Why banking-as-a-service margins never covered the cost of knowing whose money it was

The week

In mid-June 2024, many people who had kept money in fintech apps were already discovering they could not get to it. That same week, a federal regulator put one of the banks behind those apps on a short leash.

On June 14, 2024, the Federal Reserve Board announced an enforcement action against Evolve Bancorp and Evolve Bank & Trust, an Arkansas bank that sponsored many fintech programs. A fintech is a technology company offering financial products, such as a spending app or a savings account, usually without holding a banking license of its own. To hold customer deposits or issue cards, it partners with a licensed “sponsor bank,” which lends the app its charter. This arrangement is often called banking-as-a-service.

The Fed’s order was a cease and desist order, a formal instruction from a regulator to stop certain practices and fix them. It was dated June 11 and issued jointly with the Arkansas State Bank Department. It cited unsafe and unsound practices, regulatory language for conduct that puts a bank or its customers at undue risk. The bank, it said, lacked an effective risk management framework for its fintech partnerships, with gaps in anti-money laundering, sanctions and consumer compliance. It could not show it was properly checking who its partners’ customers were, watching for suspicious money flows, screening against sanctioned people and countries, and treating consumers fairly.

The order did not come out of nowhere. It recited three examinations by the Federal Reserve Bank of St. Louis and the Arkansas State Bank Department. A safety and soundness report issued on August 11, 2023 found weaknesses in how the bank managed its Open Banking Division, the unit that served fintech partners. A consumer compliance report issued on August 30, 2023 found weaknesses in how that division managed consumer compliance risk. A further examination, issued on January 10, 2024, found anti-money laundering deficiencies that amounted to a Bank Secrecy Act compliance program violation. It also found gaps in complying with sanctions rules administered by Treasury’s Office of Foreign Assets Control.

The remedies were specific, and most ran on 60- or 90-day clocks. Within 90 days the bank had to submit a plan to strengthen its risk management of the division. The plan had to include a risk rating for each fintech partner, product and program, and standards for onboarding, monitoring and offboarding partners. It also had to make sure the ledger and sub-ledger responsibilities of the bank and its fintech partners were clearly defined and maintained, including in the event of a material business disruption. The bank had to hire independent consultants to review its anti-money laundering program and to validate its transaction monitoring system. A further consultant was to review wire activity tied to fintech partners from April through September 2023, to see whether suspicious activity had been properly reported.

Other provisions reached into the balance sheet. The order required plans on capital and on liquidity that took account of the fintech business and of concentrations in the bank’s funding. It barred dividends and other capital distributions without prior approval. It required complaint procedures covering how partners identified, investigated, resolved and reported end-user complaints back to the bank. It also contained a detail that says a great deal about the business model: before exiting a relationship with a fintech partner, the bank had to give its supervisors an analysis of the impact on its liquidity.

The consequence was concrete. Evolve now needed supervisory approval before adding fintech partners or offering existing partners new products. For a bank whose growth came from signing new programs, that was a brake on the business itself.

The approval requirement was broad. It covered new fintech partners, program managers, business lines, products and services, and new products for existing partners. Each request had to include the proposed contract, the management or board minutes approving it, and a description of how the bank would manage the risk.

The order landed while Synapse was in Chapter 11 bankruptcy, after filing on April 22. Synapse was a middleware firm: a company sitting between fintech apps and banks, including Evolve, translating instructions and keeping track of who owned what. Many end users of Synapse-connected apps could not reach their money, because the bank and middleware records did not reconcile. The banks’ books and Synapse’s books told different stories about how much each person was owed, and nobody could quickly say which version was right.

The bankruptcy had gone badly from the start. Synapse had planned to sell its business to TabaPay, a payments company, but the deal fell apart in May. Synapse and Evolve each blamed the other for the gaps in the records. Late that month, the bankruptcy court ordered the appointment of a Chapter 11 trustee, and the role went to Jelena McWilliams, a former chair of the FDIC. Her task was to establish what the records could and could not show.

Evolve was one of several banks in the Synapse network; others included Lineage Bank, American Bank and AMG National Trust. End users reached those banks through consumer apps such as Yotta, a prize-linked savings app, and Juno, which marketed accounts to crypto users. Many of those customers had never heard of Synapse, and some had never heard of the banks either.

