How do Uber and Starbucks use embedded payments, and what does that teach community banks about BaaS risk and compliance?

What is banking as a service (BaaS), and why are fintech–bank partnerships facing tougher regulatory scrutiny?

Review of Jason Mikula’s Humanize: Banking as a Service—BaaS explained, Durbin incentives, embedded payments, and key regulatory risks for banks and fintechs. Continue for the real-world cautionary cases (Evolve and Blue Ridge), the compliance pitfalls regulators cite most, and a practical due‑diligence checklist before signing any BaaS deal.

Recommendation

It’s telling that even as bankers and regulators are still figuring out exactly how to define banking-as-a-service (BaaS), its wave has already washed through the financial sector and receded. In this helpful overview, consultant Jason Mikula chronicles the rise and partial fall of a new breed of tech companies that aim to make finance more convenient for customers. Mikula points to pioneers like Uber and Starbucks, whose apps allow users to make payments and deposit earnings while boosting customer loyalty. He also outlines the regulatory disasters that have befallen some community banks that dove headlong into fintech partnerships. Financial professionals will find this a useful reference.

Take-Aways

• Banking-as-a-service (BaaS) creates opportunities and risks.
• The regulatory climate after the 2008 global financial crisis set the stage for the rise of fintechs.
• For smaller banks, fintechs offer a path to renewed relevance.
• Banking-as-a-service is all about making the consumer experience easier.
• Starbucks has capitalized on embedded payments.
• Regulatory issues pose a risk to BaaS partnerships.
• Other cautionary tales have emerged from the fintech boom.
• Problems at some banks ushered in a regulatory crackdown.

Summary

Banking-as-a-service (BaaS) creates opportunities and risks.

BaaS refers to a partnership between regulated banks and nonbank companies that require some sort of consumer-facing financial services. The concept remains loosely defined. But here’s one way to think of it: Say Uber or Lyft rely on their bankers to process customer payments and to distribute fees to drivers. That would just be a banking relationship, not BaaS. But if one of the rideshare companies were to offer a branded credit card to drivers and also to hold the drivers’ earnings, then the relationship would be considered BaaS.

“There is no legislative or regulatory definition of what is or is not banking-as-a-service in the United States, though some jurisdictions do provide greater regulatory clarity.”

BaaS has emerged with the rising prominence of financial technology, or fintech, companies. Fintechs typically are not chartered as banks, so they need to partner with regulated financial institutions to do business. But as fintechs mature, some have acquired regulated banks. This list includes SoFi, LendingClub, and Green Dot. Square, for its part, applied for and received a banking charter. Other fintech models include Mint, which helps consumers analyze and manage their finances, and digital wallets such as Apple Wallet, Google Wallet, and Venmo. No matter the fintech’s model, it typically needs BaaS to fill in the gaps in its offerings. While fintechs typically excel at design, user experience, marketing, and data science, they lean on old-school banks for their ability to hold deposits and manage risk.

The regulatory climate after the 2008 global financial crisis set the stage for the rise of fintechs.

A crucial factor in the US financial sector is the interchange fee, the cost added to credit card transactions. These charges, sometimes known as swipe fees, go to credit card issuers. The revenue supports the maintenance of payment networks, and it covers the costs of customer support and fraud. Interchange fees also fund credit card rewards programs. Swipe fees became the subject of a significant regulation in 2010: The Durbin amendment to the Dodd-Frank Act capped debit card interchange fees for banks with more than $10 billion in assets, but not for banks holding below that amount. As a result, fintechs offering debit cards have flocked to smaller banks as partners.

“Like so many other parts of the US financial system, practices around interchange are incredibly complex and an ongoing source of tension, particularly among card networks, merchants, and issuing banks.”

At the time, the rationale behind the Durbin amendment was that allowing smaller banks to collect heftier interchange fees would help them compete. An unintended consequence was that, a decade later, dozens of fintechs had partnered with banks below the $10-billion-asset mark to issue co-branded debit cards. These smaller banks generally don’t possess high-end technical capabilities, and the fintechs fill the gap. If the cardholder consumer spends $100, the merchant receives just $97.80; the remaining $2.20 is split among a variety of parties. The system that allows the merchant to accept credit card payments might get 50 cents, while the remaining $1.70 is parceled out among payment networks such as Visa or Mastercard, along with the bank and its fintech partner.

