Regulatory compliance is a risk and consideration for banks and credit unions who are utilizing BaaS models.

In July 2024, the Board of Governors of the Federal Reserve System (Board), the Federal Deposit Insurance Corporation (FDIC), and the Office of the Comptroller of the Currency (OCC) signaled that they are placing greater scrutiny on BaaS relationships, having issued the Request for Information on Bank-Fintech Arrangements Involving Banking Products and Services Distributed to Consumers and Businesses. In September, the FDIC issued a notice of proposed rulemaking that would strengthen recordkeeping for bank deposits received from third party, non-bank companies accepting those deposits on behalf of consumers and businesses.

This increased regulatory review served as a response to growing market concerns: In May 2024, BaaS provider Synapse shut down abruptly, causing a massive ripple effect. As reported by BAI:

In May 2024, a key third-party provider, Synapse, suffered a significant breakdown, sending shockwaves throughout the BaaS ecosystem. Sponsor banks (insured depository institutions or IDIs), fintechs and their customers were all caught in the fallout. End customers had deposits frozen and no immediate resolution in sight.

The incident exposed just how vulnerable banks and fintechs can be when relying heavily on third-party platforms for core operations like transaction records and account reconciliation.

Developing BaaS relationships will require FIs not only to have strong compliance programs but to also up risk management efforts. This includes being detailed in Know Your Customer (KYC), Know Your Customer’s Customer (KYCC), and overall third-party engagement, particularly as relates to transaction records and account details.