BaaS compliance is the work a sponsor bank does to keep its Bank Secrecy Act and anti-money laundering program whole when fintech partners open and run accounts in the bank's name: verifying who each end customer is, understanding why they bank, monitoring what moves through the accounts, reporting suspicious activity and knowing who owns every dollar in the bank's for-benefit-of (FBO) accounts. It is hard because the partner does most of that work in its own app, on its own data, often through a middleware firm, while the federal banking agencies hold the bank responsible for the result. Botminds' BaaS Compliance exists for that gap: its agents re-perform a risk-based sample of each partner's end-customer files with the bank's own sources, tie every partner's records to its FBO account each business day and draft cited findings that a named BSA Officer approves.
The examples come from a fictional sample bank as it runs through the solution: Tessaly Community Bank, a $3.4 billion community bank with 11 fintech partner programs, 214,000 end customers and $252.2 million in FBO accounts. The rules and figures about the industry come from the regulators, linked where they appear.
BaaS compliance reaches more banks than the headlines suggest
600–1,100
insured banks the FDIC expects hold custodial deposit accounts with transactional features
13–24%
of the 4,577 FDIC-insured institutions at the time of the estimate
4
compliance functions a partner may perform for the bank: SAR monitoring and reporting, CIP, CDD, sanctions
What is BaaS compliance? The sponsor bank's BSA program, extended through its partners
BaaS compliance is not a separate rulebook. It is the bank's existing obligations under 31 CFR Chapter X, applied to customers the bank never meets. The AML program rule for banks, 31 CFR 1020.210, still asks for internal controls, independent testing, a designated BSA officer, training and risk-based customer due diligence. The customer identification program (CIP) rule, 31 CFR 1020.220, still asks the bank to verify identity "to the extent reasonable and practicable" and keep the evidence. The SAR rule, 31 CFR 1020.320, still gives the bank 30 calendar days from initial detection to file. None of these says "unless a fintech did it".
What changes is where the work happens. In banking as a service, a non-bank company markets the account, onboards the person, runs the app, often monitors the transactions and keeps the records of who owns what. The agencies describe the arrangement in their July 25, 2024 joint statement: a third party, "rather than the bank, typically markets, distributes or otherwise provides access" to the deposit product, and the statement notes these set-ups "are sometimes referred to as 'banking-as-a-service' or 'embedded finance'." BaaS compliance is the discipline of making that outsourced work answer to the bank's program as if the bank's own staff had done it.
That framing settles the most common argument inside sponsor banks. The question is never whether the partner's compliance team is capable; plenty are. The question is whether the bank can show an examiner, file by file, that what the partner did meets the bank's CIP, CDD and suspicious activity procedures. A sponsor bank that can only show the partner's attestation has delegated the work and kept the liability.
How does banking as a service work, and where does the AML work sit?
Banking as a service works by splitting one bank account into several jobs held by different companies. The end customer signs up in a fintech's app; the fintech, or a middleware firm between it and the bank, collects identity data and calls an identity-verification vendor; the money sits in an omnibus account at the bank titled for the benefit of the fintech's customers; and the fintech's own system keeps each customer's balance and transaction history. The bank's core often sees one large account and its daily movements.
One BaaS account, four companies, and where the AML work sits
| Party | What it usually does | What the bank sees of it |
|---|---|---|
| Fintech app | Markets the account, takes the application, calls its identity vendor, decides to open, and runs the customer's app, card and payments. | Whatever the program agreement makes the fintech send: often summaries and attestations unless the bank asks for the raw files. |
| Middleware or program manager | Connects the fintech to the bank through APIs, often keeps the end-customer sub-ledger and may run transaction monitoring for the fintech. | Message traffic and an omnibus balance on the core; the end-customer detail only if the contract delivers it. |
| Card processor and payment rails | Settles card, ACH and transfer activity in and out of the FBO account in daily files. | Settlement totals; which end customer a reversal belongs to only if the files are matched. |
| Sponsor bank | Owns the CIP, CDD, monitoring and SAR obligations for every end customer, decides and files every SAR, and must know what it owes each depositor. | Its own core and general ledger, and whatever it chooses to test. |
The agencies' July 2024 request for information spells out why this matters for the BSA. Fintechs "often play a critical role in maintaining a deposit and transaction system of record," it says, records the bank's core processing system may never show, and it flags the extra complexity this creates for reconciliations and BSA recordkeeping (89 FR 61577). In plain terms: the facts the bank's AML program runs on live in someone else's database. The middleware layer is where they most often get lost.
