Banking-as-a-Service Explained for Consumers and Entrepreneurs in the US
How embedded bank accounts, cards, payments, and lending work — plus the protections, risks, costs, and due-diligence questions that matter
1. Banking-as-a-Service in One Minute
Banking-as-a-Service (BaaS) is a business model in which a regulated bank provides banking capabilities, such as deposit accounts, debit cards, payments, or lending, through the technology and customer experience of another company. The customer may see the fintech, marketplace, payroll platform, or software brand, while the underlying bank holds the account, issues the card, or originates the loan.
Key takeaway: BaaS does not turn a software company into a bank. It connects a nonbank’s product to a chartered bank and other infrastructure providers. The legal rights, deposit insurance, dispute process, fees, and customer support responsibilities depend on the actual contracts and account structure.
| Question | Plain-English answer |
|---|---|
| Is a fintech app a bank? | Usually no. It may provide the app and support while a partner bank provides the regulated account or loan. |
| Is money automatically FDIC-insured? | No. Eligible deposits at an FDIC-insured bank may be insured, but pass-through coverage requires specific conditions and accurate records. |
| Who regulates the arrangement? | The bank’s federal or state regulator, the FDIC, consumer-finance regulators, state agencies, and other authorities may all have roles. |
| Why do businesses use BaaS? | To launch financial features faster than obtaining a bank charter and building all banking infrastructure internally. |
| What is the biggest practical risk? | A multi-party failure can create frozen funds, confusing support, reconciliation gaps, compliance problems, or a forced product migration. |
2. What Is Banking-as-a-Service?
Banking-as-a-Service is the delivery of regulated banking products through another company’s interface using contractual partnerships, application programming interfaces (APIs), compliance processes, and operational infrastructure. The term is commonly used when a bank makes its charter and banking capabilities available to a fintech or other business that distributes the product to end users.
A BaaS program may support one feature—such as issuing debit cards—or a broader stack that includes account opening, identity verification, ledgers, ACH transfers, wires, card processing, fraud tools, statements, customer support, and regulatory reporting.
2.1 A simple example
Imagine a small-business accounting platform that adds a branded checking account. The platform designs the app, connects transaction data to bookkeeping tools, and markets the product. A partner bank legally opens and holds the deposit account. A card network and processor move debit-card transactions. Other vendors may verify identity, screen sanctions lists, monitor fraud, and provide customer service software.
Important: The brand visible on the screen is not necessarily the institution holding the customer’s money. Consumers should identify the partner bank in the account agreement and verify that institution through official FDIC resources.
2.2 What products can BaaS support?
- Demand deposit or transaction accounts for consumers or businesses
- Savings features and subaccounts, subject to the product structure
- Debit, prepaid, virtual, or commercial cards
- ACH transfers, direct deposit, bill payment, wires, and real-time payments
- Expense management, payroll, treasury, or marketplace payouts
- Credit products, including cards, lines of credit, installment loans, or merchant financing
- Identity verification, account verification, fraud monitoring, and compliance workflows
3. How the BaaS Ecosystem Works
| Participant | Typical role | What the customer may notice |
|---|---|---|
| Sponsor or partner bank | Holds deposits, issues cards, originates credit, and remains responsible for applicable banking laws and risk management. | Bank name in account agreement, card disclosure, statement, or FDIC language. |
| Fintech or brand | Designs the user experience, markets the product, integrates APIs, and may provide first-line support. | The app, website, branding, pricing, and customer service. |
| BaaS platform or middleware | Connects the bank and brand; may provide ledgers, APIs, onboarding, compliance tooling, or program management. | Often invisible to the end user. |
| Core processor / payment processor | Posts transactions, maintains system records, and connects to payment rails or card networks. | Transaction timing, card authorization, settlement, and statements. |
| Specialist vendors | Identity, AML screening, fraud, disputes, data, cloud, call center, and other services. | Verification steps, alerts, holds, or support interactions. |
| End user | Uses the account, card, payment, or credit feature and agrees to governing terms. | The person or business whose money and data move through the system. |
3.1 The typical transaction flow
- The user applies through the fintech’s app or website.
