The CFPB reached for payment apps while the customer’s money sat at partner banks

The week

In 2024, many people who had kept money in popular fintech apps opened them to find they could not get their money out. The apps relied on Synapse, a fintech middleware firm, a company that sits between consumer apps and the banks that actually hold the money, handling the plumbing so the app does not have to. When Synapse went bankrupt, many end users of its partner apps were left unable to reach their funds, sometimes for months.

That was the backdrop when, on November 21, 2024, the Consumer Financial Protection Bureau finalized a rule defining larger participants in the market for general-use digital consumer payment applications. These are the apps people use to send money to friends, pay merchants or keep a balance on their phone.

The rule allowed the Bureau to supervise nonbank firms, companies that offer financial services without being banks, whose apps handled at least 50 million consumer payment transactions a year. That was a much higher bar than the 5 million in the 2023 proposal. It covered only transactions denominated in U.S. dollars, leaving most crypto activity outside its scope.

Supervision would let CFPB examiners review these firms for compliance with existing federal consumer financial law, including electronic fund transfer, privacy and unfair, deceptive or abusive practices rules. The rule created no new substantive obligations. It was expected to reach a small number of large technology and payment firms. Smaller apps, below the 50 million threshold, would remain outside federal supervision, though not outside the law.

The rule did not change what payment apps had to do; it changed who could come inside and check. And it arrived months after a failure that had happened somewhere else entirely: not in the app layer the rule reached, but in the records and bank accounts underneath.

The larger-participant rule was narrow by design. It did not tell payment apps to do anything new. It let the CFPB examine the largest of them for compliance with laws that already applied, as it already examined large banks.

The timing made a gap visible. For months, consumers who had kept money in apps built on Synapse had been unable to get it back, and the dispute was over records held across a middleware firm and several banks. Supervising the app layer would not have reached that problem.

Consumer exposure in app-based payments lies in three places, and only one of them depended on the new rule. The first is the substantive law that governs the app’s conduct toward customers. The second is the supervisory access the rule added. The third is the partner bank layer, where customer funds are actually held and recorded. Together they cover the obligations, the oversight and the money.

For an executive at a bank, a fintech or an investor in either, the useful exercise is to look at each layer separately, because each carries different risks and calls for different controls.

How a payment app actually holds your money

Most people assume that when they see a balance in a payment app, the app is holding their money. Usually, it is not, at least not directly. Understanding the real arrangement is the key to this whole story.

Many apps are not banks and cannot take deposits themselves. Instead, they partner with a bank. The bank opens one large account, often called a custodial or “for the benefit of” account, that holds the combined money of all the app’s customers. It works like a single large envelope at the bank with thousands of people’s cash inside.

The bank’s own records show only the envelope and its total. The list of who owns how much of what is inside is kept somewhere else, in a ledger. A ledger is simply the record of every customer’s balance and every transaction. In some arrangements the app keeps the ledger; in others, a middleware firm like Synapse does, sitting between many apps and several banks.

When everything works, nobody notices. Customers see their balances, money moves, and once a day the parties check that the total in the envelope matches the sum of all the individual balances in the ledger. That check is called reconciliation. When the totals do not match, the difference is called a break.

When the firm keeping the ledger fails, the envelope is still at the bank, but nobody can quickly say whose money is whose. That is what happened with Synapse. Customer balances were pooled in custodial accounts at several banks, the middleware firm kept the record of who owned what, and when it failed, nobody could quickly reconcile the two. Real people waited for their own money while the parties tried to rebuild the list.

This arrangement is often described as banking as a service: banks rent out their charter, their access to payment networks and their ability to hold funds, while fintech companies build the customer experience on top. It has real benefits, including faster product development and wider access to financial services. It also spreads responsibility across several companies, which is exactly where gaps can open.

The customer, meanwhile, sees only one brand: the app on their phone, and perhaps the bank’s name in small print on a debit card. They have no way to know which company keeps the ledger, which holds the cash and which handles disputes. When something goes wrong, they call whoever they can find, and every company in the chain is judged by how that call goes.

The substantive law: in force regardless

Apps that let consumers send money, pay merchants or store balances were already subject to federal consumer financial law. The Electronic Fund Transfer Act and Regulation E govern error resolution and liability for unauthorized transfers. The Gramm-Leach-Bliley Act governs privacy. The prohibition on unfair, deceptive or abusive acts or practices, often shortened to UDAAP, applies broadly. State money transmitter laws add licensing, safeguarding of customer funds and examinations of their own. A money transmitter license is the state permission a nonbank needs to move money on customers’ behalf.

