What Is Banking as a Service (BaaS)? How It Works

Banking as a Service (BaaS) is a model in which a licensed bank exposes its core banking infrastructure — accounts, cards, payments, and compliance functions — through application programming interfaces (APIs), allowing non-bank companies to embed banking products directly into their own apps or platforms without becoming a bank themselves. A software company, marketplace, or app can offer a branded debit card or checking account to its users while a chartered bank behind the scenes actually holds the funds and carries the regulatory responsibility. BaaS is the infrastructure layer behind many of the banking-like features found in fintech apps, payroll platforms, and vertical software products today.

Key Facts

• In a typical BaaS arrangement, a licensed bank holds the banking charter and regulatory responsibility, while the non-bank company (“the platform”) builds the customer-facing product and experience.
• U.S. federal banking regulators — the Federal Reserve, the FDIC, and the OCC — issued a joint statement in July 2024 on risks in bank-fintech arrangements, following a period of enforcement actions against several sponsor banks.
• The 2024 bankruptcy of Synapse, a BaaS middleware provider, left customers unable to access tens of millions of dollars in funds after platform and bank records could not be reconciled, becoming a widely cited cautionary example in the sector.
• BaaS is a subset of the broader “embedded finance” category, which also includes non-bank card issuing, lending, and payments infrastructure that doesn’t necessarily route through a chartered bank.
• Regulatory frameworks differ by region: U.S. arrangements are governed by federal banking-agency guidance on third-party risk, while the EU relies on PSD2, the Electronic Money Institution (EMI) Directive, and related frameworks.

How Banking as a Service Works

A BaaS arrangement typically involves three types of participants, though some arrangements combine roles:

1. The licensed bank (or “sponsor bank”). This is a chartered, regulated institution — insured by the FDIC in the U.S. — that actually holds customer deposits and bears ultimate regulatory responsibility for the banking products offered.
2. The BaaS or middleware provider. Some arrangements include a technology intermediary that connects the bank’s core systems to the platform via APIs, handling ledger management, card issuing rails, and compliance tooling. Not every arrangement has a separate middleware layer — some banks expose APIs directly.
3. The platform (or “distributor”). This is the non-bank company — a fintech app, marketplace, payroll provider, or other software business — that builds the customer-facing product: the app interface, the card design, the onboarding flow, and the marketing.

When an end user opens an account through the platform’s app, the account is typically held at the sponsor bank, often within a pooled “for benefit of” (FBO) account structure that tracks each end user’s individual balance through sub-ledger records maintained by the platform or middleware provider. The platform handles customer support and product experience; the bank is responsible for regulatory compliance, including Bank Secrecy Act and anti-money-laundering (BSA/AML) obligations, even though day-to-day account monitoring is often performed by the fintech partner under the bank’s oversight.

BaaS vs. Embedded Finance vs. Embedded Banking

These terms are related but not interchangeable:

• Banking as a Service specifically refers to regulated banking products — deposit accounts, debit cards, and similar — delivered through a licensed bank’s infrastructure via APIs.
• Embedded finance is the broader category: any financial product offered inside a non-financial experience, which may or may not run through a chartered bank. Card issuing platforms that operate without a bank partner, for example, fall under embedded finance generally rather than BaaS specifically.
• Embedded banking typically refers to bank-grade products delivered inside an app a customer already uses — which can overlap heavily with BaaS depending on how the arrangement is structured.

Regulation and Recent Enforcement

BaaS arrangements exist within an established bank regulatory framework rather than outside it — the non-bank platform does not need its own banking charter, but the sponsor bank’s existing charter and its associated obligations still apply to the arrangement. In June 2023, the Federal Reserve, FDIC, and OCC issued interagency guidance on third-party relationship risk management, stating that using a third party does not reduce a bank’s responsibility to conduct its activities safely and in compliance with applicable law.

Between 2022 and 2025, U.S. federal banking agencies issued consent orders against multiple sponsor banks operating BaaS programs, generally citing deficiencies in BSA/AML compliance and third-party risk management rather than problems with the underlying business model itself. In July 2024, the three agencies followed up with a joint statement specifically addressing risks in banks’ arrangements with third parties to deliver deposit products, alongside a request for public input on bank-fintech partnerships more broadly.

