BaaS: How a Banking Product Lives Without a License

Concept

BaaS (banking-as-a-service) is a model in which a licensed bank provides accounts, cards, and payments externally through an API, while a non-bank brand embeds them into its product. Essentially, this is white-label banking: for the customer it's an "account at a fintech," legally it's an account at the partner bank. This is one of the verticals of embedded finance.

The fintech builder does not obtain a banking license—in the US this takes 3–5 years and substantial capital. Instead, they rent access to someone else's license: they connect to a sponsor bank and build a product on top of its charter.

🍓 The partner bank is responsible for end customers' funds and compliance before the regulator; the fintech is responsible to the bank. Therefore, the bank treats the fintech as its primary risk and has the right to shut down the program at any time. A list of sponsors and warnings is in the "US Sponsor Banks" section below.

How It Works

Three roles. The sponsor bank holds the charter and FDIC insurance and is accountable to the regulator. The middleware/BaaS platform provides the API and part of the compliance operations. The fintech manages the product and acquires customers. The bank earns from interest on deposits, a share of interchange, and fees for regulatory access.

Customer funds are held at the partner bank, often in a pooled FBO (for-benefit-of) account. FDIC insurance works as pass-through: $250K per end depositor per bank—provided there is correct itemized recordkeeping; sweep networks across multiple banks raise the limit (at Mercury—up to $5M). The critical node is reconciliation: the picture of "whose money is in the account" must match between the bank and the platform at all times. This is the same safeguarding discipline as in correspondent banking.

The cost of failure was demonstrated by the collapse of middleware Synapse (April 2024): Synapse's ledgers diverged from the banks' records, approximately $200 million in customer funds was frozen, and the shortfall was estimated at $85–95 million. The funds were in pooled FBO accounts, and reconciliation relied on Synapse's own system.

What You Need to Launch

You don't need your own banking license. You need a sponsor bank and, typically, middleware or an issuer-processor (Unit, Treasury Prime, Synctera, Lithic, Marqeta—depending on the product). The partner bank conducts due diligence per interagency guidance and assigns the fintech to the highest risk tier.

What the bank will request during onboarding: audited financials and runway; business model sustainability; operational maturity—platform, staff, BCP/DR, track record; a complete set of BSA/AML, KYC/KYB, PCI-DSS, and PII handling policies. Without a fully staffed compliance function, don't bother showing up for onboarding.

Compliance

The fintech bears operational compliance, which the bank is obligated to oversee. The basic set: all BSA pillars; CIP plus CDD/EDD; sanctions screening; transaction monitoring. The bank requires demonstrable control over end-customer onboarding—this is broader than formal CIP.

Supervision follows a cadence: compliance testing—at least quarterly, financial review—at least semi-annually, full annual review once a year. Weak third-party risk management is the main cause of sanctions: in 2024, consent orders were issued to Blue Ridge (OCC, BSA/AML, "troubled condition"), Evolve (Fed), Cross River, and First Fed.

How It's Done in the Market

Typical stack: partner bank + middleware + issuer-processor. Public example: Mercury (a fintech, not a bank) works with Choice Financial and Column N.A.; in March 2025, Mercury announced its departure from Evolve to Column and Choice. Profiles of sponsor banks and those to avoid (Evolve, Blue Ridge) are below in the "US Sponsor Banks" section; the card side is covered in the BIN sponsorship material.

What to look for when choosing. Economics: interchange share, access fees, minimum volumes. Concentration: a bank with dozens of fintech programs under regulatory pressure shuts them down in batches—it's worth diversifying partners. Data control: your access to the ledger and reconciliation must be independent of the middleware, or you'll repeat the Synapse scenario. Exit rights: pre-negotiate the transfer of the program and customer funds to another bank.

US Sponsor Banks

Partner banking grew out of two forces. The Durbin amendment left small banks (under $10 billion in assets) with high debit interchange—servicing third-party card programs is profitable for them. And the 2010s wave of fintech startups needed access to a charter and FDIC insurance without years of licensing. The candidate list is short: of roughly 4,400 US banks, fewer than a hundred offer banking-as-a-service at all, around twenty are truly active, and the market core is about a dozen names, each known to regulators individually.

