Embedded Finance: Integrated Financial Services

Concept

🔗 Related

embedded finance cases

Embedded finance puts a financial service inside a non-financial product: a balance in Shopify, a card for an Uber driver, a loan at checkout, travel insurance bundled with a ticket. Behind every storefront sits a licensed entity (a bank, an e-money institution, an insurer, a ManCo), and the brand operates on that license under contract. Which brands do this, and through which partners, is set out in the "Cases: Who Stands Behind the Brands" section below.

For anyone building such a business, three questions matter: under whose license they operate, what is needed for a partner to onboard them, and where the boundary of their liability lies. There is no separate "embedded finance license"—each product is regulated according to its sector: payments as payments, credit as credit, insurance as insurance. Therefore, entry into each vertical is different, and it begins with choosing a model and a license-holding partner.

🍓 The core principle of the cluster: you can outsource the activity, but not the liability. It stays with the license holder. That is how US banking supervision works (interagency guidance 2023 plus the post-Synapse consent orders), how EU DORA has worked since January 2025, how the FCA treats a principal answering for its appointed representative, and how insurance treats an MGA program under NAIC. The partner that rents out the license is required to police you, and it does.

How the Model Took Shape

Finance used to be sold only by financial firms. That changed when banking moved behind APIs. Once a bank could expose accounts, cards, and payments as services, any software company could place a regulated product at the moment a customer needed it, without holding the license itself. Issuer-processors, account and payment infrastructure, and open-banking rails turned adding a financial feature into an integration task; obtaining the license stayed someone else's job.

The reason brands bother is economics. A financial feature raises the value of an existing customer: it deepens the relationship, adds a margin line, and produces transaction data the brand already understands. A marketplace that issues its sellers an account keeps balances on its own rails; a platform that lends at checkout earns on credit it used to hand to someone else. The licensed partner supplies the regulated core, the brand supplies distribution and the customer, and the contract between them decides who carries each risk.

Models and Where to Start

🔗 Related

white-label under CASP · US sponsor banks · UK host AIFM · third-party ManCo in the EU · BIN sponsorship for cards · EU/UK BaaS and neobank

Five main models. Each has its own license holder, its own minimum entry requirements, and its own supervision.

The sixth vertical is crypto. Since the MiCA CASP regime took full effect on 30 December 2024, the standard route is white-label issuance under another firm's CASP authorization, passported across the EU. Who actually holds the license in each vertical is covered separately: the BaaS guide (US sponsor banks, middleware, and the EU/UK EMI model), UK host AIFM, third-party ManCo in the EU, and the card program.

Cases: Who Stands Behind the Brands

Embedded finance is easiest to understand through brands that have already embedded financial services. The pattern repeats: brand on top, beneath it a program manager or BaaS platform (Stripe, Marqeta, Branch), and at the foundation a sponsor bank with a banking charter (Celtic, Column, Sutton, Evolve, WebBank, Fifth Third). Changing the vertical—account, card, credit—changes the provider and bank, but not the construction itself. The economics work on distribution: the bank earns on deposit interest and a share of interchange, the processor on transactions, the brand on customer retention and additional revenue (McKinsey on embedded finance and BaaS).

What exactly each brand embeds and whose banking charter stands behind the product (as of mid-2026; partner banks change over time):