- The program collects identity, business, and risk information.
- The bank or its authorized service providers perform required verification and underwriting.
- If approved, the bank opens the account or originates the credit product under program terms.
- The fintech displays balances and controls through its interface, while records are maintained across one or more systems.
- Payment rails, processors, and networks move funds and return transaction data.
- The bank and program partners monitor activity, handle disputes, reconcile records, and report as required.
4. BaaS Versus Related Financial-Technology Models
| Model | What it means | How it differs from BaaS |
|---|---|---|
| Embedded finance | Financial services placed inside a nonfinancial customer journey, such as insurance at checkout or a wallet inside a marketplace. | BaaS can be the regulated infrastructure behind embedded finance, but embedded finance is the broader customer-experience concept. |
| Open banking | Permissioned sharing of financial data—and sometimes payment initiation—between institutions and third parties. | Open banking connects to an existing account; BaaS may create and operate a new account or product through a partner bank. |
| Neobank | A digital-first financial brand that often has no bank charter and partners with one or more banks. | A neobank is a customer-facing business model; BaaS is the infrastructure and partnership model that may power it. |
| Payment processor | A company that facilitates card or electronic payments. | Processing is one component; BaaS may also include deposits, cards, compliance, ledgers, and bank sponsorship. |
| Core banking software | The system a bank uses to maintain accounts and transaction records. | Core software serves the bank; BaaS packages bank access and capabilities for external brands. |
| Bank charter | Government authorization to operate as a bank under applicable law. | Using BaaS does not give the fintech a charter or transfer the bank’s legal status. |
5. What BaaS Means for Consumers
For consumers, BaaS can make financial services easier to access and integrate into everyday apps. It can also make the service chain harder to understand. Before placing significant funds in an app, identify who holds the money, what protections apply, and how to get help when something goes wrong.
5.1 Potential consumer benefits
- Fast digital onboarding and fewer branch visits
- Financial tools integrated with payroll, shopping, freelancing, investing, or budgeting
- Lower or more transparent fees in some programs
- Real-time alerts, virtual cards, spending controls, and automated savings features
- Products designed for a specific group, occupation, or use case
5.2 Consumer risks and limitations
- Confusion about which company is the bank and which company is only the interface
- Delays when records held by the fintech, processor, and bank do not match
- Account holds or closures triggered by fraud, identity, sanctions, or compliance reviews
- Customer-service handoffs between multiple companies
- Program shutdowns or migrations that require new accounts, cards, or routing numbers
- Data-sharing and cybersecurity exposure across a larger vendor chain
- Unclear or conditional deposit-insurance eligibility
5.3 FDIC insurance: the most misunderstood issue
The FDIC insures deposits at insured banks, generally up to at least $250,000 per depositor, per insured bank, for each ownership category. A fintech itself is not FDIC-insured unless it is actually a chartered, insured bank. In many BaaS programs, customer funds are placed in a custodial or pooled account at a partner bank and may qualify for “pass-through” insurance to the end customer if regulatory requirements are satisfied.
Pass-through coverage is not based on marketing language alone. Among other conditions, the bank’s records or records maintained by an authorized party must disclose the agency or custodial relationship and identify the actual owners and their interests. Coverage also depends on the type of funds, ownership category, aggregation with the customer’s other deposits at the same bank, and the accuracy and accessibility of records.
Consumer check: Find the exact partner bank name, confirm it is FDIC-insured, read whether coverage is direct or pass-through, and add together all deposits you own at that same bank in the same ownership category—even if they appear in different apps.
