Banking as a Service on Both Sides of the Atlantic
What Cross-Border Fintechs Need To Know
-
October 27, 2026
-
The landscape of Banking-as-a-Service (“BaaS”) represents one of the most consequential structural questions facing fintechs with global ambitions. As cross-border fintech activity accelerates and regulatory scrutiny of bank-fintech partnerships intensifies across major markets, understanding how BaaS obligations are allocated in key markets such as the United States, United Kingdom and European Union has become essential for any firm seeking to build durable, compliant partnerships at scale.
This article examines the structural features of BaaS in each of these jurisdictions, identifies where they converge and diverge and offers a framework for building a scalable, cross-border compliance program.
United States: Sponsor-Bank Access and Oversight
In the U.S. market, the defining architectural feature of BaaS is the centrality of the chartered sponsor bank. Fintechs access payments infrastructure, deposit accounts, card products and lending not through their own licenses, but through partnerships with licensed banks that retain the charter and the regulatory accountability that comes with it. This is a critical distinction: the commercial arrangement between a bank and a fintech does not transfer the bank’s regulatory obligations. The bank remains responsible for identifying, assessing, monitoring and controlling risks arising from the relationship in accordance with safety-and-soundness, consumer protection and compliance requirements.1
What this means is that fintechs operating in the U.S. should expect to be subject to a robust oversight regime designed to give the sponsor bank the visibility it needs to fulfill its own obligations. This includes providing relevant customer and transaction data, risk and compliance reporting and evidence that controls are operating effectively. Banks may also retain audit and testing rights, require approval over material program changes and reserve the authority to restrict or terminate the partnership when risks are not adequately managed. The regulatory actions taken against sponsor banks in recent years, reflecting supervisory findings and enforcement activity across multiple institutions, illustrate precisely what happens when oversight capabilities fail to keep pace with the scale or complexity of fintech partnerships.
A successful U.S. BaaS partnership demands more than a commercially compelling product. It requires the fintech to maintain the controls, documentation, data capabilities and operational transparency necessary to support effective bank oversight and to demonstrate that those capabilities are functioning as intended.
United Kingdom: Direct Authorization, Customer Outcomes and Resilience
The UK presents a structurally different picture. A fintech may operate in the UK under its own regulatory authorization (as an e-money institution, a payment institution or under another permission set granted by the Financial Conduct Authority (“FCA”)) while partnering with banks to access safeguarded funds, settlement infrastructure, payment-system access or other regulated services. The fintech is not simply a downstream distributor of a bank’s charter; it may itself be a regulated entity with direct obligations. This creates a more layered accountability structure, where both parties carry regulatory responsibilities that must be carefully coordinated.
Two themes dominate the UK regulatory environment in ways that directly shape BaaS partnerships. The first is customer outcomes. The FCA’s Consumer Duty requires in-scope regulated firms to deliver good outcomes for retail consumers,2 and where a fintech supports the delivery of a product or service, the regulated firm must still meet its applicable obligations. Accountability for those outcomes is not transferred simply because aspects of the product or service are delivered through third parties. Fintechs may therefore need to demonstrate to their banking partners that their technology, processes and customer interactions actively support good customer outcomes, not merely that they avoid causing harm.
The second theme is operational resilience. Cyber incidents, outages and transaction-processing disruptions involving a fintech can affect its banking partner and, depending on the circumstances, trigger regulatory reporting obligations.3 Fintechs must be prepared to support effective incident identification, escalation, reporting and remediation. The effectiveness of that oversight is becoming an increasingly important area of supervisory focus.
European Union: Direct Obligations and an Expanding Regulatory Perimeter
The EU framework introduces yet another dimension of complexity: an expanding regulatory perimeter that can impose obligations directly on fintechs, not merely on their regulated financial institution partners. The Digital Operational Resilience Act (“DORA”) strengthens Information and Communications Technology (“ICT”) and third-party risk management requirements for financial entities and even permits direct oversight of certain critical ICT service providers – a significant development for fintechs that function as technology infrastructure within BaaS arrangements.4 Beyond DORA, three additional frameworks can create further obligations depending on the specific activities involved: the Markets in Crypto-Assets Regulation (“MiCA”), which applies to firms issuing or providing services related to crypto-assets;5 the EU Artificial Intelligence Act, which introduces risk-based requirements for AI systems used in regulated contexts;6 and the evolving AML framework, which continues to expand its scope and harmonize requirements across member states.7 Not all of these frameworks will apply to every BaaS arrangement. Their relevance depends on the products, services and technologies involved, but fintechs operating in the EU must assess their applicability carefully.
