Is BaaS still a viable operating model in 2026?

Yes, but bifurcated. Sponsor-bank count is up nearly 10 percent year-over-year. The old model — opaque middleware sitting on a sponsor bank willing to outsource compliance — is regulator-terminated. The new model rests on daily FBO account reconciliation, executive certification, direct bank contracting, and demonstrable step-in and wind-down rights. Sponsor-bank sourcing is now a regulatory-posture underwriting exercise, not a shortlist exercise.

What did the Synapse collapse actually change?

Synapse filed Chapter 11 in April 2024. The fintech's records and the sponsor bank's records did not agree, and no one had an independently verifiable source of truth. The Federal Reserve's June 14, 2024 cease-and-desist order against Evolve Bank cited unsafe and unsound practices in the third-party partnership program. The July 25, 2024 interagency joint statement on bank-fintech deposit arrangements made the existing June 2023 third-party risk management guidance apply with full force to BaaS. The CFPB's November 28, 2025 allocation of $46.2M from the Civil Penalty Fund for Synapse victims is the first-ever fintech-related use of the fund.

Which sponsor banks are still in the 2026 shortlist?

Column N.A. (full OCC national charter, direct-API stack, selective on fintech partners), Coastal Community Bank (Washington-based, added Dave as sponsor client in 2025), Grasshopper Bank (pending Enova acquisition closing H2 2026 subject to OCC and FRB approval), Cross River (under FDIC consent order April 2023 requiring prior-approval for new partnerships), Sutton and Piermont (FDIC consent orders February 2024), Bangor Savings, and Regent Bank. Blue Ridge exited BaaS in full at end of 2024 and was later released from consent order — do not list as active.

What is the FBO account model, and why is executive certification now expected?

An 'for benefit of' (FBO) account is a pooled bank account at the sponsor bank holding funds for the benefit of the fintech's end users. The fintech runs a sub-ledger mapping funds to end users. Post-Synapse, regulator expectation is daily reconciliation of the fintech's sub-ledger against the bank's FBO account, annual executive certification that the records match, an escrow or data-replication mechanism so the customer ledger survives a fintech failure, and documented step-in rights and wind-down plans. The Guidehouse practitioner primer on FBO governance is a useful summary of the post-Synapse expectations.

How is middleware repositioning?

Treasury Prime and Synctera have publicly repositioned toward direct-bank contracts and away from tri-party structures. Newline by Fifth Third (the rebrand of Rize Money, acquired May 2023) is the large-bank-owned embedded-payments alternative. Unit's historical partners include Piermont. The direction of travel across the middleware category is deeper compliance, reconciliation, and BSA/AML tooling, with speed-to-market as a secondary factor — the reverse of the pre-2024 posture.

What is the FDIC's July 2024 brokered-deposit proposal, and why does it matter for sponsor bank funding?

On July 30, 2024, the FDIC proposed an overhaul of the Section 29 brokered-deposit classification, which would eliminate exclusivity and enabling-transactions exceptions that BaaS deposits currently rely on. If finalized, sponsor banks whose deposit base is largely BaaS-generated could see those deposits reclassified as brokered, changing liquidity ratios, cost of funds, and, in some cases, the strategic sustainability of the sponsor-bank model itself. Model exposure explicitly for any sponsor bank whose deposits are heavily program-generated.

The Analyst Note Financial Services series · piece 6 of 8 · Last updated July 2026

Fintech + BaaS mid-market posture 2026: partner bank sourcing and TPRM.

The BaaS market is not dead — sponsor-bank count is up nearly 10 percent year-over-year — but it is bifurcated. Post-Synapse, the FBO account model requires daily reconciliation and executive certification. Sponsor-bank sourcing in 2026 is not a shortlist exercise. It is a regulatory-posture underwriting exercise.

