The relationship between banks and fintech companies, especially Banking-as-a-Service (BaaS) arrangements, has drawn increased attention from regulators and lawmakers in recent months.

In a September speech, Acting Comptroller of the Currency Michael Hsu said that BaaS, a business model that allows unlicensed fintech companies and businesses to offer financial services to customers on a bank's regulated infrastructure, is changing the risk profile of the financial industry. Hsu noted that the model represents a "disintermediation" trend in banking, making it difficult for customers, regulators, and the banking industry to distinguish "where the bank ends and the tech company begins."

Fintech analyst and author of the Fintech Takes newsletter Alex Johnson responded to Hsu's speech, saying: "The OCC seems to still be learning what Banking-as-a-Service is. I get the sense that the OCC doesn't even necessarily fully understand what all the banks it supervises are doing with fintech partnerships and Banking-as-a-Service, and they're still trying to get their arms around it."

To better understand this space, Hsu said the OCC plans to group bank-fintech arrangements by similar safety and soundness risk characteristics. As the OCC delves deeper into BaaS, Hsu raised a series of questions about accountability, trust, and risk that must be answered to make real progress. "When something goes wrong, who is responsible for what?" he asked. "How do banks and their third parties view and treat customers in bank-fintech partnerships? When does a customer become a product, and how are consumer protections maintained?"

Jonah Crane, a partner at financial services consulting and investment firm Klaros Group, believes the OCC's effort to map the BaaS landscape and its impact on the financial services industry is a logical step for the regulator, as it has been trying to get a handle on BaaS partnerships for years. "Now they feel like they have at least partial command of it, and they're setting standards and frameworks to determine what to ask of banks, which is why we're seeing so much regulatory activity now," he said.

However, the OCC's signals of increased scrutiny of BaaS have drawn criticism from some Republicans, who worry that more regulation will come at the expense of innovation. In a letter, House Republicans called on Hsu to clarify how the OCC plans to regulate bank-fintech partnerships. Led by Rep. Patrick McHenry (R-N.C.), five House Republicans wrote to the Acting Comptroller in October: "Under the previous administration, the OCC worked to provide banks and their customers with a clear understanding of the regulatory and supervisory expectations for emerging products and services, and how to properly assess risk. While we expect the OCC to continue to provide clear rules and support innovative banking services, that has not been the case."

In the letter, the lawmakers referenced a speech Hsu gave at a Texas bankers conference, where he discussed the different risk considerations associated with community bank-fintech partnerships. "You recently highlighted five priority areas where the OCC supports community banks," the lawmakers wrote, "but promoting fintech relationships was not among the five priorities." The Republicans wrote that, when done properly, the benefits of bank-fintech partnerships outweigh the risks. "Fintech partnerships can save fintech companies and banks money, increase competition, and provide consumers with faster, better, and cheaper banking products and services."

How to move forward

Meanwhile, the global BaaS market is expected to reach $74.55 billion by 2030, according to a September study by Grand View Research. Financial software company Finastra found in a March report that 85% of the 1,600 senior banking executives it surveyed are already implementing or plan to implement BaaS within the next 12 to 18 months.

But Crane said that, like any other business, banks should proceed cautiously when entering BaaS partnerships with fintechs, especially amid heightened regulatory scrutiny. "If I were a bank trying to run a fintech sponsorship program, I would really double down and be explicit in agreements with fintech partners about who is doing what," he said. Crane noted that banks need to ensure they can access the data they need in a timely manner to ensure fintech programs comply with the bank's regulatory obligations. "Ultimately, the bank is going to be held responsible, and at the end of the day, that's what regulators are worried about. The bank has to be responsible because they're the regulated entity, and they're using their charter."

