BaaS: How a Banking Product Lives Without a License

Sponsor Bank, Platform and Customer Brand

BaaS (banking-as-a-service) is a model in which a licensed bank provides accounts, cards, and payments through an API, while a non-bank brand embeds them into its product. Essentially, this is white-label banking: for the customer it's an "account at a fintech," legally it's an account at the partner bank. This is one area of embedded finance.

The fintech builder does not obtain a banking license—in the US that takes years and substantial capital. Instead, they rent access to the partner bank's license: they connect to a sponsor bank and build a product under its charter. An alternative on the horizon is limited direct access to the Fed's payment infrastructure for non-banks, without a sponsor — see Fed payment accounts.

The partner bank is responsible for end customers' funds and compliance before the regulator; the fintech is responsible to the bank. The bank therefore treats the fintech as its primary risk and has the right to shut down the program at any time. Sponsor banks and their associated risks are described in the "US Sponsor Banks" section.

How It Works

There are three roles in the model. The sponsor bank holds the charter and FDIC insurance and is accountable to the regulator. The middleware/BaaS platform provides the API and part of the compliance operations. The fintech manages the product and acquires customers. The bank earns from interest on deposits, a share of interchange, and fees for regulatory access. A banking service under a partner’s brand can combine accounts, payments and asset records in one integration. In the UK, ClearBank supports current and savings accounts under a partner’s brand, with APIs and transaction notifications. Compare the market, account holder, contractual bank and product scope first, then the cost of integration and ongoing servicing. British Atlantic Bank, an offshore bank in Dominica, supplies the banking infrastructure while the partner develops its customer proposition. Setup costs $25,000, followed by $2,000 monthly from launch for one brand and API integration; each additional integration costs $5,000. Individual customer records and separate accounting for the partner’s collateral support reconciliation. Customer contracts and the allocation of execution, compliance and complaint-handling duties define each party’s role under the applicable licensing regime.

The customer uses the fintech brand; the account and funds are held at the partner bank. Middleware connects the two, and the bank answers to the regulator for the whole program.

Customer funds are held at the partner bank, often in a pooled FBO (for-benefit-of) account. FDIC insurance works as pass-through: $250K per end depositor per bank—provided there is correct itemized recordkeeping; sweep networks across multiple banks raise the limit (at Mercury—up to $5M). Reconciliation is critical: the bank and platform must have matching records of who owns the funds in the account at all times. This is the same safeguarding discipline as in correspondent banking.

The cost of failure was demonstrated by the collapse of middleware Synapse (Chapter 11, 22 April 2024): Synapse's ledgers diverged from the banks' records, and end customers could not use their funds for weeks or months while the partner banks reconciled. According to the CFPB's complaint of 21 August 2025, the partner banks held less than Synapse's records showed, and the Chapter 11 trustee estimated the shortfall at $60–90 million. The funds were in pooled FBO accounts, and reconciliation relied on Synapse's own system.

What Is Needed to Launch

A company's own banking license is not needed. What's needed is a sponsor bank and, typically, middleware or an issuer-processor (Unit, Treasury Prime, Synctera, Lithic, Marqeta—depending on the product). The partner bank conducts due diligence per interagency guidance and assigns the fintech to the highest risk tier.

What the bank will request during onboarding: audited financials and runway; business model sustainability; operational maturity—platform, staff, BCP/DR, track record; a complete set of BSA/AML, KYC/KYB, PCI-DSS, and PII handling policies. It is not advisable to apply for onboarding without a fully staffed compliance function. Requirements for an already-licensed operator — an MSB, MSO, EMI or PSP — opening accounts are covered in banking for a licensed operator.

Compliance

The fintech bears operational compliance, which the bank is obligated to oversee. The basic set: all BSA pillars; CIP plus CDD/EDD; sanctions screening; transaction monitoring. The bank requires demonstrable control over end-customer onboarding—this is broader than formal CIP.

Weak oversight of fintech partners has driven enforcement: Blue Ridge received an OCC consent order in January 2024 (BSA/AML, "troubled condition", no new fintech partners without the OCC's non-objection), and Evolve a Federal Reserve cease-and-desist order in June 2024.

BaaS Market Models

Typical architecture: partner bank + middleware + issuer-processor. Public example: Mercury (a fintech, not a bank) provides banking services through Choice Financial Group and Column N.A. Niche business banking is built on the infrastructure of that same Column by Slash—an illustration of how a specialised service gets by with a sponsor instead of its own license. Profiles of sponsor banks and those to avoid (Evolve, Blue Ridge) are below in the "US Sponsor Banks" section; the card side is covered in the BIN sponsorship material.

