The Quiet Reconstruction: How Regulations Rewrote Banking as a

Service Value Chain — An Opportunity for Tech Consulting

Introduction

The Banking-as-a-service model is on an upward trajectory, with Mordor Intelligence forecasting that the global market will grow from $28.96 billion in 2026 to $65.78 million by 2031, for an impressive compound annual growth rate of around 18%. Over 80% of financial institutions globally have adopted APIs in some form as part of their offerings. According to Fedfis data, the number of BaaS provider banks in the U.S. grew from 116 to 136 institutions between 2022 and 2024.

The value chain of Banking as a Service is described as follows-

Fig.1. Banking as a Service Value Chain

Fig. 2. Market Value Projection of Banking as a Service Industry (2026–31)

Embedded finance, an emerging value chain within the BaaS ecosystem, has also begun to reach every part of human connectivity with banks. Walmart partnered with JPMorgan in March 2025 to integrate banking in the merchant area. Shopify partnered with Stripe in 2021, and Amazon partnered with Goldman Sachs in 2023 for embedded finance models

However, starting in 2022, some numbers didn’t align with the growing perspective of BaaS. For example. venture capital funding for the BaaS sector dropped by 94% between 2021 and mid-2023, falling from around $3.3 billion to $0.194 billion. There were many enforcement actions taken against the sponsor banks in the U.S. Two of the most visible middleware providers were either shut down or acquired.

It was a corrective measure by the market to address an architectural error: one side of the service focused solely on transaction volume, while the other wanted things done in a regulated manner.

History of this issue

Following the financial crisis of 2008, two major changes happened: 1) public trust in financial banks deep dived, and 2) after the Dodd-Frank regulatory tightening, it became almost impossible to obtain new bank charters in the United States.

In the early value chain system, there were also three parts inside this architecture, each very important but owned by a single party. The first was regulatory accountability, or who took all the risks. This was owned by the licensed banks. The second was operational execution. Although all three needed to run smoothly, middleware was crucial to holding it all together, as all the information flowed through it alone. And thirdly, the customer relationship, which was owned by the fintech, as it handled all brands and individual's activities. None of the three parties had a complete view and control over what the others were doing.

Therefore, for years after the boom, regulators tolerated periodic reporting, and venture capital subsidized any middleware losses. Reconciliation rarely happened on time. and the compliance costs were low.

The Technology-Regulation Mismatch

Every technological evolution can be mapped to a framework that compares the speed at which the technology arrives in the market and its innovation with the regulatory landscape's ability to accommodate them. The quadrants are described as follows-

Our case lies in high technology and a low-regulated market (technology leads, regulations lag), meaning regulations cannot keep up with the rapid pace of technological development and its use cases.

Fig. 3 and 4. Technology Regulation Mismatch Matrix and BaaS Industry Location

For BaaS, the lenient regulatory phase lasted from its emergence until 2021. From mid-2023, the calm waves segment began with stringent regulations in place, reducing the risk of compliance failures.

This framework provides consultants with a single diagnostic tool to map any industry in its current state and where it might be headed.

Regulators exposed the issue

In the U.S., the Office of the Comptroller of the Currency (OCC) released a consent order in August 2022 against Blue Ridge Bank. The reasons cited were inadequate oversight of the fintech partner. BSA/AML program deficiencies and failure to monitor third Parties in real time. However, Blue Ridge Bank referenced the OCC Bulletin 2013–19 for a decade, which contained third-party risk management guidance. But this time, its enforcement was strict. Similarly, many other banks, such as Sutton Bank, Choice Financial Group, Cross River Bank, and a series of smaller community banks, received similar actions from the FDIC in the following year. The main change occurred in June 2023, the Federal Reserve. FDIC and OCC jointly published the IGTR, or Interagency Guidance on Third-Party Relationships: Risk Management. The key difference in this guidance was that it made explicit what had been implicit in the past years. For example, periodic compliance reviews were inadequate, contractual indemnification did not transfer regulatory accountability, etc. Banks were now expected to maintain real-time monitoring of third-party tasks and working, rather than periodic monitoring.