14 min · Deep-dive · Financial Services series, piece 6 of 8

Questions this article answers

What did the Synapse collapse and the Federal Reserve's Evolve cease-and-desist actually change about the FBO account model?
What does the July 25, 2024 interagency joint statement on BaaS require in practice on top of the June 2023 TPRM guidance?
Which sponsor banks are still active in 2026, and what has happened to the consent-order and consolidation cohort?
How does the FDIC's July 30, 2024 brokered-deposit proposal reshape sponsor-bank funding?
How is BaaS middleware repositioning — Treasury Prime, Unit, Synctera, Newline?
What did the CFPB's November 28, 2025 $46.2M Civil Penalty Fund allocation signal?
What does a mid-market fintech operator or a partner bank need to buy and operate in 2026 to remain bankable?

The BaaS market is not dead. Sponsor-bank count is up nearly 10 percent year-over-year, and mid-market fintechs still bank through sponsor structures at scale. The market is bifurcated. The old model — opaque middleware sitting on top of a sponsor bank willing to outsource compliance — is regulator-terminated. The new model rests on four pillars every buyer must verify: daily reconciliation of the fintech's sub-ledger against the bank's for-benefit-of (FBO) account with annual bank-executive certification; direct contract between fintech and sponsor bank, with middleware moving out of tri-party structures; demonstrable bank-side controls — independent reconciliation, data replication or escrow, step-in rights, credible wind-down plans; and real-time enforcement risk visible across the FDIC, OCC, Federal Reserve, and CFPB. Sourcing a sponsor bank in 2026 is not a shortlist exercise. It is a regulatory-posture underwriting exercise.

Synapse and the June 14, 2024 Evolve cease-and-desist made FBO discipline a regulatory floor.

Synapse Financial Technologies filed Chapter 11 in April 2024. The failure mode was structural: the fintech's records and the sponsor bank's records did not agree, and no one had an independently verifiable source of truth. Bankruptcy-trustee estimates put the shortfall between $60M and $95M. On June 14, 2024 the Federal Reserve Board issued a cease-and-desist order against Evolve Bancorp and Evolve Bank & Trust after 2023 examinations found unsafe and unsound banking practices in the fintech-partnership program, including insufficient controls to comply with anti-money laundering laws. The 23-page order required Evolve's board to strengthen oversight, draft a plan for BSA/AML compliance, submit cash-flow projections, and obtain regulatory approval before dividends, share repurchases, or new debt. The Fed's C&D and the Synapse bankruptcy together produced the post-2024 baseline: daily reconciliation of the fintech sub-ledger against the FBO account, executive certification of records-match, escrow or data-replication so the customer ledger survives a fintech failure, and documented step-in and wind-down rights. The Guidehouse practitioner primer on FBO governance is the readable summary; the regulatory expectations behind it are enforceable.

The July 25, 2024 interagency joint statement did not add rules but made the June 2023 TPRM guidance apply with full force to BaaS.

On July 25, 2024 the Federal Reserve, FDIC, and OCC issued a joint statement on banks' arrangements with third parties to deliver bank deposit products and services. The statement did not add new rules. It made clear that the interagency third-party risk management guidance from June 6, 2023 (OCC Bulletin 2023-17, with the corresponding Federal Register publication on June 9, 2023) applies with full force to bank-fintech BaaS arrangements. The joint statement enumerated operational and compliance risks, growth-management challenges, and end-user confusion around deposit insurance as the categories most in scope. The practical implication: every sponsor bank must be able to produce a third-party risk management program summary aligned to the June 2023 guidance and a BaaS-specific control layer aligned to the July 2024 statement. Fintech buyers due-diligencing a sponsor bank should ask for both artifacts before signature and re-request them at renewal. A sponsor bank that cannot produce either is not underwriting the program to current expectations.

The sponsor bank cohort has consolidated — and RFP shortlists need to reflect it.