Banks prominent in BaaS as of mid-2026 (specific partnerships change frequently, so focus on the bank's profile rather than its client list):

• Cross River Bank (New Jersey)—one of the BaaS and fintech lending pioneers. In 2023, it received an FDIC consent order on fair lending and now must obtain regulator approval for new partnerships.
• Column N.A.—a bank built by engineers for direct API access without middleware; popular among infrastructure fintechs.
• Choice Financial Group (North Dakota) and Coastal Community Bank (Washington, about $5 billion in assets as of early 2026)—prominent banks for accounts and payments; Coastal runs dozens of programs through its CCBX platform and keeps partners under tight control.
• Lead Bank (Kansas City)—relaunched by a team with fintech background for embedded banking programs.
• Sutton Bank, Celtic Bank, Pathward (formerly MetaBank), and The Bancorp Bank—long-standing players in card issuance, prepaid, and BIN sponsorship.

Lessons from failures: Evolve Bank & Trust—Synapse's partner—received a Federal Reserve cease-and-desist in June 2024 for weak AML/BSA, OFAC violations, and ineffective control over fintech partnerships, and suffered a major data breach the same summer. Blue Ridge Bank got an OCC consent order (January 2024) for BSA/AML failures, rebuilt its risk management team—and on November 13, 2025, the OCC lifted the measure: an order can be exited by rebuilding controls. Lineage, Piermont, and Sutton have gone through similar measures for oversight of fintech partnerships.

How to choose a partner bank:

• Regulatory status. A bank under a fresh consent order may not have the right to take on new programs—like Cross River after 2023. This is checked first.
• Direct access or middleware. Column and Lead lean toward API-first without intermediaries; others work through platforms like Unit, Treasury Prime, Synctera.
• Specialization. Cards and BIN sponsorship (Sutton, Celtic, Pathward, Bancorp) versus accounts and payments (Choice, Coastal, Column).
• Concentration. How dependent the bank is on a couple of large programs and whether it is resilient to their departure.
• Risk appetite. The bank's willingness to support your vertical and scale: lending, crypto, and cross-border payments are treated differently.

New demand for sponsor banks comes from stablecoins: the GENIUS Act, signed in July 2025, set the first federal rules for payment stablecoin issuers—issuance is allowed for bank subsidiaries and OCC-approved entities with 100% reserves and under BSA/AML. For an issuer, this is the same need for a charter and a partner bank as for a regular fintech—more in our stablecoins overview.

Middleware: Unit, Treasury Prime, Synctera—and the Synapse Lesson

Between the sponsor bank and the fintech brand there is almost always a technology intermediary—a BaaS platform, or middleware: account opening, card issuance, payment flows, end-customer ledgers, and compliance infrastructure via API. For anyone building embedded finance, middleware is what you actually integrate with: the sponsor bank often stays behind the scenes. Middleware holds no license—the charter, FDIC insurance, and regulatory responsibility remain with the bank; the intermediary only services the flow.

Key providers:

• Unit—broad API platform: accounts, cards, payments, lending. After 2024, it raised the bar for fintech selection because banks narrowed their risk appetite.
• Treasury Prime—in February 2024, cut about half its staff and pivoted from selling to fintechs to selling software directly to banks (Bank-Direct product). The logic: regulators want the bank itself to control the partner, without an intermediary seller.
• Synctera—end-to-end platform: infrastructure, compliance, and a network of community banks. Bet on post-2024 tightening—enhanced reconciliation, fraud and BSA tools; in March 2025 raised US$15M (about US$94M total), signed Bolt, and expanded to Canada.

The Synapse collapse also has an epilogue: in November 2025, the court dismissed the bankruptcy case—there were no funds to settle and no buyers for the assets. In parallel, the CFPB allocated US$46.2M from its Civil Penalty Fund to compensate victims (decision of November 28, 2025, unlocked by a symbolic US$1 penalty under a stipulated judgment). That covered about half the shortfall and was the first time the fund was used for a fintech incident. The takeaway for operators is unchanged: the main risk of a program is the intermediary's accounting system; the integrity of the middleware ledger and the bank's ability to independently reconcile balances determine whether end customers get their money.

