Our risk templates, explained.

Use this guide if

Use this if a bank partner, auditor, customer, or regulator asked how your team governs AI use.

Use this guide if

Use this if you need to map risks, controls, owners, ratings, evidence, and issue remediation in one place.

Use this guide if

Use this if you need vendor due diligence questions, evidence requests, and approval conditions for third-party reviews.

Use this guide if

Use this if you need BIA, RTO/RPO, dependency, tabletop, and continuity evidence for a customer, partner, auditor, or examiner.

Use this guide if

Use this if your CFP needs to survive an OCC, FDIC, state, or Federal Reserve exam under the 2023 Interagency Addendum operational-readiness standard.

Use this guide if

Use this if your fintech operates on a sponsor-bank model (FBO accounts, BIN sponsorship, BaaS program) and your sponsor bank has started asking about liquidity stress planning — or you want to share a CFP proactively during program reviews.

Use this guide if

Use this if your sponsor bank, an examiner, or your CCO asked how you evaluate high-risk customers without creating sales-vs-compliance arguments on every deal.

Use this guide if

Use this if your employees are already using ChatGPT or Copilot and you need a structured framework that isn't a ban — covering data classification, approved tools, prohibited uses, and incident response.

Use this guide if

Use this if your board, bank partner, or examiner asked for risk metrics and you're manually pulling numbers each month — or guessing at thresholds.

Use this guide if

Use this if you're managing exam findings, audit issues, or self-identified gaps in a spreadsheet with no status, ownership, or aging visibility — and your risk committee keeps asking what's overdue.

Use this guide if

Use this if your bank partner or examiner asked whether you track operational losses and near-misses — and the honest answer is a folder of incident emails.

Use this guide if

Use this if a bank partner, regulator, or your board asked to see your documented ERM framework and what you have is a risk register and some policies with nothing connecting them.

Use this guide if

Use this if your risk committee asks for financial risk metrics monthly and you're rebuilding them by hand each time — or your board needs a risk appetite statement with real thresholds, not placeholder text.

Use this guide if

Use this if you're launching a new product — BNPL, embedded finance, instant payments, stablecoins — and your bank partner or risk committee wants a formal risk assessment before go-live.

Use this guide if

Use this if consumers are submitting data rights requests, a bank partner asked for your privacy documentation, or you need to figure out which state privacy laws actually apply to you.

Use this guide if

Use this if your incident response plan is untested, your bank partner asked about tabletop exercises, or you do not know your breach notification deadlines off the top of your head.

Use this guide if

Use this if a customer deal is contingent on SOC 2, you are preparing for your first audit, and you need to know exactly which controls auditors test and what evidence they ask for.