Enforcement actions and voluntary exits have reshaped the sponsor-bank cohort. Cross River Bank received an FDIC consent order on April 28, 2023 requiring prior FDIC approval before entering any new fintech partnership; the bank remains active but operates under prescriptive oversight. Sutton Bank and Piermont Bank both received FDIC consent orders in February 2024, both citing BSA and AML deficiencies. Blue Ridge Bank exited its BaaS program in full at the end of 2024 and was later released from its consent order — a fintech that still lists Blue Ridge as a live sponsor option in 2026 is running an outdated shortlist. Column N.A. holds a full OCC national charter (acquired via NorCal Bank) and runs a direct-API stack with no middleware, partnering selectively with what it describes as blue-chip fintechs. Coastal Community Bank added Dave as a sponsor client in 2025 and signed a non-binding term sheet with Evolve Bank & Trust to explore acquiring select BaaS programs. Grasshopper Bank reported $1.19B in BaaS program deposits and $40B+ in transaction volume for 2025; Enova International announced a roughly $369M acquisition in December 2025, with closing expected in H2 2026 subject to OCC and Federal Reserve approvals. Bangor Savings Bank (Treasury Prime partnership since September 2022) and Regent Bank in Tulsa (Synctera partner) round out the mid-market sponsor cohort. The 2026 shortlist is smaller and more clearly stratified than the 2023 shortlist.

Middleware has repositioned toward direct-bank contracts and deeper compliance tooling.

The middleware category — Treasury Prime, Unit, Synctera, and Newline by Fifth Third — has repositioned since 2024. Treasury Prime's 2025 year-in-review published a structural shift toward direct-bank contracts and away from tri-party structures, explicitly reframing its role as an API and compliance layer rather than an intermediating party in the customer relationship. Synctera has publicly emphasized reconciliation, fraud, and BSA tooling depth, with its Coastal Community Bank case study serving as the reference architecture for the sponsor-bank-plus-middleware model. Unit's historical partners include Piermont. Newline by Fifth Third — the rebrand of Rize Money after Fifth Third's May 2023 acquisition — represents the large-bank-owned embedded-payments alternative to independent middleware, wrapping the sponsor-bank capability inside a $200B+ holding company. The direction of travel across the category is more compliance, more reconciliation, more BSA/AML tooling; speed-to-market has moved down the vendor-marketing priority list. Buyers should require evidence of the tooling depth rather than accepting the marketing.

Buyer-side. Supplier-paid. Buyers pay zero. Compensation has zero weight in the Cardinal Index scoring inside the Cardinal Method. Specific commercial terms live only in the private Decision Memo a buyer signs, never on this page.

The FDIC's July 30, 2024 brokered-deposit proposal is the funding-side risk to model explicitly.

On July 30, 2024 the FDIC proposed a comprehensive overhaul of the Section 29 brokered-deposit classification. The proposal would eliminate exclusivity and enabling-transactions exceptions that BaaS-generated deposits currently rely on. If finalized in its proposed form, sponsor banks whose deposit base is heavily BaaS-generated could see those deposits reclassified as brokered, with downstream effects on liquidity ratios, cost of funds, and, in some cases, the strategic sustainability of the sponsor-bank model itself. Any fintech operator scoping a sponsor-bank relationship in 2026 should ask what percentage of the bank's deposits are program-generated and model the funding-side impact if the proposed rule is finalized in a form close to the July 2024 draft. This is a due-diligence question, not an academic one — reclassification would change the sponsor's cost stack, and by extension the pricing offered to fintech partners.

The CFPB's November 28, 2025 $46.2M Synapse allocation is the first-ever fintech-related use of the Civil Penalty Fund.

The CFPB filed a complaint against Synapse Financial Technologies on August 21, 2025. On September 12, 2025, the court entered a stipulated judgment that imposed a nominal $1 civil penalty — the procedural step required to unlock Civil Penalty Fund compensation for victims. On November 28, 2025, the CFPB approved an allocation of $46,248,291 from the Civil Penalty Fund to reimburse individuals affected by Synapse's collapse. The affected customers include users of Yotta, Juno, Copper, and other fintechs that worked with Synapse to manage bank relationships. This is the first-ever fintech-related use of the Civil Penalty Fund and a durable signal that federal regulators will use existing tools to compensate consumers when middleware fails. The regulatory posture is not narrowing — it is expanding into new applications of existing mechanisms.

Run the sponsor bank plus middleware underwriting checklist.

The ten-item checklist below is the shortest usable pre-diligence work product for a fintech operator selecting a sponsor bank, or for a corporate acquirer diligencing a fintech's bank stack. Every item traces to a specific 2024–2025 regulatory action.

