FBO accounts at fintechs are omnibus deposit accounts that a sponsor bank holds "for the benefit of" a fintech's end customers: one account on the bank's core, many people's money inside it, and a separate sub-ledger, usually kept by the fintech or a middleware firm, that says how much belongs to each person. Whether those end customers are the bank's customers depends on the rule being applied. For the customer identification program, a person who opens an account is a customer; the agencies have said reloadable prepaid cards create an account and a customer relationship with the issuing bank; and for deposit insurance the FDIC looks through to each owner only if their identities and interests can be traced in good records. The answer is "yes" often enough that a sponsor bank must be able to name every end customer and what each is owed. Botminds' BaaS Compliance does that daily: its agents rebuild every end customer's balance from the partner's file and tie the total to the FBO account at the bank.
The worked example is a fictional sample bank, Tessaly Community Bank, which holds $252.2 million in FBO accounts for 11 partner programs. The rules and figures about the industry are the regulators' own, linked where they appear.
FBO accounts at fintechs, in four numbers from the FDIC
$250,000
insured per owner per ownership category, if the pass-through conditions are met
3
tests in the FDIC's proposed definition of a custodial account with transactional features
1,000+
consumer inquiries referred to the FDIC after one middleware firm's bankruptcy froze end-customer funds
Daily
reconciliation to per-owner records the FDIC proposed in 2024; still not a final rule
How do FBO accounts work at fintechs?
An FBO account works by separating the money from the records. The money sits at the sponsor bank in one or a few deposit accounts titled for the benefit of the fintech's customers. The records of who owns what, and every card swipe, transfer and fee that changes it, sit in the fintech's or its middleware provider's system. The agencies' 2024 request for information describes it plainly: transaction records "may not be reflected in the bank's core processing system," and what the bank's core does show may be only "omnibus accounts, often titled to reflect that they are held for the benefit of (FBO) end users" (89 FR 61577).
Where the money sits, and where the records of who owns it sit
| Layer | Holds | Typical keeper | What goes wrong when it drifts |
|---|---|---|---|
| FBO account at the sponsor bank | The commingled cash of every end customer in the program | The bank's core and general ledger | Nothing visible: the balance is right for the account, whatever it means for each person. |
| End-customer sub-ledger | Each customer's balance and transaction history | The fintech, or a middleware firm for many fintechs | Balances add up to more, or less, than the cash; nobody can say whose money is missing. |
| Settlement files | Card, ACH and transfer activity that moves cash in and out | Card processors and payment rails | Money leaves the FBO account but never reaches the customer's balance, or the reverse. |
| Onboarding files | Who each end customer is, and how it was verified | The fintech's app and its identity vendor | The bank cannot show it verified the person whose money it holds. |
The arrangement is efficient, and it is how most banking-as-a-service deposit programs scale. Its weakness is that the bank's own systems are correct and uninformative at the same time: the FBO balance is accurate to the cent, and says nothing about whether each end customer's balance is. The RFI calls the result "heightened levels of operational complexity, including as it relates to reconciliations and Bank Secrecy Act (BSA) recordkeeping and compliance."
Who is the customer in an FBO account?
The end customer is the bank's customer for some purposes and not others, and the bank has to know which. The fintech is the account holder of record; the end customers are the beneficial owners. Each regulation then draws its own line.
Is the end customer the bank's customer? It depends which rule is asking
| Rule or source | What it says | What it means in an FBO program |
|---|---|---|
| CIP definitions, 31 CFR 1020.100 | A "customer" is "a person that opens a new account"; an account is "a formal banking relationship." | Where the end customer opens a deposit account or card account at the bank through the app, the bank's CIP applies to that person. |
| Prepaid card CIP guidance, 2016 (OCC, Fed, FDIC, NCUA, FinCEN) | A general purpose prepaid card that is reloadable or offers credit "creates an account," and "a customer relationship is established between the issuing bank and the cardholder." | Card programs on FBO structures often meet that test, so the cardholder is the bank's customer for CIP. |
| Bank-fintech RFI, 2024 | "Independent of contractual responsibilities, the end user may still qualify as a customer of the bank for certain regulatory purposes." | A contract calling the end user "the fintech's customer" does not settle it. |
| Pass-through deposit insurance, 12 CFR 330.5 and 330.7 | The owners' "identities and interests" must be ascertainable from the bank's records or records kept "in good faith and in the regular course of business by another party." | For insurance, each end customer counts only if the records exist and are right. |
The practical consequence for BSA is direct. If the end customer is a customer for CIP, the bank must verify their identity under 31 CFR 1020.220 and keep the identifying information for five years after the account closes. The RFI asked banks how they handle exactly this: "How do the parties to bank-fintech arrangements determine the end user's status as a customer of the bank, the fintech company, or both?" A program that cannot answer it in writing has not decided whose CIP it is running. What a sponsor bank's BSA program must reach sets out the rest of those duties.
