The main BaaS risks for a sponsor bank are that BSA/AML work is done by a partner the bank does not supervise day to day, that the records of who owns each dollar in the bank's for-benefit-of accounts sit in the partner's systems, and that partner growth outpaces the bank's controls. Each has a price. The FDIC's own estimate for one piece, keeping and reconciling end-customer records daily, is about 2,200 hours to set up and 1,100 hours a year per bank. The rest of the bill is analyst time spent testing partners, and the larger contingent cost of an enforcement order that freezes new partners. Botminds' BaaS Compliance is built to cut the first and avoid the second: agents re-perform partner files, tie out every partner each day and draft findings, while the bank's people decide.
Worked examples use a fictional sample bank, Tessaly Community Bank, with 11 fintech partner programs and $252.2 million in FBO accounts. Its figures are sample data or our estimates, labelled as such; the industry figures are the regulators' own.
What the FDIC expects daily custodial records to cost one bank
2,200hours
to set up per-owner records and daily reconciliation, per bank, on average
1,100hours
a year to maintain them
$220,000
first-year labour at the FDIC's assumed $100 an hour, then about $110,000 a year
61%
of affected small banks for which $220,000 would exceed 5% of annual salaries and benefits
What are the risks of BaaS? The regulators' list, read for what each one costs
The risks of BaaS are set out most completely in the agencies' July 25, 2024 joint statement on deposit products delivered through third parties. It groups them into operational and compliance risks, growth risks, and end-user confusion about deposit insurance. Read with a budget in mind, each one is either a cost the bank pays now, in testing and reconciliation, or a cost it risks later, in remediation.
The BaaS risks in the 2024 joint statement, and what each costs a BSA program
| Risk | In the statement's words | What it costs the BSA program |
|---|---|---|
| Third parties performing compliance functions | "Reliance on third parties to perform regulatory compliance functions may increase the risk of the bank not meeting its regulatory requirements." | Re-performance of partner CIP, CDD and alert work; review of every SAR referral. |
| Lack of access to records | Can "impair the bank's ability to determine its deposit obligations" and delay "end-users' access to their deposits." | Daily tie-out of partner records to the FBO account; contingency copies of balances. |
| Fragmented operations | Functions spread "among multiple third parties may make it more difficult for the bank to effectively assess risks." | Mapping who does what, including subpartners the bank has no contract with. |
| Operational capabilities lag growth | Rapid growth "may result in risk management and operational processes struggling to keep pace." | Analyst headcount that scales with partners and end customers, or tools that do. |
| Misaligned incentives | A partner "incentivized to promote growth in a manner that is not aligned with the bank's regulatory obligations." | Change-notice review before partner releases; onboarding restrictions when tests fail. |
| Funding concentration and liquidity | Deposits "associated with a third party may pose liquidity risks," making the bank "reluctant" to terminate. | Exit planning that keeps termination a real option, so oversight has teeth. |
| Weak audit coverage | "Lack of sufficient audit scope and coverage, follow-up processes, and remediation." | Independent testing that reaches partner activity; remediation that closes on a re-test. |
The liquidity line deserves more weight than it usually gets in a compliance discussion. A bank that cannot afford to lose a partner's deposits cannot credibly threaten to restrict it, and a restriction nobody believes in is not a control. The statement says as much: a bank may be "reluctant to make decisions necessary to manage those risks, including, if necessary, to terminate the arrangement."
Why BaaS risk is mostly a growth problem
BaaS risk compounds with growth because the partner's volume grows faster than the bank's oversight capacity. The agencies' 2024 request for information is direct about the mechanism: "potentially significant increases in the volume of payment processing may give rise to increased transaction monitoring alerts," and some banks "rely on manual workarounds, which could lead to operational breakdowns" (89 FR 61577). Failure to scale compliance, it adds, "may increase the likelihood of the bank violating applicable laws and regulations, including those related to AML/CFT."
The historical record shows where that ends. The Treasury Inspector General's review of City National Bank of New Jersey, which failed in 2019, found the "primary cause" was a strategy that brought in many more money services business customers and with them far more transactions, without the policies, procedures, risk management or BSA controls that activity needed. Its noninterest expenses, "particularly ... compensation and Bank Secrecy Act/Anti-Money Laundering remediation, outpaced income" (Treasury OIG-20-039). That bank was not a BaaS sponsor, but the pattern is the same one the joint statement describes: a new channel, fast volume, and controls that arrive after the activity.
The other way banks have priced the risk is by leaving. In a survey GAO reported in 2019, close to half of the 91 banks with money transmitter customers, 40 banks, had terminated at least one such account from 2014 through 2016 for BSA/AML reasons, and 29 had limited the number of those accounts (GAO-20-46; the sample is not generalizable). Exiting is a legitimate risk decision, but it is the most expensive one, and it is only available to a bank that has planned for it.