Sponsor Bank + BaaS Middleware Underwriting Checklist

Pull all active or recently-terminated consent orders on the sponsor bank. Cross-check FDIC, OCC, and Federal Reserve enforcement action databases. A bank under a live order affecting third-party programs has real constraints on new fintech partnerships (Cross River, Sutton, Piermont, Evolve are the reference cohort).
Verify FBO governance evidence. Request reconciliation frequency and methodology, executive annual certification of records-match, escrow or data-replication mechanism, and documented step-in rights and wind-down plan. Post-Synapse, all four are baseline expectations.
Verify compliance with the June 2023 TPRM guidance and the July 2024 BaaS joint statement. Request the third-party risk management program summary and evidence of BaaS-specific control layers on top of the general TPRM framework.
Score contracting structure — direct-bank or tri-party. Regulator posture favors direct-bank contracts; Treasury Prime and Synctera have publicly moved that direction. Tri-party structures should be justified in writing.
Model brokered-deposit exposure under the FDIC July 2024 proposal. Ask what percent of the sponsor's deposits are program-generated; model the impact of reclassification on the sponsor's funding cost and, downstream, on the pricing offered to the fintech.
Score middleware on reconciliation, BSA/AML, and fraud tooling depth — not speed-to-market. Synctera and Treasury Prime have publicly leaned into compliance depth; require evidence, not marketing.
Verify BSA/AML program adequacy. Post-Sutton and post-Piermont, AML gaps are the single most-cited failure. Request BSA officer résumé, transaction-monitoring vendor, and SAR-volume trend.
Verify KYC data flow. For consumer programs, verify how the sponsor bank receives and stores KYC data from the fintech. Regulators expect “know your customer's customer” clarity, and the sponsor bank's independent access to that data is a live examination item.
Stress-test the wind-down plan. If the fintech partner failed tomorrow, who has the customer ledger, who releases funds, on what timeline? Post-Synapse this is a live regulatory expectation, not a hypothetical.
Score the sponsor bank's BaaS commitment horizon through 2028. With Grasshopper's Enova acquisition pending (H2 2026 close), Blue Ridge exited, and Coastal Community pursuing Evolve program assets, the sponsor cohort is consolidating; ask about strategic commitment through the next examination cycle.

What breaks: five failure modes visible in every 2026 BaaS due diligence cycle.

Middleware fails and the fintech's customer ledger is opaque. Synapse is the archetype. The fintech's records and the bank's records disagreed, and no one had a durable, independently verifiable source of truth. Post-Synapse, this specific failure mode is what the daily-reconciliation-plus-executive-certification regime is designed to prevent — verify both mechanisms exist before contract.

Sponsor bank fails a BSA/AML exam. Piermont and Sutton (February 2024) both faced consent orders including BSA-related deficiencies. When the sponsor bank fails an exam, downstream fintech programs face immediate operational pressure — new-partner freezes, remediation costs allocated across programs, and in some cases forced program exit.

A consent order forces a new-partner freeze. Cross River's April 2023 FDIC consent order requires prior FDIC approval before entering any new fintech partnership. A fintech seeking to migrate to a sponsor operating under a similar order can face months of delay while the bank obtains regulatory approval to onboard.

Brokered-deposit reclassification triggers funding stress. If the FDIC's July 2024 proposal is finalized, sponsor banks whose deposits are largely program-generated may face brokered-deposit treatment, affecting liquidity ratios and cost of funds — and, by extension, the sponsor's pricing to program partners.

Sponsor bank consolidation ends the relationship. Enova's pending acquisition of Grasshopper is one of several structural changes reshaping the sponsor cohort; fintechs on Grasshopper should model post-close product and pricing continuity before the H2 2026 closing.

What this means for procurement in 2026.

The 2026 fintech and BaaS sourcing discipline is narrow and executable. Pull the enforcement history on every sponsor bank before shortlisting. Require FBO governance evidence — daily reconciliation, executive certification, escrow or replication, step-in and wind-down — as baseline. Ask for the TPRM program summary aligned to the June 2023 guidance and the BaaS-specific control layer aligned to the July 2024 joint statement. Model brokered-deposit exposure explicitly. Score middleware on compliance depth, not speed. Verify BSA/AML program adequacy. Stress-test the wind-down. And model the sponsor's strategic commitment through 2028, because the cohort is consolidating. The BaaS market is bifurcated, but it is not closed. Operators who underwrite the sponsor and the middleware to the current bar keep banking access. Operators who do not, do not.

