Middleware banking has two meanings. In a bank's technology stack, middleware is integration software that connects the core to other systems. In banking as a service, a middleware provider, which regulators also call an intermediate platform provider, is a company that sits between a sponsor bank and many fintechs: it connects them by API, often onboards the end customers, keeps the record of each customer's balance and may run transaction monitoring for the fintechs. The second kind is a compliance problem, because it puts the facts a bank's BSA/AML program depends on one more company away from the bank, while the bank keeps the legal duty. Botminds' BaaS Compliance is built to see through that layer: its agents take each partner's end-customer files, re-perform onboarding checks with the bank's own sources, and tie every customer's balance to the FBO account at the bank each business day.
Examples come from a fictional sample bank, Tessaly Community Bank, with 11 partner programs. The definitions and rules come from the federal banking agencies, linked where they appear.
Three layers, one legal duty: what a sponsor bank sees through middleware
What is middleware in banking?
Middleware in banking is any layer that sits between two systems and translates between them. In the older sense it is core banking middleware: integration software that lets a bank's core, card platform, online banking and payment hubs exchange data. In the banking-as-a-service sense it is a company. The FDIC's 2024 proposal describes the best-known example, Synapse, as a middleware provider whose software connected the systems of many fintechs to several insured banks (89 FR 80135).
The two meanings carry different risks. Integration software is a vendor product the bank runs or licenses; if it fails, the bank's own records are still the bank's. A BaaS middleware provider often runs functions the bank is legally responsible for, on its own systems, for many banks and fintechs at once. When people search for "middleware banking" they usually want the first; when a BSA officer worries about it, it is almost always the second.
What is a middleware provider in BaaS?
A middleware provider in BaaS is a technology company that connects fintechs to one or more sponsor banks and takes on some of the operational and compliance work in between. The agencies' July 2024 joint statement lists the names the industry uses: banks "rely on one or multiple third parties to maintain the deposit and transaction system of record; process payments (sometimes with the ability to directly submit payment instructions to payment networks); perform regulatory compliance functions; provide end-user facing technology applications; service accounts; perform customer service; and perform complaint and dispute resolution functions," and "these third parties are sometimes referred to as intermediate platform providers, processors, middleware providers, aggregation layers, and/or program managers" (joint statement, July 25, 2024).
The same statement then adds the sentence a sponsor bank cannot contract around: "A bank's use of third parties to perform certain activities does not diminish its responsibility to comply with all applicable laws and regulations." Calling the company in the middle a vendor, a processor or a program manager changes nothing about who answers for the CIP, the monitoring or the SAR.
What is an intermediate platform provider?
Intermediate platform provider is the regulators' formal term for the BaaS middleware company. The agencies' 2024 request for information describes "a new business model whereby some fintech companies provide an intermediate technology platform—sometimes referred to as an 'aggregation layer'—to facilitate relationships between banks and other fintech companies." These providers "enable individual banks to connect to numerous fintech companies," may market an "all-in-one" solution, and "may also offer to assist fintech companies in implementing compliance risk management programs and in handling the transfer and flow of funds" (89 FR 61577).
Two features of that description matter for BSA. First, "a single intermediate platform provider may have arrangements with multiple banks," so one firm's failure can reach several sponsor banks at once. Second, the RFI says risks "may be further heightened where an intermediate platform provider assists the fintech company in implementing risk management programs, such as compliance": the fintech's compliance program may be, in substance, the middleware provider's product.
What the middleware layer hides from a sponsor bank's BSA program
The middleware layer hides the end customer. The bank's core sees an omnibus FBO balance and the instructions that move it; the identity of each person, their balance, their transactions and whatever alerts the platform raised all sit one or two companies away. The RFI lists the functions where risk is "heightened": a fintech or intermediate platform provider "handling end-user complaints, performing customer identification and due diligence, developing and transmitting disclosures, monitoring transactions, maintaining end-user ledgers" and more.
