Embedded Finance: Accounts, Payments, Credit and Participant Roles

Financial Service and Authorised Provider

Embedded finance puts a financial service inside a non-financial product: a balance in Shopify, a card for an Uber driver, a loan at checkout, travel insurance bundled with a ticket. Each service model includes a licensed entity (a bank, an e-money institution, an insurer, a ManCo), and the brand operates on that license under contract. Examples of brands and their partners appear in the "Cases: Who Stands Behind the Brands" section.

Three questions are important in organising such a business: under whose license operations are conducted, what the partner requires for onboarding, and where the boundary of liability lies. There is no separate "embedded finance license"—each product is regulated according to its sector: payments as payments, credit as credit, insurance as insurance. Therefore, entry into each vertical is different, and it begins with choosing a model and a license-holding partner.

The principle in embedded finance is that the activity can be outsourced, but liability cannot. It stays with the license holder. That is how US banking supervision works (interagency guidance 2023 plus the post-Synapse consent orders), how EU DORA has worked since January 2025, how the FCA treats a principal answering for its appointed representative, and how insurance treats an MGA program under NAIC. The partner that rents out the license is required to supervise the client and does so.

How the Model Took Shape

Financial services used to be sold only by financial firms. Access to banking through APIs changed that model. Once a bank could expose accounts, cards, and payments as services, any software company could place a regulated product at the moment a customer needed it, without holding the license itself. Issuer-processors, account and payment infrastructure, and open-banking infrastructure turned adding a financial feature into an integration task; obtaining the license remained the task of another party.

Brands adopt this model for economic reasons. A financial feature raises the value of an existing customer: it deepens the relationship, adds a source of margin, and produces transaction data the brand already understands. A marketplace that issues its sellers an account keeps balances within its infrastructure; a platform that lends at checkout earns on credit it used to hand to someone else. The licensed partner supplies the regulated core, the brand supplies distribution and the customer, and the contract between them decides who carries each risk.

Principal Models

ClearBank provides accounts, payments, FX and event notifications through one API; Sygnum enables banks to add digital-asset custody and trading through B2B integration. A product under a partner’s brand also needs a defined customer contracting party and an operator for each service. British Atlantic Bank brings fiat accounts, FX, payouts and digital-asset operations into a partner-branded service connected through an API. The partner shapes its customer offering and prices; the agreed provider performs each regulated service within its authorisation. Payment statuses and records connect the customer interface to approval, execution and reconciliation. Cards, e-money and a partner-branded settlement stablecoin can be scoped as separate products, with their issuer, eligible customers and markets established for the launch. The six main models differ in their license holders, minimum entry requirements and supervision:

The sixth model concerns crypto services. Since the MiCA CASP regime took full effect on 30 December 2024, the standard route is white-label issuance under another firm's CASP authorization, passported across the EU. Who actually holds the license in each vertical is covered separately: the BaaS guide (US sponsor banks, middleware, and the EU/UK EMI model), UK host AIFM, third-party ManCo in the EU, and the card program.

Choosing a model by product and profile

The six models are grouped by one criterion: whether the brand's customer leaves money or assets with the licensed partner. Where it does — an account, a wallet, a card balance, a crypto holding — the partner carries safeguarding or deposit duties and checks the brand as closely as it checks its own branch network. Where it does not — a loan sold at checkout, an insurance policy bound at booking, a fund run under a host — the partner's exposure is credit, underwriting or conduct risk, and the onboarding looks more like a distribution agreement than a banking relationship.

The second criterion is geography. The US models sit on a bank charter and on FDIC insurance, which reaches the customer only through the bank's records; the EU and UK models sit on e-money or payment safeguarding, which protects funds without insuring them. A brand selling on both sides of the Atlantic usually runs two systems — a sponsor bank in the US and an EMI principal in Europe — and treats them as two products with one front end.

Crypto is the one vertical where the rented licence covers the whole EEA from day one. A CASP authorised under MiCA passports its services across the Union, and since the transitional window for firms registered under national VASP regimes closed on 1 July 2026 at the latest (earlier in member states that shortened it) there is no local registration to lean on. The partner checklist is in the CASP licence guide; the comparison of MiCA with VARA, the SFC, MAS and the US regimes is in the crypto licence map.

A worked example: a Berlin-based marketplace with 40,000 sellers wants in-app seller wallets and a crypto payout option. For the wallets it signs as a registered agent of a Lithuanian EMI; the EMI safeguards the balances and passports the service into Germany, and the marketplace's own work is KYB on sellers and the transaction-monitoring feed the EMI requires. For crypto payouts it partners with a CASP authorised for transfer and custody services, which holds the sellers' crypto-assets in segregated accounts. Two contracts, two principals, one interface; the marketplace holds no licence of its own, and the path to its own EMI is set out in the Lithuanian EMI guide.

