Banking-as-a-Service compliance has one organizing rule: every regulatory obligation attaches to the chartered bank, no matter how many fintechs, program managers, or middleware platforms sit between the bank and the end user. The practical requirements then split into five domains: BSA/AML, consumer protection, deposit insurance and funds handling, licensing, and third-party oversight. This guide maps each domain to its source regulation and to the party that performs the work versus the party that answers for it.
That distinction, performs versus answers, is where BaaS programs fail examinations. The July 2024 interagency joint statement on third-party deposit arrangements states it directly: a bank's use of third parties to perform activities does not diminish its responsibility to comply with all applicable laws and regulations.
Key Takeaways:
- The sponsor bank is accountable for all regulatory obligations in a BaaS program; fintechs and middleware can perform functions but cannot absorb the obligation
- BSA/AML requirements, program pillars, CDD, SAR filing, apply to partner-channel activity exactly as to branch activity, and the bank needs independent data access to meet them
- Fintechs carry their own obligations too: state licensing where applicable, UDAAP exposure, and contractual compliance duties the bank must enforce
- Deposit insurance misrepresentation (12 CFR Part 328) and custodial account recordkeeping are active supervisory priorities in BaaS
- Most public BaaS enforcement actions cite the oversight layer: the bank could not independently see or control what was happening in its own programs
Who Owns What in a BaaS Program
A typical BaaS stack has three layers: the sponsor bank (charter, deposit insurance, payment rails), an optional middleware platform or program manager (APIs, ledgers, program operations), and the fintech (brand, product, customer relationship). Compliance work is distributed across all three. Accountability is not.
| Domain | Who typically performs | Who answers to regulators |
|---|---|---|
| BSA/AML program, CDD, transaction monitoring | Fintech or middleware collects data; bank sets standards and monitors | Bank |
| SAR and CTR filing | Bank (fintech escalates alerts) | Bank |
| Consumer disclosures (Reg Z, Reg E, Reg DD, GLBA) | Fintech drafts; bank reviews and approves | Bank |
| Marketing and UDAAP | Fintech executes; bank pre-approves and monitors | Bank, and the fintech directly for UDAAP |
| Deposit insurance representations | Fintech-facing content | Bank, and the non-bank directly under Part 328 |
| Ledger and FBO reconciliation | Middleware or fintech maintains ledgers | Bank |
| State licensing (lending, money transmission) | Fintech | Fintech, with the bank verifying in diligence |
| Third-party oversight program | Bank | Bank |
The full obligation map from the bank's side is covered in sponsor bank compliance obligations; the fintech's side of the table is covered in our neobank compliance requirements guide.
AML in BaaS: The BSA Requirements
BSA obligations run to the bank. Under 31 CFR § 1020.210, the bank's AML program, internal controls, independent testing, a designated BSA officer, training, and customer due diligence, must cover partner-channel customers and transactions to the same standard as the bank's own. Beneficial ownership collection under 31 CFR § 1010.230 and SAR filing under 31 CFR § 1020.320 apply unchanged. The FFIEC BSA/AML Examination Manual is the standard examiners test against.
What makes AML in BaaS distinct is the data path. Customer identification, risk scoring, and transaction activity originate in the fintech's or middleware's systems. That creates four requirements the bank must engineer, not assume:
- Bank-defined standards. KYC procedures, risk-rating thresholds, EDD triggers, and prohibited customer types are set by the bank and imposed contractually, with the bank validating execution through testing.
- Independent data access. The bank needs its own access to customer and transaction data at a frequency that supports monitoring, not a monthly summary from the partner. Banks that could not independently see partner activity are a recurring feature of the enforcement record.
- Monitoring coverage proportional to volume. Scenarios tuned for a community bank's organic activity will not cover a partner program that triples transaction volume; coverage and tuning must track program growth.
- Bank-controlled SAR decisions. Partners escalate; the bank investigates, decides, and files within the regulatory deadlines. SAR quality and timeliness cannot be outsourced.
For exam-facing preparation on this domain, see BSA/AML exam preparation for BaaS platforms.
Consumer Protection Requirements
Every consumer regulation that attaches to the account or loan attaches to the bank of record: Truth in Lending (Reg Z), Electronic Fund Transfers (Reg E) including its error-resolution deadlines, Truth in Savings (Reg DD), ECOA and fair lending, GLBA privacy and safeguards, and UDAAP under both FTC Act Section 5 and the CFPB's authority. The fintech's control of the customer interface changes who does the work; it does not change who answers.
Operationally, this means the bank reviews and approves customer-facing disclosures before launch and at every change, monitors marketing (including app content and influencer campaigns) against UDAAP standards, oversees complaint intake and error-resolution timelines wherever complaints arrive, and tests fair lending outcomes for credit programs. The CFPB's Supervisory Highlights document recurring findings where bank oversight of partner marketing and disputes lagged the program's actual conduct.