In September 2024, the FDIC proposed Custodial Deposit Recordkeeping Rules to require banks to maintain direct end-customer records rather than to rely on middleware ledgers. This rule was brought in because of a series of high-profile failures in which middleware ledgers had grown structurally divergent from the records of the sponsor banks holding the actual deposits thus leaving the end users unable to access their own funds which they believed to be FDIC-insured. Furthermore, the Consumer Financial Protection Bureau (CFPB) introduced Federal Open Banking Framework that commodities basic consumer-authorized account data access under Section 1033 of Dodd-Frank Act.

In India, too, in 2022, Niti Aayog released a report on Digital Banks and introduced a Licensing and Regulatory Regime for India. This report maps the business models present and shows the major roadblocks you may encounter when pursuing “neo banking,” which emerged due to an inefficient or insufficient regulatory framework in the absence of a digital bank license. Their methodology is based on “digital bank regulatory index” comprising (i) entry barriers, (ii) competition, and (iii) business restrictions. and (iv) technological neutrality.

The EU’s EBA outsourcing guidelines, in effect since 2019, have already prohibited banks from delegating their accountability to third-party service providers. In January 2025. The Digital Operational Resilience Act came into effect, expanding the regulatory scope to ICT third-party providers, including BaaS middleware players.

As a result, the compliance costs to maintain that level of infrastructure increased for every player in this domain. For commoditized utility players whose margins were already thin and unit economics-based, it was a major blow, however it was a sign of competitive advantage for scalable growth platform models that had invested in compliance infrastructure in time.

Case Study: Fall of Synapse Financial Technologies

The Incident

It was only when Synapse Financial Technologies collapsed in April 2024 that the world came to understand that we need strong regulations in place in the BaaS ecosystem. Customers lost access to $265 million held across several fintech platforms. By May, partner banks were unable to retrieve accurate customer records, making it difficult to backtrack the transactions and process withdrawals.

Company Info

Synapse was a middleware company founded in 2014 that provided ledger services and served as a bridge connecting fintechs with FDIC-insured banks. It reconciled and routed pooled customer deposits into FBO (For Benefit Of) accounts. It generated income via fee models charging both fintech and banks for compliance, payment routing, ledger management, and platform connectivity.

Persisting Issue

Unlike regulated banks, middleware technology firms aren’t subject to the regulatory standards of traditional financial institutions. As financial institutions outsourced more functions to these companies, they became an integral part of the system and quietly held vast customer funds. Thus, there existed systemic exposure and oversight in the BaaS ecosystem. Neither banks nor fintechs had direct access to customers' sub-account data. Thus, whole process integrity fell on Synapse’s technological infrastructure.

There were operational breakdowns and mismatches between internal ledgers and bank-held funds. Unreconciled pooled accounts showed the problem with Synapse’s infrastructure. Evolve and Mercury bank pulled their deposits and withheld payments cutting off access to funds for many customers. Finally, Synapse filed for bankruptcy in April 2024.

Major Gaps

1. Consumer Protection Frameworks fail to include intermediary failure risks
2. Opacity in multi-party arrangements removes liability and reduces accountability.
3. Fragmented Regulatory landscape, no single authority.

The Solve

1. Functional licensing with proportional capital requirements: Middleware operators to obtain a limited-purpose license (not a full banking charter) that will impose minimum capital reserves proportional to the value of customer funds flowing through them
2. Operational Resilience Standards: The data ledger should either be unified or should be visible to all parties for scenarios such as a partner party's failure
3. Cross-Border Supervision: Different players operating in different countries need a cross-border framework that would establish lead regulator in case of a multi-party arrangement
4. Consumer Protection Standards to include third-party risks: Any entity in BaaS value chain that affects consumer should be subject to similar customer obligations as the licensed banks themselves
5. Resolution Frameworks by Middleware Platforms for Recovery Mechanisms: A dedicated resolution framework for large middleware providers documenting how the ledger will be handled, client fintechs would be migrated, and affected consumers will get their share

Compliance Investment Differentiating Middleware Platforms

In a low- or lenient-regulatory environment, the creation of the compliance infrastructure is at the bank's discretion. Players that invest are at a disadvantage because their fees must be higher than others' to be profitable, and hence they might not have a large customer base. Players that invest only to be sufficiently compliant can offer lower fees, thus increasing the customer base. Thus, the market favors underinvestment. This is where there are chances that the market is acting as a commodity

In a highly regulated market, the compliance infrastructure becomes a competitive advantage. Players who invest early have a significant cost advantage over others. The marginal cost of serving new fintech customers approaches zero if the middleware's compliance infrastructure is in place. Players that underinvested early have the option to either bum money to build compliant infrastructure, get acquired or merged, or exit the market.