Cases: Who Stands Behind the Brands

Brands that have embedded financial services use a recurring structure: brand on top, beneath it a program manager or BaaS platform (Stripe, Marqeta, Branch), and at the foundation a sponsor bank with a banking charter (Celtic, Column, Sutton, Evolve, WebBank, Fifth Third). Changing the vertical—account, card, credit—changes the provider and bank, but not the construction itself. The economics work on distribution: the bank earns on deposit interest and a share of interchange, the processor on transactions, the brand on customer retention and additional revenue (McKinsey on embedded finance and BaaS).

Embedded products and the banking charters supporting them (as of mid-2026; partner banks change over time):

• Shopify — Shopify Balance account and Shopify Capital credit directly in the store admin. Balance is built on Stripe Treasury, funds are placed with Fifth Third Bank N.A. (Member FDIC), the Balance card is issued by Celtic Bank. Shopify Capital loans are issued in the US by WebBank. Shopify does not hold its own license.
• Stripe — a brand that itself became an infrastructure provider. Stripe Treasury gives platforms embedded accounts, Stripe Issuing—card issuance; on Stripe's own disclosures, Treasury funds sit at Fifth Third Bank, N.A., and Issuing cards are issued by Celtic Bank and Cross River Bank. This is an example of how embedded finance is already sold as a service for other brands—see BaaS and sponsor banks.
• Uber — Uber Pro Card, a debit Mastercard for drivers with instant access to earnings. The program is run by the fintech Branch, while banking services and card issuance sit with the sponsor banks Evolve Bank & Trust or Lead Bank (whichever is named on the back of the card); issuance technology comes from Marqeta. For Uber it is a driver retention tool: instant payout ties the driver to the platform.
• Ramp — corporate charge card and spend management. Ramp Visa Corporate Card is issued by Celtic Bank, Ramp Visa Commercial Card by Sutton Bank, cards for global companies by Column N.A. Ramp develops software using banking infrastructure, while the banks hold the deposits and issue the cards.
• Brex — corporate cards and business accounts for startups. Brex Checking is provided by Column N.A.; the cards are issued by other banks — the Brex Mastercard Corporate Credit Card by Emigrant Bank, Fifth Third Bank N.A. or Airwallex (Netherlands) B.V., and the Brex Commercial Card by Sutton Bank on a Visa licence. Deposits and charter are with partner banks, product and customer with Brex.
• Toast — POS for restaurants and Toast Capital loans from $1K to $300K. Loans are issued by WebBank; repayment is a fixed percentage of daily card revenue, with no compound interest or personal guarantee. Access to restaurant sales data makes underwriting embedded.

The type of financial service determines the partners—account and card mean a sponsor bank plus an issuer-processor; credit means a partner bank ready to lend (like WebBank for Toast); cards under the business's own brand mean BIN sponsorship (see the card program). Other elements of the model are a legal entity, a ready KYC/KYB and AML policy package, integration with the processor, and an agreement with the sponsor bank: through a vendor, go-live takes weeks, and the bank takes a share of interchange and an access fee (partnership requirements and economics are in the BaaS guide).

Risks of the partnership model:

• Concentration on one bank. Evolve stands behind Uber and stood behind Shopify Balance—accounts opened before 2025 are being migrated from Evolve to Fifth Third. A common partner bank becomes a common point of failure, making the identity of the bank supporting the product and the availability of a backup important; a bank's enforcement history is checked as carefully as its pricing.
• Where money is insured. FDIC pass-through operates at the partner bank level, within $250K per depositor, and covers bank failure but not intermediary failure. The Synapse collapse (Chapter 11, April 2024) showed how customers lose access to funds when middleware fails—see the "Middleware" section of the BaaS guide.
• Whose customer and whose data. The brand owns the customer relationship but operationally depends on the provider. Migration between banks (as with Shopify and Mercury) is a regular occurrence and is planned for in advance.

The brand's own license is almost never needed here. The model requires a sponsor bank and an issuer-processor; the entire arrangement then depends on two questions: who is responsible to the regulator (the bank) and who owns the customer relationship (the brand).

The Regulatory Perimeter

In the EU the perimeter has hardened. DORA has applied since 17 January 2025 and reaches the technology vendors behind a financial product as well as the license holder, so an embedded-finance stack now carries operational-resilience duties end to end. MiCA's CASP regime has applied since 30 December 2024, providing an authorization under which crypto features can operate. PSD3 and the PSR are not adopted yet: the ECON committee approved the text agreed in early second-reading negotiations on 5 May 2026, the indicative plenary vote is 14 December 2026, and both files still await the Council's first-reading position. The texts merge the e-money and payment-institution regimes, tighten client-fund safeguarding, and extend fraud-reimbursement duties; the application date depends on the transition period in the final text and is not yet fixed. The Financial Data Access (FIDA) file, still in trilogue, would push open-banking-style access into investments, pensions, and insurance.