• Shopify — Shopify Balance account and Shopify Capital credit directly in the store admin. Balance is built on Stripe Treasury, funds are placed with Fifth Third Bank N.A. (Member FDIC), the Balance card is issued by Celtic Bank. Shopify Capital loans are issued in the US by WebBank. Shopify does not hold its own license.
• Stripe — here the brand itself became infrastructure. Stripe Treasury gives platforms embedded accounts, Stripe Issuing—card issuance; on Stripe's own disclosures, Treasury funds sit at Fifth Third Bank, N.A., and Issuing cards are issued by Celtic Bank and Cross River Bank. This is an example of how embedded finance is already sold as a service for other brands—see BaaS and sponsor banks.
• Uber — Uber Pro Card, a debit Mastercard for drivers with instant access to earnings. The program is run by the fintech Branch, while banking services and card issuance sit with the sponsor banks Evolve Bank & Trust or Lead Bank (whichever is named on the back of the card); issuance technology comes from Marqeta. For Uber it is a driver retention tool: instant payout ties the driver to the platform.
• Ramp — corporate charge card and spend management. Ramp Visa Corporate Card is issued by Celtic Bank, Ramp Visa Commercial Card by Sutton Bank, cards for global companies by Column N.A. Ramp itself builds software on top of banks, which keep the deposits and the card issuance.
• Brex — corporate cards and business accounts for startups. Brex Checking is provided by Column N.A.; the cards are issued by other banks — the Brex Mastercard Corporate Credit Card by Emigrant Bank, Fifth Third Bank N.A. or Airwallex (Netherlands) B.V., and the Brex Commercial Card by Sutton Bank on a Visa licence. Deposits and charter are with partner banks, product and customer with Brex.
• Toast — POS for restaurants and Toast Capital loans from $1K to $300K. Loans are issued by WebBank; repayment is a fixed percentage of daily card revenue, with no compound interest or personal guarantee. Access to restaurant sales data makes underwriting embedded.

To replicate the assembly: the vertical picks the partners—account and card mean a sponsor bank plus an issuer-processor; credit means a partner bank ready to lend (like WebBank for Toast); cards under your own brand mean BIN sponsorship (see the card program). Then a legal entity, a ready KYC/KYB and AML policy package, integration with the processor, and an agreement with the sponsor bank: through a vendor, go-live takes weeks, and the bank takes a share of interchange and an access fee (partnership requirements and economics are in the BaaS guide).

What to watch for:

• Concentration on one bank. Evolve stands behind Uber and stood behind Shopify Balance—accounts opened before 2025 are being migrated from Evolve to Fifth Third. A common partner bank becomes a common point of failure, so know which bank your product depends on and whether there's a backup; a bank's enforcement history is checked as carefully as its pricing.
• Where money is insured. FDIC pass-through operates at the partner bank level, within $250K per depositor, and covers bank failure but not intermediary failure. The Synapse collapse (Chapter 11, April 2024) showed how customers lose access to funds when middleware fails—see the "Middleware" section of the BaaS guide.
• Whose customer and whose data. The brand owns the customer relationship but operationally depends on the provider. Migration between banks (as with Shopify and Mercury) is a regular occurrence and is planned for in advance.

Business banking via API follows the same logic—see HEVN.

The Regulatory Perimeter

In the EU the perimeter has hardened. DORA has applied since 17 January 2025 and reaches the technology vendors behind a financial product as well as the license holder, so an embedded-finance stack now carries operational-resilience duties end to end. MiCA's CASP regime has applied since 30 December 2024, giving crypto features a real license to sit under. PSD3 and the PSR are not adopted yet: the ECON committee approved the text agreed in early second-reading negotiations on 5 May 2026, the indicative plenary vote is 14 December 2026, and both files still await the Council's first-reading position. The texts merge the e-money and payment-institution regimes, tighten client-fund safeguarding, and extend fraud-reimbursement duties; the application date depends on the transition period in the final text and is not yet fixed. The Financial Data Access (FIDA) file, still in trilogue, would push open-banking-style access into investments, pensions, and insurance.

In the US there is no single embedded-finance rule. The 2023 interagency guidance on third-party relationships set the supervisory tone, and the 2024 wave of enforcement actions against sponsor banks put it into practice, faulting weak BSA/AML monitoring and thin oversight of fintech partners; the clearest documented case is the Federal Reserve's cease-and-desist of 14 June 2024 against Evolve Bancorp and Evolve Bank & Trust. The Synapse collapse, where the Chapter 11 trustee put the gap between the ledgers and the actual balances at 65–95 million dollars, pushed the FDIC to propose recordkeeping rules for custodial for-benefit-of accounts (proposed rule published 2 October 2024, still not finalised) and made every sponsor bank re-price partner risk. The newer line is the GENIUS Act of July 2025, a federal stablecoin framework under which the OCC began chartering payment-stablecoin issuers: an embedded payment rail that carries its own license.