After regulations were strengthened from 2022 to 2024, companies that had built this infrastructure, such as Cross Bank, Goldman Sachs, and Column Bank, became structurally advantaged. Thus, the market transitioned from commoditized players to scalable growth platforms.

Going Direct- How the value chain restructured itself

Two new value chain configurations emerged in place of the old tripartite model. These were- Model 1: Direct Fintech to Bank Model Fintech directly negotiated with sponsor banks, eliminating the need for middleware players and their associated costs, but with the con of longer integration timelines and the requirement for Fintech to handle its own compliance infrastructure. For example, Comun (an immigrant-focused neobank) removed Unit (its middleware) and established a direct relationship with Community Federal Savings Bank in late 2023.

Model 2: Embedded Finance Model (Direct Brand to Bank Model) In this model, industry players who previously used fintech products directly partnered with sponsor banks or full-stack banks to launch embedded banking services within their own spaces. For example, in March 2025, Walmart (brand) partnered with JPMorgan to launch embedded banking for Marketplace merchants.

Both the new configurations, coupled with new regulations, have fewer players and thus clearer accountability and better customer management.

Value Capture

Sponsor banks with proprietary compliance infrastructure have captured a larger share of value because their compliance capability has become a sellable product rather than a hidden cost. The banks that invested early are now selling that investment as a differentiated capability to Fintech that can no longer afford to under-invest in compliance themselves.

Middleware platforms have either consolidated around scale and compliance depth, adopting a scalable growth platform with timely investment in compliance infrastructure, or exited the market entirely.

The data ownership dimension also reinforces this value redistribution. Earlier, fintech captured customers' behavioral data, while banks only saw the settlement. After 2022, banks with proprietary compliance infrastructure negotiated data rights into their partner agreements. Thus, they also began capturing customer behavioral data.

Fig. 5. Value capture by BaaS Stakeholders before 2022 regulation wave (Banking Solution BaaS Model) and after the wave (Pure BaaS API Provider Model). Source: Edgar Dunn (https://www.edgardunn.com/articles/fintech-briefing-baas-as-the-engine-of-embedded-finance)

Consulting Guide to Players

For Sponsor Bank clients, the strategic questions should be on how we can convert their compliance infrastructure from a cost center into a differentiated capability. The opportunity to help banks in transitioning by-

• Building a real-time compliance monitoring dashboard that oversees real time transaction monitoring, anomaly detection, KYC refresh, and risk profiles for all the third parties
• Maintaining a self-independent ledger for BaaS services
• Unbundling fee structure so that fintechs can pay for each compliance infrastructure explicitly, such as KYC services, AML monitoring, regulatory liaison, etc.
• Develop an exit strategy and hard red lines in case of contract lapse or termination.
• Conduct timely due diligence for all the third parties according to their risk profile and fee structure

For middleware clients, the pure middleware aggregation model will eventually wither and should be advised accordingly: either vertical integration into a banking license or specializing in deep domain expertise, handling APIs for only those specific tasks. The opportunities are-

• Vertically Integrate by partnering with a sponsor bank charter to become a full-stack bank (e.g., Column Bank) or dominate by specializing in one industry vertically, such as gig-economy payroll, insurance payments, health care payments, etc
• Renegotiate sponsor bank relationships to build shared compliance dashboards
• Build a documented record of compliance, KYC program quality and regulatory effectiveness
• (Long Term) Convert itself into a fintech company with its own set of proprietary APIs and products

Fintech clients have historically evaluated the Sponsor bank on the basis of its API openness and fee structure. onboarding speed. etc. However, the compliance evaluation framework is needed for the hour. It should not happen that after the partnership has been established, the bank receives a consent order from a regulatory authority that will hamper the operations of the fintech partner. The following can be done to help them-

• Conduct end to end compliance due diligence on prospective sponsor banks
• Negotiate data rights in the partnership agreement
• If possible, bypass middleware and diversify sponsor relationships (time consuming)
• Preparation of clear process workflows and disclosure agreements with consumers

For investor clients, the BaaS category needs to be disaggregated. The scalable growth platform model BaaS opportunity is genuinely large and is still emerging, while the singular commoditized utility model BaaS opportunity has now diminished. Consultants can-

• Score prospective BaaS Investment on four dimensions — value chain (direct or tripartite), self-ledger, data rights, and compliance infrastructure and accordingly suggest investments.