This broader regulatory perimeter has a cascading effect on BaaS relationships. As fintechs become subject to more direct regulatory obligations, their financial institution partners simultaneously need greater visibility into fintech operations, including the controls, data and documentation necessary to effectively oversee the relationship. The EU environment therefore demands that fintechs understand not only what obligations apply directly to their own activities, but also how those activities shape the regulatory responsibilities and oversight needs of their partners. This dual awareness is what distinguishes a fintech that is merely compliant from one that is genuinely partnership-ready.
Comparing Markets: Structural Differences, Consistent Expectations
Viewing all three markets together reveals a pattern that is both clarifying and strategically important. The structural differences are real and consequential. In the U.S., the sponsor bank is the central gateway to regulated banking infrastructure and the fintech’s primary compliance obligation is to support the bank’s oversight capabilities. In the UK, fintechs may hold their own authorization while using banks for specific regulated functions, with particular emphasis on demonstrating good customer outcomes and operational resilience. In the EU, regulatory obligations are shaped by each party’s specific activities and role within the arrangement, with an expanding perimeter that increasingly reaches fintechs directly.
There is still convergence despite these structural differences. Across all three markets, regulators expect that financial products delivered through BaaS arrangements are underpinned by effective governance, controls, information flows and oversight capabilities and that the parties to those arrangements can demonstrate as much. This convergence is not coincidental. It reflects a shared regulatory philosophy: that the structural form of a partnership does not determine where accountability ends.
Recommendations for Cross-Border Fintechs With BaaS Partnerships
For fintechs operating across these three markets, the strategic challenge is building a compliance framework that is both rigorous and scalable. Simply replicating one market’s framework in another is insufficient, but building entirely separate frameworks for every jurisdiction creates unnecessary complexity and fragmentation. The more effective approach involves three interconnected priorities.
- Establish a Common Control Baseline. Across all three markets, regulators expect effective governance, risk management and compliance controls. A well-designed baseline, covering areas such as customer due diligence, transaction monitoring, data governance, incident management and third-party oversight can serve as the foundation for compliance in each jurisdiction, reducing duplication and creating consistency at the core of the program.
- Supplement That Baseline With Targeted Jurisdictional Enhancements. In the U.S., this means building the data-sharing, reporting and audit-support capabilities that sponsor banks require. In the UK, it means designing processes and customer interactions that can demonstrate compliance with Consumer Duty and support operational resilience obligations. In the EU, it means assessing applicability under DORA, MiCA, the AI Act and the evolving AML framework and building the documentation and evidence infrastructure those regimes require.
- Design the Entire Control Environment for Demonstrability. Having appropriate policies and controls is necessary but not sufficient. Firms must be able to provide the data, documentation, testing results, reporting and evidence of remediation needed to demonstrate that those controls actually operate effectively. This capability serves a dual purpose: it supports the fintech’s own compliance obligations while enabling banks and other regulated partners to exercise the meaningful oversight that regulators in all three markets expect.
Regulatory readiness, properly conceived, is not a constraint on growth – it is a growth enabler. Fintechs that combine a consistent control foundation with targeted jurisdictional enhancements will be better positioned to meet their own obligations, support regulated partners and build the kind of sustainable banking relationships that allow them to scale across markets with confidence. In a regulatory environment that is growing more demanding on both sides of the Atlantic, that combination of consistency and adaptability may prove to be one of the most durable competitive advantages a cross-border fintech can build.
The authors would like to thank Gabriella Culham, Wai Yau and Margaret Mizwicki for their contributions to this article.
Footnotes:
1: “Joint Statement on Banks’ Arrangement with Third Parties to Deliver Bank Deposit Products and Services,” Federal Reserve Board, Federal Deposit Insurance Corporation, and Office of the Comptroller of the Currency (July 25, 2024).
2: https://handbook.fca.org.uk/handbook/sysc13/sysc13s9 Financial Conduct Authority, “Consumer Duty implementation: good practice and areas for improvement,” (Dec. 3, 2025).
3: Prudential Regulation Authority, “PS7/26 – Operational resilience: Operational incident and third-party reporting,” Bank of England (Mar. 18, 2026).
4: https://eur-lex.europa.eu/eli/reg_del/2025/295/oj/eng Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector,” EUR-Lex (Dec. 27, 2022), https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng.
5: “Regulation (EU) 2023/114 of the European Parliament and Council of 31 May 2023 on markets in crypto-assets,” EUR-Lex (Jan. 9 2024).
6: “Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence,” EUR-Lex (Jul. 27, 2026).
7: “Regulation (EU) 2024/1624 of 31 May 2024 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing,” EUR-Lex (May 31,2024).
The views expressed herein are those of the author(s) and not necessarily the views of FTI Consulting, Inc., its management, its subsidiaries, its affiliates, or its other professionals.
Related Insights
Published
October 27, 2026
Key Contacts
Senior Managing Director, EMEA Head of Financial Services, Forensic & Litigation Consulting
Senior Managing Director
Director