Concept
All license rental models—BaaS, sponsor bank, appointed representative, host AIFM, fronting, white-label CASP—rest on one principle: you can outsource activity, but not accountability. It remains with the license holder. This is the established position of regulators: US interagency guidance (the bank is responsible for the fintech), DORA in the EU (accountability on financial institutions), FCA (principal is responsible for AR), NAIC (insurer for MGA programs).
Hence the practical conclusion: whoever "rents out" the license is obliged to actually control the party to whom they rent it. Where control was outsourced along with the activity—that's where failures occurred.
🍓 The regulator will always find the license holder. Therefore, a serious partner does not "sell access," but embeds control—and transfers part of the requirements to those who work under it.
What the Failures Taught
Synapse (2024), Greensill and Vesttoo (2023)—different industries, one story: a shell with a license transferred not only activity but also control to the outside. Reconciliation, oversight of secondees, verification of collateral ended up with those who bore no accountability. Regulators responded by tightening precisely the control perimeter.
USA: From Rental to Ownership
The OCC published an NPR on national bank chartering (January 2026), and as of April 1, 2026, a rule came into force clarifying that limited-purpose trust banks may conduct non-fiduciary activities. Against this backdrop, in 2025 the OCC received 14 de novo charter applications—almost as many as in the previous four years combined; in December 2025, five crypto companies (Ripple, Circle, BitGo, Fidelity Digital Assets, Paxos) received conditional approvals. In parallel, the FDIC and OCC proposed (October 2025) to define "unsafe or unsound practice" and unify supervisory remarks—this is "rightsizing."
The vector is clear: direct charter is becoming more accessible, and for mature fintechs, rental is giving way to ownership. On partner banks themselves—see the US sponsor banks overview and BaaS and sponsor banks; on lending under someone else's license—see rent-a-bank and true lender.
EU: Integration and Direct Access
On April 23, 2026, the EU Council published the final compromise texts of PSD3 and PSR. Key point: the neobank regime is merged into PI (the separate E-money Directive is abolished, reauthorization will be required), and neobanks gain direct access rights to payment systems—TARGET2 and instant payments—on par with banks, which reduces dependence on sponsor banks. Application—approximately 21 months after publication. Operational resilience and ICT risks of third parties are regulated by DORA (in force since January 17, 2025) with EU oversight of critical ICT third-party providers. What this means for the agency model—see payment agents.
United Kingdom: Gateway for Principals
HM Treasury in 2026 is consulting on a gateway: to be a principal for an AR, a separate FCA authorization will be required, and AR personnel will fall under SMCR. This continues the PS22/11 line after the Greensill collapse. Details—see appointed representative and fund hosting.
Insurance: Control Instead of "Paper"
After Vesttoo (2023, approximately $4 billion in fake letters of credit), regulators require fronting carriers to have operational control over the program, not just provide "paper," and have tightened collateral verification. The mechanics of MGA and fronting are covered in delegated authority and fronting.
What This Means for Builders
- Rental is becoming more expensive and supervised. The partner will demand more control and compliance than a year or two ago.
- Choose someone who actually controls, not "sells access." Their resilience is your resilience.
- Plan your trajectory. At scale, your own license or charter is often cheaper and more reliable than rental. The overall map of models—see embedded finance.
Applicable Regulation
USA: 2023 interagency guidance and OCC chartering (OCC, NPR on chartering, FDIC, rightsizing regulation). EU: PSD3/PSR (Freshfields, PSD3/PSR) and DORA. UK: FCA PS22/11 and HM Treasury consultation. Insurance: NAIC.
Q/A
Can accountability be fully transferred to the license holder? No. Activity is outsourced, accountability is not; part of the requirements always returns to those who work under the license.
Why are regulators simultaneously opening charter and tightening oversight? These are two sides of "rightsizing": simplify entry for mature players and simultaneously raise the bar for control over partnerships.
What does direct PI access to payment systems in the EU change? Dependence on sponsor banks decreases—a neobank will be able to participate in systems directly.
This material is prepared as an expert overview and does not constitute individual legal advice.
FAQ
What does direct PI access to payment systems in the EU change?
Dependence on sponsor banks decreases—a neobank will be able to participate in systems directly.
This material is prepared as an expert overview and does not constitute individual legal advice.
Key factual claims
- Synapse (2024), Greensill and Vesttoo (2023)—different industries, one story: a shell with a license transferred not only activity but also control to the outside.
- The OCC published an NPR on national bank chartering (January 2026), and as of April 1, 2026, a rule came into force clarifying that limited-purpose trust banks may conduct non-fiduciary activities.
- On April 23, 2026, the EU Council published the final compromise texts of PSD3 and PSR.
- HM Treasury in 2026 is consulting on a gateway: to be a principal for an AR, a separate FCA authorization will be required, and AR personnel will fall under SMCR.
- After Vesttoo (2023, approximately $4 billion in fake letters of credit), regulators require fronting carriers to have operational control over the program, not just provide "paper," and have tightened collateral verification.
- USA: 2023 interagency guidance and OCC chartering (OCC, NPR on chartering, FDIC, rightsizing regulation).