The Fed’s order did not mention Synapse, and it did not address the missing balances. Its scope was the bank’s own risk management and compliance. Read side by side, though, the two stories described one business from opposite ends: what supervisors found when they examined the bank, and what customers experienced when one link in the chain broke.

The two events, a regulator’s order and a partner’s bankruptcy, came from the same underlying problem. Both pointed at the costs of being the bank in a model built to make banking feel effortless.

Banking-as-a-service had attractive unit economics on paper. A small bank could gather deposits and card interchange from dozens of fintech programs without building consumer products or branches. Interchange is the small fee a merchant’s bank pays to the cardholder’s bank every time a card is used; across millions of swipes, it adds up. Revenue scaled with balances and transaction volume.

Two features of the market made the revenue side especially appealing to small banks. The first was interchange. Under the Durbin amendment to the Dodd-Frank Act, debit interchange is capped for issuers with $10 billion or more in assets, while smaller banks are exempt from the cap. A small sponsor bank could therefore earn more per debit swipe than a large one, and share that margin with its fintech partners. The second was funding. When interest rates rose sharply in 2022 and 2023, deposits became valuable again, and fintech balances were a way to gather them without branches.

Neither feature said anything about cost. Both rewarded growth in balances and transactions, and both encouraged banks to sign more programs. The pricing conventions that grew up around them, mostly revenue shares negotiated program by program, carried no line for the work of being the bank.

The costs that mattered most scaled differently. They grew with the number of programs, the number of systems holding records, and the complexity of each partner’s flows. The Evolve order and the Synapse failure arrived within weeks of each other. Together they exposed three such costs: keeping a ledger the bank could stand behind, overseeing what partners did under the bank’s charter, and absorbing a partner’s exit.

The first is a running cost of records. The second is a running cost of compliance. The third is a tail cost that arrives all at once. Together they cover what a sponsor bank pays to be the bank. Each makes more sense once the machinery is clear.

Three layers and two sets of books

The model has three layers. At the top is the fintech app the customer sees: a slick interface, a brand, a debit card in a nice color. At the bottom is the sponsor bank, which holds the actual money, has the banking license, and answers to regulators. In between, in many arrangements, sits a middleware provider, a technology company that connects many apps to one or more banks so that each app does not have to build its own bank connection.

Every bank runs on a core banking system, the central software that records accounts, balances and transactions. It is the bank’s official book of record. Middleware providers connect to it using APIs, short for application programming interfaces. An API is a defined way for one computer system to make requests of another: the app writes what it wants in a standard form, and the bank’s system carries it out.

The key question in any financial arrangement is simple to ask and surprisingly hard to answer: whose money is this? In a traditional bank, the core system knows that directly. Each customer has an account with a balance. In banking-as-a-service, the answer is often split across organizations. That split is where the trouble starts.

Suppose a regional bank signs up a fintech offering a savings app. The app’s customers believe they each have an account. At the bank, though, there is one large account in the fintech’s name, held for the benefit of all its customers. The bank knows the total. The fintech, or its middleware provider, knows how that total breaks down person by person. As long as both sets of books agree and everyone stays in business, nobody notices the gap.

Now follow a single payment. A customer of the savings app moves money from a paycheck into the app. The app sends an instruction through the middleware provider’s API. The money lands in the bank’s pooled account, and the middleware ledger credits that customer. Later the customer spends with the app’s debit card, the card network settles the transaction with the bank, and the middleware ledger debits the customer. Each step happens in a different system, owned by a different company, often at a different moment. Multiply that by many customers, many apps and, in some arrangements, several banks, and the opportunities for the two sets of books to disagree multiply too.

Where the timing gaps come from

Each payment rail settles on its own schedule. Card transactions are authorized in seconds but settle later, and the final amount can differ from the authorization, as with a restaurant tip or a hotel hold. ACH transfers move in batches, arrive at the bank as files, and can be returned days afterwards. Wires become final quickly but draw the closest attention from anti-money laundering teams. A middleware ledger that credits a customer the moment an instruction is sent will run ahead of the bank’s books for hours or days, by design.

Timing differences are normal and clear themselves. The danger is that they disguise real errors. Consider a return that was never posted, a fee taken twice, a refund credited to the wrong person, or a negative balance written off in only one ledger. Each looks like timing noise at first. Only a process that ages every difference, and investigates the ones that fail to clear, can tell them apart.