For smaller banks, fintechs offer a path to renewed relevance.

The banking industry has changed dramatically from the days of It’s a Wonderful Life, the classic film that depicted a financial institution as a community-based organization, one that took deposits and made loans within a confined geographic area. In the 20th century, if a bank wanted to attract deposits, it opened new physical branches. Now, marketing strategy is much different: Banks can use the internet to attract deposits from anywhere, making geographical locations an afterthought. The new reality has challenged smaller banks — they lack the marketing muscle of Chase, Wells Fargo, and Bank of America, and the retail branches that once drove their business have become less important. These smaller institutions have looked to fintech partners to funnel new loans and deposits onto their balance sheets. For banks challenged by a changing market, fintechs offer a compelling pitch.

“Consumer-facing fintechs promised to function as nationwide deposit-gathering front ends for small, local banks.”

Fintechs can help banks gather deposits in several ways, including:

• From lower-income consumers — Companies such as Chime, Current, and Dave appeal to consumers with lower incomes, lower levels of wealth, and smaller account balances. These consumers shy away from the hefty fees charged by large banks.
• From higher income savers — Apple partnered with Goldman Sachs to offer savings accounts for affluent consumers.
• Through peer-to-peer payments — Cash App, Venmo, and Apple Cash are all examples of payment systems that let consumers transact without cash or checks. While users typically keep small balances in the accounts, they generally have a bank account linked to the account.
• Through “neobrokerage” — Companies such as Robinhood, Public.com, and eToro offer cash management accounts and a way for consumers to invest their funds.

Banking-as-a-service is all about making the consumer experience easier.

The ride-sharing app Uber offers a compelling illustration of the BaaS trend of reducing customer hassles. In pre-Uber days, passengers in taxis had to either carry cash or hope the cab driver accepted credit cards. Payment took place in a transaction at the end of the ride. Uber has completely reshaped the consumer thought process. The customer’s credit card is stored in the Uber app, and the fares are automatically charged. No longer does the rider need to pay at the end of the trip, or even think about the fare. It’s a subtle but powerful shift.

“While apparently relatively minor on the surface, embedding payments solved multiple pain points, thus reducing friction.”

Uber’s financial innovation may be even more meaningful for Uber drivers, many of whom are squeezing out a living from the service. Uber allows drivers to instantly move their earnings to an external bank account. This feature helps keep drivers on the road — if drivers with tight finances had to wait a week or two to get paid, they might not be able to afford to buy gas or get a car wash. The embedded payment system lets Uber drivers keep driving, while also incentivizing them to work more.

Starbucks has capitalized on embedded payments.

Starbucks encourages its customers to pay for their coffee through the Starbucks app, which acts like a stored-value card. Customers load their Starbucks account with money from a credit card, debit card, or bank transfer. Starbucks realized that consumers needed an incentive to pay through the app rather than simply swiping a credit card at the point of sale, so customers who purchase through the app receive a reward currency known as Stars. To encourage those customers to come back, the app rewards them with Stars not just for routine transactions but also for buying on certain days, for playing games, and for completing challenges.

“The effort has been wildly successful, with 34.3 million users as of early 2024.”

The Starbucks app has been a hit — it is used for about one-third of all transactions at Starbucks’s US stores. More than 34 million customers have moved more than $1 billion into their stored-value wallets. A little-noticed benefit is that Starbucks saves money on payment processing: If a customer moves $15 into the app and then makes three separate purchases of $5 each, the retailer is hit with interchange fees on just one transaction rather than on all three. Meanwhile, the program boosts customer loyalty, and it even lets Starbucks use the unspent balances as a zero-interest loan.

Regulatory issues pose a risk to BaaS partnerships.

Even as technology advances and delivery systems evolve, US banking remains a highly regulated sector. The industry’s three main overseers — the Federal Reserve, the Federal Deposit Insurance Corporation, and the Office of the Comptroller of the Currency (OCC) — mandate that banks are responsible for the actions of their fintech partners. In one example, Evolve Bank & Trust of Arkansas used fintech partnerships to grow its balance sheet to more than $1.5 billion in deposits by the end of 2022. However, Evolve was hit with a major regulatory action by the Federal Reserve Bank of St. Louis in 2024. The Fed flagged shortcomings in the bank’s risk management and anti-money laundering controls. Around the same time, Evolve made public that it had been the victim of a ransomware attack.

