Banking as a service (BaaS)

Banking as a service (BaaS) is an arrangement in which a licensed bank makes its products, such as deposit accounts, cards and payment rails, available to non-bank companies, usually through APIs, so those companies can offer banking features under their own brand. The bank in the arrangement is the sponsor bank or partner bank; there is often a middleware provider between the bank and the brand.

Why it matters in KYB review

BaaS splits one compliance obligation across several companies. The bank remains responsible for its BSA/AML program, including the customer due diligence required by 31 CFR 1020.210(b)(5): understanding the nature and purpose of each customer relationship and conducting ongoing monitoring. The fintech usually runs the onboarding flow and often the first-line review. A middleware provider may hold the data.

The 2023 interagency guidance on third-party relationships makes the bank's position clear: "a bank's use of third parties does not diminish its responsibility to perform in a safe and sound manner and comply with laws." When a fintech's KYB review is thin, the finding lands on the bank, and the bank's response usually lands back on the fintech: tighter requirements, file remediation, paused onboarding.

For business customers, BaaS programs add specific risks: small businesses opened at high speed through self-serve signup, customers who are themselves payment companies or money services businesses, and volume spikes after marketing campaigns.

What an analyst checks

For each business customer:

• Entity, beneficial owners and control person, verified to the bank's standard.
• Nature and purpose of the account, and expected activity, recorded in a way monitoring can use.
• Screening results and how each hit was resolved.
• Whether the customer type needs bank approval under the program agreement.

For the program:

• Which party owns which control, in writing.
• Whether the bank can see the evidence behind each decision, not just the decision.
• How exceptions and backlogs are handled when volume rises.

Common pitfalls

• Unclear ownership of a control, so each party assumes another performs it.
• Customer files that live only in the fintech's systems, out of the bank's view.
• Onboarding tuned for conversion, with review depth that does not scale when application volume jumps.
• Treating the middleware provider's KYC checks as the complete KYB review.

Related terms

Sponsor bank, partner-bank due diligence, customer due diligence, onboarding SLA.

Sweat AI is an AI-native BPO for banks and fintechs, working onboarding and fraud queues 24/7. For BaaS programs, our analysts review business applications to the partner bank's standard and return a file the bank can audit, while your team keeps the decision. See neobank and BaaS onboarding.