By 2026 the regulator has moved in two directions at once, and both halves belong to the same "rightsizing". Entry was eased: on 27 February 2026 the OCC published a separate final rule under which, from 1 April 2026, limited-purpose trust banks are expressly permitted to conduct non-fiduciary activities as well, including custody. During 2025 the agency received 14 de novo charter applications — almost as many as in the previous four years combined — and Comptroller Jonathan Gould called it a return to normal. In December 2025 five crypto firms took conditional approvals at once (Ripple, Circle, BitGo, Fidelity Digital Assets and Paxos), and the wave continued in February 2026 with Stripe (Bridge), Protego and Crypto.com. In parallel the demands on those who rent a licence out were raised: in October 2025 the FDIC and the OCC proposed to define "unsafe or unsound practice" and to rein in MRAs. How the American doors are laid out in the first place — state licences, federal charters and the separate crypto regimes — is mapped in US financial and crypto licenses.

The UK runs on principles plus license-by-license supervision. The FCA's Consumer Duty, in force since July 2023, raises the bar on any product reaching a retail customer through a brand; the appointed-representative regime keeps the authorized principal answerable for the firms operating under it; and mandatory APP-fraud reimbursement, live since 7 October 2024, prices fraud back into the payment chain. Safeguarding reform for payment and e-money firms has landed: PS25/12 (7 August 2025) added the CASS 15 supplementary regime, in force since 7 May 2026, while the end-state post-repeal regime is held back for a further consultation. On the appointed-representative side, HM Treasury consulted on 12 February 2026 on a gateway for principals: acting as principal for an AR would require a separate FCA permission, and AR staff would fall under the SMCR, with the feedback window closing on 9 April 2026. The line continues FCA PS22/11 after the Greensill collapse, and the proposal remains a consultation rather than a rule in force.

Insurance shows the same logic in a third vertical. After the Vesttoo collapse in 2023, involving roughly $4 billion of fake letters of credit, regulators require fronting carriers to hold operational control over the programme rather than merely supply the "paper", and have tightened collateral verification. The mechanics of delegated authority and fronting are covered in delegated authority and fronting.

Across all three regions the message is the same: the license holder owns the risk, so the partner supervises the program as if it were its own.

When It's Time for Your Own License

Renting a license buys speed and a low entry barrier, but not forever. As volumes grow the economics and the supervisory load invert: the partner takes a larger revenue share and tightens control, while your own license becomes cheaper per transaction. Thresholds vary by vertical. Card programs are often cited at around several hundred thousand active cards (to be verified for a given BIN sponsor); in payments the move from agent to your own e-money or EMI license is driven by turnover and the wish to control the rails; in funds it arrives when management fees cover the cost of running your own AIFM. The 2025–26 market pushes the same way: after the 2024 consent-order wave and the Synapse collapse the pool of US sponsor banks shrank, and the survivors are pricier and stricter, so larger programs increasingly pursue a direct charter. The GENIUS Act added a parallel path: the OCC approved Paxos's conversion to an OCC trust on 12 December 2025 and gave Circle conditional approval the same month, and Circle announced final OCC approval for First National Digital Currency Bank, N.A. on 10 July 2026.

Jurisdictions

🔗 Related

Singapore — funds · Singapore — payments (PSA) · UAE (ADGM/DIFC) · Offshore (BVI/Cayman) · Malta (cell structures) · Hong Kong

The same models read differently by country. Breakdowns of the licensing and hosting regimes: Singapore — funds, Singapore — payments (PSA), UAE (ADGM/DIFC), Offshore (BVI/Cayman), Malta (cell structures), and Hong Kong.