“US bank regulators have made it increasingly clear that they are paying attention to the unique risks posed by banking-as-a-service.”

Evolve illustrated that BaaS partnerships don’t absolve financial institutions of their requirement to oversee business partners. Banks’ responsibilities include:

• Initial vetting — A chartered financial institution must conduct a thorough examination of a partner, looking into the fintech’s finances, business acumen, information security, risk management, and other factors.
• Ongoing oversight — Even after the fintech passes muster, the bank must continue to monitor its partner’s practices and risk management.
• Anti-money laundering compliance — Fintechs frequently are the point of direct contact with consumers, so the bank must make certain that its partner is adhering to the same rules that the bank itself would be expected to follow. This includes complying with Know-Your-Customer rules, and then monitoring transactions and filing suspicious activity reports.
• Tech oversight — While banks do business with fintechs to tap into their technology prowess, banks remain very much on the regulatory hook in terms of risk management and information security.
• Lending compliance — Banks must make sure that their fintech partners comply with a long list of relevant laws, including the Truth in Lending Act (TILA), the Fair Debt Collection Practices Act (FDCPA), the Servicemembers Civil Relief Act (SCRA), and the Equal Credit Opportunity Act (ECOA).

Other cautionary tales have emerged from the fintech boom.

Community banks can use BaaS partnerships to fuel growth. But a few high-profile mishaps have underscored just how much responsibility rests with the chartered financial institutions. One such example comes from Blue Ridge Bank, which has existed since 1894. In 2015, the institution had $267 million in assets, making it a small fish in the banking ocean. Then it embarked on an aggressive growth spree, snapping up three small banks from 2016 to 2020. In addition to the acquisitions, Blue Ridge began partnering with BaaS firms. The bank was attracted by the usual advantages — it could grow its balance sheet without expanding its physical presence, and the fintech strategy promised low-cost deposits.

“This isn’t to say that community banks cannot successfully pursue BaaS models, but rather that doing so requires adequate investment in control-side infrastructure.”

Through partnerships with a variety of fintechs, including Upgrade, Kashable, and Jaris, Blue Ridge grew rapidly. By early 2022, its BaaS efforts had generated nearly $330 million in deposits. But then came its fall: In late 2022, the OCC issued an expansive regulatory agreement with Blue Ridge. The OCC said Blue Ridge’s partners had not complied with the Bank Secrecy Act, suspicious activity monitoring and reporting, or information security protocols. By 2024, Blue Ridge had agreed to a consent order with its regulator. The OCC labeled the bank “troubled” and ordered it to raise its capital and leverage ratios. Blue Ridge was forced to raise capital and to replace its low-cost deposits with much more expensive brokered deposits.

Problems at some banks ushered in a regulatory crackdown.

The enforcement actions against Evolve and Blue Ridge were especially dramatic, but a number of other community banks have come under regulatory scrutiny since 2022. Some bankers may see the regulatory backlash as too risky and may choose to back away from any flirtations with fintechs. Inevitably, BaaS partnerships are something of an awkward alliance: Bankers are steeped in a tradition of caution, compliance, and risk avoidance. Technologists, however, much prefer the “move fast and break things” ethos. Both approaches have their pros and cons, of course, but the competing mindsets complicate any partnership between banks and fintechs.

“There long has been a culture clash between ‘bankers,’ who tend to focus on risk mitigation, and the technologists that dominate nonbank fintech companies, who tend to prioritize innovation driven by a test-and-learn approach over perfection.”

Stricter regulatory oversight is just one headwind for the BaaS trend. Another factor is that fintechs have lost some of their appeal to investors. While fintechs raised $121.1 billion in global venture capital in 2021, that figure plummeted to $46.3 billion in 2023. Meanwhile, as venture capital recedes, it’s clear that not all fintech models will succeed, and some, such as Synapse, have failed. The overall model of BaaS remains a viable one, but the concept is experiencing some post-boom turmoil.

About the Author

Jason Mikula is the publisher of Fintech Business Weekly, a newsletter about the rapidly evolving financial services ecosystem. He also advises and invests in early-stage start-ups.