Updated: October 20, 2026
Banking as a Service (BaaS) is often described as banking delivered through software. The practical model is more specific: a licensed bank provides regulated accounts, payments or lending, while a technology company connects those services to its own app or business through application programming interfaces (APIs). In 2026, the opportunity is still real, but the conversation has shifted from rapid launches to accountable delivery. Regulators and customers increasingly expect clear responsibility for deposits, complaints, fraud, data and service outages—not simply a polished interface.
The strongest developments to watch are therefore not just artificial intelligence (AI) or blockchain. They include better controls over fintech-bank partnerships, instant payment infrastructure, embedded credit with responsible underwriting, and operational systems that can explain decisions and recover from disruption. Rules differ by country, so a BaaS product available in the United States may not work the same way in the United Kingdom or European Union. The sections below focus on what these changes mean in practice, which technologies are maturing, and what businesses should check before choosing a provider.
- 1 January 2025 date the EU Digital Operational Resilience Act (DORA) began applying to covered financial entities
- 7 seconds maximum execution time under the U.S. FedNow Service, subject to successful processing
- 2026 year the EU AI Act’s general application date falls on 2 August, with phased exceptions and earlier obligations
The Rise of Banking as a Service (BaaS)
BaaS lets a non-bank company incorporate regulated financial functions into a product without becoming a bank itself. A U.S. sponsor bank might hold customer deposits and issue a debit card, while a fintech supplies the app, customer support and transaction interface. In the UK, an electronic-money institution may issue e-money, but that balance is not automatically a bank deposit protected by the Financial Services Compensation Scheme (FSCS). The distinction matters: “banking-like” features do not establish who holds funds or what protection applies.
Growth in BaaS reflects demand for accounts and payments inside familiar products—payroll software, marketplaces, expense tools and retail apps. But the model is not simply an API purchase. Each arrangement has a chain of responsibilities: the bank or licensed institution owns regulated decisions, the program manager may coordinate operations, and the distributor communicates with the end user. If contracts do not assign customer identification, transaction monitoring, complaints, refunds and incident reporting clearly, failures can leave customers unsure whom to contact.
Recent U.S. enforcement actions and bank-supervisory scrutiny have made oversight a central commercial issue. The Federal Deposit Insurance Corporation (FDIC) has repeatedly emphasized that deposit insurance applies to deposits at an insured bank, not to a fintech brand or an app balance in itself. Pass-through deposit insurance can depend on recordkeeping and other requirements; customers should not infer coverage from a logo. For businesses, a provider’s bank partner, account structure and reconciliation process deserve the same attention as API uptime.
Before launching, a company should map the funds flow from customer payment to settlement and identify the regulated entity at every step. It should ask who performs Customer Identification Program checks, who files suspicious activity reports where required, how daily ledger balances are reconciled, and how customers recover funds if the program manager fails. The OCC’s third-party risk-management guidance and the Federal Reserve’s supervisory expectations are useful reference points for U.S. banks; they do not remove the bank’s responsibility to supervise vendors.
| Structure | Typical regulated provider | Key customer check |
|---|---|---|
| U.S. app-based deposit account | FDIC-insured partner bank | Confirm the bank, account ownership and applicable deposit-insurance terms |
| UK e-money wallet | FCA-authorised electronic-money institution | Check safeguarding disclosures; e-money is not an FSCS-protected bank deposit |
| EU payment account | Credit institution or authorised payment institution | Identify the licence, safeguarding or deposit-protection arrangement and country of authorisation |
Artificial Intelligence: The Game Changer
AI is already useful in banking operations, but its value depends on the task and the controls around it. Machine-learning models can rank transactions for fraud review, help route service requests and identify unusual account behavior. For example, a card issuer can combine device, merchant and transaction signals to decide whether to request an additional verification step. That is more useful than treating AI as a guarantee that fraud will be prevented: models can produce false positives, miss new attack patterns or disadvantage customers whose behavior differs from the training data.
For BaaS providers, a practical deployment should define the model’s purpose, permitted data, performance measures and escalation path. Fraud teams need to know how often alerts are correct and how quickly a human reviewer can reverse a mistaken block. Credit models require additional scrutiny: in the United States, the Equal Credit Opportunity Act and Regulation B apply to covered credit decisions, and the Consumer Financial Protection Bureau has said that creditors must provide specific reasons for adverse actions even when complex algorithms are used. “The model said no” is not an adequate explanation.
AI can also support risk-based authentication and anti-money-laundering investigations by grouping related activity for analysts. It should not be confused with a substitute for legally required controls or qualified staff. A suspicious-activity monitoring system still needs documented thresholds, quality checks and a route for filing reports where required. Institutions should test changes against historical cases and monitor drift as customer behavior, fraud tactics and payment channels change.
