The De Novo Bank’s Day-One Fraud Program

Every de novo bank application contains a promise: a BSA/AML and fraud program, described in detail, committed to in writing. The FDIC's conditional approval turns that promise into a condition, and the bank's first examination tests whether it came true.

That test arrives fast. A de novo operates under heightened supervision for its first three years, with more frequent exams and less benefit of the doubt than an established bank gets. Examiners walk in with the business plan and check it against reality. A named BSA officer is not a program. A policy binder is not a control. What counts is whether the bank can show, applicant by applicant, that it verified who it let in the door.

The default you inherited is the problem

Here's the uncomfortable part: the fraud program most banks would build by default is the one that's currently failing across the industry.

The default is document-based intake. The applicant types their information into a form or hands over paperwork; staff collect paystubs and statements; someone calls the employer number on the application. Every artifact in that chain is applicant-supplied, and applicant-supplied artifacts are precisely what fraud rings manufacture.

The numbers from the lending side show where this ends up. Cotality puts material misrepresentation at 1 in 116 mortgage applications. Fannie Mae's fraud team maintains a watchlist of 63 fictitious employers, some with staffed phone lines whose entire purpose is to answer verification calls. On the deposit side, synthetic identities, real Social Security numbers attached to fabricated people, have cost lenders an estimated $6 billion, and they pass document-based onboarding because no document is technically fake.

The fraud program most banks would build by default is the one that's currently failing across the industry.

More than one bank executive has told us the ending of that story: they launched digital account opening, fraud poured in, and they shut the channel down. The channel wasn't the problem. The verification model behind it was.

What source verification changes

A source-verified program inverts the trust model. Instead of trusting what the applicant supplies, the bank confirms every material fact against the system that originates it.

Identity gets validated against authoritative sources, with SSN issuance checks that make synthetic identities visible instead of invisible. Employment and income come from payroll systems of record, so a fake employer's phone line never enters the loop. Funding accounts are confirmed by direct, consented connection rather than a voided check. And each of those verifications produces a timestamped, source-attributed record, which is exactly the evidence a de novo needs sitting in the file when the first exam team asks how the bank knows its customers are real.

For a bank under de novo conditions, this isn't just better fraud math. It's the difference between telling examiners about a program and handing them one.

The buildout window is the opportunity

The months between conditional approval and opening day are when the entire stack gets assembled: core, digital banking, compliance tooling. Verification belongs in that first wave, not the post-launch backlog, for a practical reason: it has no core dependency, so it can be configured, tested, and demonstrably working before the core conversion finishes and before the first customer walks in.

An established bank has to unwind a decade of document-based habit. A de novo just has to make one good decision during the buildout.

There's a competitive edge hiding in the compliance requirement, too. The de novo mandate is deposit growth, and the fastest deposit channel is digital, the same channel established competitors turned off after their fraud waves. A new bank that opens with verification-first intake can run digital account opening as its most controlled channel from the first day, in a market where the incumbents retreated to branch-only.

The business plan promised examiners a fraud program. Build it as source verification and it doubles as the growth engine.