Banking-as-a-Service (BaaS) is the model in which a licensed, chartered bank rents its regulated capabilities (deposit accounts, payments, debit and credit cards, lending) to non-bank companies through APIs, so those companies can offer banking products under their own brand. The bank keeps the charter, the insured deposits, and the regulatory obligations; the brand keeps the customer. After the 2024 Synapse collapse froze over $265 million belonging to more than 100,000 end users, BaaS split into two models: a sponsor-bank model regulators now watch closely, and an embedded-software model a financial institution can adopt with ordinary vendor diligence.
Key takeaways:
Save this reference card — the three-layer BaaS stack and its failure point in one image.
BaaS is a compliance program with an API attached. A ride-share company that gives drivers a debit card, a payroll platform that pays workers instantly, a software tool that issues virtual cards — none of these are banks. They rent regulated banking functions from a chartered institution and present the experience as their own. The brand on the app is rarely the bank holding the money.
The charter never moves. Only a bank can hold insured deposits, move money across the payment rails, and answer to federal regulators. BaaS rents access to those capabilities; it does not hand off the obligations that come with them. Lose sight of that one distinction and you get the failures this guide walks through.
Roughly 25% of retail members already run a business on a personal account. Only about 8% of credit union members use their institution for business banking. An estimated 87% of new LLCs never see a credit union offer at all, and the average small business stays with its first bank for about 7 years. The members are already in the building. The gap is the product, not the relationship.
A working BaaS arrangement has three layers, each with a different role and a very different level of regulatory responsibility. Risk flows down to the bank; the brand and the customer relationship sit up top.
| Layer | Who it is | What it does | Carries the charter? |
|---|---|---|---|
| Brand / Fintech | The customer-facing company | Owns the app, the relationship, and the brand | No |
| BaaS Platform | Middleware / API provider | Connects the brand to the bank, runs the ledger and tooling | No |
| Licensed (Sponsor) Bank | Chartered, insured institution | Holds deposits, moves money, owns regulatory obligations | Yes |
The sponsor bank holds the charter and the deposit insurance, and answers to the OCC, FDIC, or Federal Reserve for everything in the program, including the conduct of partners several steps removed from it. The BaaS platform sits in the middle, providing the APIs, the tooling, and the ledger that tracks which end customer owns which dollar. That middleware makes integration fast. It was also the single point of failure in the industry's worst collapse. The brand or fintech owns the experience but holds neither the money nor the charter.
The appeal is speed: a brand can stand up a banking product in months instead of years. The danger is the distance that grows between the people using the product and the bank legally responsible for it. The further those two ends drift apart, the harder it gets to answer a question that should always be simple: where is the money, and whose is it?
The licensing question has a short answer: the fintech or brand does not need a banking license; the sponsor bank supplies it. That is the entire commercial logic of BaaS. The longer answer determines what each party can legally do.
For a financial institution reading vendor decks, the licensing lens cuts fast: whoever asks you to hold the deposits is asking you to be the sponsor bank, with everything the next sections describe. A vendor that never touches your charter, your ledger, or third-party deposits is selling software, not BaaS sponsorship.
In 18 years of bringing digital banking to credit unions, no term has caused more boardroom confusion than BaaS, and the confusion usually comes down to this split. Post-Synapse, BaaS divides cleanly into two models. They share a name and almost nothing else.
| Sponsor-bank BaaS | Embedded-software BaaS | |
|---|---|---|
| Who holds deposits | The sponsor bank, for fintech customers it never onboarded | The FI, for its own members (no change) |
| Who owns the ledger | The middleware platform | The FI, on its own core |
| Regulatory exposure | High — full BSA/AML, fair-lending, and third-party liability across the partner chain | Low — standard vendor diligence; no new deposit-pooling risk |
| What you can offer | Rented charter, cards, and accounts for outside brands | Modern tools for your own members: formation, bookkeeping, tax, compliance |
| Example | Evolve Bank powering dozens of fintech apps through Synapse | A credit union embedding small-business software in its own app |
The first model produced the consent orders. The second is how a community bank or credit union modernizes without becoming the kind of institution regulators now watch most closely. When a vendor says "BaaS," your first question should be: which of these two am I being offered?