Two architectures, two kinds of risk

Programs were not all built the same way. In one design, the bank opens an individual account on its own core system for every end user, and the fintech supplies the interface. The bank always knows each person’s balance, because its own system of record holds it. In the other design, common with middleware, the bank holds pooled accounts and the per-person ledger lives with the middleware firm.

The first design costs the bank more to run and takes longer to launch. The second is cheaper and faster, and it moves the question of whose money it is outside the bank. A bank can run both designs at once, for different programs. The mix makes a single picture of risk harder to assemble, because controls that work for accounts on the core do not carry over to pooled ones.

Reconciliation of this kind is not exotic. Large organizations reconcile accounts with suppliers and subsidiaries every day. What was unusual in banking-as-a-service was the combination of thin margins, fast growth and a widespread assumption that somebody else in the chain was doing the definitive bookkeeping.

The ledger

In the common model, end-user money sat in pooled custodial accounts at one or more banks, held for the benefit of the fintech’s customers. A custodial account is one where an organization holds money on behalf of others, rather than owning it. The bank’s core system knew the pooled balance. Which individual owned how much often lived only in the middleware provider’s ledger. A ledger is simply the record of who owns what and how it has changed. Money also moved between partner banks inside the model, which meant no single bank saw the whole picture.

Reconciling that structure daily is real work. Reconciliation means checking that two sets of records agree, and investigating every place they do not. It needs:

• A sub-ledger or shadow ledger the bank controls, a copy of the customer-by-customer breakdown that sits in the bank’s own hands.
• A daily feed of end-user balances from the partner.
• Automated matching against pooled account activity.
• Staff to work exceptions, the mismatches, before they age.
• An audit trail that would survive the partner’s disappearance.

In a program earning thin spreads on modest balances, those costs can exceed the margin. So they were often assumed to sit with the middleware provider, whose own economics were no stronger. Everyone could reasonably believe someone else was keeping the definitive books.

The reconciliation, step by step

A sound daily cycle has a small number of steps, and each one has an owner. Shortly after the close of business, the partner sends a file listing every end user, each balance and the day’s movements. The bank loads it into its own sub-ledger and totals it by pooled account. It compares those totals with the balances on its core system. Then it works down a level, matching individual movements against card settlement files, ACH files and wire records, so that any difference can be traced to a person and a transaction.

Breaks are then sorted. Timing items are tagged with the date they should clear. Errors are assigned to the partner or the bank for correction, with a deadline. Anything unexplained is escalated. The output is a short report: the total unreconciled, the count of open breaks by age, and the items that have missed their deadline.

The data contract matters as much as the matching engine. The partner’s file should use a fixed format, carry a permanent unique identifier for each end user, and include enough transaction detail to trace every movement. A file of balances alone, without the movements behind them, lets a bank see that the totals disagree but not why.

Why the cost scales with programs, not balances

Reconciliation effort is driven by variety more than volume. Automated matching handles large numbers of routine transactions cheaply. The cost is in exceptions, and exceptions come from each program’s particular features: its fee schedule, its card product, whether it allows overdrafts, how it handles disputes, whether funds move between banks. Ten programs with different designs need ten sets of matching rules, ten data feeds to watch and ten partners to chase. One large program with simple flows can be cheaper to reconcile than three small ones.

A revenue share pegged to balances therefore misprices the work. It pays the bank most for the program that may cost least to reconcile, and least for the small, complex program that generates the most exceptions.

Ownership is the design choice that matters. A sponsor bank that treats the end-user ledger as its own record, even when a partner operates it, assigns a named owner in finance or deposit operations. It tracks a small set of metrics: unreconciled amount, number of open breaks, and age of the oldest break. A “break” is a single mismatch between the two sets of books. A break older than a few days is a warning that the partner’s records and the bank’s have started to drift. Left alone, small drifts compound, the way a checkbook you stop balancing becomes impossible to untangle after a few months.

When Synapse failed, the bankruptcy trustee and the banks could not agree on who was owed what. The gap between bank-held funds and what end users believed they had ran to tens of millions of dollars, according to the CFPB’s later account of the banks’ reconciliation. Pass-through deposit insurance did not help. Pass-through insurance is the arrangement under which deposit insurance can extend to each individual behind a pooled account, but it depends on accurate records of beneficial ownership, that is, who really owns each dollar. It also protects against a bank’s failure, not a middleware firm’s. Customers who believed their money was “FDIC insured” discovered that the protection did not cover the event that actually happened to them.