Is FBO money FDIC insured?
FBO money is insured against the failure of the bank, not the failure of the fintech, and only per owner if the pass-through conditions are met. The FDIC explains pass-through insurance in its 2024 proposal: it "may rely on records of those other than a failed IDI to identify depositors and their insured deposits, if such records are maintained in good faith and in the regular course of business," and then "each owner's interest in the deposit at the IDI is separately insured up to the statutory deposit insurance limit, currently $250,000" per ownership category (89 FR 80135).
Pass-through insurance on an FBO account: met, and not met
Conditions met: The bank's records disclose a custodial or agency relationship, such as "for the benefit of" end customers.
Conditions not met: The account looks like the fintech's own operating money.
Conditions met: Identities and interests can be traced from the bank's or another party's good-faith records.
Conditions not met: The sub-ledger is missing, wrong or inaccessible.
Conditions met: The funds genuinely belong to the named end customers.
Conditions not met: Funds are the fintech's, or ownership cannot be shown.
Conditions met: Each end customer insured up to $250,000 per ownership category.
Conditions not met: Insured to the named account holder, aggregated with its other deposits at the bank.
Conditions met: Deposit insurance does not apply: the bank has not failed. Access depends on the records.
Conditions not met: Same, and harder: nobody can quickly prove who owns what.
That last row is where most end-customer harm happens, and the agencies have tied it to marketing as well as records. The joint statement says misrepresentations of deposit insurance "may occur, for example, when nonbank third parties have communicated to end users that their funds are FDIC insured, without disclosing that FDIC insurance protects only against the failure of an IDI, and not against the failure of the nonbank entity" (joint statement), a matter governed by the FDIC's rule at 12 CFR part 328, subpart B.
FBO account vs custodial account: what the FDIC proposal would cover
An FBO account is a custodial account by title; the FDIC's 2024 proposal would single out the ones that move money. It defines a "custodial deposit account with transactional features" by three tests: the account "is established for the benefit of beneficial owner(s)," it "holds commingled deposits of multiple beneficial owners," and "a beneficial owner may authorize or direct a transfer through the account holder from the account to a party other than the account holder or beneficial owner" (89 FR 80135). A fintech wallet with a debit card meets all three.
The proposal lists ten exemptions where it thought other laws already keep good records: accounts holding only trust deposits, government depositors, broker-dealers and investment advisers, lawyers' trust accounts, employee benefit plans, real estate and title escrow, mortgage servicing custodial accounts, accounts where law bars disclosing the owners, reciprocal deposit networks not used for payments, and housing association and lease security deposits. Fintech payment and wallet programs are not on the list, which is the point.
What is the FDIC custodial account rule? Still a proposal
The FDIC custodial account rule is a proposed regulation, published October 2, 2024 as "Recordkeeping for Custodial Accounts," that would require banks holding transactional custodial accounts to keep per-owner records, reconcile them daily and be able to reach them even if the fintech or middleware firm fails. It is not law. Its comment period was extended into January 2025, and the Unified Agenda lists it as a long-term action with the final rule "To Be Determined" (RIN 3064-AG07).
What the FDIC's custodial account proposal would require of a sponsor bank
- Per-owner records
For each account: the beneficial owners, the balance attributable to each, and the ownership category, in a prescribed electronic file format.
- Daily reconciliation
Reconcile against the beneficial ownership records "no less frequently than at the close of business daily," handling timing variances by standard banking practice.
- Direct access when records sit with a third party
"Direct, continuous, and unrestricted access," including on the third party's "business interruption, insolvency, or bankruptcy."
- Independent validation
Periodic validation of the third party's records "by a person independent of the third party," with results given to the bank.
- Continuity plans
Backup copies of balances and the legal and technical means to rebuild records without the third party.
- Written policies and annual certification
Policies and procedures, plus an annual certification by a senior executive that the bank implemented and tested the requirements, and an annual report.
One sentence in the preamble matters for every BSA officer: the proposal "would not supersede or modify any requirements imposed by statute or regulation," and meeting it "would not necessarily satisfy the IDI's obligation under the Bank Secrecy Act." A bank can reconcile balances perfectly and still fail to know who the owners are. The daily tie-out and the identity test are two different controls.
What happened with Synapse FBO accounts?
Synapse Financial Technologies, a middleware provider between fintechs and several banks, filed for bankruptcy in late April 2024, and end customers lost access to their money for months because the records of who owned the pooled funds could not be reconciled. The FDIC's account, in the preamble to its proposal, is that "in early May 2024, one of the IDIs that partnered with Synapse froze deposits," stating that "Synapse denied the IDI access to an essential system through which the IDI accessed information on end users, deposits, and transactions." Court filings later said that "even after obtaining access to Synapse's data, the trustee and IDIs have experienced difficulties reviewing and reconciling this data against the IDIs' data" (89 FR 80135).
