The examiner's question for a BaaS bank is who runs each check, and the FDIC wrote it down in Sutton Bank's consent order of 1 February 2024. The bank had to compile an inventory that "should detail what aspects of AML/CFT compliance each program manager is responsible for conducting", naming customer identification, transaction monitoring, independent testing and suspicious activity reporting. Each cell needs a party's name. Whatever name goes in, the bank still answers for the result. For AML transaction monitoring, that means saying who watches each program's payments and showing the work was done.
What is banking as a service, and who are the parties?
Banking as a service is an arrangement in which a chartered bank lets a nonbank company offer the bank's accounts, cards or payments to the company's own customers, under the company's brand. The deposits and the charter stay at the bank. Inside a nonbank app, the same setup often goes by embedded finance.
Four parties usually appear. The sponsor bank, also called the partner bank, holds the deposits and the BSA duties. The fintech owns the app, the brand and the signup flow, and the end user holds the account or the card. Between bank and fintech there is often a middle layer, which the FDIC, the OCC and the Federal Reserve describe in their joint statement of July 2024 on bank deposit arrangements as "intermediate platform providers, processors, middleware providers, aggregation layers, and/or program managers."
Prepaid cards show the structure. The card is the bank's, a program manager sells and runs it, and end users load it, which is why prepaid card money laundering risk lands on the bank's books. Sutton's order made the bank evaluate how its prepaid program managers monitored and reported suspicious activity.
Who owns which AML check in a BaaS program?
The bank owns every Bank Secrecy Act check. The joint statement says a third party "may perform certain regulatory compliance functions", among them suspicious activity monitoring and reporting, customer identification, due diligence and sanctions compliance. Then it adds: "Regardless of whether the functions are shared between the bank and the third party, the bank remains responsible for failure to comply with applicable requirements." The agencies say the statement changes no legal requirement and sets no new supervisory expectation.
Table 1. Who runs each AML check in a BaaS program (as of November 2026)
| Check | What the rule asks of the bank | Who may perform it | Order that named it |
|---|---|---|---|
| Customer identification program (CIP) | Identity procedures that give the bank "a reasonable belief that it knows the true identity of each customer" (31 CFR 1020.220) | Fintech or program manager, at signup | Metropolitan (2023), Thread (2024) |
| Customer due diligence | A customer risk profile and ongoing monitoring (31 CFR 1020.210) | Fintech or middle layer | Thread (2024) |
| Beneficial owners | Under 31 CFR 1010.230, each owner of 25 percent or more and one control person of each legal entity customer | Fintech, at business onboarding | Thread (2024) |
| OFAC sanctions | Report blocked property within 10 business days (31 CFR 501.603) | Fintech or middle layer screens; the holder reports | Evolve (2024) |
| Transaction monitoring | Ongoing monitoring to identify and report suspicious transactions (31 CFR 1020.210) | Fintech, middle layer or bank | Blue Ridge, Thread, Evolve (2024) |
| Suspicious activity reports | Under 31 CFR 1020.320, suspicious transactions of $5,000 or more reported no later than 30 calendar days after the bank first detects them (up to 60 days when no suspect is identified) | Fintech or program manager refers; the bank files | Sutton, Thread (2024) |
| Currency transaction reports | A report on each cash transaction over $10,000 (31 CFR 1010.311) | The bank, where cash reaches it | None of the orders read |
| 314(a) requests | A search of records for each name in a FinCEN request (31 CFR 1010.520) | The bank, using the fintech's customer records | Thread (2024), "legally required searches", read here as including 314(a) |
| Ledger and sub ledgers | No BSA rule; an order term | Middle layer or fintech | Evolve (2024) |
| Independent testing | Testing for compliance by bank personnel or an outside party (31 CFR 1020.210) | Bank staff or an outside firm; Sutton's inventory lists it among program manager duties | Sutton (2024), Hatch (2025) |
Three orders spelled out what monitoring had to reach. Thread Bank's order of 21 May 2024 asked for a documented process to monitor transactions for suspicious activity, "including ACH transactions". Blue Ridge Bank's order covered the accounts and sub accounts provided through its partners and added a review of cash, ACH and wire activity through the bank. Evolve's order of 11 June 2024 asked for an "evaluation of the appropriateness of filtering criteria and thresholds used in the Bank's transaction monitoring system".
That review needs history. complead, formerly Sanction Scanner, runs transaction monitoring on a rules engine with backtesting: a draft rule runs first on real history, in a window of 30, 60 or 90 days, and the result shows its alert volume, clearance rate and true positives. Each rule is scoped to one product, segment or jurisdiction, and every change is saved as a version that names who made it, when and why.
The orders also reached past the first fintech. Lineage Bank's order of 30 January 2024 covered the fintechs that its direct fintech partners do business with, "Third-Party FinTechs" in the order's words, whenever funds or transactions run through the bank. The September 2026 proposal on third party risk takes a narrower view of such chains: a partner's use of subcontractors does not by itself usually create a separate relationship, or a presumption that the bank oversees each subcontractor directly.
Can a sponsor bank rely on a fintech's checks?