Pass-through coverage has its own conditions under FDIC rules. The bank’s account records must disclose that the account is held in a custodial capacity. The identities and interests of the beneficial owners must be ascertainable. They can come from the bank’s records, or from records the custodian or another party keeps in good faith in the regular course of business. Those conditions are tested only when a bank fails. A sponsor bank that cannot reconcile on an ordinary Tuesday should not expect its partner’s records to be in better shape on the day the FDIC arrives.

The Evolve order touched the same nerve from the supervisory side. Among the things the bank’s risk management plan had to cover were controls to keep the ledger and sub-ledger responsibilities of the bank and its partners clearly defined, including during a material business disruption. With Synapse in bankruptcy at the same moment, that clause read less like boilerplate and more like a description of the problem.

The oversight

The federal banking agencies had set the baseline a year earlier. Their interagency guidance on third-party relationships, finalized in June 2023, stated that a bank’s use of third parties does not diminish its responsibility to operate safely and soundly and in compliance with the law. In May 2024 the agencies followed with a guide to third-party risk management written for community banks. Neither document was specific to fintech, but both applied to it.

The Evolve order turned on oversight. Customer due diligence, the checks a bank runs to confirm who a customer is and whether they pose risk, can be performed by a fintech under contract. So can transaction monitoring, the automated watching of payments for signs of fraud or money laundering; sanctions screening, the check against government lists of prohibited people and countries; complaint handling; and disclosures, the terms and fee information customers must be given. The legal obligation stays with the chartered bank. Each new program adds a distinct customer base, product design and risk profile to supervise.

That makes oversight cost roughly proportional to program count, while revenue depends on which programs grow. A bank with thirty programs needs to test thirty onboarding flows, tune monitoring for thirty customer populations, review thirty sets of marketing and fee disclosures, and answer examiners on all of them. Examiners are the regulators’ staff who inspect banks. They do not accept “our partner handles that” as an answer.

What supervisors asked Evolve to build

The order offers an unusually detailed bill of materials for oversight. It required a risk rating method applied to each partner, product and program, and kept current. It required standards for onboarding, monitoring and offboarding partners. It required the people responsible for the division to have the expertise, stature, independence and resources to do the job. It required complaint procedures that reached into partners’ own handling of end-user complaints, including root-cause analysis and reporting back to the bank. And it required the board, or a committee, to approve new products and partners in writing before launch.

On anti-money laundering, the order set out a sequence that recurs in orders of this kind. An independent consultant reviews the program and identifies every partner, business line and product that must be risk-rated within it. A second consultant validates the transaction monitoring system, including its thresholds and whether the data it receives is complete. A third looks back over past wire activity to find suspicious transactions that should have been reported. Each report then feeds a new written program that the supervisors must find acceptable.

Every item on that list carries a recurring cost after the order is lifted. Risk ratings must be refreshed. Monitoring rules must be retuned as partners change their products. Complaint data must be collected from partners and analyzed. Each of those tasks grows with the number of partners and products, which is exactly the variable the business model was built to increase.

The data problem inside oversight

A sponsor bank cannot monitor what it cannot see. In many programs the fintech ran onboarding and collected customer information, and the middleware held the transaction detail. The bank received summaries. Monitoring summaries for suspicious activity is close to impossible, because the patterns that matter, such as money moving rapidly through many new accounts, show up only in individual transactions.

The fix is contractual and technical at once. The bank needs a right to customer-level and transaction-level data, delivered on a schedule it sets, in a format its own monitoring tools can ingest. It needs a right to test the partner’s onboarding decisions by sampling files. It also needs a right to require changes when testing finds problems, with a consequence if the partner does not make them. Without those rights the bank is relying on the partner’s attestation, which an examiner will read as a claim rather than evidence.

How the burden differs by program

Programs do not carry the same compliance load. A consumer debit program raises questions about error resolution for electronic transfers, disclosures and complaint handling. A program for small businesses adds beneficial ownership checks on legal entities and more varied payment patterns. Programs that move money across borders, or that serve customers of crypto platforms, draw the closest scrutiny on sanctions and money laundering. Lending programs add fair lending and credit risk. A bank that prices every program the same way is cross-subsidizing its riskiest partners with revenue from its simplest.