5.4 Your electronic-transfer rights
Consumer electronic transfers are commonly governed by the Electronic Fund Transfer Act and Regulation E. Depending on the product, these rules may require disclosures, periodic statements or account histories, limits on liability for unauthorized transfers, and error-resolution procedures. Timing matters: consumers generally should report unauthorized transfers immediately and review statements promptly. Regulation E includes a 60-day reporting deadline tied to the first statement showing certain errors, while shorter timelines can affect liability for a lost or stolen access device.
Business accounts generally do not receive the same Regulation E protections as consumer accounts. Business users should negotiate security procedures, alert settings, approval controls, and responsibility for fraudulent transfers in the account agreement.
5.5 Consumer due-diligence checklist
| Check | What to verify |
|---|---|
| Legal provider | Who is the bank? Is the bank name in the deposit or card agreement? |
| Insurance | Are funds eligible for FDIC insurance, and under what conditions? |
| Fees | Monthly, ATM, overdraft, transfer, foreign transaction, instant withdrawal, inactivity, and card replacement fees. |
| Access | Daily limits, cash withdrawal options, transfer holds, and what happens during an outage. |
| Disputes | Where and how to report fraud or errors; applicable deadlines. |
| Account closure | How remaining funds are returned and how long that process may take. |
| Data | What information is shared among the bank, fintech, processors, and other vendors. |
| Support | Which company handles routine questions, disputes, legal notices, and escalations. |
6. What BaaS Means for Entrepreneurs
BaaS can let a startup, software company, marketplace, or established brand add financial products without becoming a bank. The opportunity is significant—but so are the obligations. A successful program is not merely an API integration. It is a regulated operating model that needs governance, compliance, reconciliation, consumer protection, security, capital, and a credible exit plan.
6.1 When BaaS may make strategic sense
- The financial feature solves a frequent, high-value customer problem
- The company has a trusted distribution channel and can acquire users efficiently
- Banking data improves an existing workflow, such as accounting, payroll, procurement, or marketplace operations
- The business can fund compliance, operations, disputes, fraud losses, reserves, and audits
- The product has enough transaction volume or revenue potential to justify fixed program costs
- Leadership accepts that the partner bank can require changes, restrict activity, or terminate the program
6.2 When BaaS may be the wrong choice
- The feature is mainly cosmetic and does not improve retention, revenue, or customer outcomes
- The company cannot identify a clear regulated product owner
- The plan assumes the bank will handle all compliance and customer complaints
- Unit economics require unusually high interchange, float, or overdraft revenue
- The target market has high fraud or AML risk without adequate controls
- The business lacks funds for a lengthy implementation or partner migration
6.3 BaaS operating models
| Model | Advantages | Trade-offs |
|---|---|---|
| Direct bank partnership | Closer bank relationship, more control, potentially clearer accountability. | Longer diligence, heavier integration, more internal compliance and operations. |
| BaaS middleware platform | Faster integration, packaged APIs, broader operational tooling. | Additional dependency, fees, and potential distance from the sponsor bank. |
| Program manager model | Outsourced operational expertise and established processes. | Less direct control; responsibilities must be carefully documented. |
| Multiple-bank architecture | Redundancy, product specialization, and potential capacity benefits. | More complex reconciliation, compliance, contracts, and customer disclosures. |
| Acquire or obtain a charter | Maximum long-term control for qualified firms. | Extremely high capital, regulatory, governance, staffing, and time requirements. |
7. BaaS Costs, Revenue Models, and Unit Economics
Pricing varies widely by product, risk profile, volume, bank, vendor stack, and negotiated responsibilities. Entrepreneurs should model total program cost rather than relying on a single “per active account” quote.