Who is responsible for AML in banking as a service? The bank, in the regulators' words
The sponsor bank is responsible, whoever does the work. The 2024 joint statement says it in one sentence that every BaaS program should have in its policy: a third party "may perform certain regulatory compliance functions such as monitoring and reporting suspicious activity, customer identification programs, customer due diligence, and sanctions compliance on behalf of the bank. Regardless of whether the functions are shared between the bank and the third party, the bank remains responsible for failure to comply with applicable requirements" (joint statement).
The 2023 Interagency Guidance on Third-Party Relationships, still in force, says the same from the other side: using a third party leaves the bank answerable for safe operation and legal compliance exactly as if it had done the work itself (88 FR 37920). The bank can contract out the labour. It cannot contract out the obligation.
BaaS compliance in one table: what a partner may do, and what stays with the bank
What the fintech partner may do: Collect name, date of birth, address and ID number in its app; call an identity vendor; open the account.
What the sponsor bank still owns: A CIP that meets 31 CFR 1020.220, run as the bank's procedure, with records kept five years (identifying data after the account closes; verification records after they are made).
What the fintech partner may do: Ask purpose and expected activity; assign a risk rating with its model.
What the sponsor bank still owns: Risk-based CDD under 1020.210, a customer risk profile the bank can explain, and enhanced review where the bank's policy calls for it.
What the fintech partner may do: Run scenarios on its own platform, work alerts, refer unusual activity to the bank.
What the sponsor bank still owns: Monitoring that covers activity in its accounts and sub-accounts, and the decision on every SAR.
What the fintech partner may do: Refer facts. File its own SAR only where it has its own obligation, for example as a money services business.
What the sponsor bank still owns: Filing within 30 days of initial detection (60 with no suspect), and never revealing to anyone involved that a SAR exists.
What the fintech partner may do: Keep each end customer's balance and history in its sub-ledger.
What the sponsor bank still owns: Knowing its deposit obligations; under the FDIC's pending proposal, daily reconciliation and direct access to those records.
What the fintech partner may do: Screen applicants and payments against OFAC lists.
What the sponsor bank still owns: OFAC compliance for every customer and payment the bank processes.
One rule narrows the bank's options more than most BaaS contracts admit. The CIP rule lets a bank rely on another institution's identification work only if that institution has its own AML program rule, answers to a federal functional regulator and certifies annually that it performs the bank's CIP (31 CFR 1020.220(a)(6)). A fintech app is rarely that. In most programs the partner is running the bank's CIP as the bank's agent, which is why the bank must test it.
What are BaaS regulations? The rules, the guidance and the proposals
BaaS regulation is a stack of three kinds of document: binding rules, supervisory guidance that describes sound practice, and proposals that may change both. Knowing which is which keeps a program from treating a proposal as law or a rule as a suggestion. The table below is the stack as it stands at the end of October 2026.