Customer-facing personalization can be helpful when it is based on clear consent and produces a useful outcome, such as alerting a user that a recurring bill is due. It becomes more problematic if sensitive transaction data is repurposed for marketing without an appropriate legal basis or if a recommendation is presented as independent financial advice. The UK General Data Protection Regulation and the EU GDPR both impose requirements around personal-data processing; the precise obligations depend on the parties, purpose and jurisdiction.
- Fraud: Measure alert precision, false declines and loss rates—not just the volume of transactions screened.
- Credit: Retain understandable reasons for decisions and test outcomes across relevant customer groups.
- Governance: Record model versions, training data sources, human overrides and incident response procedures.
Generative AI: Transforming Customer Interactions
Generative AI can draft answers, summarize a long support history or help an agent find the right procedure. In a BaaS program, that may reduce time spent searching separate systems for a card dispute, a cash transfer or a failed identity check. The safest near-term pattern is an assistant grounded in approved product documents and customer-specific information that the user is authorized to see, with a human able to review consequential actions.
A conversational tool should not be allowed to invent account terms, promise that a transfer will settle by a particular time, or make an unsupported claim about deposit protection. Retrieval from a controlled knowledge base can reduce such errors, but it does not eliminate them. Providers should test prompts involving fraud, vulnerable customers, complaints, mistaken transfers and requests to disclose another person’s data. They should also keep a record of what the system answered and which source material it used, subject to applicable retention and privacy rules.
Generative AI can assist product teams by summarizing anonymized feedback or drafting alternative explanations of a fee. It should not silently determine eligibility or generate a credit decision without the controls required for that decision. Under the EU AI Act, the general application date is 2 August 2026, while some provisions have different effective dates; systems used in regulated financial contexts need a careful assessment of classification and obligations rather than a blanket assumption that every chatbot is high-risk or exempt.
Marketing is another possible use, but personalization can cross a line when financial hardship or health-related information is inferred from spending. A bank or fintech should define prohibited audience segments, review generated claims and make opt-outs accessible. The U.S. Federal Trade Commission’s consumer-protection authority and national privacy and advertising laws can be relevant even when the marketing model is supplied by a vendor.
The commercial test is simple: does the tool resolve a real customer problem with fewer errors, without making accountability harder to trace? A bot that answers a basic balance question may be low-risk; one that initiates a payment, blocks an account or recommends borrowing requires stronger authentication, clear confirmation and an accessible human route.
Cybersecurity Innovations for 2026
BaaS expands the number of connected systems handling identity data and money. A mobile app, identity vendor, processor, cloud provider and sponsor bank may all play a role in one transaction. Security therefore depends on the whole chain: API permissions, encryption, access management, vendor monitoring and tested recovery plans. A breach at a non-bank partner can still disrupt service or expose customer information, even if the bank’s core ledger remains intact.
Passkeys and phishing-resistant authentication are important developments. The FIDO Alliance’s passkey approach uses public-key cryptography tied to a user’s device or password manager, reducing reliance on reusable passwords and one-time codes that can be phished. It is not a complete defense against account takeover: recovery processes, device compromise and social engineering still matter. Providers should offer secure recovery, notify customers of new devices and use step-up checks for high-risk actions such as changing a payee or withdrawal destination.
AI-based security tools can flag unusual login patterns or payment behavior, but automated blocking needs a fast appeal and recovery path. Security teams should measure time to detect and contain incidents, not only the number of alerts. API controls should include authentication, least-privilege scopes, rate limits, secrets management and continuous testing. OpenAPI documentation can help teams understand endpoints, but documentation alone is not a security control.
Quantum-safe cryptography is a longer-horizon preparedness issue, not a reason to claim that current banking encryption has already been broken. In August 2024, the U.S. National Institute of Standards and Technology finalized its first three post-quantum cryptography standards: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA). Banks and technology vendors should inventory cryptographic dependencies and plan how systems could migrate as standards and supervisory expectations develop. The immediate priority remains sound key management and timely patching.
For firms within scope, the EU Digital Operational Resilience Act (DORA) has applied since 17 January 2025. It sets requirements on ICT risk management, incident reporting, resilience testing and oversight of critical ICT third-party providers. In the United States, incident-reporting obligations vary by institution and regulator; a company should map its own deadlines instead of assuming one universal reporting window. A tested playbook should name decision-makers, customer-notification responsibilities and backup payment procedures.
The Role of Embedded Finance
Embedded finance places a payment, account, credit or insurance function inside a non-financial product. A seller may accept payment and offer a working-capital loan in its commerce dashboard; a payroll platform may provide wage access or an employee card. The customer sees one journey, but the provider must still identify which entity takes deposits, extends credit, transmits money or underwrites insurance.