7.1 Common cost categories
| Cost category | Examples | Why it can surprise founders |
|---|---|---|
| Implementation | Bank diligence, legal work, integration, testing, certification, project management. | Work expands when product design or compliance requirements change. |
| Platform and account fees | Monthly minimums, per-account, per-transaction, API, ledger, statement, and reporting fees. | Minimum commitments can exceed early revenue. |
| Card costs | Manufacturing, personalization, shipping, tokenization, processor, network, and dispute fees. | Physical cards and fraud can make low-activity accounts unprofitable. |
| Payments | ACH, wire, RTP/FedNow, returns, reversals, chargebacks, and exception handling. | Failures and returns often cost more than successful transactions. |
| Compliance | KYC/KYB, sanctions, monitoring, case management, audits, licensing analysis, and staff. | High-risk customers require more review and manual operations. |
| Fraud and credit | Fraud losses, reserves, chargebacks, credit losses, collections, and insurance. | Losses can grow faster than volume during scaling. |
| Support and disputes | Agents, escalation, complaints, error resolution, refunds, and quality assurance. | Regulated timelines and complex cases create staffing peaks. |
| Exit and migration | Data transfer, reissuance, customer notices, replacement accounts, and dormant balances. | A partner change can become a major operational project. |
7.2 Common revenue sources
- Interchange share from card purchases
- Subscription or software fees tied to the broader product
- Payment, instant-transfer, or premium-service fees where legally permitted and clearly disclosed
- Net interest or deposit-related revenue sharing, depending on the arrangement
- Credit interest and fees, subject to lending laws, underwriting, and bank economics
- Increased retention, conversion, or customer lifetime value in the core business
Expert insight: Treat interchange and interest-related revenue as variable, not guaranteed. Network rules, regulation, customer behavior, fraud, bank pricing, and interest rates can change the economics. A durable model usually creates value beyond the financial product itself.
7.3 A practical unit-economics formula
Monthly contribution per active customer = interchange share + subscription revenue + payment/other revenue + allocated deposit or credit revenue − platform fees − payment and card costs − fraud and credit losses − support and compliance cost − incentives.
Run base, downside, and severe-stress cases. Include lower activation, lower card spend, higher fraud, higher support contacts, partner repricing, reserve requirements, and migration costs.
8. U.S. Regulation and Legal Responsibilities
There is no single federal “BaaS license.” Instead, the arrangement sits inside existing banking, payments, consumer-protection, privacy, anti-money-laundering, lending, and state-law frameworks. The exact obligations depend on the product and who performs each function.
8.1 Bank supervision and third-party risk
Federal banking agencies have emphasized that using third parties does not remove a bank’s responsibility to operate safely, comply with law, and protect customers. Interagency guidance describes a third-party risk-management life cycle that includes planning, due diligence, contract negotiation, ongoing monitoring, and termination. Regulators have also highlighted risks in third-party deposit arrangements, including inaccurate records, rapid growth, concentration, liquidity, compliance, fraud, cybersecurity, and customer confusion.
8.2 Major legal and regulatory areas
| Area | Why it matters in BaaS |
|---|---|
| Deposit insurance and advertising | Claims must accurately describe the insured bank and conditions for coverage; pooled accounts require reliable ownership records. |
| Electronic Fund Transfer Act / Regulation E | Consumer disclosures, unauthorized-transfer liability, and error-resolution rules may apply. |
| Truth in Lending Act / Regulation Z | Credit pricing, APR disclosures, billing errors, advertising, and other lending rules may apply. |
| Equal Credit Opportunity Act / Regulation B | Credit decisions and marketing must avoid prohibited discrimination and meet notice requirements. |
| Fair Credit Reporting Act | Use of consumer reports, adverse action, identity theft, and data furnishing can create obligations. |
| Bank Secrecy Act / AML / sanctions | Customer identification, due diligence, monitoring, suspicious-activity processes, and sanctions controls are central. |
| UDAAP / UDAP | Unfair, deceptive, or abusive acts and practices can arise from marketing, fees, holds, closures, disputes, or support failures. |
| Gramm-Leach-Bliley Act | Privacy notices, information sharing, and safeguards for customer information may apply. |
| State money-transmission and lending laws | A nonbank may need licenses depending on funds flow, control, product design, and activities. |
| State privacy and data-breach laws | Consumer rights and notification duties can vary by state. |
| Card-network and payment-rail rules | Operating rules, dispute procedures, fraud controls, and technical standards are contractually binding. |
8.3 The bank–fintech responsibility matrix
Contracts should assign every material task, but allocation does not eliminate legal responsibility. A strong responsibility matrix identifies who owns, performs, approves, monitors, and evidences each control. It should cover onboarding, KYC/KYB, sanctions, transaction monitoring, fraud, complaints, disputes, disclosures, marketing approval, change management, data retention, regulatory reporting, reconciliation, incident response, and account closure.