The questions that matter most to consumers, such as whether a hacked customer recovers the money and how fast a dispute is resolved, were already answered by this law. The CFPB could already bring enforcement actions.

Scam losses, where a customer is tricked into authorizing a payment, were and remain the hardest category. Regulation E generally does not treat an authorized payment as an error. If a fraudster steals your login and sends money, that is unauthorized and the law protects you. If a fraudster persuades you to send the money yourself, the law generally treats you as having authorized it. The debate over who bears those losses was therefore playing out in Congress, in network rules and in individual company policies, outside this rule.

For executives, scams are a reminder that legal liability and customer expectations are not the same thing. A customer who has lost savings to a scam rarely cares whether the payment was technically authorized. How a firm handles those cases, within the law, shapes its reputation as much as any rule does.

The threshold and the dollar-only scope of the rule are worth noticing for the same reason. They decided who would be examined, not who had to comply. An app processing fewer than 50 million transactions a year, or a firm mainly handling crypto, was outside the new supervision but still subject to whatever law already applied to its activities.

For a payment business, the practical point is that this layer applies whatever happens to any particular supervisory rule. Holding payment programs to Regulation E, privacy and UDAAP standards is not optional, and the absence of a federal examiner does not change the legal obligations.

Supervisory access: the part the rule added

Supervision differs from enforcement. Enforcement is what happens after something has gone wrong: an investigation, a lawsuit, a penalty. Supervision is ongoing oversight. Examiners request documents, sample dispute files, review complaint handling and test whether written procedures match practice. They can find problems before they become violations. For large banks this has long been routine. For large payment apps it would have been new at the federal level.

The practical effect would have fallen on governance and evidence. Compliance management systems, complaint handling, error resolution timelines and fraud controls would all have been examined. A compliance management system is the set of policies, people, training, monitoring and reporting through which a firm makes sure it follows the law.

Firms that had grown fast under lighter scrutiny often have reasonable outcomes but thin documentation of how decisions are made. Building that documentation is worthwhile in any case. State regulators, courts, card networks and bank partners ask for the same evidence.

Two areas would likely have drawn early examiner attention. One is account freezes and closures. Apps freeze accounts to stop fraud, but a freeze that holds a customer’s balance for weeks without explanation generates complaints and possible unfairness claims. Written criteria, time limits and a customer notice for each freeze are the evidence that answers the question.

The other is the error resolution clock. Regulation E sets deadlines for investigating disputes and for provisional credit, a temporary refund to the customer while the investigation continues. Examiners test those deadlines by sampling files. Firms that measure their own on-time rate monthly find late cases before an examiner does.

Take a fast-growing payment app preparing for its first federal examination. Its leaders believe customers are treated fairly, and complaint volumes are modest. But when the compliance team tries to pull twenty dispute files at random, it finds that decisions were recorded in three different systems, that the reasons for denying some disputes were never written down, and that nobody tracks how many investigations finished within the legal deadline. The outcomes may well have been reasonable. The evidence is missing. Over the following months the team builds a single dispute record, a standard reason list and a monthly timeliness report. The same work later satisfies a state regulator’s request and a partner bank’s annual review, which is why it was worth doing whether or not the federal examiners ever arrived.

The partner bank layer: where the money sits

Most payment apps rely on banks to hold customer funds, issue cards or reach payment networks. Those banks are supervised, and the 2023 interagency guidance on third-party relationships made clear that they must manage partners’ risks, including consumer protection risk. Synapse showed what happens when that management fails at the ledger level.

For a partner bank, this layer has three distinct exposures. Compliance exposure: if a partner mishandles Regulation E disputes on accounts held at the bank, the bank may share responsibility. Ledger exposure: the bank must be able to identify the beneficial owner of every dollar in a custodial account, on any given day, without relying solely on a partner’s system. The beneficial owner is the actual person whose money it is, as opposed to the app or middleware firm whose name is on the account. In September 2024 the FDIC proposed a recordkeeping rule for custodial accounts with transactional features to address exactly that. Reputational exposure: customers rarely distinguish the app from the bank behind it.

The controls follow. Daily reconciliation of the bank’s custodial balances against the partner’s customer-level ledger, with breaks escalated within a set time. A contractual right to receive the full ledger, in a usable format, on demand and on the partner’s failure. A tested plan for paying customers directly if the partner disappears. Counsel should review how partnership agreements allocate these duties.