Payments are generally the most mature use case. A marketplace can use a payment processor to collect funds and pay sellers, but the arrangement may involve money-transmission licensing, safeguarding, chargeback rules and settlement obligations depending on location and structure. In the United States, card transactions also sit within card-network rules and applicable consumer protections, including Regulation E for certain electronic fund transfers from consumer accounts. A merchant’s checkout design should disclose the amount, timing and recipient before the customer confirms.
Embedded credit can make financing available at the point of need, but convenience does not make a loan affordable. Providers should disclose the annual percentage rate (APR), fees, repayment schedule and consequences of missed payments in the way required by local law. In the U.S., the Truth in Lending Act and Regulation Z govern many consumer-credit disclosures; buy-now-pay-later products can have specific coverage and evolving rule treatment. In the UK, consumer-credit activity may require Financial Conduct Authority authorisation. Businesses should verify the lender and complaint route rather than treating a “pay later” button as a mere checkout feature.
Data is a potential advantage and a material risk. A platform may know a merchant’s sales history and tailor a cash-flow product, but it should explain what data supports the offer, how long it is retained and whether it is shared with a lender. Consent and data minimization matter, particularly where transaction data can reveal sensitive personal circumstances. The business should also plan for the operational case in which its BaaS provider suspends service: can customers access statements, make repayments or retrieve funds?
Good embedded finance works because it removes unnecessary steps while keeping essential disclosures visible. Its success should be measured by completed transactions, complaint rates, loss rates and customer outcomes—not by the number of financial features added to an app.
Mobile-First Banking: A Necessity, Not an Option
A mobile-first service is not simply a desktop website squeezed onto a phone. Customers need to see available balances, pending transactions, fees and payment status in a way that distinguishes settled money from funds that are still in transit. Clear status labels matter when a bank transfer is instant but a card authorization remains pending, or when a returned payment changes the account balance later.
Useful mobile features include device-based passkeys, immediate card freezes, merchant-specific card controls, accessible statements and alerts that can be adjusted by the customer. The Consumer Financial Protection Bureau’s Regulation E in the United States sets rules for error resolution and unauthorized electronic transfers on covered consumer accounts; an app should make it straightforward to report an error and should not replace formal rights with a chatbot-only process. UK and EU services have their own complaint and payment-services frameworks.
Accessibility is a product requirement, not a cosmetic extra. WCAG 2.2, published by the World Wide Web Consortium in October 2023, includes criteria relevant to mobile interfaces, including focus visibility and target size. Banks should test with screen readers, enlarged text and customers with motor or cognitive impairments. A biometric-only sign-in can create problems for customers who cannot use the supported sensor, so an alternative secure method is needed.
Mobile banking also raises resilience questions. Customers should know how to reach support if the app is unavailable, and high-risk transactions should have confirmation screens that show the payee and amount before submission. A bank and its fintech partner need to test app updates, API changes and outage communications together. Convenience is valuable only when customers can still understand and control what happens to their money.
Automation in Banking Operations
Robotic process automation (RPA) uses software scripts to carry out repetitive, rules-based tasks, such as moving data between systems or checking whether a required document is present. It can reduce manual re-entry in account opening and reconciliation, but it is brittle when screen layouts change or source data is inconsistent. A bot that repeats a mistake at high speed can create more work than it removes.
For BaaS operators, the best automation candidates are bounded and measurable: matching transactions across a ledger and processor file, routing a complete complaint to the right team, or reminding staff that a document is missing. Before automating, teams should document exceptions and assign a person to review unresolved cases. Reconciliation should compare the customer ledger, bank records and processor settlement reports, with differences escalated rather than silently written off.
Combining RPA with machine learning can support document classification or anomaly ranking, but these are different technologies and need different controls. A model may estimate which item deserves attention; a deterministic rule should govern whether a payment is released or an account is closed. Changes should be tested in a controlled environment and logged with an owner, rollback plan and version history.
Automation can also improve compliance operations by collecting evidence for audit and tracking service-level deadlines. It does not transfer regulatory responsibility from the bank or licensed provider to a software vendor. Firms should calculate the full cost, including integration, monitoring, exception handling and business continuity. A realistic success measure is fewer unresolved exceptions and faster accurate completion—not simply fewer staff hours per case.
Regulatory Considerations and Compliance
Regulation is one of the main forces shaping BaaS in 2026, and the applicable rules depend on where customers live, what the product does and which entity performs each activity. In the United States, a bank’s partnership with a fintech does not outsource the bank’s legal responsibilities. The FDIC, Office of the Comptroller of the Currency (OCC) and Federal Reserve have each issued third-party risk-management expectations; the 2023 interagency guidance describes a lifecycle that includes planning, due diligence, contract negotiation, ongoing monitoring and termination.