Flex is assembled the same way: business accounts, cards and treasury for US business owners run on partner banks and brokers, alongside the owner's personal finances — a segment where a rented licence stays cheaper than a charter of its own.

What to look for when choosing. Economics: interchange share, access fees, minimum volumes; on the fintech side, the revenue mix comes down to interchange, subscription, and yield on balances. Concentration: a bank with dozens of fintech programs under regulatory pressure shuts down several programmes at once—it's worth diversifying partners. Data control: the operator's access to the ledger and reconciliation must be independent of the middleware, or the Synapse scenario repeats. Exit rights: pre-negotiate the transfer of the program and customer funds to another bank.

US Sponsor Banks

Partner banking grew out of two forces. The Durbin amendment left small banks (under $10 billion in assets) with high debit interchange—servicing third-party card programs is profitable for them. And the 2010s wave of fintech startups needed access to a charter and FDIC insurance without years of licensing. The candidate list is short: of roughly 4,200 FDIC-insured institutions, only a small group offers banking-as-a-service at all, and each of them is known to its supervisors individually.

Banks prominent in BaaS as of mid-2026 (specific partnerships change frequently, so focus on the bank's profile rather than its client list):

• Cross River Bank (New Jersey)—one of the BaaS and fintech lending pioneers.
• Column N.A.—a national bank offering direct API access without middleware; Mercury and Slash accounts run on it.
• Choice Financial Group (North Dakota) and Coastal Community Bank (Washington, about $5 billion in assets as of early 2026)—prominent banks for accounts and payments; Coastal runs its BaaS programs through its CCBX platform.
• Lead Bank (Kansas City)—focused on embedded banking programs.
• Sutton Bank, Celtic Bank, Pathward (formerly MetaBank), and The Bancorp Bank—long-standing players in card issuance, prepaid, and BIN sponsorship.

Lessons from failures: Evolve Bank & Trust—Synapse's partner—received a Federal Reserve cease-and-desist in June 2024 for weak AML/BSA, OFAC violations, and ineffective control over fintech partnerships. Blue Ridge Bank got an OCC consent order (January 2024) for BSA/AML failures, and on November 13, 2025, the OCC lifted the measure: an order can be exited by rebuilding controls.

How to choose a partner bank:

• Regulatory status. A bank under a fresh consent order may not have the right to take on new programs—Blue Ridge's 2024 order barred new fintech relationships without the OCC's non-objection. This is checked first.
• Direct access or middleware. Column and Lead lean toward API-first without intermediaries; others work through platforms like Unit, Treasury Prime, Synctera.
• Specialization. Cards and BIN sponsorship (Sutton, Celtic, Pathward, Bancorp) versus accounts and payments (Choice, Coastal, Column).
• Concentration. How dependent the bank is on a couple of large programs and whether it is resilient to their departure.
• Risk appetite. The bank's willingness to support the operator's vertical and scale: lending, crypto, and cross-border payments are treated differently.

New demand for sponsor banks comes from stablecoins: the GENIUS Act, signed in July 2025, set the first federal rules for payment stablecoin issuers—issuance is allowed for subsidiaries of insured banks, OCC-approved non-bank issuers and state-qualified issuers, with reserves of at least 1:1 and under the Bank Secrecy Act. For an issuer, this is the same need for a charter and a partner bank as for a regular fintech—more in our stablecoins overview; a brand that would rather not obtain its own PPSI license falls back on white-label issuance through Bridge.

Middleware: Unit, Treasury Prime, Synctera—and the Synapse Lesson

Between the sponsor bank and the fintech brand there is almost always a technology intermediary—a BaaS platform, or middleware: account opening, card issuance, payment flows, end-customer ledgers, and compliance infrastructure via API. For anyone building embedded finance, middleware is what the operator actually integrates with: the sponsor bank often stays behind the scenes. Middleware holds no license—the charter, FDIC insurance, and regulatory responsibility remain with the bank; the intermediary only services the flow. The same construction extends beyond accounts and cards: in crypto, the back end for brokers and fintechs is Zero Hash, and even a G-SIB can assemble its product on someone else's infrastructure—as Morgan Stanley's digital trust bank does.