What did the FDIC estimate for custodial account recordkeeping?
The FDIC estimated that between 600 and 1,100 insured institutions would be directly affected by its 2024 proposal on custodial accounts, and that complying would take each of them, with its partners, about 2,200 hours to set up and 1,100 hours a year. At the agency's assumed labour rate of $100 an hour, that is roughly $220,000 in the first year and $110,000 a year after (89 FR 80135).
The FDIC also flagged the burden on small banks: for about 61% of the 3,259 small institutions, $220,000 would exceed 5% of annual salaries and benefits, and it expected significant effects on between 261 and 478 of them. Those numbers explain why the proposal has not moved. The Unified Agenda lists it as a long-term action with the final rule "To Be Determined" (RIN 3064-AG07). A bank should not budget as if it were law. It should notice that the FDIC thought daily, per-owner records were worth a fifth of a million dollars a year to protect depositors, and that the FDIC itself said meeting the rule would not by itself satisfy a bank's BSA obligations.
How much does sponsor bank oversight cost? A worked estimate
Sponsor bank oversight costs mostly analyst time, and the largest share goes on chasing the partner rather than testing it. The estimate below takes one partner program's quarterly test and its follow-up, splits it into tasks, and prices it with the same $100 hourly rate the FDIC used. The split is our estimate for a typical program, not a measured result.
Where one partner program's quarterly test days go, by hand and with BaaS Compliance
A year of partner testing for an 11-program sponsor bank, by hand
Programs
11 partner programs
The sample bank's book: wallets, cards, payroll, remittance, savings and earned-wage programs.
Third-party risk manager
Tests a year
× 4 quarterly tests
One risk-based sample per program per quarter, as the sample bank's BSA Officer has set it.
BSA Officer
Analyst days per test
× 12 days
Our estimate above. With the agents doing the mechanical part, about 1.5 days.
Partner oversight analyst
Cost of a day
× 8 h × $100
The FDIC's assumed labour rate for this kind of work, applied by us.
Finance
Two features of the estimate matter more than its total. First, hand testing scales linearly with partners: the twelfth program costs as much as the first, so a bank adding partners faster than analysts is choosing a thinner test. Second, the biggest hand-work items are requests and chasing, which produce no evidence at all. A test that re-performs files with the bank's own identity service and OFAC list history spends its time on the part examiners read. The neighbouring guide on the cost of a quarterly fintech partner review prices the same work for lending programs.
What KPIs should a sponsor bank track? The measures the orders asked for
A sponsor bank should track the measures regulators have already ordered banks to produce: whether every partner's records tie to the FBO account, how fast referrals arrive, how many re-performed files fail, how old the backlog is and whether remediation closes on time. Each is defined so it can be computed, not estimated, and each traces to an order or a rule.
A BaaS compliance scorecard, defined and sourced
| Measure | How it is computed | Why it is on the scorecard | Sample bank, Oct 27 |
|---|---|---|---|
| Partners tied out | Partners whose end-customer total equals the FBO balance at close, with every balance rebuilt, over all partners | Joint statement: lack of access to records can impair the bank's ability to determine its deposit obligations | 9 of 11 (one short, one file late) |
| Age of unexplained differences | Business days since a difference first appeared without a matching payment | Evolve order: bank and partner duties for ledgers and sub-ledgers must be defined and kept | $22,790.75 since Oct 14 |
| Re-performed failure rate | Files failing any CIP or CDD test on re-performance, by partner and risk stratum | Blue Ridge order: onboarding of end-user accounts must comply with BSA/AML requirements | 4 of 60 at one partner (6.7%) |
| Referral timeliness | Business days from the partner's detection to the bank's receipt, against the agreement | SAR clock: 30 days from initial detection; Blue Ridge: written standards for timely disposition | Median 1 day; 1 of 27 late |
| Backlog reported | Open alerts and referrals past their standard, reported in writing to the board | Blue Ridge order: monitoring backlogs reported to the board and management in writing | Reported daily on the desk |
| Remediation on time | Open items past their date, and days overdue, by partner | Evolve order: noncompliance "appropriately tracked and escalated" | Overdue items escalate at 5 days |
| Partner inventory current | Partners, subpartners and products risk-rated and inside the BSA program | Evolve order: every fintech partner, business line, activity and product identified and risk-rated | 11 programs, tiers set |
Notice what is missing: the number of questionnaires returned, the number of partner meetings held, the percentage of policies attested. Those measure activity, and the joint statement's list of risks is about outcomes. The Evolve order also asked for one risk assessment and rating method, applied to every partner and kept up to date, which is the subject of the next section.
How do you measure fintech partner risk?