Only inside limits the rule sets. The customer identification rule lets a bank rely on another financial institution's CIP work when three conditions hold: the reliance is reasonable, the other institution "is subject to a rule implementing 31 U.S.C. 5318(h) and is regulated by a Federal functional regulator", and it signs a contract to certify every year that its AML program is in place and that it performs the bank's CIP steps.
The list of Federal functional regulators is short: the Federal Reserve, the OCC, the FDIC, the NCUA, the SEC, the CFTC and the former Office of Thrift Supervision. A fintech supervised by none of them, such as an app company or a state licensed money transmitter, cannot be relied on this way, so the bank has to treat the fintech's identity checks as its own work, which in practice means reading the procedures, testing files and keeping the results. The 2026 proposal agrees. In its words, the use of third parties "does not diminish" a banking organization's responsibility to meet these requirements.
The Federal Reserve found that Metropolitan Commercial Bank opened prepaid card accounts through a program manager "without having adequate procedures for verifying each applicant's true identity". On 19 October 2023 the Board announced a penalty of approximately $14.5 million for those violations and for deficient third party risk management practices.
Which US banks were ordered to fix their BaaS programs, and what did the orders require?
From August 2022 to June 2026, nine partner banks received the 11 orders below from the OCC, the Federal Reserve and the FDIC. All but Lineage's 2026 order deal with third party relationships, fintech and program manager partners among them.
Table 2. US orders against partner banks, August 2022 to June 2026 (regulators' records read 12 November 2026)
| Bank and regulator | Order and date | What it required |
|---|---|---|
| Blue Ridge Bank (OCC) | Formal agreement, 29 August 2022; terminated 24 January 2024 (OCC enforcement search) | A written program for the risks of its fintech partners, with a BSA risk assessment for each |
| Metropolitan Commercial Bank (Federal Reserve) | Cease and desist order, 16 October 2023; terminated 4 December 2025 (Federal Reserve enforcement list) | Identity checks on prepaid accounts opened through a program manager; about $14.5 million penalty |
| Choice Bank (FDIC, North Dakota) | Consent order, 18 December 2023 | Board meetings at least monthly on BSA compliance in third party relationships, CIP, CDD and suspicious activity monitoring |
| Blue Ridge Bank (OCC) | Consent order, 24 January 2024; terminated 13 November 2025 | No new fintech partner without the OCC's written no supervisory objection; end user approval criteria per partner and subpartner; monitoring that reaches partners' sub accounts, with a review of cash, ACH and wire activity |
| Lineage Bank (FDIC) | Consent order, 30 January 2024 | Oversight of direct fintechs and the fintechs behind them; an independent report covering each partner, suspicious activity included, then yearly; consent before 10 percent yearly growth; an orderly exit plan |
| Sutton Bank (FDIC, Ohio) | Consent order, 1 February 2024 | An inventory of each program manager's AML duties; quarterly reports on third parties; review of prepaid program managers' monitoring |
| Piermont Bank (FDIC) | Consent order, 27 February 2024 | Controls fit for the risk of its third party relationships; board approval before any new or renewed relationship |
| Thread Bank (FDIC) | Consent order, 21 May 2024; terminated 22 December 2025 | For its banking as a service and loan as a service programs: CDD, ACH monitoring, timely SARs, CIP data on hand, beneficial owners, required searches, checks on partners |
| Evolve Bank & Trust (Federal Reserve, Arkansas) | Cease and desist order, 11 June 2024 (Federal Reserve release); no termination date on the Federal Reserve list on 12 November 2026 | Defined ledger duties; a review of fintech partners' wires from April to September 2023; OFAC screening procedures; approval before new fintech partners |
| Hatch Bank (FDIC) | Consent order, 3 April 2025; terminated in January 2026 | CIP, CDD, SARs, independent testing and information sharing, including work done through third parties; a check that partner system documents reflect the rules, thresholds and scenarios in use |
| Lineage Bank (FDIC) | Consent order, 24 June 2026 | Business plan, profit plan and credit; no fintech provision |
Three demands come back across these orders. One is a named owner for every AML task, from Sutton's inventory to Thread's process for making sure partners meet the bank's AML program. Another is approval before growth. Blue Ridge could not take on a new fintech partner without the OCC's written no supervisory objection, and Piermont needed its board's prior written approval for any new or renewed third party relationship. Evolve needed its supervisors' approval for new fintech partners, and Lineage needed prior written consent for any new or expanded business line that would grow its total assets or liabilities by 10 percent a year. The last is monitoring that reaches every sub account and payment rail, ACH and wire included.
What did regulators outside the US do?
Germany's BaFin restricted a bank's partner model in the same way. On 16 December 2022 it ordered Solaris SE to fix its risk management and money laundering prevention, barred new partner businesses without supervisory consent and appointed a special representative to oversee the work. On 7 March 2024 it published a fine of EUR 6.5 million on Solaris for systematically filing suspicious activity reports late. A further order, published on 12 July 2024, set deadlines for gaps in money laundering prevention, reporting, outsourcing management and IT, with a penalty payment threatened.