Legal warning: Do not assume that operating “under the bank’s license” automatically eliminates state licensing, consumer-law, privacy, or money-transmission exposure for the nonbank. Obtain product-specific legal analysis before launch and whenever funds flow or features change.
9. Risk Management, Security, and Operational Resilience
9.1 The major BaaS risk categories
| Risk | Example | Core mitigation |
|---|---|---|
| Operational | A processor outage prevents card authorizations or balance updates. | Redundancy, service-level metrics, incident playbooks, and tested recovery. |
| Reconciliation | The app ledger, processor, and bank records disagree. | Daily multi-way reconciliation, exception ownership, aging limits, and audit trails. |
| Compliance | Disclosures, monitoring, or disputes do not meet legal requirements. | Control mapping, bank approval, testing, training, and independent review. |
| Fraud | Synthetic identities, account takeover, scams, or first-party fraud create losses. | Layered identity, behavioral controls, velocity rules, alerts, and human review. |
| Liquidity / funding | Rapid deposit movement or settlement obligations strain the bank or program. | Forecasting, concentration limits, settlement controls, and contingency plans. |
| Cybersecurity | A vendor breach exposes customer information or credentials. | Security assessments, least privilege, encryption, monitoring, and incident response. |
| Third-party concentration | The program depends on one bank, processor, or critical vendor. | Portability, alternative providers, termination rights, and tested migration plans. |
| Consumer harm | Customers cannot access funds or obtain timely support. | Clear ownership, escalation paths, staffing, complaint analytics, and closure procedures. |
| Model risk | Automated fraud or credit models produce inaccurate or biased outcomes. | Validation, explainability, monitoring, overrides, and fair-lending testing. |
9.2 Security practices entrepreneurs should require
- Multi-factor authentication for customers and administrators
- Role-based access, least privilege, and regular access reviews
- Encryption in transit and at rest, with sound key management
- Secure software development, code review, vulnerability testing, and patching
- Centralized logs and monitoring for suspicious activity
- Independent penetration tests and vendor security assessments
- Data minimization, retention schedules, and secure deletion
- Tested incident-response and customer-notification procedures
- Business continuity plans that include bank and processor outages
- Controls for privileged actions, manual adjustments, and customer refunds
9.3 Reconciliation is a safety control, not bookkeeping
In a BaaS stack, balances may be represented in the fintech interface, middleware ledger, processor, card network, payment rail, and bank core. Differences can result from timing, duplicate messages, reversals, returns, file failures, manual adjustments, or software defects. Programs should reconcile cash and customer-level balances at least daily, investigate exceptions promptly, restrict unresolved manual adjustments, and preserve a complete audit trail.
10. How to Choose a BaaS Bank or Platform
Entrepreneurs should evaluate the bank and technology stack as long-term regulated partners, not interchangeable software vendors. The cheapest proposal may be the most expensive if it lacks operating capacity, reliable records, or a workable exit process.