Each BSA function, who often runs it in a middleware program, and what the bank needs to see
| BSA function | Often run by | What the bank needs to see itself |
|---|---|---|
| Customer identification | The fintech app, through the platform's connection to an identity vendor | The raw identity responses and the open decision for each account, so it can re-perform a sample with its own sources. |
| Due diligence and risk rating | The platform's or fintech's rating model | The inputs and the rating for each customer, and the model's logic in plain words. |
| Transaction monitoring | The platform, for all its fintechs; sometimes the fintech | Per-customer activity, the scenarios run, alert volumes and dispositions, and the referrals they produced. |
| Who owns which dollar | The platform's sub-ledger | A daily per-customer file it can add up and tie to the FBO account. |
| SAR referrals | The fintech or the platform | Timely, complete referrals, with nothing about the bank's decision ever sent back. |
| Sanctions screening | The platform at onboarding and on payments | Screening results with the list version in force on the day. |
The Blue Ridge consent order shows how the OCC reads this gap: the bank had to monitor activity through its fintech partners and count the activity in each partner's accounts and sub-accounts (AA-ENF-2023-68). A bank that receives only a monthly attestation from the platform cannot do either.
Who is responsible when middleware fails?
The sponsor bank is responsible for its depositors and its BSA obligations when middleware fails; the contract can allocate costs, not the duty. What failure looks like was set out by the FDIC: after Synapse filed for bankruptcy in late April 2024, one partner bank froze deposits placed through it, and the trustee and banks then had difficulty matching Synapse's records against the banks' own (89 FR 80135). The neighbouring guide on the Synapse bankruptcy follows the case; how FBO accounts work at fintechs explains the record-keeping behind it.
"Synapse was a so-called 'middleware provider' for numerous fintech companies, meaning that its software bridged the information technology systems of fintech companies and IDIs."
FDIC, Recordkeeping for Custodial Accounts, proposed rule, 2024
Regulators have described what a bank should have in place before that day. The joint statement lists "risk-based contingency plans, which address potential operational disruption or business failure at the third party that may disrupt end users' access to funds," and suggests the contract "address the transfer of the relevant accounts, data, or activities to another entity in the event of the third party's bankruptcy, business failure, business interruption, or failure to perform as expected." The FDIC's pending proposal would go further for custodial accounts: "direct, continuous, and unrestricted access" to the records, even in the third party's insolvency, plus backup copies held independently.
What did the 2024 bank-fintech RFI say?
The July 2024 request for information, issued by the OCC, the Federal Reserve and the FDIC, described how bank-fintech arrangements work, named the intermediate platform provider as a distinct business model, set out the risks, and asked dozens of questions, including how banks and fintechs reconcile account records and which party holds and keeps them. It was a request, not guidance or a rule (89 FR 61577).
From the 2024 RFI to the 2026 proposal: no direct answer in between
- RFI comments, Jul to Oct 2024, extended once
- No summary of comments or final product published22 months
- Sep to Nov 2026: proposal would rescind the 2024 joint statement
The RFI's lasting contribution is vocabulary and a map of risk. Banks that answer its questions about their own programs, who keeps the records, who monitors, how reconciliations work, what happens if the platform exits, have most of a middleware risk assessment already written.
Subpartners and subcontractors: how far down the chain a sponsor bank looks
A sponsor bank should look as far down the chain as its BSA duties go, which is to every end customer, whoever onboarded them. The enforcement orders drew the line there. The OCC's Blue Ridge order counted fintech subpartners as third-party relationships and required end-user approval criteria for each of them (AA-ENF-2023-68). The Federal Reserve's Evolve order put "program managers" on the list of relationships that needed prior approval (Evolve order).
The guidance is lighter on this point, and getting lighter. The 2023 guidance asks banks to assess a third party's "reliance on subcontractors" and consider contract terms on notice and consent (88 FR 37920). The September 2026 proposal says "the use of subcontractors alone does not typically create an independent third-party relationship or create a presumption of direct banking organization oversight" (91 FR 58536, proposed). For general vendors that is sensible. For a middleware platform that holds the end-customer records, the BSA duty makes the question moot: the bank needs the data whether or not it calls the platform a relationship.