Deposit Insurance, Part 328, and Custodial Accounts
Deposit-focused BaaS carries two requirements that have moved to the center of supervisory attention:
- No misrepresentation of deposit insurance. 12 CFR Part 328 governs use of the FDIC name and logo and prohibits misrepresenting what is insured. Fintech marketing that implies the fintech itself is insured, or omits that pass-through insurance depends on conditions, creates direct exposure for the non-bank and supervisory exposure for the bank.
- Accurate custodial recordkeeping. Pass-through insurance and basic funds safety depend on ledgers that can tie every dollar in a pooled FBO account to its beneficial owner, continuously. The 2024 joint statement highlights ledger and reconciliation failures as a core risk in these arrangements. Our deep dive on FBO account reconciliation in BaaS covers the control design.
BaaS Licensing: Who Needs What
The bank's charter covers deposit-taking and, in most program designs, lending. The fintech operating on top of it is not license-free:
- Money transmission. A fintech that holds or moves customer funds outside the bank's direct custody may need state money transmitter licenses; program structure determines whether activity stays within the bank's exemption footprint.
- Lending and servicing. State lender, broker, servicer, and collection licenses can apply to the fintech's role in credit programs, alongside state rate and fee laws.
- Brokered deposit treatment. How deposits arrive through partners affects their classification and the bank's liquidity and reporting obligations.
The bank's diligence must verify the partner's licensing posture before launch and re-verify as products and states change; see the sponsor bank due diligence checklist. Fintechs weighing whether they need a charter at all should start with whether a neobank needs a bank charter.
The Oversight Layer: Where BaaS Programs Actually Fail
Public enforcement actions against BaaS banks rarely cite a missing policy. They cite the oversight layer: third-party risk programs that did not match program scale, boards that did not see partner-level risk, banks without independent access to partner data, and remediation that lagged growth. The requirements come from the 2023 Interagency Guidance on Third-Party Relationships (OCC Bulletin 2023-17, FDIC FIL-29-2023, FRB SR 23-4), applied to relationships that almost always qualify as critical activities.
Two companion guides cover this layer in depth: what the consent orders require and teach, and how to build the sponsor bank oversight program that keeps a bank off that list.
Operationalizing BaaS Compliance
Every requirement above decomposes into recurring work: CDD standards tested, ledgers reconciled, disclosures re-approved, marketing reviewed, complaints tracked, licenses re-verified, findings remediated. In a multi-partner program that is thousands of dated, owned, evidence-producing tasks a year, and the examination question is always the same: show us.
Canarie turns those obligations into exactly that, scheduled tasks with owners, deadlines, and captured evidence, across every partner in the program, so the bank's accountability is demonstrable rather than asserted.
See how BaaS compliance teams run partner obligations in one system →
Frequently Asked Questions
What are the compliance requirements for BaaS?
BaaS compliance requirements span five domains: a BSA/AML program covering all partner-channel activity (31 CFR Part 1020), consumer protection compliance for every partner-delivered product (Reg Z, Reg E, Reg DD, ECOA, UDAAP, GLBA), deposit insurance representation and custodial recordkeeping rules (12 CFR Part 328), licensing appropriate to each party's role, and a third-party oversight program meeting the 2023 interagency guidance. All of them are ultimately the chartered bank's responsibility.
Who is responsible for AML in BaaS?
The sponsor bank. Fintech and middleware partners can perform operational functions such as identity verification and alert generation, but the bank sets the standards, must maintain independent access to customer and transaction data, validates partner execution through testing, and retains SAR investigation and filing authority. The BSA obligation cannot be transferred by contract.
Do fintechs in BaaS programs need their own licenses?
Often, yes. Depending on program structure, a fintech may need state money transmitter licenses, lender or servicer licenses, or collection licenses, and it carries direct UDAAP and FDIC-misrepresentation exposure regardless of licensing. The sponsor bank is expected to verify a partner's licensing posture during due diligence and monitor it as products and geographies change.
Is BaaS regulated differently from regular banking?
No separate BaaS rulebook exists, and that is the point: the same statutes and regulations apply, delivered through a structure that makes compliance harder to execute and prove. The agencies' BaaS-specific issuances, the 2023 third-party guidance and the 2024 joint statement on deposit arrangements, clarify how existing requirements apply rather than creating new ones.
What happens when a BaaS program fails compliance requirements?
The documented pattern runs from examination findings (MRAs and MRIAs) to formal enforcement: consent orders requiring lookbacks, partner-by-partner re-approval, staffing plans, independent validation, and regulator non-objection before program growth, sometimes with civil money penalties. Several banks exited BaaS entirely under the weight of remediation. The escalation mechanics are covered in MRA vs. MRIA vs. consent order.
BaaS compliance requirements are ordinary banking requirements executed through an extraordinary structure. The bank that treats each partner as a delivery channel for its own obligations, with standards it sets, data it can see, and evidence it captures, meets them. The bank that treats compliance as the partner's department meets the enforcement record instead.