Conclusion

The Banking as a Service industry emerged from a space created by customer demand, leading to significant capital infusion while the regulatory structure was still in its nascent phase. Those who underinvested in compliance got profits and a customer base very early. Eventually, when regulators caught up, the value capture was redistributed, middleware began to thin out, and the players who had invested in compliance infrastructure earlier came forward. Thus, we can say that regulatory architecture decides who gets to hold value and be accountable in the long run.

References

American Banker. (n.d.). Fintechs navigate a choice: BaaS, middleware, or go direct. Retrieved from https://www.americanbanker.com/news/fintechs-navigate-a-choice-baas-middleware-or-go-direct

Bain & Company. (n.d.). Embedded finance. Retrieved from https://www.bain.com/insights/embedded-finance/

Bank of England. (2021). Outsourcing and third-party risk management (Supervisory Statement). Retrieved from https://www.bankofengland.co.uk/

Banking Dive. (n.d.). Piermont Bank and Sutton Bank FDIC consent orders. Retrieved from https://www.bankingdive.com/news/piermont-sutton-bank-fdic-consent-orders-aml-bsa-baas-third-party-partners/711815/

Castellum.AI. (n.d.). Website. Retrieved from https://www.castellum.ai

Consumer Financial Protection Bureau. (n.d.). Personal financial data rights. Retrieved from https://www.consumerfinance.gov/

European Banking Authority. (n.d.). Guidelines on outsourcing arrangements. Retrieved from https://www.eba.europa.eu

European Union. (2022). Regulation (EU) 2022/2554 (Digital Operational Resilience Act). Retrieved from https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022R2554

Federal Deposit Insurance Corporation. (2023). Financial Institution Letter FIL-23–029. Retrieved from https://www.fdic.gov

Federal Register. (2024). Recordkeeping for custodial accounts. Retrieved from https://www.fdic.gov/news/financial-institution-letters/2023/fil23029.html

Fiverity. (n.d.). How banks can build compliant fintech ecosystems. Retrieved from https://www.fiverity.com/resources/

McKinsey & Company. (n.d.). Embedded finance: Who will lead the next payments revolution? Retrieved from https://www.mckinsey.com/industries/financial-services/our-insights/embedded-finance-who-will-lead-the-next-payments-revolution

Mordor Intelligence. (n.d.). Global Banking-as-a-Service market report. Retrieved from https://www.mordorintelligence.com/industry-reports/global-banking-as-a-service-market

National Payments Corporation of India. (n.d.). About UPI. Retrieved from https://www.npci.org.in/product/upi

Office of the Comptroller of the Currency (OCC) (2023).** **Third-party risk management: OCC Bulletin 2023–17. Retrieved from https://www.occ.gov/news-issuances/bulletins/2023/bulletin-2023-17.html

Office of the Comptroller of the Currency (OCC) (2022). Enforcement action EA2022–038. Retrieved from https://www.occ.gov/static/enforcement-actions/ea2022-038.pdf

Open Banking Limited. (n.d.). About us. Retrieved from https://www.openbanking.org.uk

Press Information Bureau, Government of India. (n.d.). Press release. Retrieved from https://www.pib.gov.in/PressReleaseIframePage.aspx?PRID=2200567&reg=3&lang=2

Reserve Bank of India. (n.d.). Reserve Bank of India (Non-Banking Financial Companies — Peer to Peer Lending Platform) Directions, 2025. Retrieved from https://rbi.org.in/Scripts/BS_ViewMasDirections.aspx?id=12934

Reserve Bank of India. (n.d.). Master directions: Reserve Bank of India (Non-Banking Financial Companies — Account Aggregator) Directions, 2025. Retrieved from https://www.rbi.org.in

SSRN. (n.d.). Research paper. Retrieved from https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2676553

The Financial Brand. (n.d.). Bankers say BaaS turmoil primes future growth. Retrieved from https://thefinancialbrand.com/news/banking-as-a-service/

Wiley Online Library. (2006). Journal article. Retrieved from https://onlinelibrary.wiley.com/doi/10.1111/j.1756-2171.2006.tb00036.x

Yale Journal. (n.d.). The Synapse collapse. Retrieved from https://www.yalejournal.org