Where License Rental Came From
The license rental model grew out of the embedded-finance boom of the late 2010s: fintechs wanted to launch payments, accounts, and insurance in weeks, and a license of their own did not fit that speed. The solution was access under someone else's authorization—through a sponsor bank, an appointed representative, a host AIFM, or a fronting carrier. A decade of cheap money and generous venture funding amplified demand: renting the regulatory perimeter was simpler and faster than building your own. By the early 2020s, thousands of companies operated this way. Then came the failures of 2023–2024—they exposed the thin spot in the design, and regulators began tightening precisely the control perimeter.
Concept
All license rental models—BaaS, sponsor bank, appointed representative, host AIFM, fronting, white-label CASP—rest on one principle: you can outsource activity, but not accountability. It remains with the license holder. This is the established position of regulators: US interagency guidance (the bank is responsible for the fintech), DORA in the EU (accountability on financial institutions), FCA (principal is responsible for AR), NAIC (insurer for MGA programs).
Hence the practical conclusion: whoever "rents out" the license is obliged to actually control the party to whom they rent it. Where control was outsourced along with the activity—that's where failures occurred.
What the Failures Taught
Synapse (2024), Greensill and Vesttoo (2023)—different industries, one story: a shell with a license transferred not only activity but also control to the outside. Reconciliation, oversight of secondees, verification of collateral ended up with those who bore no accountability. Regulators responded by tightening precisely the control perimeter.
USA: From Rental to Ownership
The OCC issued an NPR on national bank chartering (January 2026) and, on March 2, 2026, finalized a separate rule: as of April 1, 2026, limited-purpose trust banks are expressly permitted to conduct non-fiduciary activities as well, including custody. Against this backdrop, in 2025 the OCC received 14 de novo charter applications—almost as many as in the previous four years combined; Comptroller Jonathan Gould called it "a return to normal." In December 2025, five crypto companies (Ripple, Circle, BitGo, Fidelity Digital Assets, Paxos) received conditional approvals at once, and in February 2026 the wave continued—Stripe (Bridge), Protego, and Crypto.com. In parallel, the FDIC and OCC proposed (October 2025) to define "unsafe or unsound practice" and rein in MRAs—this is precisely "rightsizing."
The vector is clear: direct charter is becoming more accessible, and for mature fintechs, rental is giving way to ownership. On partner banks themselves—see the US sponsor banks overview and BaaS and sponsor banks; on lending under someone else's license—see rent-a-bank and true lender.
EU: Integration and Direct Access
On April 23, 2026, the EU Council published the final compromise texts of PSD3 and PSR (political agreement with Parliament had already been reached in November 2025). Key point: the neobank regime is folded into PI (the separate E-money Directive is abolished, reauthorization will be required), and neobanks gain the right of direct access to payment systems—TARGET2 and instant payments—on par with banks, which reduces dependence on sponsor banks. PSD3 will require transposition within 21 months of entry into force, and PSR will begin to apply directly from the same date (verification-of-payee rules—in the 27th month). Operational resilience and third-party ICT risks are governed by DORA (in force since January 17, 2025), with direct EU oversight of critical ICT third-party providers. What this means for the agency model—see payment agents.
United Kingdom: Gateway for Principals
HM Treasury in 2026 is consulting on a gateway: to be a principal for an AR, a separate FCA authorization will be required, and AR personnel will fall under SMCR. This continues the PS22/11 line after the Greensill collapse. Details—see appointed representative and fund hosting.
Insurance: Control Instead of "Paper"
After Vesttoo (2023, approximately $4 billion in fake letters of credit), regulators require fronting carriers to have operational control over the program, not just provide "paper," and have tightened collateral verification. The mechanics of MGA and fronting are covered in delegated authority and fronting.
What This Means for Builders
- Rental is becoming more expensive and supervised. The partner will demand more control and compliance than a year or two ago.
- Judge a partner by the depth of their control and compliance. That is what determines how resilient your own access is; their reliability becomes yours.
- Plan your trajectory. At scale, your own license or charter is often cheaper and more reliable than rental. The overall map of models—see embedded finance.
Where the Perimeter Is Shifting
Behind all four jurisdictions runs a single vector: entry through your own license or charter is becoming more accessible, while the demands on those who "rent out" access grow stricter. In the US it is the pairing of the return of de novo chartering and the definition of "unsafe or unsound practice"; in the EU, direct access for neobanks to the systems and DORA oversight of ICT providers; in the UK, a gateway for principals and the extension of SMCR to ARs. For mature players the economics shift toward ownership: at scale, a license of your own gives a predictability that rental cannot. For early stages and niche products, rental remains a workable entry point—now as a supervised instrument with control and compliance requirements built in.
Applicable Regulation
USA: 2023 interagency guidance, the OCC final rule on national bank chartering (April 2026), and the FDIC/OCC proposal on "unsafe or unsound practice" (OCC, final rule, FDIC, rightsizing, OCC, unsafe-or-unsound NPR). EU: PSD3/PSR (Freshfields, PSD3/PSR) and DORA. UK: FCA PS22/11 and the HM Treasury consultation on AR reform (2026). Insurance: NAIC.
Frequently asked questions
Can accountability be fully transferred to the license holder? No. Activity is outsourced, accountability is not; part of the requirements always returns to whoever operates under the license.
Why are regulators simultaneously opening up charters and tightening oversight? These are two sides of "rightsizing": simplify entry for mature players while raising the bar for control over partnerships.
What does direct PI access to payment systems in the EU change? Dependence on sponsor banks decreases—a neobank will be able to participate in the systems directly.
This material is prepared as an expert overview and does not constitute individual legal advice.