BaaS
Banking as a service (BaaS) is the model in which a licensed institution — a bank, an e-money or payment institution — provides regulated products through APIs (accounts, payments, card issuing, sometimes lending) to companies that offer them under their own brand without holding a licence; a BaaS platform often sits between them. It supplied the licences behind most neobanks and embedded-finance products, and the regulatory actions against several BaaS banks in 2023–2024 showed where its oversight had failed.
- Also known as
- Banking as a service, Banking-as-a-Service, BaaS platform, Sponsor bank model
- Used at
- neobanks and consumer fintechs without their own licence, embedded finance in software and marketplaces, corporate card and expense products, payroll and earned-wage access, crypto on- and off-ramps, and cross-border wallets
- Binding
- the licensed institution is fully responsible to its regulator for every product and customer, whoever the brand is; distributors may need agent or distributor registration (EU EMD/PSD2 agents, UK agents and distributors, US third-party risk-management guidance from the OCC, FDIC and Federal Reserve of 2023); AML, safeguarding, consumer-protection and complaint-handling rules follow the product
- Typical models
- a sponsor bank with direct fintech partnerships (the US model — Evolve, Cross River, Sutton, Lead Bank and others); an EMI or PI offering its licence through APIs (the European model — Solaris, Modulr, Railsr, Treezor, Swan); and middleware platforms (Synapse, Unit, Treasury Prime, Marqeta for cards) that connect fintechs to sponsor banks and, in some cases, hold the ledger
- Typical economics
- the fintech pays set-up and per-account, per-transaction and per-card fees plus a share of interchange; the sponsor earns fees, deposits and float; the platform takes a margin; the fintech's gross margin on payments is thin until scale, which is why the model concentrated in a few providers
- Parties
- the sponsor institution and its regulator, the platform, the fintech brand, the card schemes, and the end customers — whose deposits, in the Synapse collapse of 2024, turned out to be tracked in ledgers nobody could reconcile
How BaaS works in practice
A fintech wants to launch a consumer account with a debit card in six months. It contracts with a BaaS platform that connects it to a sponsor bank: the bank holds the deposits and the licence, the platform provides APIs for onboarding, accounts, payments and cards and runs the ledger, and the fintech builds the app and the brand. The customer's money is in an omnibus account at the bank, allocated to individual customers on the platform's ledger; the card is issued on the bank's BIN; the fintech's KYC uses the bank's approved vendor and standards; and the bank's compliance team oversees the fintech's programme — or is supposed to. Launch in six months, on schedule; the fintech is a regulated agent or programme manager, not a bank, and everything works while the volumes are small.
The strains show at scale and in failure. Sponsor banks that took on dozens of fintech programmes were found by US regulators in 2023–2024 to have inadequate oversight of their partners' AML and consumer practices; consent orders followed; programmes were wound down; fintechs lost their banking partner with months' notice. The Synapse bankruptcy in 2024 left tens of thousands of end customers unable to access funds for months because the middleware's ledger and the banks' records did not reconcile — a failure of the model's plumbing that regulators had not anticipated and that rewrote the rules on ledgers, reconciliation and "for benefit of" accounts. In Europe, EMI-based BaaS providers faced their own supervisory findings on AML and safeguarding. The survivors are those whose oversight of programmes matched their regulator's expectations, and the fintechs that survived their provider's trouble were those with a second one.
For a fintech, BaaS is the fastest way to a regulated product and a dependency whose failure modes are now known; for a buyer of a BaaS-based fintech, the sponsor contract, the reconciliation controls and the sponsor's regulatory standing are the diligence.
Example
A consumer fintech with 400,000 accounts on a single sponsor bank via a middleware platform learns in March that the bank has received a consent order requiring it to exit third-party programmes within nine months. The fintech has no second provider; its customers' deposits are in the bank's omnibus account on the platform's ledger. Migration: a new sponsor is signed in month three after a diligence in which the new bank reviews the fintech's KYC files (finding 6% needing refresh) and its transaction monitoring; card reissuance on a new BIN; a customer-by-customer reconciliation of balances before transfer, in which €180,000 of unexplained differences are found and funded by the fintech; and the move in month eight. Cost €4 million, 9% of customers lost, and a board rule afterwards: two sponsors, the fintech's own reconciliation of every customer balance daily, and a migration plan on file.
Common mistakes
- One sponsor, no second, and a migration plan that does not exist. - Trusting the platform's ledger without the fintech's own daily reconciliation to the bank. - Fintechs treating compliance as the sponsor's job; the sponsor's regulator treats it as both. - Sponsors taking on programmes faster than their oversight can cover. - Buying a BaaS-based fintech without reading the sponsor contract and the sponsor's regulatory file.