Banking as a Service works by connecting three parties behind a single app: a chartered sponsor bank that holds your deposits and carries the regulatory license, a middleware technology company that translates the bank’s systems into software other companies can plug into, and a consumer-facing brand that designs the app you actually use. The brand you see on your phone is usually not a bank. It is renting access to one.
That split is what makes the model useful, and it is also where the risks live. Each party handles a different slice of the work, so when something fails, the question of who owes you what can get complicated fast.
The Three Parties Behind the App
The sponsor bank is a chartered institution, either federally chartered through the Office of the Comptroller of the Currency or state-chartered, with FDIC deposit insurance.1Federal Reserve. How Can I Start a Bank? It owns the banking license, holds the deposits on its balance sheet, and is legally responsible for compliance with banking law. Even though it is lending its charter to outside partners, it still has to meet the capital requirements its regulator sets.
The middleware provider is the technology layer in the middle. Banks tend to run on older core systems that modern apps cannot easily talk to, so the middleware company wraps those systems in software interfaces that developers can use. Many middleware providers also run compliance tools, identity checks, and transaction monitoring on top of the connection.
The consumer-facing brand is the company whose name is on the app. It builds the interface, runs the marketing, and manages the customer experience. It does not hold a banking charter, which means every regulated function happening behind the app depends on the sponsor bank and the middleware provider.
This arrangement lets each party focus on what it is best at. It also distributes accountability across multiple organizations, which is why problems in a Banking as a Service program often take a long time to untangle.
What Happens When You Tap “Send”
When you move $200 inside a brand’s app, the request moves through all three parties. The app packages the transaction details and sends them to the middleware provider. The middleware checks the formatting and forwards the request to the sponsor bank’s core processing system.
The bank’s system verifies that the account has the money, confirms your identity and account status, and runs the request through its fraud rules. If everything clears, the bank updates its own internal ledger. For transfers that have to leave the bank, the money travels over the Federal Reserve’s payment rails, including Fedwire for large or time-sensitive payments and FedNow for instant round-the-clock settlements.2Federal Reserve Bank of Richmond. Funds Transfer and Settlement Fedwire posts same-day with immediate finality once completed.3Federal Reserve Financial Services. Fedwire Funds Service
A confirmation then travels back through the middleware to the app, and the whole round trip usually takes seconds. Every step is logged, which creates a trail from your tap to the final ledger entry. That trail matters, because the ledger kept by the bank is the official record of who owns what.
Is Your Money Actually FDIC-Insured?
Deposits at a sponsor bank are eligible for FDIC insurance, but eligibility is not automatic in a Banking as a Service setup. Customer funds are typically held in pooled accounts under the brand’s name rather than individual accounts opened in each customer’s own name. For the FDIC to look through that pooled account and insure each customer separately, three conditions have to be met.4FDIC.gov. Pass-through Deposit Insurance Coverage
- The money has to actually belong to the individual customers. If the brand has promised customers something different from what the bank is paying, such as a higher interest rate, the arrangement can look like a debtor-creditor relationship between the brand and the customer, which breaks this condition.
- The bank’s records have to show the account is held for others, usually with titling like “XYZ Company FBO Customers.”
- Someone in the chain — the bank, the brand, or another party — has to maintain records showing exactly who each customer is and how much they are owed.
If any of these fails, the FDIC treats the whole pool as a single deposit belonging to the brand. Standard insurance then covers only $250,000 total for that one “depositor,” no matter how many thousands of customers have money in the pool. This is the gap that trips up consumers who assume an “FDIC-insured bank partner” label on an app means their own balance is covered.
Federal rules also control how a non-bank brand talks about this. A company that is not itself an insured bank has to clearly state that it is not FDIC-insured, that insurance covers only the failure of the partner bank, and which specific bank actually holds the deposits. Any products offered alongside the deposit account that are not insured, such as investments, need a prominent disclaimer saying so.5eCFR. 12 CFR Part 328 – FDIC Official Signs, Advertisement of Membership, False Advertising, Misrepresentation of Insured Status, and Misuse of the FDIC Name or Logo
What the Synapse Collapse Showed
The clearest picture of how this model can fail came in 2024, when middleware provider Synapse Financial Technologies filed for bankruptcy. A court-appointed trustee found an $85 million shortfall between what the partner banks were holding and what depositors were owed. Customers of multiple brands that relied on Synapse lost access to their money for months while four banks tried to reconcile ledgers that did not match. The trustee reported that Synapse appeared to have commingled funds across institutions, using multiple banks to serve the same companies, and the source of the missing money was not clear.
