understand duration, funding, and conditions.
- Capture current monthly, transaction, withdrawal, ATM, card, exchange, inactivity, and support fees with the quoted dollar amount or rate.
- Identify revenue from interchange, spread, lending, subscription, data, or partner payments where disclosed.
- Compare yield calculation and change authority.
- Check minimum balances and qualifying activities.
- Calculate cost at your expected volume.
- Record notice requirements for changes.
Plan the exit before you need it
Read the exit terms while nothing is wrong. A product you cannot leave cleanly should carry less, whatever its features, because closure and migration are where hidden dependencies show up.
- Read change-of-bank and assignment clauses.
- Identify the notice period for material changes.
- Check how routing changes affect direct deposits and debits.
- Determine whether data and statements remain available after closure.
- Confirm the return method for a residual balance.
- Plan withdrawal before closing linked accounts.
- Revoke external access and recurring payments.
- Obtain a final statement and closure confirmation.
Order matters in that list. Withdrawal comes before closing linked accounts, and revoking access comes before you stop checking the app, so that no recurring payment or connection outlives the relationship.
Write the decision by use case
A finding only matters against a use. Write each one down with its evidence, its risk and the control that makes it acceptable, then decide for that use alone.
| Finding | Evidence | Risk | Control | Decision |
|---|---|---|---|---|
| Partner bank verified | Official directory | Low | Recheck after notice | Accept |
| Subledger access unclear | Terms and support | High access risk | Keep low balance | Limited use |
| No alternate support | Published policy | Deadline risk | Do not use for payroll | Reject payroll use |
| Exit terms unread | None yet | Unknown | Read before adding funds | Hold |
Record the decision by use case, not as a permanent rating of the company. A product rejected for payroll can still suit occasional shared expenses. Review the decision again after a partner, ownership, terms, routing, protection, or feature change, because each one can move a finding from one row to another.