Payment products must also fit the relevant licensing and consumer-protection framework. In the U.S., state money-transmitter laws may apply to non-bank payment activity, while Regulation E covers specified electronic transfers involving consumer accounts. Deposit advertising should not imply that a fintech itself is FDIC-insured. Where pass-through insurance is claimed, recordkeeping must support identification of the actual owners and their interests under the applicable rules.
In the EU, the revised Payment Services Directive (PSD2) remains a major framework for payment services and strong customer authentication, while the EU’s Instant Payments Regulation entered into force in 2024 with phased implementation dates. It requires covered euro-area payment service providers to meet instant-payment obligations on a timetable that varies by provider type and obligation. DORA, applicable from 17 January 2025, adds operational-resilience requirements for covered financial entities and oversight of certain ICT providers. These are separate regimes: meeting payment authentication requirements does not by itself satisfy resilience obligations.
AI governance is another moving area. The EU AI Act entered into force in 2024 and applies in stages; its general application date is 2 August 2026, with specified provisions applying earlier and some obligations phased later. A bank using an AI system should determine its role—provider, deployer or both—and assess the system’s classification. In the UK and U.S., existing financial, privacy, equality and consumer-protection laws can still apply even without a single comprehensive AI statute.
A practical compliance program begins with a product map: customer location, legal entity, licence, funds flow, data flows and outsourced providers. It should include a named owner for each control, documented complaints and error handling, audit access in vendor contracts, incident notification duties and an exit plan. For customers, the corresponding questions are straightforward: who holds the money, what protection applies, how can an error be disputed, and which regulator or ombudsman handles a complaint?
Real-Time Payments and Interoperability
Instant payments are a concrete infrastructure change with direct consequences for BaaS products. In the United States, the Federal Reserve’s FedNow Service launched in July 2023 and supports transfers between participating institutions, with funds available to the recipient within seconds when a payment completes successfully. The Clearing House’s RTP network is a separate U.S. instant-payment rail. Neither system means every bank account can send or receive every payment at all times; participation, limits, fraud controls and the payment purpose matter.
In the European Union, the Instant Payments Regulation (EU) 2024/886 introduced requirements around sending and receiving euro instant credit transfers, verification of payee and charges. Implementation is phased, and deadlines differ for euro-area and non-euro-area payment service providers. Verification of payee is designed to help identify a mismatch between an account identifier and the named recipient, but customers still need to examine the details and beware of scams.
For a fintech building on these rails, faster settlement changes fraud economics. A transfer may be difficult or impossible to recall once completed, so providers need checks before execution, clear confirmation screens and a rapid process for reporting suspected scams. APIs should return an unambiguous status—accepted, pending, rejected or completed—rather than presenting a queued instruction as settled funds. Customer terms should explain limits, availability and how disputes are handled.
Interoperability also means designing for multiple rails rather than assuming one network serves every use case. A card payment, ACH transfer, Faster Payments transaction in the UK and euro instant credit transfer have different settlement, return and dispute characteristics. Businesses should compare total cost, availability, reversibility and recipient coverage when selecting a route. Routing decisions should be monitored for failed payments and unfairly uneven access, not optimized only for the lowest processing fee.
What Businesses and Customers Should Watch Next
For a business evaluating a BaaS partner, the most important questions concern operational proof. Request the name and regulatory status of the bank or licensed institution, a diagram of the funds and data flows, the latest independent security assurance, uptime and incident history, and a sample reconciliation report. Ask what happens if the partner or sponsor bank terminates the relationship, and how customers can receive statements or recover funds during a transition.
Contracts should assign responsibility for onboarding, sanctions screening, transaction monitoring, complaints, refunds, data breaches and regulatory exams. They should include audit rights, access to relevant records, service-level measures and assistance with an orderly exit. A provider that cannot explain its subcontractors or explain how a ledger is reconciled presents a material risk, regardless of how quickly its API can be integrated.
Customers should check whether a balance is a bank deposit, e-money or another claim; identify the legal entity holding or safeguarding funds; and read the provider’s fee and dispute disclosures. In the United States, look for the actual insured bank and the conditions of any pass-through deposit-insurance representation. In the UK, distinguish FSCS-protected bank deposits from e-money safeguarding. A familiar brand is not, by itself, a statement of legal protection.
The most durable BaaS innovations in 2026 are likely to be those that make financial services easier to use without obscuring who is accountable. AI can help staff and customers, instant payments can shorten settlement, and embedded products can remove friction. Each also raises a specific question: can the decision be explained, can the payment be reversed or disputed, and can the customer still access help when a provider fails? Providers that answer those questions clearly will be better positioned than those that treat innovation as a feature launch alone.