Embedded Finance: Integrated Financial Services

Concept

🔗 Related

embedded finance cases · regulatory perimeter

Embedded finance puts a financial service inside a non-financial product: a balance in Shopify, a card for an Uber driver, a loan at checkout, travel insurance bundled with a ticket. Behind every storefront sits a licensed entity (a bank, an e-money institution, an insurer, a ManCo), and the brand operates on that license under contract. Which brands do this, and through which partners, is set out in the "Cases: Who Stands Behind the Brands" section below.

For anyone building such a business, three questions matter: under whose license they operate, what is needed for a partner to onboard them, and where the boundary of their liability lies. There is no separate "embedded finance license"—each product is regulated according to its sector: payments as payments, credit as credit, insurance as insurance. Therefore, entry into each vertical is different, and it begins with choosing a model and a license-holding partner.

🍓 The core principle of the cluster: you can outsource the activity, but not the liability. It stays with the license holder. That is how US banking supervision works (interagency guidance 2023 plus the post-Synapse consent orders), how EU DORA has worked since January 2025, how the FCA treats a principal answering for its appointed representative, and how insurance treats an MGA program under NAIC. The partner that rents out the license is required to police you, and it does. Where supervision is heading is set out in the regulatory perimeter material.

How the Model Took Shape

Finance used to be sold only by financial firms. That changed when banking moved behind APIs. Once a bank could expose accounts, cards, and payments as services, any software company could place a regulated product at the moment a customer needed it, without holding the license itself. Issuer-processors, account and payment infrastructure, and open-banking rails turned adding a financial feature into an integration task; obtaining the license stayed someone else's job.

The reason brands bother is economics. A financial feature raises the value of an existing customer: it deepens the relationship, adds a margin line, and produces transaction data the brand already understands. A marketplace that issues its sellers an account keeps balances on its own rails; a platform that lends at checkout earns on credit it used to hand to someone else. The licensed partner supplies the regulated core, the brand supplies distribution and the customer, and the contract between them decides who carries each risk.

Models and Where to Start

🔗 Related

white-label under CASP · US sponsor banks · UK host AIFM · third-party ManCo in the EU · BIN sponsorship for cards · EU/UK BaaS and neobank

Five main models. Each has its own license holder, its own minimum entry requirements, and its own supervision.

The sixth vertical is crypto. Since the MiCA CASP regime took full effect on 30 December 2024, the standard route is white-label issuance under another firm's CASP authorization, passported across the EU. Who actually holds the license in each vertical is covered separately: the BaaS guide (US sponsor banks, middleware, and the EU/UK neobank model), UK host AIFM, third-party ManCo in the EU, and the card program.

Cases: Who Stands Behind the Brands

Embedded finance is easiest to understand through brands that have already embedded financial services. The pattern repeats: brand on top, beneath it a program manager or BaaS platform (Stripe, Marqeta, Branch), and at the foundation a sponsor bank with a banking charter (Celtic, Column, Sutton, Evolve, WebBank, Fifth Third). Changing the vertical—account, card, credit—changes the provider and bank, but not the construction itself. The economics work on distribution: the bank earns on deposit interest and a share of interchange, the processor on transactions, the brand on customer retention and additional revenue (McKinsey on embedded finance and BaaS).

What exactly each brand embeds and whose banking charter stands behind the product (as of mid-2026; partner banks change over time):

• Shopify — Shopify Balance account and Shopify Capital credit directly in the store admin. Balance is built on Stripe Treasury, funds are placed with Fifth Third Bank N.A. (Member FDIC), the Balance card is issued by Celtic Bank. Shopify Capital is issued through Stripe with participation from Evolve Bank & Trust and Celtic Bank. Shopify does not hold its own license.
• Stripe — here the brand itself became infrastructure. Stripe Treasury gives platforms embedded accounts, Stripe Issuing—card issuance; behind them stand partner banks (Goldman Sachs, Citi, Cross River, Fifth Third, and others) and issuer banks like Celtic. This is an example of how embedded finance is already sold as a service for other brands—see BaaS and sponsor banks.
• Uber — Uber Pro Card, a debit Mastercard for drivers with instant access to earnings. Banking services are provided by Branch, the card is issued by Evolve Bank & Trust, issuance technology is provided by Marqeta. For Uber it is a driver retention tool: instant payout ties the driver to the platform.
• Ramp — corporate charge card and spend management. Ramp Visa Corporate Card is issued by Celtic Bank, Ramp Visa Commercial Card by Sutton Bank, cards for global companies by Column N.A. Ramp itself does not hold deposits or issue cards—it builds software on top of banks.
• Brex — corporate cards and business accounts for startups. Issuance relies on regulated banks Column N.A. and Sutton Bank, processing goes through Mastercard and Visa networks. Deposits and charter are with partner banks, product and customer with Brex.
• Toast — POS for restaurants and Toast Capital loans from $1K to $300K. Loans are issued by WebBank; repayment is a fixed percentage of daily card revenue, with no compound interest or personal guarantee. Access to restaurant sales data makes underwriting embedded.