Key providers:

• Unit—broad API platform: accounts, cards, payments, lending.
• Treasury Prime—pivoted from selling to fintechs to selling software directly to banks (its Bank Direct platform). The logic: regulators want the bank itself to control the partner, without an intermediary seller.
• Synctera—end-to-end platform: infrastructure, compliance, and a network of community banks. It also sells banks the tooling to run a compliant sponsor-banking program and has a Canadian product line.

The Synapse collapse also has an epilogue: the CFPB allocated US$46.2M from its Civil Penalty Fund on 28 November 2025 and a further US$9.0M on 29 May 2026 — US$55.2M in total — unlocked by a symbolic US$1 penalty under the stipulated judgment entered on 12 September 2025. The first allocation alone covered more than half of the estimated shortfall. The takeaway for operators is unchanged: the main risk of a program is the intermediary's accounting system; the integrity of the middleware ledger and the bank's ability to independently reconcile balances determine whether end customers get their money.

After Synapse and the interagency guidance, banks demand direct control over end customers, and middleware is moving to direct software sales to banks, not fintechs (the Treasury Prime case), with contracts increasingly linking bank and fintech directly and leaving the platform only the technology. What to check when choosing middleware:

• Who holds the ledger and how FBO is reconciled—daily independent reconciliation on the bank's side, not trust in the platform's system.
• Which sponsor banks stand behind the platform and what condition they're in—consent orders, risk appetite (see the "US Sponsor Banks" section).
• Whose compliance is it—the BSA/AML program sits with the bank, the platform is just tooling; who is contractually responsible for CIP/CDD of end customers.
• Readiness for the direct model—will the program continue operating if the bank wants to contract with the fintech directly.

EU/UK: The EMI Model

In Europe, the role of the US sponsor bank is played by a provider holding either a banking license (credit institution) or an EMI license. A company connects to the API and offers accounts, cards, and payments under its own brand, while the provider holds the license and liability; a single home-state authorization grants a passport across the EEA. The key distinction is license type: a bank can take deposits under deposit insurance and lend, while an EMI issues electronic money and handles payments, with client funds protected by safeguarding—segregation in a separate account or an insurance policy—rather than deposit insurance. Minimum capital for an EMI is €350K; for a bank, disproportionately more. So an EMI is faster and cheaper as a provider, while a bank is needed where there are deposits and credit.

Notable providers (mid-2026):

• Banks (credit institutions): ClearBank (UK, PRA/FCA; its subsidiary ClearBank Europe N.V. is authorised by the ECB and supervised by DNB—euro accounts, SEPA, SEPA Instant, T2), Griffin (UK bank authorised by the PRA; FSCS-protected accounts via API), Solaris SE (Germany; full banking licence, BaFin).
• EMIs: Swan (France, ACPR; embedded accounts, cards and payments), Treezor (France, ACPR; client funds segregated with Société Générale), Modulr (UK/EU; FCA and DNB, direct participant in Faster Payments and Bacs with settlement accounts at the Bank of England, principal member of Mastercard and Visa), Railsr (UK, FCA; onboarding of new agents or distributors needs the FCA's prior written consent).

What to look at: license type for the operator's product (insured deposits and credit—only through a bank), provider stability (a provider's regulatory and financial problems affect all products built on its infrastructure), and scheme access (direct participation in payment systems, as with Modulr and ClearBank, is more reliable than access through an intermediary).

The regulatory horizon: PSD3 and PSR will fold EMIs into a single payment-institution regime, narrow the commercial-agent exclusion, and require payment systems to admit licensed non-bank payment service providers on objective, non-discriminatory terms. A provisional political agreement was reached on 27 November 2025 and the European Parliament's ECON committee approved the agreed texts on 5 May 2026, with the plenary vote forecast for 14 December 2026 (OEIL 2023/0209(COD)); neither act is adopted or in force. Under the agreed texts the rules apply 21 months after entry into force, so an application date can only be fixed once the acts are published in the Official Journal. Crypto-asset infrastructure moves under MiCA and the CASP regime, and EU DORA applies to ICT risks. The agent model and own-license thresholds are covered in payment agents in EU/UK.

A provider gives access to services under its licence: the operator gains speed to market and takes on its regulatory and financial risk. So in Europe a BaaS partner is chosen by supervisory status, capital, and real access to payment schemes—the API is secondary.

Sponsor Banks and European Providers Side by Side

Comparison of twelve US sponsor banks

Charter, state and regulator come from the FDIC BankFind register as of the 30 June 2026 call report; specialisation, integration model and supervisory record are set out in the bank profiles.

