Banking-as-a-Service
What is Banking-as-a-Service?
Banking-as-a-Service (BaaS) is a model in which a licensed bank supplies its infrastructure, license coverage and compliance controls to third-party companies through APIs, letting them offer accounts, cards, transfers and lending under their own brand. The bank stays the regulated entity, while the partner owns the product and the customer relationship.
BaaS exists because a banking license is slow and expensive to obtain, and a core banking system is slow to build. A software platform that wants to pay out to its sellers, or a retailer that wants to issue a branded card, can reach the market through a partner bank instead of applying for its own authorization. The partner integrates the bank's APIs; the bank keeps the ledger, holds client funds and answers to the regulator.
Key facts
- Also called: embedded banking or white-label banking. BaaS is the supply layer behind most embedded finance products.
- Who provides it: licensed banks and, in Europe, licensed e-money and payment institutions.
- Who uses it: fintechs, vertical software platforms, marketplaces, retailers and digital-first banks.
- Typical services: deposit accounts and IBANs, debit and prepaid card issuing, , wire and SEPA transfers, lending, plus and screening.
- Who holds the license: the bank, always. The partner operates under the bank's permissions as an agent or distributor.
- Commercial models: revenue share on interchange and interest, a monthly platform fee, per-transaction pricing, or a mix of the three.
How it works
- The brand picks a partner bank. It contracts with a licensed bank directly, or with a BaaS platform (middleware) that has already connected to one or more banks and wraps their systems in a single API.
- The brand builds on the API. It uses the API to onboard customers, open accounts or , issue cards, and send transfers and . Customer onboarding follows the KYC program the bank approves.
- Funds sit at the bank. Customer money is held at the partner bank, often in one pooled account in the brand's name. The brand or middleware keeps a that records how much of that pool belongs to each customer.
- The bank oversees the program. The bank reviews the partner's compliance controls, transaction monitoring and complaints handling, and the regulator examines the bank for everything that runs under its license.
Types of BaaS
Providers are grouped by which part of the banking stack they supply. The categories aren't mutually exclusive, and a full-stack provider covers several at once.
- Account BaaS – named accounts, IBANs or virtual ledgers for holding and reconciling client funds.
- Payment BaaS – access to domestic and cross-border rails such as ACH, SEPA and wire transfers.
- Card BaaS – debit, prepaid and credit card issuing, including BIN sponsorship and card processing.
- Credit BaaS – loans, credit lines or instalment products originated on the bank's balance sheet.
- Compliance BaaS – onboarding checks, sanctions screening and transaction monitoring delivered as an API alongside the account.
For example, a neobank whose customer accounts are held at a partner bank uses account and card BaaS, a gig platform that pays workers into branded accounts uses account and payment BaaS, and a SaaS tool that issues expense cards to its business users uses card BaaS.
Why it matters
- A company can launch a financial product in months instead of the multi-year path of applying for a license and building a core banking system.
- Financial features keep users inside the partner's product. A payroll platform that moves funds through its own interface keeps the payment, the transaction data and the fee, rather than passing all three to an external bank.
- Banks earn deposit balances and interchange from customer segments they don't reach directly, on infrastructure that's already built and already examined.
- Regulators hold the licensed bank accountable for what its partners do, so BaaS contracts push bank-grade , transaction monitoring and controls onto the partner. Weak controls at the partner surface as enforcement action against the bank.
Risks
- Ledger gaps. When the middleware's ledger and the bank's records don't match, nobody can confirm who owns which funds. After the US middleware provider Synapse filed for bankruptcy in 2024, partner banks couldn't reconcile end-user balances, and customers of several fintech apps lost access to their money for months.
- Deposit insurance limits. In the US, FDIC insurance pays out when an insured bank fails. It doesn't cover losses caused by a fintech or middleware provider failing or keeping inaccurate records.
- Partner-bank enforcement. A regulator's action against the partner bank lands on every brand built on it. In 2024, the OCC barred Blue Ridge Bank from adding fintech partners without approval, and the Federal Reserve issued a cease-and-desist order to Evolve Bank & Trust over its fintech partnership controls. Brands on those banks had to pause growth or move to another bank.
BaaS vs open banking
Both connect banks and third parties over APIs. BaaS shares the license and the ledger; open banking shares data and payment initiation rights over accounts the bank continues to own.
| Model | What the bank shares | Who owns the customer relationship |
| Banking-as-a-Service | License coverage, ledger, accounts, card issuing | The third-party brand |
| Account data and payment initiation access | The bank | |
| Banking-as-a-Platform | Nothing outward – the bank plugs third-party fintech services into its own app | The bank |
| Card acceptance and processing, no bank account | The merchant |