The clearest cautionary example in the sector is Synapse Financial Technologies, a BaaS middleware provider that filed for bankruptcy in April 2024. Discrepancies between Synapse’s ledger records and its partner banks’ records left customers unable to access an estimated tens of millions of dollars in funds for an extended period, and the Consumer Financial Protection Bureau later moved to distribute settlement funds to affected consumers. The episode prompted the FDIC to explore a formal standard-setting body to certify whether banks’ fintech partners meet baseline risk-management standards, and pushed at least one fintech to acquire its own bank charter specifically to eliminate reliance on a middleware layer.

By 2026, the regulatory posture had shifted somewhat: a presidential executive order directed federal regulators to identify and reduce barriers to bank-fintech partnerships, and proposed legislation in Congress sought to have regulators formally study how these partnerships affect community bank health — reflecting an ongoing debate between encouraging innovation and tightening consumer protection.

Why Companies Use BaaS

Non-bank companies typically turn to BaaS to add financial features — branded debit cards, business checking accounts, expense management, or payroll-linked accounts — without pursuing a banking charter themselves, which is a multi-year process with substantial capital and compliance requirements. Reasons cited across the industry include:

• Faster time to market for launching a banking-like feature compared with obtaining a bank charter.
• Lower regulatory overhead for the platform itself, since the sponsor bank carries the primary regulatory relationship.
• Revenue opportunities from interchange fees on card transactions and other financial-product margins.
• Deeper customer engagement, by keeping money movement inside the platform’s own app rather than sending users to a separate bank.

Risks and Considerations

BaaS arrangements carry risks that are distinct from those of a standalone bank or a standalone software company:

• Ledger reconciliation risk. When customer balances are tracked by a platform or middleware provider rather than directly by the bank, discrepancies between records can leave customers unable to access funds if the middleware provider fails — the core failure mode in the Synapse collapse.
• Regulatory concentration on the sponsor bank. Because the chartered bank bears ultimate compliance responsibility regardless of what a partnership contract says, a compliance failure by the fintech partner can still result in a consent order against the bank.
• Program concentration risk. A sponsor bank that derives a large share of its revenue from BaaS partnerships carries added risk if regulators restrict its ability to add new partners, which can disrupt the platforms that depend on it.
• Consumer confusion over deposit insurance. Regulators have flagged concerns about platforms providing inaccurate or unclear information regarding whether and how FDIC insurance applies to funds held through a BaaS arrangement.
• Migration difficulty. If a platform needs to switch sponsor banks — because of a bank failure, contract dispute, or regulatory action — moving accounts and historical transaction data between institutions can take months.

Frequently Asked Questions

Is Banking as a Service the same as a neobank? No. A neobank is typically the customer-facing brand and app that end users interact with, while BaaS is the underlying infrastructure — often provided by a separate chartered bank and possibly a middleware company — that makes the neobank’s banking features possible. Many neobanks rely on a BaaS arrangement rather than holding their own banking charter.

Who is legally responsible if something goes wrong in a BaaS arrangement? Under U.S. interagency guidance, the licensed sponsor bank retains ultimate regulatory responsibility for the safety, soundness, and legal compliance of the banking activity, even when a third party handles day-to-day operations or customer-facing functions.

Is my money FDIC-insured if I use a BaaS-powered app? It depends on the specific structure. Funds are often insured when properly held in an FDIC-insured sponsor bank under compliant “for benefit of” account structures, but insurance can be jeopardized if recordkeeping fails, as seen in the Synapse case. Users should look for clear, specific disclosures from the platform about which bank holds their funds and how deposit insurance applies.

What is the difference between BaaS and embedded finance? BaaS refers specifically to regulated banking products delivered through a licensed bank via APIs. Embedded finance is the broader category, including financial features — such as non-bank card issuing or lending — that may not route through a chartered bank at all.

Why did regulators increase scrutiny of BaaS after 2023? A combination of regional bank failures in spring 2023 and the 2024 collapse of BaaS middleware provider Synapse drew regulatory attention to gaps in ledger reconciliation, third-party risk management, and consumer disclosures within bank-fintech partnerships, leading to a wave of consent orders and joint regulatory guidance.

Disclaimer: This article is for informational purposes only and does not constitute financial, investment, or legal advice. Global Crypto 360 does not endorse any specific platform, bank, or provider mentioned. Always conduct your own research (DYOR) and consult a licensed professional before making financial decisions.