A fair objection is that many fintechs run better compliance operations than the small banks that sponsor them. Some do, with larger teams and better tooling. That does not move the legal obligation, and it does not remove the bank’s need to verify. The efficient arrangement uses the partner’s capability and gives the bank enough data and testing rights to rely on it with evidence. That costs less than duplicating the work, but it still costs something, and it still grows with each partner added.

Many sponsor banks grew partner lists faster than compliance teams. Earlier consent orders against other sponsor banks in 2023 and 2024 had signaled this, including FDIC orders against Lineage Bank, Sutton Bank and Piermont Bank and an OCC order against Blue Ridge Bank. Evolve showed that the supervisory response could include a freeze on new partners, which halts the revenue model itself. Boards should dwell on that. A compliance shortfall in this business can cost more than a fine paid and forgotten; it can stop the engine of growth.

Pricing oversight properly changes program selection. A bank can charge a fixed per-program oversight fee on top of a revenue share, so small programs pay their own supervision. It can set a minimum expected balance or volume before onboarding. It can require partners to fund specific controls, such as real-time transaction data feeds to the bank’s own monitoring system. Programs that cannot bear those charges are telling the bank something about their risk-adjusted value. Their apparent profit depends on oversight that nobody is paying for.

The exit

The third cost is rare and large. When a fintech or middleware partner fails, the bank needs to identify every end user, freeze or release funds correctly, communicate, handle complaints, and answer regulators. It must do this while the partner’s staff, systems and records may be in the hands of a bankruptcy trustee, the court-supervised official who takes control of a failed company’s assets. Chapter 11 is the part of US bankruptcy law under which a company tries to reorganize or wind down under court protection. During it, what was once a cooperative partner becomes a legal process with its own priorities.

Exit cost is set at signing. A contract can:

• Give the bank a complete, current copy of customer-level records in a usable format, delivered daily.
• Grant step-in rights, the right to take over systems and data if the partner fails.
• Require escrow of ledger software or documentation, meaning a copy is held by a neutral third party and released to the bank in defined circumstances.
• Define who contacts end users, with pre-approved messages.

These terms are cheap to negotiate up front. After a partner enters bankruptcy, the same rights can take months of litigation to obtain, and customers wait in the meantime.

The first days of a partner failure

A partner failure unfolds in a predictable order, and each step has a cost. First comes a decision about access. If the bank cannot trust the partner’s ledger, it may have to stop payments out of the pooled accounts, which protects the funds but strands customers. Next comes reconstruction of who is owed what, from the records the bank holds and whatever the partner, or its trustee, will release. Then comes communication, with customers who may not know the bank’s name, through an app the bank does not control.

The regulatory demands run alongside. Supervisors will expect frequent updates. Complaints arrive through the bank, the fintech, the CFPB and state regulators. Card programs bring the card networks’ own requirements. Each of these needs senior attention at the moment the operations team is busiest, and each is far easier to meet with a plan written in calm conditions.

Exit is also a liquidity event

The Evolve order carried a telling provision: before exiting any fintech relationship, the bank had to give its supervisors an analysis of the impact on its liquidity. Program balances are deposits, and a large program can be a large share of a small bank’s funding. When the program leaves, by choice or not, its deposits leave with it. The order also required a liquidity plan addressing funding concentrations and diversification beyond the fintech business.

Exit risk therefore has two faces. Operationally, the bank must be able to wind a program down cleanly. Financially, it must be able to absorb the outflow. A program that funds a large share of the balance sheet cannot be exited at will, which weakens the bank’s hand in every negotiation with that partner. Concentration limits set in advance keep that bargaining power with the bank.

A sponsor bank can also hold an explicit reserve or capital allocation for program wind-down, sized from a rehearsed scenario. That number turns an unpriced tail risk into a known cost per program. It belongs in the pricing model next to the oversight fee and the reconciliation budget. Whether a bank’s custodial account structures and disclosures handle deposit insurance and beneficial ownership correctly is a question for its lawyers.

Who bears it when the books disagree

When a fintech partner’s records and the bank’s books disagree, customers lose access to their money and the bank’s name goes into the headline.

Customers. The people affected were not sophisticated investors. They were ordinary users who had trusted an app with savings or spending money. When records failed to reconcile, they could not reach their money. The explanation, a dispute between a bankruptcy trustee and several banks over whose books were right, was the last thing anyone waiting on rent money wanted to hear.