BaaS, embedded finance, and embedded banking get used interchangeably, and that looseness causes real confusion in partnership conversations. Keep them straight:
BaaS is the engine, embedded finance is the broad category of what you build with it, and embedded banking is one important product family inside that category. An institution does not have to become a high-risk sponsor bank to take part in embedded banking, and for community banks and credit unions, that is the whole point.
Decision-makers ask for names, so here they are. The middleware tier is where the 2024–25 shakeout hit hardest; the sponsor-bank tier is where the enforcement landed.
Middleware / BaaS platforms
| Provider | What it does | What happened in 2024–25 |
|---|---|---|
| Unit | BaaS middleware, card issuing, accounts | Active; tightened bank-partner and compliance requirements |
| Treasury Prime | Bank-direct BaaS connectivity | Active; pivoted toward a bank-led, direct-relationship model |
| Synctera | BaaS platform with sponsor-bank marketplace | Active; leaned into compliance tooling and program management |
| Column | Nationally chartered bank with a developer API | Active; bank and platform are the same entity, removing the middleware gap |
| Stripe Treasury | Embedded banking via partner banks | Active; large-scale, bank-partner model |
| Synapse | Middleware that pooled customer funds in FBO accounts | Filed Chapter 11 in April 2024; ledger shortfall triggered the crisis |
| Bond, Solid | BaaS middleware startups | Exited the market amid the broader BaaS pullback |
Sponsor banks
| Bank | Role | What happened in 2024–25 |
|---|---|---|
| Evolve Bank & Trust | Major Synapse sponsor bank | Federal Reserve cease-and-desist order (June 2024) over its fintech risk-management framework |
| Blue Ridge Bank | Active BaaS sponsor | OCC consent order over BSA/AML deficiencies in its fintech programs |
| Lewis & Clark Bank | Smaller sponsor bank | Continued operating; representative of community-bank entrants |
| Coastal Community Bank | High-volume sponsor bank | Continued operating with significant fintech-program exposure |
The pattern across the survivors is consistent: the ones still standing rebuilt their compliance functions before they grew their partner books, not after.
The lightly-governed BaaS era is over. That is not a forecast; it is what the public record now shows. Each fact below comes with what it means for you.
The Synapse collapse. In April 2024, Synapse Financial Technologies, a middleware provider in that middle layer, filed for Chapter 11. Synapse did not hold deposits; it reconciled and routed pooled customer funds into "for benefit of" (FBO) omnibus accounts at partner banks. When the relationships unraveled, the bank-held balances did not match Synapse's records, with an estimated shortfall of up to $95 million between bank-held funds and amounts owed. More than 100,000 end users lost access to over $265 million, and many were locked out of their money for months. This was a ledger and reconciliation breakdown, not a hack or a market crash. (CNBC, Banking Dive, Fortune) What this means for you: if you cannot reconcile down to each end customer independent of the middleware, you do not have a program — you have exposure.
Enforcement against sponsor banks. Regulators did not stop at the middleware. The Federal Reserve issued a cease-and-desist order against Evolve Bank & Trust, a Synapse partner, in June 2024, citing an ineffective risk-management framework for its fintech partnerships. The OCC placed Blue Ridge Bank under a consent order over Bank Secrecy Act and anti-money-laundering deficiencies. The common thread was weak due diligence and inadequate ongoing monitoring of partners. (Federal Reserve, Banking Dive) What this means for you: outsourcing the activity does not outsource the responsibility. Earn the upside of a partner's program and you own the full downside of its conduct.