The FDIC received more than a thousand inquiries and complaints from people who could not get to their deposits. The core problem was recordkeeping. When the middleware layer that was tracking which customer owned which dollar collapsed, the information needed to pay people back became unreliable.
In response, the FDIC proposed a rule in late 2024 that would require banks holding custodial deposit accounts with transactional features to keep detailed beneficial ownership records in a standardized electronic format, reconcile them daily, and document their internal controls. If the bank relies on a third party to maintain the records, it has to have direct and continuous access to them, even if that third party becomes insolvent.6Federal Register. Recordkeeping for Custodial Accounts The agency estimated first-year compliance costs for the banking system at roughly $250 million.
The practical takeaway for anyone using a Banking as a Service app: ask which bank actually holds your deposits, and treat the pass-through insurance conditions above as something to check rather than assume.
Your Protections if Something Goes Wrong
Because these are electronic accounts, Regulation E governs what you can lose from unauthorized transactions. Your exposure depends on how quickly you report the problem.
- If you report within two business days of learning about it, your liability is capped at $50, or the amount of unauthorized transfers that happened before you gave notice, whichever is less.
- If you report after two business days but within 60 days of receiving a statement that shows the problem, your liability can rise to $500, and only if the bank can show the later transfers would not have happened with earlier notice.
- If you do not report within 60 days of a statement, you can be liable for the full amount of transfers that happened after the 60-day window, with no cap.
Extenuating circumstances, like a medical emergency, require the institution to extend these deadlines to a reasonable period.7eCFR. 12 CFR 205.6 – Liability of Consumer for Unauthorized Transfers Regulation E applies regardless of whether you opened the account at a traditional bank branch or through a Banking as a Service brand’s app, because the sponsor bank is the regulated entity and the rule binds it.
When you open the account in the first place, federal anti-money-laundering rules require the program to collect your name, date of birth, address, and taxpayer identification number, then verify that information through documents, consumer reporting agencies, or public records, and screen it against government lists of suspected terrorists.8eCFR. 31 CFR 1023.220 – Customer Identification Programs The legal duty to run that check sits with the sponsor bank under the Bank Secrecy Act, even when the brand’s app is the thing collecting your information.9Office of the Law Revision Counsel. 31 USC 5311 – Declaration of Purpose
If a transaction looks suspicious, the sponsor bank is the one that has to file a Suspicious Activity Report, within 30 calendar days of first detecting the facts. If no suspect has been identified, the bank gets another 30 days, but filing can never be delayed more than 60 days from initial detection.10Office of the Comptroller of the Currency. Suspicious Activity Reports
Who’s Watching the Banks That Run These Programs
Federal regulators have been direct about one point: a bank that outsources operations to a fintech partner does not outsource its regulatory responsibility. Joint guidance from the Federal Reserve, FDIC, and OCC states that using third parties, including fintech companies, does not reduce the bank’s duty to make sure activities happen safely and in compliance with applicable law.11Federal Register. Interagency Guidance on Third-Party Relationships: Risk Management
Under that guidance, examiners look at Banking as a Service relationships as part of their routine supervision of the sponsor bank. They review whether the bank can actually oversee and manage its fintech partners, test transactions for legal compliance, and raise deficiencies with the bank’s senior management and board. When circumstances warrant, regulators can examine the fintech partner directly, and serious problems can lead to enforcement actions against the bank.
This has already played out. In 2024, the OCC issued a consent order against Blue Ridge Bank for failures tied to its fintech partnerships, finding that the bank had not maintained a reasonable BSA/AML compliance program, with weak internal controls, insufficient independent testing, and inadequate staffing. The order gave the bank 30 days to build a written third-party risk management program specifically covering its fintech partners and their subpartners.12Office of the Comptroller of the Currency. Consent Order for Blue Ridge Bank NA
For you as a customer, the practical implications of this oversight regime are narrower than they sound. Regulators act on bank problems, not on your individual complaint. Your own leverage sits in Regulation E, the FDIC pass-through conditions, and the recordkeeping of whichever bank actually holds your money. Before you park a balance in a brand-name app, it is worth knowing the name of that bank, confirming the account titling signals an agency relationship, and reading what the brand says about insurance in its own disclosures rather than relying on the logo.