EU law will say the same. Article 18 of the Anti-Money Laundering Regulation, which applies to obliged entities from 10 July 2027, lets an obliged entity outsource tasks to service providers, but the entity "shall remain fully liable" for any act or omission connected to them. A partner bank behind a BaaS app therefore keeps the liability for the checks its fintech runs for it.
What did Synapse show about the ledger?
It showed that when a middle layer's ledger stops matching the bank's records, consumers lose access to their money. Synapse Financial Technologies supplied the software that bridged fintech apps and their partner banks. It filed for bankruptcy on 22 April 2024. The CFPB alleged that Synapse failed "to maintain adequate records of the location of consumers' funds" and failed to make those records match the banks' own.
When the banks compared records, the money they held for consumers fell short of Synapse's records by "between $60 and $90 million". Consumers went weeks or months without access while the banks reconciled. The stipulated judgment, entered on 12 September 2025, carries a $1 civil money penalty that lets the Bureau use its civil penalty fund to pay harmed consumers.
The Federal Reserve wrote the ledger duty into Evolve's order, an action the Board called independent of the Synapse bankruptcy proceedings. Evolve had to keep the ledger and sub ledger duties of the bank and of each fintech partner clearly defined and maintained, "including in the event of a material business disruption".
What is an FBO account?
An FBO ("for the benefit of") account is a pooled deposit account at the bank that holds the money of a fintech program's end users. The FDIC's October 2024 proposal on custodial accounts describes the type in three parts: the account is set up for the benefit of beneficial owners, it holds the commingled deposits of many of them, and each can direct a transfer through the account holder to a third party. Each user's balance lives on a sub ledger, which at Synapse's programs the middle layer kept.
Picture a pooled account holding $10.0 million for three fintech apps. Their sub ledgers show $4.1 million, $3.5 million and $2.8 million, or $10.4 million in all. That leaves a $0.4 million gap. Some users' balances have no money behind them at the bank, and nobody sees it until the records are compared. The FDIC proposal would make the bank reconcile against the beneficial ownership records "no less frequently than at the close of business daily", so a gap like this would show within a day. As of November 2026 no final rule has followed.
What does the fintech own in its own name?
Some duties fall on the fintech directly, whatever the contract with the bank says. If its activity fits the definition of a money services business in 31 CFR 1010.100(ff), it must register with FinCEN under 31 CFR 1022.380, whether or not any state has licensed it, unless it acts only as another money services business's agent or only sells prepaid access.
Sanctions duties are its own too. A US fintech is a US person, so a confirmed match against the OFAC SDN list means blocking, and a report of blocked property is due within 10 business days. The rule puts primary responsibility for that report on the actual holder of the property. In a pooled account that may be the bank. Agree in advance who files, and have the fintech tell the bank as soon as a match is confirmed.
The fintech also owns the evidence the bank's orders asked for. Sutton's order called for quarterly reporting on third parties' compliance. Lineage's called for a yearly independent report that covers each fintech partner, including any suspicious activity by or through it. A fintech that keeps its decisions and records in order can answer both without rebuilding them.
What should a sponsor bank ask each fintech before and after launch?
Each question comes from an order or a rule. Keep the answers on file before an examiner asks for them.
- Who runs each check? A party's name in every cell of the inventory: CIP, monitoring, testing, suspicious activity reporting. Why: Sutton's order asked for that inventory.
- How is that party monitored? Due diligence and ongoing monitoring of whoever does AML work for the bank, with quarterly reports. Why: Sutton's order asked for both.
- What did this partner see this year? A review of each fintech, suspicious activity included. Why: Lineage's 2024 order required a yearly independent report that covers each partner.
- Who may open an account? Written approval criteria for end users, for each fintech and each subpartner. Why: Blue Ridge had to send the OCC these criteria within 10 days.
- Who owns the business customers? Every owner holding 25 percent or more, and the one person with significant control. Why: the beneficial ownership rule covers legal entity customers, whoever onboarded them.
- Does the ledger match the bank's records? A reconciliation on a set schedule, with breaks explained. Why: Evolve's order and the Synapse shortfall.
- What happens if the partner fails? An exit plan that reaches fourth and fifth parties. Why: Thread's exit plan had to say how the bank would monitor all fintech relationships, "including third, fourth, and fifth party providers", for service interruptions.
BaaS rules and orders in 2026, month by month
- January 2026. The FDIC's enforcement list for January 2026 includes an order terminating Hatch Bank's consent order of 3 April 2025.
- 10 April 2026. FinCEN published a proposal to "fundamentally reform" the requirements for AML/CFT programs; comments were due by 9 June 2026.
- 24 June 2026. Lineage Bank received a new consent order, on its business plan, profit plan and credit.
- 15 September 2026. The FDIC, the OCC, the NCUA and the Federal Reserve proposed joint third party risk guidance that would take the place of the 2023 Guidance and its supplements, the July 2024 joint statement among them. Comments were due 16 November 2026, and no final guidance had appeared in the Federal Register by 12 November 2026.
Once the inventory names who runs monitoring for each program, the next question is which transaction monitoring rules run on the program's ACH and wire flows. Hatch's order made it concrete: the bank had to assess whether a partner's system documentation reflected "the rules, thresholds and scenarios in use".