To replicate the assembly: the vertical picks the partners—account and card mean a sponsor bank plus an issuer-processor; credit means a partner bank ready to lend (like WebBank for Toast); cards under your own brand mean BIN sponsorship (see the card program). Then a legal entity, a ready KYC/KYB and AML policy package, integration with the processor, and an agreement with the sponsor bank: through a vendor, go-live takes weeks, and the bank takes a share of interchange and an access fee (partnership requirements and economics are in the BaaS guide).

What to watch for:

• Concentration on one bank. Evolve stands behind Uber and stood behind Shopify Balance—accounts opened before 2025 are being migrated from Evolve to Fifth Third. A common partner bank becomes a common point of failure, so know which bank your product depends on and whether there's a backup; a bank's enforcement history is checked as carefully as its pricing.
• Where money is insured. FDIC pass-through operates at the partner bank level, within $250K per depositor, and covers bank failure but not intermediary failure. The Synapse collapse (Chapter 11, April 2024) showed how customers lose access to funds when middleware fails—see the "Middleware" section of the BaaS guide.
• Whose customer and whose data. The brand owns the customer relationship but operationally depends on the provider. Migration between banks (as with Shopify and Mercury) is a regular occurrence and is planned for in advance.

Business banking via API follows the same logic—see HEVN.

The Regulatory Perimeter

In the EU the perimeter has hardened. DORA has applied since 17 January 2025 and reaches the technology vendors behind a financial product as well as the license holder, so an embedded-finance stack now carries operational-resilience duties end to end. MiCA's CASP regime has applied since 30 December 2024, giving crypto features a real license to sit under. PSD3 and the PSR reached provisional political agreement on 27 November 2025; the texts merge the e-money and neobank regimes, tighten client-fund safeguarding, and extend fraud-reimbursement duties, with application realistically falling in 2027 after the transition. The Financial Data Access (FIDA) file, still in trilogue, would push open-banking-style access into investments, pensions, and insurance.

In the US there is no single embedded-finance rule. The 2023 interagency guidance on third-party relationships set the supervisory tone, and the 2024 wave of consent orders against sponsor banks (Blue Ridge, Evolve, Sutton, Piermont, Thread and others) put it into practice, faulting weak BSA/AML monitoring and thin oversight of fintech partners. The Synapse collapse, which left roughly 85 million dollars of customer balances unreconciled, pushed the FDIC to propose recordkeeping rules for custodial for-benefit-of accounts and made every sponsor bank re-price partner risk. The newer line is the GENIUS Act of July 2025, a federal stablecoin framework under which the OCC began chartering payment-stablecoin issuers: an embedded payment rail that carries its own license.

The UK runs on principles plus license-by-license supervision. The FCA's Consumer Duty, in force since July 2023, raises the bar on any product reaching a retail customer through a brand; the appointed-representative regime keeps the authorized principal answerable for the firms operating under it; and mandatory APP-fraud reimbursement, live since 7 October 2024, prices fraud back into the payment chain. Safeguarding reform for payment and e-money firms is in train, tightening how client money is held. Across all three regions the message is the same: the license holder owns the risk, so the partner supervises the program as if it were its own.

When It's Time for Your Own License

Renting a license buys speed and a low entry barrier, but not forever. As volumes grow the economics and the supervisory load invert: the partner takes a larger revenue share and tightens control, while your own license becomes cheaper per transaction. Thresholds vary by vertical. Card programs are often cited at around several hundred thousand active cards (to be verified for a given BIN sponsor); in payments the move from agent to your own e-money or neobank license is driven by turnover and the wish to control the rails; in funds it arrives when management fees cover the cost of running your own AIFM. The 2025–26 market pushes the same way: after the 2024 consent-order wave and the Synapse collapse the pool of US sponsor banks shrank, and the survivors are pricier and stricter, so larger programs increasingly pursue a direct charter. The GENIUS Act added a parallel path, with the OCC granting conditional national trust charters to stablecoin issuers such as Circle and Paxos in December 2025.

Jurisdictions

🔗 Related

Singapore — funds · Singapore — payments (PSA) · UAE (ADGM/DIFC) · Offshore (BVI/Cayman) · Malta (cell structures) · Hong Kong

The same models read differently by country. Breakdowns of the licensing and hosting regimes: Singapore — funds, Singapore — payments (PSA), UAE (ADGM/DIFC), Offshore (BVI/Cayman), Malta (cell structures), and Hong Kong.

Sources

• interagency guidance 2023
• DORA
• McKinsey on embedded finance and BaaS