Banking as a Service (BaaS) is a model in which licensed banks and other regulated financial institutions expose their core banking capabilities, including deposit accounts, payment rails, card issuance, lending infrastructure, and regulatory licenses, through APIs, enabling fintech companies, non-banks, and brands to offer financial products and services under their own brand without needing to obtain their own banking license or build core banking infrastructure from scratch. In the sponsor bank model, the licensed bank assumes regulatory responsibility and balance sheet exposure for the financial products while the fintech partner handles customer acquisition, product design, user experience, and often the underwriting technology, splitting revenue and risk according to their contractual arrangement.
Introduction to Banking as a Service
Banking as a Service emerged from the same API-first architectural revolution that transformed lending technology broadly, but with a specific focus on enabling non-bank entities to access regulated banking infrastructure. Obtaining a full banking license in the United States requires years of regulatory approval, tens of millions of dollars in startup capital, ongoing compliance with comprehensive bank examination requirements, and the attention of experienced banking professionals in every operational domain. BaaS eliminates this barrier for companies that want to offer financial products but whose core competency lies elsewhere, such as in software development, consumer marketing, or vertical industry expertise rather than bank operations and compliance. The FDIC bank charter and application process illustrates the barrier that BaaS circumvents, providing context for why fintech companies overwhelmingly prefer sponsor bank partnerships to direct charter applications.
The BaaS market has grown explosively, with hundreds of fintech companies offering deposit accounts, debit cards, credit cards, personal loans, buy-now-pay-later, earned wage access, and small business lending products through sponsor bank relationships with a much smaller number of banks that have specialized in BaaS infrastructure. BaaS has also attracted intense regulatory attention: the OCC, FDIC, and Federal Reserve have all issued guidance or enforcement actions related to BaaS arrangements, emphasizing that sponsor banks cannot outsource their regulatory obligations to fintech partners and must maintain adequate risk management and compliance oversight of all BaaS relationships. The OCC third-party risk management guidance is the primary regulatory framework governing sponsor bank obligations in BaaS arrangements and is required reading for any institution operating in this space.
How Banking as a Service Works
In a typical BaaS lending arrangement, a fintech lender partners with a sponsor bank that has the necessary state and federal licenses to originate consumer or business loans in all 50 states. The fintech handles borrower acquisition, application processing, underwriting using its own algorithms, and customer service, all through its own branded digital experience. Applications that meet the underwriting criteria are formally originated by the sponsor bank, which is the lender of record and assumes the initial credit risk. The sponsor bank then either retains the loans on its own balance sheet, transfers them to the fintech through an immediate purchase arrangement, or sells them to a third-party investor, depending on the economics and risk allocation structure of the BaaS agreement.
The sponsor bank is responsible for regulatory compliance across the full loan lifecycle: fair lending, TILA and Regulation Z disclosures, ECOA adverse action notices, BSA and AML compliance, FCRA compliance for credit reporting, and state law compliance. In practice, the fintech typically builds these compliance functions into its technology platform and the sponsor bank reviews and approves the compliance infrastructure, conducts periodic audits, and maintains oversight of all aspects of the program. This oversight requirement is the regulatory non-negotiable in BaaS: sponsor banks that allow fintech partners to operate compliance programs without adequate oversight have been subject to enforcement actions, consent orders, and in extreme cases, orders to exit BaaS arrangements entirely.
For lenders that are themselves non-bank fintechs without a bank sponsor, BaaS represents a path to nationwide lending capability without the cost and time of obtaining individual state lending licenses in every jurisdiction. BaaS also provides access to payment rails including ACH, wire transfer, and card networks that require bank sponsorship for direct access, enabling fintech lenders to offer instant funding and flexible repayment options that would otherwise require banking relationships that small lenders cannot easily negotiate.
Example
A fintech company with a best-in-class mobile application for gig economy workers wants to offer short-term installment loans up to $1,500 to help workers manage cash flow between platform paydays. The company has sophisticated underwriting algorithms that use gig platform earnings data, bank account transaction history, and behavioral data from the app to predict repayment capacity better than traditional credit scores. However, the company lacks banking licenses and cannot legally originate loans in most states. It partners with a community bank through a BaaS agreement: the bank is the lender of record, provides access to ACH payment rails for both loan funding and repayment collection, and maintains regulatory oversight of the program. The fintech handles application intake, underwriting, customer communication, and collections, and purchases each originated loan from the bank within 2 business days of funding. The bank earns a per-loan fee for its regulatory infrastructure and balance sheet exposure during the hold period. The fintech earns interest income from its loan portfolio and builds toward a lending business that would be impossible without the BaaS partnership.
Compliance Requirements
BaaS compliance requirements are layered across the sponsor bank, the fintech partner, and the BaaS platform provider. The sponsor bank must comply with all applicable banking regulations as if it were directly originating and servicing the loans, regardless of how much day-to-day operation the fintech handles. The fintech must comply with the sponsor bank oversight requirements, which typically include regular compliance audits, real-time data access for bank examiners, program-level TILA and fair lending analysis, and immediate remediation of any compliance deficiencies identified by the bank or its regulators. The FDIC guidance on bank fintech partnerships outlines specific risk management expectations for banks engaged in BaaS arrangements, including third-party risk management, concentration risk, and consumer compliance considerations that examiners assess during BaaS program reviews.
Bottom Line
Banking as a Service enables fintech lenders to operate at scale with nationwide reach without direct banking licenses, but the compliance infrastructure connecting the BaaS fintech to its sponsor bank must be robust, documented, and examiner-ready at all times. Vergent LMS supports BaaS lending programs with its loan origination system featuring Regulation Z and TILA-compliant disclosure generation, credit bureau reporting in Metro 2 format, ACH payment collection with same-day ACH, role-based access control for multi-party oversight requirements, and a SOC 2 Type II certified infrastructure, meeting the compliance and technology bar that sponsor banks require of their fintech lending partners.