Johnson said the OCC's September enforcement action against Blue Ridge Bank offered the industry a glimpse into the specific concerns regulators may raise when BaaS is poorly executed. According to Securities and Exchange Commission (SEC) filings, the OCC ordered the Charlottesville, Virginia-based bank to improve oversight of third-party fintech partnerships. Blue Ridge's BaaS partners include Unit and digital bank Upgrade, and the bank was required to strengthen anti-money laundering risk management, suspicious activity reporting, and information technology controls after regulators found "unsafe or unsound practices." Under the order, Blue Ridge must obtain OCC non-objection before entering any new contracts with fintech partners or adding new products with existing partners.

Crane said this action signals that regulators will scrutinize bank-fintech partnerships more closely in the future and expect banks to demonstrate in concrete ways how they ensure partners' operations align with the bank's regulatory compliance obligations. But for banks that invest in compliance, the rewards could be substantial as BaaS demand grows. "Demand for these programs will persist because not all fintechs—actually very few—will actually become banks. Banks that operate such programs in a way that satisfies both partners and regulatory expectations will be rewarded," Crane said. He also said that as regulation tightens, fintechs seeking embedded banking services may become more selective. "They may prioritize resilience and stability, and a bank committed to compliance, over speed, whereas previously speed was an important factor for fintechs looking for a bank partner."

A boon for community banks

As companies compete for consumer accounts, the BaaS model has become a cost-effective way for community banks to grow deposits without expanding into new markets. Johnson said: "From a revenue perspective, it's very profitable and less capital-intensive. You can participate without spending a lot of resources, and I think that's the main constraint that's causing many community banks to struggle right now. They just don't have the resources to have direct-to-consumer products like fintechs or big banks."

Under the Durbin Amendment to the Dodd-Frank Act, banks with assets below $10 billion are exempt from caps on interchange fee revenue, while larger competitors are subject to them. In a typical BaaS model, the fintech acquires customers and handles the user experience, while the sponsor bank stays behind the scenes, managing the operational financial infrastructure and fulfilling the regulatory duties that come with holding a bank charter. Fees generated through debit card interchange fees are typically split between the parties. Banks that choose to venture into BaaS may also partner with a third-party infrastructure provider that acts as "middleware" between the financial institution and the fintech.

According to a February report by Cornerstone Advisors, a sponsor bank with 1 million consumer accounts growing 2% monthly, sharing most revenue streams with a BaaS infrastructure provider and sharing interchange fee revenue with sponsor companies, could generate approximately $17.2 million in annual non-interest income from offering BaaS. The study estimated that if a bank also served 300,000 commercial customers growing 2% monthly, annual BaaS revenue would increase to $24 million.

Johnson said: "The BaaS business model provides an interesting 'get out of jail free card' for many community banks that would otherwise struggle to grow or would have to choose acquisition." Honolulu-based Central Pacific Bank is one example. The bank decided to launch a BaaS program after witnessing local customers open mainland-based digital bank accounts during the pandemic. David Morimoto, the bank's senior executive vice president and chief financial officer, said: "We could do business as usual and continue to focus on traditional community banking in Hawaii, or we could take a different route. We chose to participate in disruption rather than let disruption happen and affect our business." Central Pacific Bank, with $7.34 billion in assets, is leveraging its partnership with Swell Financial, a digital bank it incubated during the pandemic and spun off this year, to enter the broader U.S. market. Morimoto said: "Banks in Hawaii have always explored how to get into more U.S. banking markets rather than being limited by geography. In the past, that required physical branches on the mainland. In today's environment, physical branches are less important."

According to an Oliver Wyman study, BaaS allows banks to reach more customers at significantly lower customer acquisition costs. The report estimated that the cost of acquiring a customer typically ranges from $100 to $200, but BaaS can help banks reduce that cost to $5 to $35. For community banks struggling to grow deposits amid increasing competition from nonbanks and national institutions, BaaS could be an attractive solution. Johnson said regulators may take this into account when crafting future guidance or regulations. "(Regulators) will take into account that Banking-as-a-Service is a lifeline for many community banks."