The comparison shows three features. First, every bank on it sits below $10 billion of assets, which is the Durbin line: a sponsor above it earns regulated debit interchange, one below it earns the unregulated rate, and that difference is the economic basis of the whole model. The exemption is tested on the bank together with its affiliates at the end of each year, so a bank close to the line — The Bancorp at $9.2 billion, Cross River at $8.5 billion — is also a bank whose card economics can change after a good year. Second, the supervisor is not uniform: six of the twelve answer to the FDIC, four to the OCC and two to the Federal Reserve, and the public actions in the table came from different agencies — the Fed in 2024 and the OCC in 2026. A fintech assesses a consent order from any of them the same way — as a possible freeze on new programs — but it negotiates the exit with a different agency. Third, integration models form two groups: Column and Lead sell direct API access and expect the fintech to handle its own share of compliance, while the card banks work through program managers who sit between them and the brand, which is the model the BIN sponsorship material describes.

Comparison of eight European providers

Licence type and the ability to take deposits and lend are decisive when comparing European providers. A product that holds deposits or lends has only three providers here — ClearBank, Griffin and Solaris. Everything else is an EMI, where client money is safeguarded rather than insured, and where the provider's own capital, ownership and supervisory status become the risk the product inherits. Direct access to schemes is the second filter, because a provider that settles through someone else adds one more commercial bank to the chain; Modulr and the ClearBank pair are the only rows with direct participation named here.

The following partnership models apply to four product types.

A worked example of the concentration risk. A US card programme earns debit interchange at the unregulated rate only while its sponsor, with affiliates, stays under $10 billion; if the sponsor crosses the line, the same volume is priced at the regulated cap from the following July. A programme that also depends on a sponsor under a fresh consent order — Evolve in 2024, CFSB in 2026 — can find new-program approvals frozen while its own growth depends on them. Both risks are managed the same way: a second sponsor under contract before the first one is needed, and a ledger the programme can reconcile without the middleware.

Applicable Regulation

There is no separate regime for BaaS—the bank remains under standard supervision (OCC/FDIC/Fed), and the relationship with the fintech is governed by the Interagency Guidance on Third-Party Relationships (2023). The FDIC is preparing a rule on custodial accounts (NPRM dated October 2, 2024, new Part 375): itemized recordkeeping of beneficiaries and daily reconciliation; as of June 2026—it's a proposal, not finalized, comment period closed. In parallel, some players are moving from renting a charter to holding one — see ILC charters and US bank charter applications, and also the regulatory perimeter and rent-a-bank. An existing charter is the shortcut: infrastructure fintech Increase now runs Increase Bank, the former Twin City Bank in Washington, renamed on 1 July 2026 according to FDIC BankFind, instead of a multi-year de novo application.

Evolution: The BaaS Crisis and the Supervisory Turn

The 2021–2023 BaaS boom grew faster than the supervision around it: dozens of banks plugged in fintech programs for the sake of fee income and cheap deposits, while control over the programs themselves often lagged. In June 2023, the OCC, FDIC, and the Fed issued the joint Interagency Guidance on third-party risk management, and in 2023–2024 a wave of enforcement actions against sponsor banks swept the market—Blue Ridge and Evolve among them—with regulators demanding that deficiencies in AML and program oversight be remedied.

The turning point was the Synapse collapse: the "fintech → middleware → bank" chain leaves customer funds inaccessible when reconciliation depends on the intermediary. After it, some banks wound down their BaaS lines, the middleware market went through consolidation, and fintechs began checking a bank's supervisory record more carefully and preferring short integrations with direct access to the partner. In Europe, a comparable role is played by EMIs and payment licenses—see the "EU/UK: The EMI Model" section above.

In 2025 the supervisory approach shifted toward "rightsizing": the FDIC under new leadership withdrew a number of contested proposals, the OCC began closing out some older consent orders, and the tone shifted from pressure to normalization. Yet the requirements for beneficiary recordkeeping and reconciliation remained, and the basic logic of "the bank answers for its program" settled in as the market's new norm.

A sponsor bank gives the fintech access to banking services under its charter and remains accountable to the regulator for the entire program; in Europe the same role is played by a provider holding a banking or EMI licence. So check the partner's regulatory status and supervisory maturity before its pricing — and the conversation about the operator's own license starts where the program's scale outgrows the partnership model.