Banking-as-a-service enforcement actions, read order by order

Banking-as-a-service enforcement actions are formal orders in which a bank regulator requires a sponsor bank to fix how it oversees the fintech partners that open accounts and move money in its name. The two most detailed public examples are the OCC's January 2024 consent order against Blue Ridge Bank, N.A., terminated in November 2025, and the Federal Reserve's June 2024 order against Evolve Bank & Trust, issued with the Arkansas State Bank Department. Both found BSA/AML programs that had not kept pace with partner activity; both required the bank to risk-rate every partner, review past transactions for unreported suspicious activity and stop adding partners without supervisory approval. Botminds' BaaS Compliance is built around the evidence those orders demanded: re-performed partner files, daily tie-outs of partner records to FBO accounts, timed SAR referrals and findings with remediation that closes on a test.

This page reads the orders from their text on the regulators' own sites. It covers only orders whose text we could read there; other 2024 orders against sponsor banks are not discussed. Where the page shows the solution, the examples come from a fictional sample bank, Tessaly Community Bank, and its 11 partner programs.

What are BaaS enforcement actions?

BaaS enforcement actions are consent orders and cease-and-desist orders, issued under section 8 of the Federal Deposit Insurance Act, that tie a sponsor bank's BSA/AML and risk management failures to its fintech partner business and prescribe the fix. They are "consent" orders because the bank agrees to them without a hearing; in the OCC's words, "the Bank neither admits nor denies" the findings (AA-ENF-2023-68). They bind the bank until the regulator terminates them in writing.

What distinguishes a BaaS order from an ordinary BSA order is where it points. The Blue Ridge order defines "third-party relationship" to include "the Bank's fintech partners and subpartners," and requires suspicious activity monitoring "for all lines of business, including accounts and sub-accounts provided by and through the Bank's third-party relationships." The Evolve order describes the bank's Open Banking Division, which offered "deposit accounts and payment processing services to financial technology companies" that served end customers, and aims most of its remedies there (Evolve order). The Cross River Bank consent order, covered in a neighbouring series, shows the same structure applied to fintech lending.

What the Blue Ridge order required, article by article

The Blue Ridge order asked the bank to rebuild its BSA program around its partners in eight steps, most within 30 to 90 days. Read as a list, it is a specification of BaaS compliance as the OCC saw it in 2024.

Article V, third-party risk management. A written program, with "an assessment of BSA risk for each third-party relationship, including risk associated with BSA compliance, money laundering, terrorist financing, and sanctions risk, as well as each third-party relationship's processes for mitigating such risks." It also required, within ten days, "the criteria it is using for end user accounts to be approved for each third-party fintech relationship, including fintech subpartners," and within 90 days "adequate support that BSA/AML risk is effectively controlled" for each existing partner, failing which each partner needed OCC non-objection to keep onboarding end users.

Article VI, risk assessment. A BSA risk assessment covering "all activities provided by or through the Bank's third-party relationships," with "the quantity of risk associated with third-party activities" and a money laundering risk report on those relationships for the board.

Article VII, audit. An audit program with "an expanded scope and risk-based review of activities conducted through the Bank's third-party relationships," and transaction testing whose method is written down: "identification of the control population, sample size, sampling methodology, how the control will be tested, and what constitutes a successful test."

Articles IX and X, due diligence and monitoring. Customer risk profiles, enhanced due diligence and beneficial ownership for all customers, and suspicious activity monitoring that could "quantify the volume of activities and transactions conducted by or through the accounts and sub-accounts of each of the Bank's third-party relationships." The bank had to set deadlines for working each type of alert, document each SAR decision with the key facts behind any decision not to file, and report "any backlogs ... promptly ... to the Board and management, in writing."

Article XI, look-back. A review of September 1, 2022 to August 31, 2023 that included "high risk customer activity involving the Bank's third-party relationships," reporting the methods, the customers reviewed, and how many warranted SARs and how many did not. How a SAR lookback at a fintech partner works takes that requirement apart.

"Effective immediately, the Bank must ensure that onboarding of new end user accounts within existing third-party fintech relationships and subpartners complies with BSA/AML requirements."

OCC consent order, Blue Ridge Bank, Article V

One requirement has since been overtaken by general guidance. The order's demand to document every decision not to file a SAR is stricter than the October 2025 interagency SAR FAQs, which say the BSA neither requires nor expects a bank to document a decision not to file (SAR FAQs, October 9, 2025). An order can require more than the rule for the bank it binds; it does not change the rule for everyone else.

Was the Blue Ridge consent order terminated?

Yes. The OCC terminated it on November 13, 2025, stating that "the safety and soundness of the Bank and its compliance with laws and regulations does not require the continued existence of the Order"; the termination was signed for the OCC's Novel Bank Supervision unit (AA-ENF-2025-58; OCC News Release 2025-109). The order had run about 22 months. For that whole period, the growth limit in Article V meant any new fintech relationship or new product through an existing one needed the OCC's written non-objection first.

What did the Evolve Bank consent order require?

The Evolve order required the bank to rebuild risk management of its fintech business before growing it, and to prove its partners were inside the BSA program. The Board's press release summarised the finding: examinations in 2023 found Evolve "engaged in unsafe and unsound banking practices by failing to have in place an effective risk management framework for those partnerships" (Federal Reserve, June 14, 2024).