After Synapse and the interagency guidance, banks demand direct control over end customers, and middleware is going "direct": selling software to banks, not fintechs (the Treasury Prime case), with contracts increasingly linking bank and fintech directly and leaving the platform only the technology. What to check when choosing middleware:

• Who holds the ledger and how FBO is reconciled—daily independent reconciliation on the bank's side, not trust in the platform's system.
• Which sponsor banks stand behind the platform and what condition they're in—consent orders, risk appetite (see the "US Sponsor Banks" section).
• Whose compliance is it—the BSA/AML program sits with the bank, the platform is just tooling; who is contractually responsible for CIP/CDD of end customers.
• Readiness for the direct model—will the program survive if the bank wants to contract the fintech directly.

EU/UK: The neobank Model

In Europe, the role of the US sponsor bank is played by a provider holding either a banking license (credit institution) or an neobank license. A company connects to the API and offers accounts, cards, and payments under its own brand, while the provider holds the license and liability; a single home-state authorization grants a passport across the EEA. The key distinction is license type: a bank can take deposits under deposit insurance and lend, while an neobank issues electronic money and handles payments, with client funds protected by safeguarding—segregation in a separate account or an insurance policy—rather than deposit insurance. Minimum capital for an neobank is €350K; for a bank, disproportionately more. So an neobank is faster and cheaper as a provider, while a bank is needed where there are deposits and credit.

Notable providers (mid-2026):

• Banks (credit institutions): ClearBank (UK, PRA/FCA; since August 2024 ClearBank Europe N.V. holds an ECB Credit Institution Licence under DNB supervision—euro accounts, SEPA, SEPA Instant, TARGET2), Griffin (UK; full banking license since March 2024—the UK's first full-charter BaaS platform), Solaris SE (Germany; banking license plus neobank, but under special BaFin supervision since December 2022 with a special representative and regulator approval for new clients; raised €96M Series F in 2024 plus a capital guarantee of up to €100M).
• neobanks: Swan (France, ACPR, EEA passport; accounts, cards, and local IBANs, 150+ companies in 30 countries), Treezor (France, ACPR, Mastercard Principal Member; owned by Société Générale, which in January 2026 agreed to sell it to fintech Shares), Modulr (UK/EU; FCA and DNB, direct participant in Faster Payments and Bacs with settlement accounts at the Bank of England, principal member of Mastercard and Visa), Railsr (recapitalized after its 2023 pre-pack administration; in December 2024 agreed to acquire Equals Group for £283M, becoming one of Europe's largest embedded-finance providers).

What to look at: license type for your product (insured deposits and credit—only through a bank), provider stability (the Solaris and Railsr stories show that a provider's regulatory and financial problems hit everyone built on it), and scheme access (direct participation in payment systems, as with Modulr and ClearBank, is more reliable than access through an intermediary).

The regulatory horizon: PSD3 and PSR will merge neobanks and neobanks into a single regime, narrow agent exemptions, and give non-banks direct access to payment systems—political agreement was reached in November 2025, agreed texts passed COREPER in April 2026, with application expected after a transition period, tentatively from 2027–2028. Crypto rails move under MiCA and the CASP regime, and EU DORA applies to ICT risks. The agent model and own-license thresholds are covered in payment agents in EU/UK.

Applicable Regulation

There is no separate regime for BaaS—the bank remains under standard supervision (OCC/FDIC/Fed), and the relationship with the fintech is governed by the Interagency Guidance on Third-Party Relationships (2023). The FDIC is preparing a rule on custodial accounts (NPRM dated October 2, 2024, new Part 375): itemized recordkeeping of beneficiaries and daily reconciliation; as of June 2026—it's a proposal, not finalized, comment period closed. In parallel, there is "rightsizing" of supervision and a shift of some players from renting to direct charter—see regulatory perimeter and rent-a-bank.

Sources

• GENIUS Act
• Interagency Guidance on Third-Party Relationships (2023)
• Federal Register — custodial accounts
• Bankingdive — dismissed the bankruptcy case