Embedded finance after Synapse: the sponsor bank's balance sheet is the product

Embedded finance, the distribution of banking products through non-bank brands and software platforms, has become one of the few genuine growth channels in retail and small-business banking. Bain and Bain Capital estimated that embedded finance accounted for $2.6 trillion, nearly 5% of US financial transactions, in 2021 and projected it would reach $7 trillion, more than 10%, by 2026, with platform and enabler revenues growing from $22 billion to $51 billion¹. McKinsey estimates the European market generated €20–30 billion in 2023, about 3% of banking revenues, and could exceed €100 billion by 2030, when embedded channels might originate 20–25% of retail and SME lending².

Behind most of those brands sits a regulated bank. In banking-as-a-service (BaaS), the sponsor bank holds the charter, the deposit insurance relationship and the payment-network access; the fintech owns the customer interface; and in many programmes a middleware provider sits in between, keeping the ledger of which end user owns which slice of pooled deposits. That division of labour works until one layer fails.

What Synapse revealed

When the middleware provider Synapse filed for bankruptcy in April 2024, about $265 million of deposits across more than 100,000 consumer accounts was frozen, and the court-appointed trustee later estimated a shortfall of $60–90 million between what end users were owed and what could be located³. The CFPB alleged that Synapse failed to keep adequate records of where consumers' funds were held and failed to ensure those records matched those of its partner banks³. In November 2025 the Bureau allocated $46.2 million from its Civil Penalty Fund to affected consumers, roughly half the projected shortfall⁴.

The lesson for banks is uncomfortable. Customers of the fintech apps believed their money was in a bank. Legally it was, in pooled custodial accounts, but no single party could quickly show who owned what. The FDIC responded in September 2024 with a proposed rule that would require banks offering such accounts to keep records identifying each beneficial owner and to reconcile balances for each owner daily⁵.

The enforcement wave, and what it targeted

Even before Synapse, supervisors had turned their attention to sponsor banks. An analysis of 124 severe federal enforcement actions from January 2023 to mid-2024 found that 18.3% of actions since the start of 2024 had targeted BaaS banks, up from 13.5% in 2023. Anti-money-laundering failings dominated: 64% of actions against BaaS sponsor banks focused on AML shortfalls, against 29% for other banks, and 79% of the AML-focused BaaS actions required look-back reviews⁶.

In July 2024 the Federal Reserve, FDIC and OCC issued a joint statement on arrangements with third parties to deliver deposit products, highlighting operational, compliance, liquidity and concentration risks, and the risk of end-user confusion about deposit insurance⁷. The orders themselves share common themes: third-party oversight capacity, BSA/AML controls in partner channels, board oversight and data access. Some banks have since worked their way out. One Virginia sponsor bank exited its BaaS programme and had its OCC consent order terminated in November 2025 after 22 months, crediting experienced compliance hires⁸.

The policy pendulum swings back

US policy has shifted markedly since 2025. The FDIC withdrew its proposed brokered-deposits rule in March 2025, saying its narrow reading of the primary-purpose exception was inconsistent with the law⁹. On 15 September 2026 the OCC, Federal Reserve, FDIC and NCUA proposed new third-party risk management guidance to replace the 2023 interagency guidance, arguing that the earlier text had been read as prescriptive and could discourage partnerships with fintechs; comments are due by 16 November 2026¹⁰.

Lighter-touch guidance does not remove the underlying exposure. A sponsor bank remains the regulated entity, the holder of the deposits and the institution customers and supervisors turn to when a partner fails. Tailoring allows banks to spend less effort on low-risk vendors; it does not reduce the need to know, in real time, the balance and identity behind every custodial sub-account.

What good partner-bank risk management looks like

The consent orders and the Synapse failure point to a practical standard. First, the sponsor bank, not the fintech or middleware provider, must be able to produce a per-customer balance file on demand, reconciled to its own general ledger. Second, onboarding due diligence must be matched by continuous monitoring: transaction patterns, complaint trends, marketing claims about deposit insurance and the financial health of the partner itself. Third, the bank needs contractual and technical rights to step in: access to partner data, the ability to freeze or redirect flows, and a tested plan to pay customers directly if a partner fails.

None of this is new in principle; the 2024 joint statement already listed the risks⁷. What is new is that supervisors, customers and courts have seen what happens when the data does not exist. Banks that can demonstrate these capabilities will find it easier to win programme managers, who increasingly ask sponsor banks about their own enforcement history and control maturity before signing.

Where banks win

• Ledger ownership. Banks that hold or independently shadow the end-user ledger, reconciled daily or faster, can onboard partners with confidence and survive a partner's failure.
• Compliance as a service. Monitoring, sanctions screening and complaint handling across programmes, delivered centrally, turn the most expensive part of BaaS into a scale advantage.
• Selective partnering. Fewer, larger programmes with transparent unit economics outperform long tails of small partners that each bring their own risk.
• Own-brand embedding. Large banks can embed their own products in corporate clients' and merchants' platforms, capturing the channel without the sponsor-bank risk.

Embedded finance will keep growing because customers want financial services where they already are. The banks that profit from it will be the ones that treat the partnership as an extension of their own balance sheet, with the controls to match.

The easing of US guidance creates a window. Banks that use it to cut oversight costs indiscriminately risk repeating the 2022–24 cycle; banks that use it to invest in automation, shared controls and real-time reconciliation can grow their programme books on a lower, more defensible cost base.