10.1 Due-diligence questions
| Category | Questions to ask |
|---|---|
| Bank relationship | Who is the sponsor bank? Will you have direct access to bank decision-makers? What products and customer segments are approved? |
| Regulatory history | Has the bank or platform faced public enforcement, growth restrictions, or material audit findings relevant to the program? |
| Responsibilities | Who performs each compliance, fraud, dispute, support, reconciliation, and reporting task? Who is accountable when a vendor performs it? |
| Ledger and records | Which system is the system of record? Can ownership records support timely deposit-insurance determination? How are exceptions reconciled? |
| Economics | What are implementation fees, minimums, reserves, pass-through costs, repricing rights, and loss allocations? |
| Technology | API reliability, change control, sandbox quality, webhooks, idempotency, reporting, and data-export capability. |
| Risk controls | Customer limits, prohibited activities, monitoring, fraud tooling, model governance, and escalation procedures. |
| Support | Service levels, after-hours coverage, complaint handling, regulatory deadlines, and executive escalation. |
| Termination | Notice periods, transition assistance, data ownership, account portability, card reissuance, customer communications, and wind-down costs. |
| Resilience | Critical subcontractors, concentration risk, business continuity, disaster recovery tests, and alternative-bank strategy. |
10.2 A weighted partner scorecard
| Criterion | Suggested weight | What “strong” looks like |
|---|---|---|
| Regulatory and compliance capability | 25% | Clear governance, experienced staff, documented controls, credible audit and testing. |
| Operational reliability and reconciliation | 20% | Accurate records, transparent exceptions, tested processes, strong service metrics. |
| Bank relationship and product fit | 15% | Direct engagement, aligned risk appetite, realistic approval and change process. |
| Technology and data portability | 15% | Stable APIs, full reporting, exportable data, disciplined releases. |
| Economics and scalability | 10% | Transparent pricing, reasonable minimums, sustainable costs at several volume levels. |
| Security and resilience | 10% | Mature security program, incident response, recovery testing, vendor oversight. |
| Exit and migration readiness | 5% | Contractual assistance, usable data, practical transition plan. |
11. Step-by-Step BaaS Implementation Roadmap
- Define the customer problem. Start with the workflow and customer outcome, not a list of banking features.
- Map the regulated product. Identify deposits, payments, cards, credit, money movement, and data flows.
- Build a legal and licensing analysis. Determine federal and state requirements for every party and activity.
- Design the operating model. Assign control ownership, staffing, governance, complaints, disputes, fraud, and reconciliation.
- Create realistic economics. Include all vendor, bank, compliance, support, loss, reserve, and migration costs.
- Run partner diligence. Evaluate the bank, platform, processors, critical vendors, subcontractors, and regulatory capacity.
- Negotiate contracts and exit rights. Align service levels, audit rights, data access, indemnities, change control, and termination.
- Build and test. Test happy paths, errors, reversals, returns, outages, fraud, disclosures, accessibility, and record accuracy.
- Complete bank approval and readiness reviews. Marketing, procedures, training, models, vendors, and controls usually require approval.
- Launch gradually. Use limits and controlled cohorts; monitor customer harm, fraud, exceptions, complaints, and reconciliation.
- Operate continuous oversight. Review metrics, incidents, regulatory changes, vendors, models, and customer outcomes.
- Maintain a migration and wind-down plan. Assume a critical partner may leave and test how records, funds, and communications would move.