The BaaS compliance rulebook, by force
| Document | What it says about partner programs | Status, October 2026 |
|---|---|---|
| 31 CFR 1020.210, AML program | Internal controls, independent testing, a BSA officer, training, ongoing CDD. Covers customers onboarded through partners. | Binding rule. A 2026 FinCEN proposal would rewrite it; still proposed. |
| 31 CFR 1020.220, CIP | Verify identity; keep records; reliance only on regulated institutions under contract. | Binding rule. |
| 31 CFR 1020.320, SARs | 30 days from detection; five-year records; confidentiality binds the bank and its agents. | Binding rule. October 2025 interagency FAQs apply. |
| Interagency Guidance on Third-Party Relationships (June 2023) | Life cycle from planning to termination; outsourcing does not reduce responsibility. | In force. A replacement was proposed September 15, 2026. |
| Joint statement on deposit products through third parties (July 2024) | Names the risks of BaaS deposit arrangements and the bank's continuing AML responsibility. | In force. The 2026 proposal would rescind it. |
| FDIC Recordkeeping for Custodial Accounts (proposed 2024) | Per-owner records, daily reconciliation, direct access, annual certification. | Proposal. Listed as a long-term action; no final rule. |
Two points from the table matter for planning. First, the 2026 third-party proposal would replace the 2023 guidance with lighter, principles-based text and rescind the 2024 joint statement, but it does not touch the CIP, CDD or SAR rules, so a lighter third-party framework does not lighten the BSA duties carried through partners. The guidance in plain words walks through what would change. Second, the FDIC's custodial-account proposal says outright that meeting it would not by itself discharge a bank's Bank Secrecy Act duties. Daily reconciliation is a floor for deposit insurance, not a substitute for knowing the customer.
Where BaaS compliance breaks: four seams between the partner and the bank
BaaS compliance usually fails at a seam, not inside either company. Each party's process works on its own terms; the failure is in what passes between them unverified. Four seams account for most of what the enforcement orders describe.
Identification done in someone else's software. A partner release can change how onboarding behaves without anyone at the bank noticing. In the sample program Fernquill Pay, release 4.18 let onboarding continue when the identity service timed out; the date-of-birth check queued and never ran, and the partner's file still recorded a pass. Re-performed by the bank's agents, four of 60 sampled files failed, and a test of every account opened from October 1 to 26 found 212 of 3,412 with the same gap. A screenshot of the identity vendor's result would have shown nothing wrong.
Records of who owns each dollar. If the partner's end-customer records and the FBO balance drift apart, the bank cannot state what it owes each customer. At the sample bank, Fernquill's records showed $48,212,904.17 against $48,190,113.42 in the FBO account; the partner called the $22,790.75 difference timing. It was 23 debit-card funding reversals that never reached the customers' wallets. How FBO accounts work at fintechs explains why that gap is a BSA problem as well as an accounting one.
Referrals and the SAR wall. Partners refer unusual activity; the bank's investigators decide and file. The partner must never learn the outcome: the SAR rule bars the bank, its staff and its agents from revealing that a SAR exists (31 CFR 1020.320(e)). A careless "we filed on that one" in a partner email is a violation.
Findings with no owner. Oversight that ends in an email produces no evidence that anything was fixed. Both the OCC's Blue Ridge order and the Federal Reserve's Evolve order asked for tracked, escalated remediation, not just findings.
Testing, not attestations: what a sponsor bank should re-perform
The defensible standard is re-performance: take a risk-based sample of the partner's end-customer files and run the checks again with the bank's own identity service and OFAC list history as of the opening date, then compare the answers with what the partner reported. The 2023 guidance supports it: where risk warrants, a bank's ongoing monitoring may test the third party's own controls directly (88 FR 37920).
BaaS Compliance on one partner program: the re-performed sample beside the day's FBO tie-out
When failures share a cause, test the whole population
Sampling alone is not enough when failures share a cause. The sample bank's rule, a setting the BSA Officer approves, is that two failures with one cause trigger a test of the whole population, which is how four failed files became a list of 212 accounts with balances and risk ratings. The other half of the test runs daily: the agents rebuild every end customer's balance from the partner's file, so the bank can show, on any morning, that it could name every customer and what each is owed.
Re-performance also changes the conversation with the partner. A finding written as condition, criteria, cause and effect, each sentence cited to the CIP rule, the program agreement or the partner's own identity response, is hard to argue with and easy for an examiner to follow. In the sample case the drafted finding proposed the narrowest restriction that addressed the risk, a pause on new high-risk applicants, and the BSA Officer approved it from a ladder that also offered a full pause (which needs the Chief Risk Officer) or no restriction with a reason.