Three of its requirements are specific to BaaS. First, an independent review that began with "identification of all Bank fintech partners, business lines, activities, and products to ensure that such fintech partners, business lines, activities, and products are appropriately risk-rated and included in the Bank's BSA/AML compliance program." Second, a plan with "a common risk assessment and rating methodology" for each fintech partner, product and customer, and controls so that the bank's and partners' responsibilities for ledgers and sub-ledgers "are clearly defined, established, and maintained, including in the event of a material business disruption." Third, an independent review of "domestic and international wire transaction activity associated with the Bank's fintech partners" from April 1 to September 30, 2023, to see whether suspicious activity "was properly identified and reported" (Evolve order).

The growth limit was broader than Blue Ridge's. Evolve could not, without the supervisors' prior written approval, "establish any new fintech partners, subsidiaries, business lines, products, programs, services, or program managers," and "before exiting a relationship with a fintech partner, the Bank shall conduct and provide the Supervisors with an impact analysis on the Bank's liquidity." The order stays in force "until stayed, modified, terminated, or suspended in writing." What happened to end customers of one middleware firm in the same period is told in the neighbouring guide on the Synapse bankruptcy.

Why are regulators targeting BaaS banks?

Regulators are targeting BaaS banks because the model moves the BSA work, and the records it depends on, outside the bank while leaving the obligation inside. The agencies said so in July 2024: banks in these arrangements may rely on third parties to keep the system of record and perform compliance functions, and that reliance leaves the bank's own responsibility to comply undiminished (joint statement).

The same day's request for information described the operational strain: end-customer records kept by fintechs, alert volumes that rise with payment growth, and banks falling back on manual workarounds (89 FR 61577). The orders above are what that strain looks like after an examination: monitoring that missed partner sub-accounts, staffing that did not grow with the book, and no complete list of who the partners and subpartners were.

What the orders have in common

Set side by side, the two BaaS orders ask for the same five things: know every partner, rate its BSA risk, monitor what moves through its accounts, look back at what was missed, and stop growing until the first four are proven. The details differ in ways that tell a bank what each regulator worried about most.

Life under a growth limit: what a request for approval must contain

Under both orders, the bank had to ask before it grew, and each order said what the request had to include. Blue Ridge had to submit "the due diligence package including supporting documentation, any proposed contract, and any management or board committee minutes approving the relationship." Evolve's requests had to contain "any proposed contract, any management, board, or board committee minutes approving the activity or relationship, a description of the applicable measures to effectively manage the risk." Those lists are a fair test of any sponsor bank's file on a new partner, order or no order.

Building the evidence before an examiner asks

The cheapest time to produce what an order demands is before the order. Almost every remedy above, a partner inventory with risk ratings, BSA risk per partner, monitoring evidence by sub-account, records of who owns what, written alert standards, tracked remediation, is evidence a sponsor bank could keep as a matter of routine. The difference between a bank under an order and one that is not is often whether that evidence existed when the examiner arrived.

An examiner pack from BaaS Compliance: findings, samples, tie-outs and the trail behind them

In the solution, the inventory and ratings live on one page, every test is cited to its source, and the trail records people, agents and partners alike. The design target is that every partner's records tie to their FBO account every business day, so that a Blue Ridge-style request for "adequate support that BSA/AML risk is effectively controlled" for each partner is a report, not a project. What that oversight costs is priced in a companion guide.

Partner inventory, tiers and restrictions in force: the page an order asks for

Questions people ask

What is a sponsor bank consent order?

It is a formal enforcement order, agreed by the bank without admitting the findings, that requires a bank sponsoring fintech programs to fix specific failures by specific dates. The BaaS orders above required partner inventories, BSA risk ratings per partner, monitoring of partner sub-accounts, transaction look-backs and regulator approval before adding partners or products.

What is the difference between a consent order and a cease-and-desist order?

Both are orders under 12 U.S.C. 1818 and both bind the bank. A consent order is one the bank agrees to; the Federal Reserve's Evolve order is formally a "Cease and Desist Order Issued Upon Consent," and the OCC's own listing describes the Blue Ridge consent order as a cease-and-desist order. The label matters less than the terms and the deadlines.

How long does a BaaS consent order last?

Until the regulator terminates it in writing; there is no fixed term. Blue Ridge's ran from January 24, 2024 to November 13, 2025, about 22 months. The Evolve order says its provisions remain effective "until stayed, modified, terminated, or suspended in writing by the Supervisors."

Did the Evolve order come from the Synapse bankruptcy?

No. The Federal Reserve said its action "is independent of the bankruptcy proceedings regarding Synapse Financial Technologies, Inc.," and the findings came from examinations issued in August 2023 and January 2024. The order does require the bank to define its own and its partners' record-keeping duties, including in a business disruption.

Do BaaS enforcement actions include fines?

The two BaaS orders discussed here imposed remedies and growth limits rather than penalties in their text. Penalties appear when violations are found and pursued; in October 2026 the OCC assessed a $350 million civil money penalty against American Express National Bank for BSA/AML failures, alongside the Federal Reserve's order on its parent.

How can a sponsor bank show it is not the next order?

By keeping the evidence the orders asked for as routine: every partner and subpartner inventoried and rated, files re-performed rather than attested, partner records tied to FBO accounts daily, referrals timed and remediation closed on a re-test. The BaaS Compliance solution is built to produce that evidence for every partner, every day.