In the US there is no single embedded-finance rule. The 2023 interagency guidance on third-party relationships set the supervisory tone, and the 2024 wave of enforcement actions against sponsor banks put it into practice, faulting weak BSA/AML monitoring and thin oversight of fintech partners; the clearest documented case is the Federal Reserve's cease-and-desist of 14 June 2024 against Evolve Bancorp and Evolve Bank & Trust. The Synapse collapse, where the Chapter 11 trustee put the gap between the ledgers and the actual balances at 65–95 million dollars (the CFPB's complaint of 21 August 2025 put it at 60–90 million, and the CFPB has since allocated $55.2 million from its Civil Penalty Fund to affected consumers), pushed the FDIC to propose recordkeeping rules for custodial for-benefit-of accounts (proposed rule published 2 October 2024, still not finalised) and made every sponsor bank re-price partner risk. The newer line is the GENIUS Act of July 2025, a federal stablecoin framework under which the OCC will license and supervise payment-stablecoin issuers (its implementing rule was proposed on 25 February 2026): an embedded payment rail that carries its own license.

By 2026 the regulator's "rightsizing" ran along two lines. Entry was eased: a separate OCC final rule, published in the Federal Register on 2 March 2026 and effective from 1 April 2026, confirms that national trust banks may also conduct non-fiduciary activities, such as custody. By early December 2025 the agency had received 14 de novo charter applications that year — almost as many as in the previous four years combined — and Comptroller Jonathan Gould called it a return to the norm. In December 2025 five crypto firms took conditional approvals at once (Ripple, Circle, BitGo, Fidelity Digital Assets and Paxos), and the wave continued in February 2026 with Stripe (Bridge), Protego and Crypto.com.

In parallel the supervisory criteria themselves were revised: in October 2025 the FDIC and the OCC proposed to define "unsafe or unsound practice" and to rein in MRAs, focusing supervision on material financial risk, and published the final rule on 1 September 2026, effective 2 November 2026. State licences, federal charters and the separate crypto regimes in the United States are mapped in US financial and crypto licenses.

The UK runs on principles plus license-by-license supervision. The FCA's Consumer Duty, in force since July 2023, sets higher standards for any product reaching a retail customer through a brand; the appointed-representative regime keeps the authorized principal answerable for the firms operating under it; and mandatory APP-fraud reimbursement, in force since 7 October 2024, places fraud costs back on the payment chain. Safeguarding reform for payment and e-money firms has been introduced: PS25/12 (7 August 2025) added the CASS 15 supplementary regime, in force since 7 May 2026, while the FCA will decide on the end-state post-repeal regime after reviewing how the supplementary regime works, and its timing depends on HM Treasury revoking the safeguarding rules of the Payment Services and E-Money Regulations. On the appointed-representative side, HM Treasury consulted on 12 February 2026 on a gateway for principals: acting as principal for an AR would require a separate FCA permission, and AR staff would fall under the SMCR, with the feedback window closing on 9 April 2026. The line continues FCA PS22/11 after the Greensill collapse, and the proposal remains a consultation rather than a rule in force.

Insurance shows the same logic in a third vertical. After the Vesttoo collapse in 2023, involving roughly $4 billion of fake letters of credit, regulators require fronting carriers to hold operational control over the programme rather than merely supply the "paper", and have tightened collateral verification. The mechanics of delegated authority and fronting are covered in delegated authority and fronting.

Across all three regions the principle is the same: the license holder owns the risk, so the partner supervises the program as if it were its own.

Transition to the Brand's Own License

Renting a license offers a fast launch and a low entry barrier, although these advantages are not permanent. As volumes grow the economics and the supervisory burden change: the partner takes a larger revenue share and tightens control, while the brand's own license becomes cheaper per transaction. Thresholds vary by vertical. Card programs have no published threshold: the break-even point depends on the BIN sponsor's revenue share and fees and is worked out against a given sponsor's terms; in payments the move from agent to the brand's own e-money or EMI license is driven by turnover and the wish to control the infrastructure; in funds it arrives when management fees cover the cost of running the brand's own AIFM.

The 2025–26 market pushes the same way: after the 2024 consent-order wave and the Synapse collapse the pool of US sponsor banks shrank, and the survivors are pricier and stricter, so larger programs increasingly pursue a direct charter. Stablecoin firms found a parallel path in national trust charters: on 12 December 2025 the OCC conditionally approved Paxos's conversion to a national trust bank and Circle's de novo First National Digital Currency Bank, and Circle announced final OCC approval for First National Digital Currency Bank, N.A. on 10 July 2026.

Jurisdictions

The same models read differently by country. Breakdowns of the licensing and hosting regimes: Singapore — funds, Singapore — payments (PSA), UAE (ADGM/DIFC), Offshore (BVI/Cayman), Malta (cell structures), and Hong Kong.