What BaaS compliance software should do, and what it should not
Software for BaaS compliance earns its place if it produces evidence the bank could not produce by hand at the same coverage; it fails if it only digitises the questionnaire. The list below is what a sponsor bank's BSA officer can fairly demand of any tool, including this one. How to test fintech compliance software on your own partner's last quarter turns it into a pilot.
What BaaS compliance software should do for a sponsor bank
- Re-perform, with the bank's sources
Identity, OFAC as of the opening date and due diligence checks run again, not read from the partner's screenshots. Each result cites its source.
- Escalate from sample to population
When failures share a cause, test every affected account and produce the list the partner must fix.
- Tie every partner to its FBO account daily
Rebuild every end customer's balance, refuse to call a difference timing without a matching payment, and escalate on a clock.
- Keep SAR decisions behind a wall
Partners see only that a referral was received or reviewed; every outgoing message is checked for anything that reveals a SAR.
- Separate drafting from deciding
Agents test and draft; a named analyst submits, a third-party risk manager concurs and the BSA officer approves. No one approves their own work.
- Close remediation on a test
Each item has an owner, a date and the test that closes it; overdue items escalate without anyone remembering to chase.
- Hand the examiner a pack
Findings, samples, tie-outs, partner messages, agent versions and overrides, with SAR decisions excluded except for the BSA officer.
What it should not do matters as much. It should not approve findings, restrict a partner, message a partner, net away a difference or close a remediation item; in the solution those are always people's decisions, and the agents' limits are written down per agent. It should not decide or file SARs; the bank's investigators do that in case management. And it should not claim to certify compliance with a rule. BaaS Compliance is set up around the rules on this page; whether the bank's program meets them is the examiner's call.
The BaaS compliance desk: what needs a person this morning
Questions people ask
What are BaaS banks in the US?
They are FDIC-insured banks, often community banks, that hold deposits, issue cards or fund loans for customers acquired by fintech partners. There is no official list. The FDIC's 2024 custodial-account proposal estimated that 600 to 1,100 insured institutions hold the kind of commingled, transactional FBO accounts these programs use, out of 4,577 at the time.
What is a fintech partner bank?
It is the chartered bank behind a fintech's account, card or loan: the fintech brands and distributes the product, and the bank holds the deposits, issues the card or makes the loan. The agencies call these "bank-fintech arrangements," and the bank's regulators examine the program as the bank's own activity. The neighbouring guide on what a sponsor bank is covers the charter side.
Can a fintech perform CIP for a sponsor bank?
It can collect and verify identity data as the bank's agent under the bank's CIP, but the bank cannot simply rely on it. Formal reliance under 31 CFR 1020.220(a)(6) is limited to institutions that have their own AML program rule, a federal functional regulator and an annual certification contract. Without that, the bank must test the partner's work as its own.
Does the September 2026 third-party proposal change BaaS compliance?
It would change the guidance, not the BSA. If finalized, it would replace the 2023 third-party guidance and rescind the 2024 joint statement, stressing risk-based tailoring and stating that guidance is not enforceable on its own. The CIP, CDD and SAR rules that follow every partner's customers are regulations and stay as they are.
How often should a sponsor bank test a fintech partner?
No rule sets a frequency; it should follow risk. The 2023 guidance says monitoring may be periodic or continuous and more frequent for higher-risk activities. In the sample bank, file re-performance runs on a quarterly sample of 60 files per program, while the FBO tie-out runs every business day.
What does BaaS Compliance cost to run on our own programs?
That depends on the number of programs, files and partner data feeds, and we will scope it on a sample of your own partner files and a month of one partner's records. The cost of BaaS oversight guide sets out what the work costs by hand, using the FDIC's own hour estimates, so the comparison is on your numbers. The starting point is BaaS Compliance.