Regulators. A sponsor bank’s regulators look straight through the fintech brand to the chartered institution. A shortfall in oversight lands on the bank’s record, and, as Evolve’s order showed, can restrict what the bank is allowed to do next.

Reputation. The customer’s relationship is with the app. The headline, when things go wrong, names the bank. A small bank can find its name attached to a national story about people who lost access to their money, through programs it never marketed itself.

Staff. When a partner fails, the work of untangling the records falls on the bank’s operations and compliance teams, alongside their day jobs. Without a rehearsed plan, that work is improvised under intense pressure, which is how errors get made.

Well-run partners. Fintechs that kept good records and honored their contracts were caught up too. When a sponsor bank needs approval before offering existing partners new products, those partners cannot launch new features through it on their own timetable. Some move to a different bank, a migration that means new account numbers, new cards, new disclosures and confused customers.

Other sponsor banks. Supervisory attention does not stay with one bank. After a high-profile failure, examiners carry what they learned to every bank with a similar model. Banks with sound programs still had to show their work, which raised the cost of the business for everyone.

Strategy. Most importantly, a business model whose costs are understated looks more profitable than it is. Decisions to grow, to sign more partners, to accept smaller programs, all rest on that inflated picture. Getting the costs right avoids bad outcomes, and it also produces better choices about which business to be in.

A partner program run almost boringly well

Return to the regional bank. A well-run version of its fintech business looks almost boring. Every morning, a named person in deposit operations receives the partner’s customer-level balances, and an automated process matches them to the pooled account. A short dashboard shows the unreconciled amount, open breaks and the age of the oldest one, and it goes to the board’s risk committee every quarter. Each program pays a fixed oversight fee, and the bank declines programs too small to carry it. Contracts include daily record delivery and step-in rights. Once a year, the bank rehearses a partner failure: it pretends the middleware provider has vanished overnight and checks whether it could tell every customer what they are owed. The result sizes a wind-down reserve for each program.

Scale changes the design, not the duty

A community bank with three programs and a bank with fifty carry the same obligations at very different cost per program. The small bank can reconcile with a simple, well-documented process and one trained analyst, as long as partner files are clean, and its board can review each program by name. The large one needs reconciliation software, a dedicated partner oversight team, tiered risk ratings and a program inventory that compliance and finance both trust. Either approach can work. The trouble comes in the middle: a bank that grew from three programs to thirty without changing how it worked.

Fintechs face the mirror image. A fintech choosing a sponsor bank, or a middleware provider, should ask whether that bank produces a daily reconciliation and has the compliance staff for another program. A sponsor bank that says yes to everyone, quickly and cheaply, is offering a price that probably leaves out the costs described here.

The strongest case against pricing it all in

There is a serious argument on the other side. Bank-fintech partnerships widened access to accounts, payments and credit for people larger banks served poorly. Most programs never failed. If every program must carry an oversight fee, a reconciliation budget and a wind-down reserve, small and experimental programs become uneconomic, and the business consolidates around a few large banks and large fintechs. That cost falls on the customers the model was meant to reach.

The argument is right about the effect and wrong about the alternative. The costs exist whether or not anyone prices them. Leaving them out makes small programs look cheaper while shifting the bill to customers who lose access when something breaks, and to the bank when supervisors respond. A visible price lets the bank and the partner decide together whether a program is worth running. Some will not be, and that is information the market needed in 2024.

The ways it goes wrong are familiar from many outsourcing stories:

• Assuming the partner’s ledger is good enough. If the bank cannot reproduce who owns what from its own records, it does not really know.
• Pricing only on revenue share. Small programs then look free to add, while each brings its own supervisory workload.
• Growing partners faster than compliance. The sales pipeline moves quickly; the controls do not.
• Leaving exit terms for later. Rights that cost little to agree in a friendly negotiation become very expensive in a courtroom.
• Letting marketing outrun the facts on insurance. Customers hear “insured” and assume total protection against any failure.

The theme across all of them is the same. The bank lent its charter, and with it, the responsibility. Outsourcing the work did not outsource the accountability.