12. Common BaaS Mistakes—and How to Avoid Them
| Mistake | Why it fails | Better practice |
|---|---|---|
| Treating BaaS as a plug-in API | Regulated operations extend far beyond software integration. | Fund compliance, operations, support, reconciliation, and governance before launch. |
| Using vague FDIC language | Customers may misunderstand who is insured and when coverage applies. | Name the bank and explain conditions accurately and consistently. |
| No direct bank relationship | Critical decisions and escalations become slow or distorted. | Establish governance and direct access to the sponsor bank. |
| Weak reconciliation | Balance discrepancies can become customer harm and insurance-record problems. | Automate daily reconciliation with owned, time-bound exception handling. |
| Overreliance on one vendor | A termination or outage can stop the product. | Design portability, export data, and maintain a tested contingency plan. |
| Ignoring business-account fraud exposure | Business users may have fewer statutory protections than consumers. | Use dual approval, limits, alerts, positive pay, and strong security procedures. |
| Scaling before controls mature | Fraud, complaints, and manual work grow nonlinearly. | Use staged growth gates tied to operational and risk metrics. |
| Assuming the bank owns every complaint | The fintech often controls the interface and first contact. | Create shared procedures, deadlines, escalation, root-cause analysis, and quality testing. |
| No closure or refund process | Customers can lose access to essential funds during termination. | Document timelines, communication, checks/ACH refunds, dormant funds, and exceptions. |
13. The Future of BaaS in the United States
BaaS is likely to remain an important distribution model, but the market is becoming more disciplined. Banks and regulators are focusing more intensely on third-party deposit records, rapid growth, liquidity, consumer harm, subcontractors, and the ability to monitor programs in real time. Platforms that cannot demonstrate accurate records, clear control ownership, strong risk management, and orderly termination will face increasing pressure.
The strongest long-term models are likely to combine direct bank governance, transparent customer disclosures, robust ledgers and reconciliation, product-specific compliance, and a business model that creates value beyond interchange or deposit revenue. Embedded finance will continue to expand, but successful programs will look less like “renting a charter” and more like operating a jointly governed financial institution capability.
Strategic conclusion: BaaS can shorten the path to market, but it does not shorten the path to responsibility. The winning advantage is not merely access to banking APIs; it is the ability to operate a compliant, resilient, customer-centered program over many years.
14. Frequently Asked Questions
14.1 Is Banking-as-a-Service legal in the US?
Yes, bank–fintech partnerships can be lawful, but each activity must comply with applicable banking, consumer, payments, privacy, AML, and state laws. There is no single BaaS license.
14.2 Is BaaS the same as a bank?
No. BaaS is a partnership and technology model. The regulated bank remains the bank; the nonbank typically provides the customer experience or specialized service.
14.3 Are all BaaS accounts FDIC-insured?
No. Eligible deposits held at an FDIC-insured bank may be insured. Pooled or custodial arrangements may depend on pass-through requirements, accurate ownership records, and aggregation with other deposits at the same bank.
14.4 How can I find the partner bank behind an app?
Read the deposit account agreement, cardholder agreement, disclosures, and website footer. Then verify the bank through official FDIC tools. Do not rely only on an app-store description or marketing page.
14.5 What happens if the fintech fails?
The result depends on the structure. Customer deposits held at a bank do not become the fintech’s corporate assets, but access can still be delayed if records, reconciliation, support, or system access fail. Deposit insurance protects against failure of the insured bank, not every operational failure of a fintech.
14.6 What happens if the partner bank fails?
The FDIC resolves the insured bank. Eligible insured deposits are protected within applicable limits and ownership categories. Accurate records are especially important in pass-through arrangements.
14.7 Can a startup offer checking accounts without a bank charter?
A startup may market and service a deposit product through a partner bank, but the bank opens and holds the account. The startup must not misrepresent itself as a bank and may have independent legal obligations.
14.8 How long does a BaaS launch take?
Timelines vary. A narrow card or account program can still require months of diligence, contracts, product design, compliance procedures, integration, testing, bank approval, and operational readiness. Complex lending or multi-state products can take longer.
14.9 How much does BaaS cost?
There is no standard price. Costs often include implementation, monthly minimums, account and transaction fees, card and payment costs, compliance vendors, staff, fraud losses, reserves, audits, support, and exit costs.
14.10 Does the bank handle all KYC and AML work?
Not necessarily. The bank remains responsible for its legal obligations, but contracts may require the fintech or vendors to collect information, run checks, monitor transactions, investigate alerts, or maintain evidence under bank oversight.
14.11 Does a BaaS company need money-transmitter licenses?
Possibly. It depends on funds flow, control, contractual roles, exemptions, and state law. A bank partnership does not automatically remove licensing requirements.
