Case Study #1 – FFBKC and ARMAI for Embedded Finance Oversight
The briefing
The briefing, at a glance
FFBKC, a 90-year-old community bank scaling a banking-as-a-service portfolio, engaged ARMAI’s intelligent review engines to modernize third-party oversight — automating vendor due diligence, real-time risk scoring, and audit-ready documentation across its BaaS program.
Institution snapshot
- Total assets
- ~$1B (Q1 2026)
- Members / customers
- 25,000 customers
- Locations
- 9 branches (Kansas City, MO)
- Specialization
- Mortgage lending; growing BaaS portfolio
- Primary regulator
- FDIC
- Core technology
- Jack Henry (SilverLake, Banno, LoanVantage) — selected July 2024
- Founded
- 90-year-old institution
- Vendor
- ARMAI Technologies — Charlotte, NC
Third-party oversight was outgrowing the spreadsheet.
Third party risk management — including contract SLA monitoring — has historically been completed manually in Excel. As FFBKC deepened its partner banking footprint, operational overhead for vendor oversight grew in lockstep with the BaaS portfolio.
The bank recognized similarities and idiosyncrasies across vendor relationships that could be systematized. What was needed was a structured, evidence-driven approach to third-party oversight that could keep pace with a highly scrutinized BaaS environment — and stand up to examiner review.
Where Generative AI created leverage.
Intelligent platforms can now perform several functions simultaneously: reading policy documents and contracts, ingesting regulatory guidance, and producing scores and findings against defined schemas and frameworks.
For FFBKC, this created an opportunity to automate vendor due diligence, run real-time risk scoring on fintech partners, continuously monitor BaaS programs, and produce audit-ready documentation aligned with supervisory expectations — without adding proportional headcount.
Governance, technology, people, and operations moved together.
The AI Governance Readiness Check classified this deployment as high scrutiny. The combination of use case (vendor oversight), output nature (text and recommendations shaping risk decisions), decision impact (AI as primary input with human override), and materiality (potential material financial loss or significant regulatory finding) all pointed the same direction.
Community banking is a people and program (process) business. Good governance designs technology to fit the people and process — not the other way around.
Governance
Principles-based framework anchored to the binding architecture that survived April 17, 2026: FFIEC IT Handbook, 2023 Interagency TPRM Guidance, and SR-24-2.
Technology
Vendor-tool sits outside Jack Henry’s integration frameworks; likely a custom integration working from bank-controlled documents (policies, SOC reports, contracts).
People
Recent CRO (Jenny Michaels) and VP of Fintech (Josh Hofer) hires signal a bank building the human capacity to own AI oversight, not just consume vendor output.
Operations
Model owner + business owner roles, monitoring plan, change log tied to BaaS partner changes, and a tech-failure playbook inside the business continuity plan.
From announcement to a governed operating rhythm.
The FFBKC + ARMAI partnership was publicly announced March 30, 2026 — just weeks before the April 17, 2026 rescission of SR 11-7 and its replacement with SR 26-2. What follows is the arc of a governed deployment of this type, mapped to the milestones any community bank should expect.
- Q3 2024Core modernization
FFBKC selects Jack Henry (July 2024) to become their core processor, laying the digital foundation that later AI tools sit alongside.
- 2024–2025Leadership build-out
Jenny Michaels joins as CRO (2024); Josh Hofer joins as VP of Fintech (2025) — both essential to owning AI oversight in a BaaS context.
- March 2026Deployment announcement
ARMAI + FFBKC partnership goes public. Automates vendor due diligence, real-time risk scoring, continuous fintech program monitoring, and audit-ready documentation.
- April 2026+Interpretive window
SR 11-7 rescinded and replaced by SR 26-2, which explicitly carves out GenAI and most community banks. Binding architecture (FFIEC, TPRM, SR-24-2) continues to govern.
- OngoingEvidence rhythm
Model inventory registration, validation records, change logs tied to vendor model updates and BaaS partner shifts, and a tech-failure playbook in the BCP.
Outcomes management should stand behind.
FFBKC has not publicly disclosed post-deployment performance metrics. What is publicly on record are the operational objectives the partnership was announced to deliver, in the words of the two principals:
Josh Hofer, VP of Fintech, FFBKC: “As we expand our fintech and embedded finance initiatives, modernizing how we manage third-party and enterprise risk is critical. ARMAI brings a practical, bank-informed approach that enhances transparency, efficiency, and exam readiness across our organization.”
Sandip Bhatlawande, Founder & CEO, ARMAI: “Banks should not have to choose between innovation and compliance. Our Intelligent Review Engines enable their teams to accelerate vendor onboarding and continuously monitor risk.”
Total assets
Q1 2026
Customers
Across 9 KC-metro branches
Evidence outcomes
Risk, use case, vendor, failure, monitoring
What executives should carry into their next board meeting
- 1.
The vendor-tool purchased to streamline third-party oversight itself becomes a new third-party governance gap. That is an inherent feature of GenAI deployments — and it is manageable with well-designed AI governance.
- 2.
Under the April 17, 2026 architecture, SR 26-2 explicitly carves out GenAI and most community banks. The binding rulebook that still governs is FFIEC IT, 2023 Interagency TPRM, SR-24-2, plus every domain-specific regulation the AI touches.
- 3.
Every high-scrutiny AI deployment should produce five evidence outcomes: risk analysis, use case documentation, vendor governance, failure response, and performance monitoring. Community banks should treat these as the examiner’s checklist.
- 4.
Any GenAI program should follow three rules: integrate technically within your core processor’s infrastructure; harness your data by ringfencing input sources; and build principles-based governance around the binding architecture. People, process, then technology.
- 5.
Community banks that engage now shape the AI-specific guidance regulators have promised. Those without appetite for uncertainty should not engage with GenAI — those with appetite gain operational advantages and regulatory voice.
How our 4-question Readiness Check classifies this deployment.
Question 1
What does this AI deployment actually do?
Vendor or third-party oversight — using AI to evaluate other vendors’ risk, compliance, or performance.
Question 2
How is the AI’s output used downstream?
Produces text and recommendations that directly shape financial or risk decisions.
Question 3
How much does the AI’s output drive the decision?
The AI’s output is the primary input — a human reviews and can override.
Question 4
If the AI got it materially wrong, what’s the worst plausible consequence?
Material financial loss or a significant regulatory finding.
Classification verdict
High governance scrutiny is warranted — traditional model risk management practices apply, scoped to the bank’s risk exposures and complexity of model use.
Full analysis, quotes, and sources
The complete long-form write-up, with every quote, chart, and citation preserved.
Thinking about deploying AI at your community bank? Start with our free AI Governance Readiness Check to understand the depth of governance your deployment needs — in under 2 minutes.
Stay in the loop
New field research on AI adoption in community banking — delivered when we publish.