Measure fintech partner risk by the harm the partner could do and how likely it is, then let the score drive how hard the bank tests. The September 2026 interagency proposal puts it that way: risk assessments "commonly take into account both the magnitude of harm the third-party relationship could cause ... and the likelihood that the harm will occur" (91 FR 58536, proposed). The 2023 guidance, still in force, asks banks to identify "critical activities" that could cause significant risk, significant customer impact or a significant hit to the bank's condition (88 FR 37920).
For BSA purposes the inputs are concrete: the product (cross-border remittance carries more risk than a teen debit card), the volume and growth of end customers, who keeps the records, who monitors transactions, the last quarter's failure rate and the age of open findings. At the sample bank these produce four tiers, Low, Moderate, Elevated and High, and the tier sets the sample's weights. A High-tier partner's 60 quarterly files are 40% high-risk applicants and 40% accounts opened in the quarter; a failure raises the tier, and the tier raises the testing.
What is BaaS credit risk?
BaaS credit risk is the risk on loans a sponsor bank funds or holds through fintech lending programs, and on assets it buys with partner deposits. The 2024 RFI describes arrangements in which "a partner bank agrees to facilitate and fund loans, while the fintech company solicits end users," with loans kept on the bank's balance sheet or sold, and notes that a bank concentrated in such a program can see its credit exposure rise when originations fall (89 FR 61577). The joint statement adds the deposit side: fast-growing partner deposits "deployed in illiquid or long-term assets" create liquidity and funding risk.
Credit risk is outside what BaaS Compliance tests; it sits with the bank's credit and treasury functions. It belongs on the same board page, though, because the partners that bring the most deposits or loans are usually the ones the bank is least willing to restrict.
What should a BaaS oversight program report to the board?
A BaaS oversight program should report, partner by partner, the tier, the latest test results, the day's tie-out, referrals and their timeliness, open remediation and any restriction in force, plus what changed since the last report. The 2023 guidance gives the board "ultimate responsibility" for third-party risk oversight and expects "appropriate periodic reporting" on monitoring results (88 FR 37920). The Blue Ridge order went further and asked for a money laundering risk report "related to the Bank's third-party relationships" (AA-ENF-2023-68, Article VI).
All eleven partner programs on one page, as the Chief Risk Officer sees them
The price of getting it wrong
The cost of weak BaaS oversight is rarely a single fine; it is a period in which the bank cannot grow the business it built. The OCC's January 2024 order barred Blue Ridge Bank from onboarding any new fintech partner, or offering new products through existing ones, without the OCC's written non-objection, "until the Bank complies with the BSA" (AA-ENF-2023-68); the order was terminated in November 2025, about 22 months later. The Federal Reserve's June 2024 order required Evolve Bank & Trust to obtain prior written approval for new fintech partners or new products for existing ones (Federal Reserve order). The enforcement casebook reads both orders line by line.
Penalties come on top where violations are found. For a willful violation of most BSA requirements, the statutory civil penalty is the greater of the amount involved, up to a cap, or a floor, and FinCEN's January 2025 inflation adjustment puts that range at $71,545 to $286,184 per violation; negligence carries $1,430 per violation and a pattern of negligence up to $111,308 (90 FR 5629). Against those numbers, the $422,400 hand-testing budget above is not the expensive option. Thin testing is.
Remediation that closes on a test, with overdue items escalated
Questions people ask
What are the biggest BaaS risks for a community bank?
Compliance functions run by the partner, records of who owns the deposits held outside the bank, and growth that outruns the BSA team. The 2024 RFI notes the growth risk is often sharper "in the case of a community bank," whose systems and staff may not scale without significant investment. Funding concentration then makes the bank reluctant to restrict the partner.
How much does sponsor bank oversight cost?
By our estimate, about 12 analyst days per partner program per quarterly test when done by hand, or roughly $9,600 a test at the FDIC's assumed $100 an hour. For 11 programs tested quarterly that is about $422,400 a year, before the daily reconciliation the FDIC priced separately at about $110,000 a year per bank.
Is the FDIC custodial account rule final?
No. It was published as a proposal on October 2, 2024, its comment period was extended into January 2025, and the Unified Agenda lists it as a long-term action with the final rule "To Be Determined." No final rule or withdrawal had been published as of late October 2026.
What is the difference between BaaS risk and third-party risk?
BaaS risk is third-party risk in its most concentrated form: the third party does not support the bank's product, it is the product's front end, back office and often its compliance team. General third-party metrics, covered in the neighbouring guide on third-party risk management metrics, apply; BaaS adds the end customer, the FBO account and the SAR duties on top.
Can a sponsor bank reduce oversight cost without reducing coverage?
Yes, by moving time from requests and chasing to testing. In our estimate, requests, chasing and evidence assembly are about half of a hand-run quarterly test and produce no evidence. Re-performance with the bank's own sources, and a daily tie-out that rebuilds each balance, keep the coverage and the evidence while removing most of that time. The BaaS Compliance page shows the full flow.