Banking-as-a-Service Explained: How Fintech Apps Borrow a Bank's Charter

When someone opens an account with a popular budgeting app, a neobank, or a payroll-linked debit card, they are often not banking with a bank at all. Instead, they are using a technology company that has partnered with a federally chartered bank behind the scenes. This arrangement, known as Banking-as-a-Service (BaaS), has quietly become the plumbing beneath much of consumer fintech—and a source of growing regulatory attention after a high-profile middleware failure left customers unable to access their own money.

How the Arrangement Works

In a typical BaaS stack, three parties are involved. First is the fintech, the consumer-facing brand that builds the app, markets the product, and handles customer service. Second is a middleware or "banking-as-a-service" platform that connects the fintech's software to banking infrastructure. Third, and most important, is a chartered bank—often a smaller FDIC-insured institution—that actually holds the deposits, moves money through payment rails, and is the regulated entity ultimately responsible for compliance.

• Fintech app: designs the user experience, markets the product, and often sets fees or rewards
• Middleware/BaaS platform: provides APIs connecting the fintech to the bank's core systems and ledgers
• Partner bank: holds customer funds, is FDIC-insured, and bears regulatory responsibility for the program

This structure lets a fintech launch quickly without obtaining its own bank charter, which is an expensive, slow process. It also lets smaller banks reach customers nationwide through an app rather than a branch network. The result is that a single partner bank may stand behind the apps of dozens of consumer-facing fintech brands at once.

Where Deposit Insurance Fits—and Where It Doesn't

FDIC insurance protects deposits held at FDIC-member banks, and funds placed through a BaaS arrangement can be covered under "pass-through" insurance rules, provided strict recordkeeping conditions are met. The FDIC's regulation on recordkeeping for timely deposit insurance determination (12 CFR Part 370) requires custodial deposit accounts—the kind used in many fintech partnerships—to maintain records showing exactly which end customer owns which portion of a pooled account. If those records are incomplete, missing, or held by a middleman that goes out of business, the FDIC may not be able to quickly determine who is owed what, even if the underlying bank itself is healthy.

When the Middle Layer Breaks

In 2024, the bankruptcy of Synapse Financial Technologies, a middleware firm that connected several fintech apps to partner banks, exposed exactly this vulnerability. Reconciliation disputes between Synapse, its partner banks, and the fintech brands it served left some customers temporarily unable to access funds, even though the money was supposed to be sitting in FDIC-insured accounts. The episode drew attention from the Consumer Financial Protection Bureau, which examined complaint data describing delayed or blocked access to funds tied to banking-as-a-service arrangements, and highlighted how fragile recordkeeping can become when multiple parties maintain separate, sometimes inconsistent, ledgers of the same money.

The Regulatory Response

Federal banking regulators have moved to tighten expectations for banks that rely on fintech partners. In June 2023, the Federal Reserve, FDIC, and Office of the Comptroller of the Currency jointly issued guidance on managing risks in third-party relationships, making clear that a bank cannot outsource its compliance responsibility simply because a fintech or middleware firm is handling the customer relationship. Banks are expected to maintain direct oversight of how customer funds are tracked, how quickly records can be reconciled, and how a program would be unwound if a partner failed. Examiners have since increased scrutiny of bank-fintech programs, and some partner banks have faced formal enforcement actions tied to weak oversight of these arrangements.

What This Means for Consumers

• Check the fine print: most BaaS apps disclose their partner bank's name in account agreements or FAQs
• Remember that insurance covers the bank, not the app: look up the partner bank directly on the FDIC's BankFind tool to confirm it is insured
• Understand that multi-layered structures can delay access to funds during a dispute, even when deposits are ultimately protected
• Diversify large balances across institutions rather than assuming unlimited protection through a single fintech relationship

Banking-as-a-service has made it easier and cheaper to launch new financial products, and most arrangements function smoothly day to day. But the technology stack between a customer and their money has grown more layered, and regulators have signaled that this complexity itself is a risk to be managed—not just a convenience to be marketed.