What to require from a middleware layer: data, access and a way out
From any middleware layer, a sponsor bank should require the data to test the BSA work, the access to keep serving depositors if the platform fails, and the right to act on what it finds. The list below is what that means in a contract and in daily operation.
What a sponsor bank should require of a BaaS middleware platform
- A daily per-customer file by a set time
Every end customer's balance and transactions, so the bank can add them up and tie them to the FBO account before the day starts.
- Raw onboarding evidence
Identity vendor responses and open decisions for each account, not pass rates, so the bank can re-perform files.
- Monitoring visibility
Scenarios, alert counts, dispositions and referrals per fintech, on the bank's schedule.
- Change notices before releases
Any change to onboarding, monitoring or data flows, early enough to review for control impact.
- Direct access that survives failure
Access to records if the platform is interrupted, insolvent or in bankruptcy, and the bank's own copy of daily balances.
- Transfer terms
The right to move accounts, data and activities to another provider without penalty if the platform fails or exits.
- A list of the fintechs and subpartners
Every program the platform runs through the bank, kept current, so the bank's inventory is complete.
In the sample bank, these requirements show up as ordinary morning work. The partner data feed is due at 6:00 AM Eastern; when one partner's file had not arrived, the desk showed it as a late file with three retries before the tie-out deadline, rather than silently skipping the partner.
BaaS Compliance desk: a late partner file is a work item, not a gap
What is banking middleware software, and is core banking middleware the same risk?
Banking middleware software usually means integration products, such as API gateways, enterprise service buses and messaging layers, that connect a bank's core to other applications. It is not the same risk as a BaaS middleware provider, because the bank licenses or runs it and the records stay in the bank's systems. The 2023 guidance still applies: due diligence should "review both the banking organization's and the third party's information systems to identify gaps in service-level expectations, business process and management, and interoperability issues," and consider "dependency on a single provider for multiple activities" (88 FR 37920).
The test that separates the two is simple: if the provider disappeared tomorrow, could the bank still name every end customer and what each is owed from its own records? For integration software, yes. For a BaaS middleware provider that keeps the sub-ledgers, only if the bank has been taking and checking those records itself.
Tying through the middleware layer to every end customer, every business day
Questions people ask
Is a middleware provider a bank?
No. A BaaS middleware provider is a technology company; the deposits sit at the sponsor bank and the bank's charter is what makes the accounts possible. As the 2024 joint statement warns, deposit insurance covers the failure of the insured bank, not the failure of the company in the middle.
Can a middleware provider perform CIP for a bank?
It can run the identity checks as the bank's agent under the bank's CIP, and many do. The bank cannot formally rely on it under 31 CFR 1020.220(a)(6) unless it is a regulated institution with its own AML program rule and federal functional regulator, which most platforms are not, so the bank must test the work.
Do sponsor banks contract directly with middleware providers?
Not always. The joint statement names "multiple levels of third-party and subcontractor relationships, where the bank does not have direct contracts with entities that perform crucial functions" as an elevated risk. The FDIC's pending proposal would require a direct contract where a third party keeps the custodial records.
What happened to BaaS middleware after 2024?
The regulators' documents show the questions, not the market. The agencies asked about intermediate platform providers in the 2024 RFI, the FDIC proposed direct-access record rules for custodial accounts, and enforcement orders put subpartners and program managers inside banks' oversight. None of those has yet produced a final rule specific to middleware.
How does a sponsor bank test through a middleware layer?
By taking the platform's own files, onboarding responses, per-customer balances and settlement data, and re-checking them with the bank's sources: re-performing a sample of identity checks, tying every customer's balance to the FBO account daily, and testing the whole population when failures share a cause. That is the method behind BaaS Compliance, and the fintech AML analyst guide shows who does what in it.