Banking-as-a-Service Explained

What is Banking-as-a-Service?

Banking-as-a-Service, usually shortened to BaaS, is an arrangement in which a regulated financial institution makes financial capabilities available for another business to integrate into its own product. These capabilities can include payment accounts, bank accounts, cards, transfers and, in some arrangements, lending.

A customer might use an account inside a retailer’s app while a partner bank provides the underlying deposit account. Alternatively, a business software platform might offer payments through a licensed payment institution rather than a bank.

The distinction matters: BaaS is a commercial delivery model, not a licence category. It does not tell you whether a product is a bank deposit, electronic money or a payment service. That depends on the legal structure and the entities involved.

How Banking-as-a-Service works

A typical arrangement connects three layers:

• The customer-facing business: the app, platform or brand distributing the product.
• The technology layer: software connecting the interface to account, card, compliance and payment systems.
• The regulated provider: the institution legally responsible for providing the relevant financial service.

One company may perform several roles. A bank might supply both the technology and regulated services, while another programme might involve a separate middleware company and several financial institutions.

An example: a marketplace payout account

Imagine a marketplace offering sellers an account for receiving sales proceeds and paying suppliers.

A seller applies through the marketplace interface. Identity and business information passes to the regulated provider, directly or through a technology intermediary. Checks may cover beneficial ownership, sanctions exposure and the expected purpose of the account.

Once approved, the provider opens the relevant account or establishes an electronic-money relationship. The marketplace displays balances and payment controls using application programming interfaces, or APIs.

When the seller requests a transfer, the instruction travels through the technology layer. The provider applies relevant controls and sends the payment through the appropriate payment system. Status updates then return to the marketplace.

The app is the interface, but it is not necessarily the institution holding the money or executing the payment.

Why the ledger matters

A ledger records balances and transactions. BaaS arrangements may involve a bank’s core ledger, an intermediary’s sub-ledger and the customer-facing platform’s records.

These records must reconcile. If an app displays a credit before the underlying payment settles, the arrangement needs clear rules for pending transactions, reversals and losses.

An individual account number or virtual IBAN does not, by itself, establish that the customer has a separately titled bank account. It may instead route money into a pooled account, with individual entitlements tracked on a sub-ledger.

BaaS, embedded finance and open banking

These terms overlap, but describe different things.

Embedded finance describes the customer experience: financial services appear inside a non-financial product. Examples include payments within accounting software or financing at checkout. BaaS can provide the infrastructure behind that experience.

Open banking generally concerns permissioned access to account information or payment initiation through defined interfaces. It does not, by itself, provide a banking licence or allow a business to accept deposits.

BaaS concerns the provision of financial capabilities through a partner institution. It can support embedded finance and use open-banking connections, but neither is essential to every arrangement.

A payment gateway is also not automatically BaaS. It may simply transmit payment information or connect a merchant to an acquiring provider without supplying customer accounts.

Who does what—and who remains responsible?

The division of work should be documented in contracts, operating procedures and customer disclosures. Outsourcing tasks does not automatically transfer regulatory accountability.

The regulated provider

Depending on its permissions and the product, the provider may be responsible for:

• Holding deposits or issuing electronic money.
• Executing payments or issuing cards.
• Overseeing customer due diligence and financial-crime controls.
• Meeting applicable capital, safeguarding, reporting and conduct requirements.
• Supervising outsourced activities and distribution arrangements.

A bank cannot simply lend out its licence while ignoring how the programme operates.

The customer-facing business

The brand may collect application information, provide first-line support, market the product and operate parts of the fraud-control process.

It may also need its own authorisation, registration or appointment as an agent. The answer depends on what it actually does, not whether its contract calls it a technology company.

For example, making regulated credit decisions, initiating payments or distributing electronic money can raise different requirements. A lending product also needs clarity about the lender of record, servicing responsibilities and applicable consumer-credit rules.

The technology intermediary

An intermediary may translate API requests, manage programme configuration and connect several banks or payment providers.

This can simplify integration, but adds another dependency. Contracts should establish who owns essential records, who can access them and how services continue if the intermediary fails or the relationship ends.

Where customer money sits

The central question is not whether an app offers “banking”. It is what legal claim the customer has, against which entity, and with what protection.

Bank deposits

Where customers hold eligible deposits at a bank, a statutory deposit-protection scheme may apply, subject to its limits, eligibility conditions and aggregation rules.

Several brands can use the same bank. Customers should not assume each brand creates a separate protection allowance.

Where funds are held through pooled or custodial structures, protection can depend on legal ownership, beneficiary identification and accurate records. A marketing statement about a partner bank is not enough to establish the treatment of every balance.

