Banks’ relationships with fintechs, particularly banking-as-a-service (BaaS) arrangements, have garnered increased attention among regulators and lawmakers in recent months.

BaaS, a business model that allows fintechs and corporations without a charter to offer their customers financial services by using the regulated infrastructure of a bank, is changing the financial industry’s risk profile, Michael Hsu, the acting comptroller of the Office of the Comptroller of the Currency (OCC), said in a September speech. 

The model represents the “de-integration” of banking, a trend that has made it difficult for customers, regulators and the banking industry to distinguish between “where the bank stops and where the tech firm starts,” he said.

“It seems like the OCC is still learning about what banking-as-a-service is,” Alex Johnson, a fintech analyst and author of the Fintech Takes newsletter, said in response to Hsu’s speech. “I got the sense that it didn't even necessarily seem like the OCC had a perfect understanding of what all of the banks that it oversees are doing when it comes to fintech partnerships and banking-as-a-service, and they're still trying to sort of get a handle on that.”

To get a better understanding of the space, Hsu said the OCC aims to subdivide bank-fintech arrangements into cohorts with similar safety and soundness risk profiles and attributes.

As the OCC dives deeper into BaaS, Hsu said a wide range of questions regarding responsibility, trust and risk must be answered to make real progress.

“Who is responsible for what when things break?” he said. “How do banks and their third parties view and treat customers in bank-fintech arrangements. When do customers go from being the client to becoming the product, and how are consumer protections maintained?” 

The OCC’s quest to map out the BaaS space and its impact on the financial services industry is a natural step for the regulator, which has spent years trying to get its arms around BaaS partnerships, said Jonah Crane, a partner at Klaros Group, a financial services advisory and investment firm.

“Now that they feel like they've got their arms at least part way around them, they're developing ideas and frameworks for what kinds of standards they should be holding the banks to, and that's why you're seeing all of this regulatory activity now,” he said.

But the OCC’s signaling of a greater focus on BaaS has irked some Republicans who fear more regulation would come at the expense of innovation.

In a letter, House Republicans called on Hsu to clarify how the OCC plans to regulate bank-fintech partnerships. 

“Under the previous administration, the OCC worked to provide banks and their customers with a clear understanding of the regulatory and supervisory expectations surrounding emerging products and services and how to properly assess risk,” five House Republicans, led by Rep. Patrick McHenry, R-NC, wrote the acting comptroller in October. “While we expected the OCC to continue to provide clear rules of the road and support innovative banking services, such has not been the case.”

In their letter, the lawmakers pointed to a speech Hsu gave at a bankers conference in Texas, where he touched on the different risk considerations associated with community bank-fintech partnerships. 

“[Y]ou recently highlighted five areas the OCC would prioritize in supporting community banks,” the lawmakers wrote. “Promoting fintech relationships was not among the five priorities.”

When conducted properly, the benefits from bank-fintech partnerships outweigh the risks, the Republicans wrote.

“Fintech partnerships can lead to cost savings for both fintechs and banks, increase competition, and provide faster, better, and cheaper banking products and services for consumers,” they said.

How to proceed

Meanwhile, the global BaaS market is expected to reach $74.55 billion by 2030, according to a study released in September by Grand View Research. 

And a March report by financial software company Finastra found 85% of 1,600 senior banking industry executives it surveyed are already implementing or planning to implement BaaS over the next 12 to 18 months.

But just like any other venture, banks should exercise caution when entering into BaaS partnerships with fintechs, especially in light of heightened regulatory scrutiny, Crane said.

“If I were a bank trying to run a fintech sponsorship program, I would really double down and get clear on my agreements with my fintech partners on who's doing what,” he said. 

Banks need to make sure they can access the data they need in a timely manner to ensure the fintech’s program is consistent with the bank’s regulatory obligations, Crane said. 

“Ultimately, the bank is going to be on the hook, and at the end of the day, that’s what you're seeing come through in the regulator’s concern,” he said. “The bank needs to be on the hook because they're the regulated party. They are leveraging their charter.”

An enforcement action the OCC issued against Blue Ridge Bank in September gives the industry a glimpse into the specific types of concerns a regulator may have when BaaS isn't done well, Johnson said.

The OCC ordered the Charlottesville, Virginia-based bank to improve its oversight of third-party fintech partnerships, according to a Securities and Exchange Commission (SEC) filing.