This is the sixth piece in the Financial Services Analyst Note series. The anchor is How mid-market financial services operators should source technology contracts in 2026. Related pieces: Bank branch of 2026 technology stack, Credit union sourcing 2026, PCI DSS 4.0 for mid-market merchants, FFIEC IT booklet mapping. Every vendor named here is in The Cardinal Source's active supplier pool.

In short

Synapse (April 2024) and the Federal Reserve's June 14, 2024 cease-and-desist against Evolve made FBO discipline — daily reconciliation, executive certification, step-in and wind-down rights — a regulatory floor, not a nice-to-have.
The July 25, 2024 interagency joint statement on BaaS did not add new rules but made the existing June 2023 third-party risk management guidance apply with full force to bank-fintech deposit relationships.
Live sponsor-bank cohort: Column (national charter, direct-API), Coastal Community, Grasshopper (pending Enova acquisition H2 2026), Cross River (under order), Sutton and Piermont (under orders), Bangor Savings, Regent. Blue Ridge exited end of 2024.
Middleware has repositioned: Treasury Prime and Synctera have publicly moved from tri-party toward direct-bank contracts; Newline by Fifth Third represents the large-bank-owned embedded-payments alternative.
The FDIC's July 30, 2024 brokered-deposit proposal, if finalized, could reclassify BaaS-generated deposits and reshape sponsor-bank funding economics — model exposure explicitly.
The CFPB's November 28, 2025 $46.2M Civil Penalty Fund allocation for Synapse victims is the first-ever fintech-related use of the fund — a durable signal on future enforcement posture.

Sources

Federal Reserve Board, cease-and-desist against Evolve Bancorp / Evolve Bank & Trust (June 14, 2024). federalreserve.gov
Federal Reserve Board, Evolve C&D order PDF. federalreserve.gov
Interagency (FRB / FDIC / OCC), Joint Statement on Banks' Arrangements with Third Parties to Deliver Deposit Products (July 25, 2024). occ.treas.gov
OCC Bulletin 2023-17, Interagency Guidance on Third-Party Relationships. occ.gov
Federal Register, Interagency Guidance on Third-Party Relationships (June 9, 2023). federalregister.gov
CFPB, Synapse Financial Technologies enforcement action. consumerfinance.gov
Cross River Bank FDIC consent order (April 28, 2023) — industry coverage. consumerfinancemonitor.com
Piermont / Sutton FDIC consent orders (February 2024) — industry coverage. bankingdive.com
Blue Ridge Bank consent order exit — industry coverage. americanbanker.com
FDIC brokered-deposit proposed rule (July 30, 2024) — legal analysis. goodwinlaw.com
Guidehouse, FBO account model and post-Synapse governance. guidehouse.com
Synctera, Coastal Community Bank BaaS case study. synctera.com
Treasury Prime, 2025 year-in-review. treasuryprime.com
Grasshopper Bank, Enova acquisition announcement (December 2025). grasshopper.bank
Fifth Third Bank, Newline (Rize Money acquisition, May 2023). ir.53.com

All linked sources were live at time of publish (July 2026). Verify before quoting in a procurement document.

Selecting a sponsor bank or refreshing your BaaS stack in 2026?

Run the Tier 1 benchmark.

Submit your current sponsor bank and middleware contracts, plus a one-page summary of program-generated deposits, KYC data flow, and reconciliation cadence. We return a benchmark PDF in five business days showing the sponsor's enforcement history, whether the FBO governance evidence clears the post-Synapse baseline, and where brokered-deposit exposure sits under the FDIC's July 2024 proposal. Free. No follow-up sales drip.

Run the Tier 1 benchmark →

Series · Financial Services deep-dive · 8 pieces

Anchor: How mid-market financial services operators should source technology contracts in 2026. Prior pieces: PCI DSS 4.0 for mid-market merchants · FFIEC IT booklet mapping · Bank branch of 2026 technology stack · Credit union sourcing 2026. Coverage: Finance. Method: The Cardinal Method.