What regulators expect. The governing framework is the interagency Third-Party Relationships: Risk Management guidance the Federal Reserve, FDIC, and OCC finalized in June 2023, followed in May 2024 by a companion guide written specifically for community banks. The principle is blunt: a bank's use of third parties does not diminish its responsibility for the activity. (Federal Reserve, OCC) What this means for you: due diligence before a partnership, contractual controls during it, continuous monitoring throughout, with oversight scaled to the risk.
The FDIC custodial-account rule. In September 2024 the FDIC proposed a rule requiring banks that hold custodial deposit accounts with transactional features to keep accurate per-owner records, reconcile them, and submit to independent validation. As of July 2026 it remains in proposed status: the comment period closed in January 2025, the FDIC withdrew several other 2024 proposals in March 2025, but left this one pending. (FDIC, Federal Register) What this means for you: the direction is set even though the rule is not final. The recordkeeping responsibility lands on the insured bank, so build for it now.
BaaS is not dead. The loose version is, and the version that survives is a compliance discipline first and a technology product second.
Whether you are a fintech choosing a sponsor bank or an FI evaluating whether to become one, the same file has to hold up. Before signing anything:
Modernizing does not mean becoming a sponsor bank, no matter how often vendor decks imply it does.
The high-risk version rents your charter to many unknown fintechs, holds pooled deposits for customers you never onboarded, and leans on a middleware ledger you do not control. That is the model that produced the consent orders. The embedded-software version is different in every dimension: you embed better tools for your own members, inside your own app, on your own ledger. The products small businesses actually need (formation, bookkeeping, accounting, and tax filing) do not require deposit-pooling or third-party-fintech risk.
The opportunity is large and largely unserved. With a quarter of retail members already running a business on a personal account and only 8% banking their business with you, the members are already in the building. You can serve them with embedded software that runs inside your existing app, vendor-managed, on your terms, with proper due diligence and clear data boundaries, without ever becoming the kind of sponsor bank regulators watch most closely. For where this is heading, see our 2026 credit union trends piece, our look back at the 2025 fintech year, and our state of community banking.
Jupid sits at the responsible end of this spectrum: no charter rental, no pooled deposits, no outside fintech program. Jupid embeds small-business financial tools (incorporation, accounting, tax, and compliance) natively inside the bank or credit union's own app, for its own members. You keep the relationship, the brand, the deposits, and the regulated activity. Members reach an AI accountant through WhatsApp and iMessage that connects to their bank accounts, categorizes transactions at 95.9% accuracy, and handles tax filing. Jupid integrates with Banno, Q2, and Alchemy across 3,000+ financial institutions and is SOC 2 certified, which keeps vendor diligence short. Our team previously built Anna Money, serving 60,000+ small businesses at $40M ARR. Explore a partnership with Jupid or reach us at [email protected].
This article is for educational purposes only and does not constitute legal, regulatory, tax, or financial advice. Regulatory rules and guidance change; the FDIC custodial-account rule discussed here was in proposed status as of July 2026. Consult qualified legal and compliance counsel before entering any banking-as-a-service or bank-fintech partnership.
CBO & Co-Founder
Business leader with 18 years embedding fintech into U.S. banks, leading 200+ integrations across products and partnerships. Deep expertise in digital banking and fintech partnerships, building lasting relationships with financial institutions across the US.
Embedded banking, embedded finance, BaaS, and open banking get used interchangeably. They are not the same. Here is the clean separation, with examples.
Embedded finance puts banking, lending, and accounting inside the apps people already use. Here's what it means for banks and credit unions in 2026.
Embedded accounting builds bookkeeping into the apps, platforms, and banks SMBs already use. What it is, who's adding it, and the ROI math, for 2026.
New here? Enter this code at checkout and your first month is on us — full AI bookkeeping, tax filing, and a 24/7 accountant, $0 for 30 days.
New customers. First month free with code NEW2026, cancel anytime.
Join 1,000+ businesses using Jupid to save time and money. Start simplifying your finances today.
30-day money-back guarantee