Blue Ridge, which counts Unit and neobank Upgrade among its BaaS partners, was ordered to bolster its anti-money laundering risk management, suspicious activity reporting and information technology controls after the regulator “found unsafe or unsound practice(s),” the filing indicated.

Under the order, Blue Ridge must obtain the OCC’s non-objection before entering into any new contracts with fintech partners or adding new products in cooperation with existing partners.

The action signals regulators are going to take a much closer look at bank-fintech partnerships going forward, and they’ll expect banks to show in granular ways how they're ensuring partners’ operations are consistent with the bank's regulatory compliance obligations, Crane said.

But for banks that invest in compliance, the return could be lucrative as demand for BaaS grows, he said.

“There's going to continue to be such a demand for these kinds of programs because not all these fintechs — in fact, very few of them — are going to ever become banks,” Crane said. “There'll be a reward for being a bank who runs one of these programs in a way that both satisfies their partners and meets regulatory expectations.” 

Fintechs shopping for embedded banking services may also become more selective as regulators step up oversight, he said. 

“They may prioritize resilience and stability and a bank who has committed to getting the compliance piece right over speed, whereas previously, speed to market was a big factor for fintechs looking for the bank partners,” Crane said.

A boon for community banks

As firms compete for consumer accounts, the BaaS model has emerged as a cost-efficient way for community banks to grow deposits without having to expand to new markets. 

“It's very lucrative from a revenue perspective, but also pretty capital-light,” Johnson said. “You can participate in it without having to expend a lot of resources, which, I think, is the main constraint that's causing a lot of community banks to struggle right now. They just don't have the resources to throw at direct-to-customer products like the fintech companies or the bigger banks do.”

But under the Durbin Amendment, banks below the $10 billion-asset threshold are not subject to a cap on interchange revenue like their larger competitors.

In a typical BaaS model, fintechs acquire the clients and are in charge of the user experience, while the sponsor bank remains in the background, managing the financial infrastructure of the operation and fulfilling the regulatory duties that come with holding a bank charter. The fees generated through debit card interchange are often shared between the two parties.

Banks that choose to venture into BaaS may also partner with a third-party infrastructure provider, which acts as the “middleware” between the financial institution and fintech. 

A sponsor bank with 1 million consumer accounts, growing at 2% per month, that shares revenue for most revenue sources with a BaaS infrastructure provider and shares interchange revenue with the sponsoring firm, would generate roughly $17.2 million in annual noninterest income from providing BaaS, according to a February report by Cornerstone Advisors.

Annual BaaS revenue would grow to $24 million for a bank that also provided the service to 300,000 commercial clients, growing at 2% a month, the study estimated.

“The BaaS business model presents an intriguing ‘get-out-of-jail-free’ card for a lot of community banks that otherwise would struggle to grow or that would have no choice but to acquire,” Johnson said.

For Honolulu-based Central Pacific Bank, the impetus to launch a BaaS program came after witnessing local customers open accounts with mainland-based neobanks during the pandemic.  

“We could be business as usual, and continue focusing on traditional community banking in Hawaii, or we could take a different tack,” said David Morimoto, the bank’s senior executive vice president and CFO. “We chose to participate in the disruption rather than just allow that disruption to occur and impact our business.”

The $7.34 billion-asset Central Pacific Bank is using its partnership with Swell Financial, the digital bank it incubated during the pandemic and spun out this year, to access the broader U.S. market.

“Hawaii banks have explored ways to access more of the U.S. banking market rather than limit themselves geographically,” Morimoto said. “In the past, it required a physical presence on the mainland. In today’s environment, that physical presence is no longer as important.”

BaaS allows banks to reach a greater number of customers at a significantly lower customer acquisition cost, according to a study by Oliver Wyman.

The cost of acquiring a customer is typically in the range of $100 to $200, the report estimated, but BaaS can help banks lower that cost to $5 and $35. 

For community banks struggling to grow deposits amid increasing competition from nonbanks and national institutions, BaaS can be an enticing solution.

And it’s something that regulators will likely evaluate when crafting future guidance or regulation, Johnson said.

“[Regulators] are going to take into consideration the fact that banking-as-a-service is a lifeline for a lot of these community banks,” he said.