What a sponsor bank should be able to answer

• For every partner program, can we say from our own records, today, exactly how much each end customer is owed?
• Who in our organization owns the end-user ledger, by name, and can they tell the board how much is unreconciled right now, how many breaks are open and how old the oldest one is?
• What does each program cost us to supervise, and does its pricing cover that cost, or only its share of revenue?
• If our largest partner failed tonight, do our contracts give us the records, system access and customer communication rights we would need tomorrow morning?
• Do our customer disclosures describe deposit insurance accurately, including what it does not cover? Has counsel reviewed them recently?

These questions apply well beyond sponsor banks. Any organization that lets a partner hold its customer records, while keeping the legal obligation for them, faces a version of the same arithmetic.

A bank that can answer all five from its own records has priced the business. A bank whose answers begin with a partner’s name has found where its unpriced costs are.

With hindsight

Regulators followed the same three costs. In July 2024 the federal banking agencies issued a joint request for information on bank-fintech arrangements. It was a formal invitation for the industry and public to describe how these partnerships work and where the risks lie. Alongside it came a joint statement on deposit products offered through third parties. In September 2024 the FDIC proposed a recordkeeping rule for custodial deposit accounts with transactional features, aimed squarely at the ledger problem: making sure banks can tell who owns each dollar in a pooled account.

The July statement was careful to say it did not establish new supervisory expectations. It gathered existing requirements and gave examples of effective risk management. The request for information was broader than deposits, covering payment and lending arrangements too, and asked how banks and fintechs actually divided the work. Together they signaled that supervisors saw the issue as a feature of the model rather than of one bank.

The FDIC proposal shows most clearly how regulators read the Synapse failure, which it discussed at length. It would apply to custodial deposit accounts with transactional features: pooled accounts holding several beneficial owners’ money, from which those owners can direct payments to others. Banks would keep records of each beneficial owner’s balance and ownership category, in a standard electronic format, and reconcile them against the account balance at least daily. A bank could rely on a third party to keep the records only with direct, continuous and unrestricted access to them, including during that party’s insolvency or bankruptcy. A senior executive would certify compliance every year.

Those provisions map almost exactly onto the three costs. Daily reconciliation from records the bank can reach is the ledger cost. Access during a partner’s bankruptcy is the exit cost. An annual certification puts a named executive behind the oversight. Whatever the later course of the rulemaking, the proposal set down in regulatory language what a sponsor bank had to be able to do. Every bank pricing a program since has had that description to work from.

The market adjusted too. Many sponsor banks reduced partner counts, raised fees or left the business. That is what repricing looks like in practice. Once the costs of oversight and exit became visible, some programs no longer made sense at the old price.

End users waited a long time. In August 2025 the CFPB, the Consumer Financial Protection Bureau, brought a case against Synapse in its bankruptcy court and filed a stipulated judgment with a $1 civil penalty. That nominal penalty was not a slap on the wrist so much as a key: it let the agency draw on its Civil Penalty Fund to compensate end users. By the CFPB’s account, the banks held between $60 million and $90 million less than Synapse’s records showed. In November 2025 it allocated about $46 million from the fund to affected end users, and a further $9 million in May 2026.

The case itself was narrow. It was filed as an adversary proceeding in the bankruptcy court for the Central District of California on August 21, 2025, and the court entered the stipulated judgment on September 12, 2025. The Bureau alleged that Synapse violated the Consumer Financial Protection Act by failing to keep adequate records of where consumers’ funds were, and failing to make sure its records matched the partner banks’. The judgment also included injunctive relief, among it a ban on selling customer information. The Bureau’s case page noted that many consumers had not received their full balances.

The fund also showed the limits of public money as a backstop. It can compensate victims who have not been made whole, but it cannot create records that never existed. Establishing who was owed what still had to come first, from whatever the trustee and the banks could assemble.

From bankruptcy filing to the first large compensation allocation took well over a year. For ordinary customers, that is a long time to be without savings they believed were safe, and for the brands involved, a long time to absorb the reputational cost.

Some expectations from mid-2024 did not hold up. Banking-as-a-service did not disappear; sponsor banks kept running fintech programs, and new ones launched. What held up was the arithmetic. Banks that stayed in the business had to show examiners and partners that they could reconcile, oversee and exit, and the cost of doing so became part of the price.

Policy direction on fintech partnerships loosened in 2025. The economics did not change. Reconciliation, oversight and exit planning remain costs of holding the money, whatever the regulatory mood. A bank that prices them in can grow its partnerships with confidence. A bank that leaves them out is borrowing against a bill that will eventually arrive.