Banking as a Service After the Crackdown: The Consolidation Playbook

Banking as a service was sold on a genuinely good idea: a fintech should not have to spend years and enormous capital obtaining a bank charter to offer a deposit account or a debit card. Rent the charter, integrate an API, ship in months. That idea was correct, and it produced a decade of products that would not otherwise exist.

The execution had a defect at its center, and the defect was not regulatory hostility or immature technology. It was that the arrangement inserted a third party between the bank and the customer, gave that third party the ledger, and left the bank legally responsible for obligations it could not directly observe. A sponsor bank held the deposits and carried the regulatory liability. A middleware platform ran the software that recorded which end customer owned which portion of a pooled account. The fintech held the customer relationship. Three parties, one set of obligations, and a system of record sitting with the party that had the least regulatory accountability.

That model is finished. The replacement is not the disappearance of embedded finance, which continues to grow, but its consolidation into fewer, larger, compliance-first arrangements where the bank sees every ledger entry and owns every compliance decision. The strategic consequences follow mechanically from that shift: higher minimum program sizes, longer launch timelines, better economics for sponsor banks, and a market that now favors incumbents and well-capitalized fintechs over the long tail that the original model was built to serve. The thing that made banking as a service democratizing is exactly the thing regulators removed.

What Actually Failed

The failure was a reconciliation gap, and it is worth being precise about the mechanism because the whole regulatory response follows from it.

Most middleware-era programs used a for-benefit-of account structure. The sponsor bank held one or a small number of pooled accounts in the name of the fintech or the platform, for the benefit of end customers. Inside that pool, the individual customer balances existed only as entries in a ledger maintained off the bank's core system, typically by the middleware platform. From the bank's perspective the pooled account held a large balance. Who owned which slice of it was a fact the bank knew only because a third party's software said so.

That structure works precisely as long as the third party's ledger is accurate and reconciles to the bank's balance. When it does not, there is no authoritative record to fall back on. The Synapse collapse made this concrete at scale: when the middleware provider failed, the fundamental question of which end customer owned which dollars could not be answered with confidence, funds were frozen for extended periods while reconciliation was attempted across incomplete records, and end customers who reasonably believed they held insured deposits discovered that deposit insurance protects against bank failure, not against a non-bank intermediary's inability to produce a correct ledger.

Two lessons landed, and both are now regulatory doctrine in practice.

The first is that a ledger maintained outside the bank is not a bank record. The bank's obligation to know its customers and their balances cannot be delegated to a vendor's database, because when the vendor fails the obligation does not.

The second is that the customer's mental model was correct and the legal structure was not. Consumers believed they had a bank account. Marketing encouraged that belief. The structure delivered something materially different, and the gap between the two only became visible under stress, which is the classic pattern of a risk that is not priced until it is realized.