Electronic money and payment funds

Electronic money is not a bank deposit. In relevant regimes, electronic-money and payment institutions must protect specified customer funds through safeguarding arrangements, such as segregation or an eligible insurance or guarantee arrangement.

Safeguarding is not the same as deposit insurance. Recovery can still involve delays, administrative costs or disputes over records and entitlements.

Failure of the app or intermediary

Even where money remains at a sound bank, customers can temporarily lose access if a technology provider fails, records cannot be reconciled or contractual access is interrupted.

Deposit protection generally addresses qualifying bank failure—not every operational failure, fraud loss or insolvency elsewhere in the chain. Continuity planning therefore matters alongside legal protection.

How regulation differs by jurisdiction

The applicable rules follow the service, entity and customer location. A licence in one jurisdiction does not automatically permit worldwide distribution.

European Union

EU structures commonly involve credit institutions, payment institutions under PSD2, or electronic-money institutions under EMD2 and national implementing law.

A payment or electronic-money authorisation is not permission to accept bank deposits. Passporting can support cross-border activity within the relevant European framework, but notification procedures, agent arrangements and local requirements still matter.

Bank-led arrangements also face outsourcing and ICT-risk obligations, including DORA where applicable. Consult the relevant national authority and the European Banking Authority for the framework and subsequent changes.

United Kingdom

UK arrangements distinguish banks from authorised payment institutions and electronic-money institutions. The FCA supervises relevant payment and electronic-money activities; banks operate within the applicable PRA and FCA framework.

Eligible bank deposits may receive Financial Services Compensation Scheme protection. Money held with a non-bank payment or electronic-money institution does not receive that protection simply because it is safeguarded. Check permissions and consumer guidance with the Financial Conduct Authority.

United States

US BaaS commonly involves a chartered bank working with a non-bank fintech. Bank oversight depends on the bank’s charter and supervisory structure; non-bank activities can also trigger federal and state requirements, including money-transmission or lending rules.

FDIC insurance covers eligible deposits at insured banks, not the fintech itself. Pass-through coverage for custodial arrangements depends on applicable conditions, including ownership and recordkeeping requirements. The Federal Deposit Insurance Corporation explains these distinctions.

Switzerland

Switzerland distinguishes banking authorisation from FINMA’s FinTech licence under Article 1b of the Banking Act. The FinTech licence allows certain acceptance of public deposits under statutory restrictions, including restrictions on investing those deposits and paying interest.

It is not equivalent to a full banking licence, and deposits accepted under it are not covered by Swiss deposit insurance. The precise activity may trigger additional requirements. Consult FINMA for licence categories and conditions.

United Arab Emirates

Within the UAE Central Bank’s jurisdiction, banking, retail payment services, card schemes and stored-value activities sit within distinct regulatory frameworks. A technology partnership does not replace the relevant permissions.

The DIFC and ADGM have separate financial-services regulators and legal frameworks. Permissions there should not be assumed to authorise equivalent activities across the UAE. Start with the Central Bank of the UAE and identify whether a financial-free-zone regulator is also relevant.

Singapore

Singapore distinguishes banking licences from payment-service licences under the Payment Services Act. Standard and major payment institutions have different scope and obligations, and relevant customer-money protection requirements depend on the service and licence.

A payment account is not automatically an insured bank deposit. Check the provider’s exact permissions and applicable safeguards with the Monetary Authority of Singapore.

Benefits, costs and practical checks

BaaS can reduce the need for a business to build financial infrastructure from scratch. It can also place payments or accounts closer to the customer’s existing workflow.

However, it does not remove compliance work or guarantee a quick launch. Integration, risk approval, customer support and reconciliation can require substantial ongoing effort.

Commercial costs may include implementation fees, minimum commitments, account charges and transaction fees. Card programmes may share interchange revenue, subject to regulation and contractual deductions. Fraud losses, disputes and reserves can materially affect the economics.

Before selecting a programme—or relying on an embedded account—establish:

• Legal provider: which entity supplies each service, and under what permission?
• Money structure: is the balance a deposit, electronic money or another claim?
• Protection: what scheme or safeguarding arrangement applies, with what exclusions?
• Records: who maintains the authoritative ledger and reconciles differences?
• Support: who handles complaints, disputed payments and frozen accounts?
• Continuity: what happens if the brand, intermediary or provider exits?
• Portability: can accounts, records and recurring payments move, or must customers reopen elsewhere?

The strongest BaaS arrangements make these answers clear before launch. The useful test is not how invisible the financial provider becomes, but whether responsibilities, customer rights and access to money remain understandable when something goes wrong.