Suppose a community bank holds custodial accounts for three fintech partners. Each morning its operations team receives each partner’s customer-level ledger and compares the total with the bank’s own balance. A small difference appears for one partner. Under its policy, any break above a threshold must be explained by the partner within one business day and escalated to a senior officer if not. The partner traces it to a delayed batch of card transactions, and the break clears. Nothing dramatic happened. The routine means that if a partner ever failed, the bank would already hold a recent, verified list of who owns what, and could begin paying customers directly from it.

Run the same bank without that routine. It sees only the total in each custodial account. One partner fails. The bank asks for the ledger and receives an incomplete file. Customers start calling the bank, because the bank’s name is on their cards. Regulators ask how much each customer is owed. The bank does not know, and cannot find out quickly. The Synapse collapse made that situation real.

Who carries the risk

Seen together, the three layers explain why the rule mattered less than its headlines suggested. It extended oversight to the app layer, where the law already applied. The layer that had just failed consumers sat with the banks.

For a bank in fintech partnerships, the money layer is where the largest risks sit: losses if records cannot be reconstructed, regulatory criticism for weak third-party oversight, legal claims from customers and damage to the bank’s name even when the failure was a partner’s. For a payment app, the substantive law sets the floor for how customers must be treated, and documentation of decisions is what every examiner, court, network and partner bank will want to see. For customers, the question is simple and urgent: can I get my money, and how quickly? For boards on either side, the question is whether anyone can answer that customer, today, without depending on a third party’s system.

Staff feel these risks too. When records cannot be reconciled, it is customer service agents who take the angry calls, operations teams who work nights rebuilding files and compliance officers who answer regulators’ questions without good answers. A clean daily routine protects them as much as it protects customers.

There is also a strategic point. Fintech partnerships can be profitable for banks, and payment apps can grow quickly on borrowed infrastructure. But the value of those partnerships depends on trust that the money is safe and accounted for. A single failure, as Synapse showed, can undermine that trust across a whole category of products.

Assuming someone else has it covered

A well-run payment program, whether at the bank or the app, has a few clear features. Regulation E, privacy and UDAAP standards are applied to every product regardless of which regulator is watching. Decisions on disputes, complaints, freezes and fraud are documented in a way an outsider could follow. Error resolution timeliness is measured monthly. Custodial balances are reconciled daily against customer-level records, with breaks escalated on a clock. The bank has a contractual right to the full ledger and a rehearsed plan to pay customers directly.

Most failures come from assuming another party is in charge. Apps assume the partner bank is responsible for compliance; banks assume the app or middleware firm keeps accurate records. Firms treat the presence or absence of a federal examiner as the measure of their obligations. Banks reconcile totals but never look at customer-level detail. Contracts promise access to records but specify no format or timeline. And contingency plans for a partner’s failure exist on paper but have never been tested.

Whose money, and where

• For every custodial account we hold or rely on, who keeps the customer-level ledger, and could we produce it ourselves tomorrow if that party failed?
• Do we reconcile custodial balances against customer-level records daily, and what happens when there is a break?
• Do our contracts give us the full ledger, in a usable format, on demand and on a partner’s failure?
• Have we tested a plan to pay customers directly if a partner disappears?
• Could we show an examiner, a court or a partner bank how our dispute, complaint and fraud decisions are made?

With hindsight

The rule itself did not last. In May 2025 Congress used the Congressional Review Act to overturn the larger-participant rule, and the president signed the resolution. It was gone less than six months after it was finalized.

The CFPB’s capacity and supervisory activity fell sharply over the same period. Federal supervision of the app layer, the one thing the rule had added, effectively disappeared.

The substantive law did not change, and state regulators continued to license and examine money transmitters. Payment apps still owed their customers the same protections under Regulation E, privacy law and the ban on unfair, deceptive or abusive practices, and state examiners kept checking.

The partner bank layer stayed in focus. In August 2025 the CFPB sued Synapse over its handling of consumer funds and recordkeeping, seeking a nominal penalty that opened access to its Civil Penalty Fund, a pool of money collected from penalties in other cases that can be used to compensate harmed consumers. In November 2025 it allocated about $46 million from that fund to affected users, and a further $9 million or so in May 2026, against a shortfall the partner banks had estimated at $60 million to $90 million.

The episode underlined the argument here: the consumer harm in that case sat in the records layer, beyond the reach of app supervision. No examination of an app’s complaint handling would have told customers whose money was in which bank.

The lasting advice is to follow the money rather than the headlines. A rule that attracts attention may reach only part of the risk, and may not last. The obligations that endure are the laws already on the books and the basic duty to know, at any moment, whose money you are holding. Banks and fintechs that build those foundations do not need to wait for any particular regulator to tell them to.