14.12 Can BaaS be used for lending?
Yes. A bank may originate credit distributed through a fintech. Lending programs require careful attention to underwriting, disclosures, fair lending, servicing, collections, credit reporting, state law, and the true-lender or bank-partnership structure.
14.13 What is a sponsor bank?
A sponsor bank is the chartered institution that provides the regulated banking product or access to payment systems for a program. Its exact role varies by product.
14.14 What is a pooled account?
A pooled or custodial account holds funds beneficially owned by multiple end customers. Detailed records outside the bank core may be needed to identify each customer’s balance and support pass-through insurance.
14.15 What should consumers do before keeping a large balance in a fintech app?
Identify the bank, verify insurance status, understand pass-through conditions and aggregation, review withdrawal limits and support, enable security controls, and avoid keeping more operational cash than necessary in an untested product.
14.16 What is the biggest BaaS risk for founders?
Building a high-growth customer product on a partner and control environment that cannot scale. Operational, compliance, fraud, or reconciliation failures can lead to losses, customer harm, regulatory action, or termination.
14.17 Can a BaaS partner terminate the program?
Yes, subject to contract. Banks can change risk appetite, require remediation, restrict growth, or terminate. Founders need clear notice, transition support, data access, customer communication, and wind-down provisions.
14.18 How is BaaS taxed?
There is no special BaaS tax regime. Companies may have federal, state, and local tax obligations related to service revenue, interest, fees, incentives, payroll, and business structure. Customers may receive tax forms for interest or other reportable income. Consult a qualified tax adviser.
15. Actionable Takeaways
- Consumers: identify the partner bank and read the actual account agreement before relying on insurance claims.
- Consumers: report fraud or transfer errors immediately and preserve screenshots, statements, and support records.
- Entrepreneurs: treat BaaS as a regulated operating program, not a shortcut around banking obligations.
- Entrepreneurs: make reconciliation, customer support, complaints, and migration readiness board-level concerns.
- Both: understand that a strong app experience does not by itself prove the safety, insurance status, or resilience of the underlying arrangement.
Sources Consulted and Checked
These sources were consulted and checked while preparing this document to support accuracy and further verification:
- Federal Reserve, FDIC, and OCC: Interagency Guidance on Third-Party Relationships: Risk Management (2023).
- Federal Reserve, FDIC, and OCC: Joint Statement on Banks’ Arrangements with Third Parties to Deliver Bank Deposit Products and Services (July 25, 2024).
- FDIC: Banking With Third-Party Apps (May 31, 2024).
- FDIC: Pass-through Deposit Insurance Coverage guidance and Deposit Insurance FAQs.
- Electronic Code of Federal Regulations: 12 CFR Part 1005, Regulation E, including unauthorized-transfer liability and error-resolution procedures.
- Federal Trade Commission: Gramm-Leach-Bliley Act resources and the Safeguards Rule guidance.
- Financial Crimes Enforcement Network: Bank Secrecy Act, Customer Due Diligence, and Money Services Business registration resources.
- Consumer Financial Protection Bureau: Research and consumer advisories regarding deposit-insurance coverage for funds stored through payment apps.
- Office of the Comptroller of the Currency: Financial technology and third-party relationship bulletins and resources.
Reader Advice
This article is provided for educational and informational purposes only. It is not personalized legal, tax, compliance, investment, banking, or financial advice, and it does not replace guidance from a qualified professional familiar with your circumstances. Banking-as-a-Service structures, product terms, fees, deposit-insurance eligibility, legal duties, regulatory expectations, and statistics can change over time and may vary by state, institution, product, and account arrangement. Before making a financial or business decision, verify current information through official regulators, the relevant partner bank, governing agreements, and other authoritative sources. Consumers and businesses should also consider operational, fraud, cybersecurity, liquidity, account-access, licensing, and partner-termination risks and seek appropriate professional advice where needed.