The FDIC noted that more than 1,000 consumer inquiries were referred to it after the freeze, and that "it is clear that some consumers misunderstood the nature of the relationships they entered into, the nature of deposit insurance, or both." The neighbouring guide on the Synapse bankruptcy follows the case in detail. For a sponsor bank, the lesson is narrow and severe: if the only complete list of owners sits in a third party's system, the bank's ability to pay its own depositors depends on that third party staying in business. The middleware layer is where that dependency usually sits.
How often should FBO accounts be reconciled? Daily, and to each end customer
FBO accounts should be reconciled every business day, and not only in total. A total-to-total match proves the partner's file adds up to the cash; it does not prove each customer's balance is right, and it misses offsetting errors. The FDIC's proposal set the daily floor, and the Federal Reserve's Evolve order required the bank to define who keeps which ledgers and sub-ledgers, and to keep those duties working through a serious business disruption (Evolve order).
Take the sample bank's morning tie-out for Fernquill Pay, a wallet and debit card program with 41,820 end customers. The partner's 5:58 AM file showed $48,212,904.17; the FBO account at close held $48,190,113.42. The difference, $22,790.75, had been unexplained since October 14, and Fernquill had replied that it was timing. The reconciler rebuilt all 41,820 balances from the file: they added to Fernquill's total, with no negatives or duplicates, so the gap was not inside the file. The break explainer then searched the payments hub, the card processor's settlement files and the general ledger, and found 23 debit-card funding reversals that left the FBO account on October 14 and never reached the wallets. They summed to the cent.
BaaS Compliance FBO tie-out: every balance rebuilt, and the break traced to its cause
Two rules in the sample bank's settings make this work. An unexplained difference of $0.00 is allowed; a "timing" label needs a matching payment in flight. And an unexplained difference escalates after one business day and again after three. Under those rules, the partner's October 16 explanation was tested and failed: a timing difference moves, and this one sat at the same amount for days. The remediation item that followed closes only after three daily tie-outs in a row at $0.00.
What an FBO structure hides from BSA monitoring
An FBO structure hides the customer from the bank's own monitoring. A bank's transaction monitoring sees the omnibus account: large aggregate inflows and outflows that look like any busy program. Structuring by one end customer, funnel activity across several wallets, or mule accounts receiving and passing on funds are visible only at the end-customer level, in the partner's data. The RFI flagged this when it named transaction monitoring and end-user record-keeping among the partner functions that heighten risk (89 FR 61577).
The OCC's Blue Ridge order made the point binding for that bank: its suspicious activity monitoring had to reach the accounts and sub-accounts provided through its fintech partners, and it had to measure the activity flowing through each partner's accounts (AA-ENF-2023-68). Daily end-customer files serve both purposes at once. The same file that proves the balances tie also gives the bank the per-customer activity its monitoring and its review of partner referrals need.
One partner program: the re-performed identities beside the day's FBO tie-out
Questions people ask
What is a custodian FBO account?
It is a deposit account opened by a custodian, such as a fintech, payment company or program manager, and titled for the benefit of the people whose money it holds. The custodian is the account holder; the end customers are the beneficial owners. In the FDIC's proposed rule the custodian is the "account holder," even when the account is titled in the bank's own name for the benefit of the business's customers.
Who keeps the records for FBO accounts?
Usually the fintech or a middleware provider keeps the end-customer sub-ledger, and the bank keeps the omnibus account. The RFI asked banks directly: "Generally, what party holds and maintains the account records?" The FDIC's proposal would let a third party keep them only if the bank has direct, continuous and unrestricted access and reconciles daily.
Does FDIC insurance protect FBO money if the fintech fails?
No. Deposit insurance pays when an insured bank fails, not when a fintech or middleware firm does. If the fintech fails, end customers' money is still at the bank, but getting it to them depends on records that show who owns what, which is what went wrong in 2024.
Is an FBO account the same as a pooled or omnibus account?
In BaaS, mostly yes: the FBO title tells the bank the funds belong to others, and the pooling is what makes it omnibus. The FDIC's proposal adds a third element, transactional features, so an FBO account from which end customers can pay third parties is the kind it would regulate.
Does a sponsor bank need its own copy of end-customer balances?
Under the FDIC's proposal it would need direct access and continuity plans, such as copies of daily balances held independently of the third party; that rule is not final. Under the Evolve order, record duties had to keep working through a serious business disruption. A bank that rebuilds every balance daily from the partner's file, as BaaS Compliance does, keeps that copy as a by-product.