Fintech as a service

A fintech as a service provider splits financial products into modules that a developer can call one at a time. The usual modules are accounts with an IBAN, SEPA and card payments, the issuing of debit or prepaid cards, identity checks for onboarding, lending, and the trading or custody of securities and crypto assets. A buyer can take a single module such as card issuing or combine several of them into a complete financial product for its customers.

Large payment companies sell such modules to platforms and marketplaces. Adyen offers platforms business accounts and cards for their users, names banking licenses in the EU, the United Kingdom and the United States, and states that it takes care of KYC checks and compliance. With Stripe Issuing, a platform can give commercial cards to its business users in the European Economic Area and add them to Apple Pay or Google Pay. Groups such as Ephelia in London combine accounts, cards and payments with the licenses of their own group companies.

Fintech as a service creates no new type of license, because each function stays regulated by the rules for that activity. A company that provides payment services in Germany needs authorization from BaFin under the Payment Services Supervision Act, and deposits or loans require a banking license under the KWG. The buyer of the service usually holds no license and works as the partner, agent or outsourcing client of a license holder, a setup also called license as a service. Under section 25 of the ZAG, a payment institution must report each agent to BaFin and the Deutsche Bundesbank, and the agent may start only after its entry in the payment institutions register.

A licensed firm that buys a function from a technology provider has to manage that provider as a third party. Since 17 January 2025, DORA has required every financial entity to keep a register of information on its contracts with ICT third-party providers and to plan an exit for services that support critical or important functions. On 18 November 2025 the European Supervisory Authorities designated the first critical ICT third-party providers, which they now oversee directly. For services outside ICT, the EBA published guidelines on third-party risk management in September 2026, which will replace its outsourcing guidelines of 2019 once they apply.

The Anti-Money Laundering Regulation, which applies from 10 July 2027, allows a bank or payment firm to outsource KYC tasks to service providers and keeps the firm fully liable for them. Article 18 of the regulation reserves some decisions for the firm itself, among them the risk profile of a customer, the decision to accept the customer and the reporting of suspicious activity to the financial intelligence unit. KYC in Germany follows the Money Laundering Act until that date.

In Switzerland, FINMA grants a fintech license under Article 1b of the Banking Act. A firm with this license may accept public deposits of up to CHF 100 million or crypto-based assets, as long as it neither invests them nor pays interest on them, and these deposits have no deposit protection if the firm fails. Swiss banks that outsource functions follow FINMA Circular 2018/3, in force since 1 April 2018, which requires them to keep an inventory of the material functions they have outsourced.

Some Swiss banks work on the provider side of the model as well. Sygnum Bank in Zurich connects partner banks through APIs to accounts, payments, custody, brokerage and tokenization, so that a smaller bank can offer digital assets to its clients without running the operation itself.

The model spreads one financial product across several companies, and every handover is a point where records, money or duties can get lost. Synapse Financial Technologies in the United States connected fintech apps with partner banks, and after its failure the FDIC described the difficulty of reconstructing consumer balances and reconciling the records of Synapse with those of the banks. In September 2024 the FDIC proposed a rule under which banks would have to identify the owner of every deposit that a third party places with them and reconcile each balance daily.

In Germany, the supervisory measures against Solaris in Berlin showed the anti-money laundering side of the same risk. BaFin sent a special representative to the bank after an audit of its controls and later made new partner programs subject to its permission. Concentration is a further risk, because a fault at one provider reaches every brand that depends on it at the same moment. BaFin names concentration in IT outsourcing (in German) among its focus risks, and the European Banking Authority already warned in its report on digital platforms of September 2021 that supervisors see these dependencies only in part.

Fintech as a service, or FaaS, is the delivery of financial functions such as accounts, payments, cards, KYC checks or trading by a provider through APIs. The buying company offers these functions to its own customers under its own brand, and a licensed institution behind the provider carries the regulatory duties for each function.

Banking as a service is the part of the model that needs a bank, namely accounts with deposit protection, cards and loans from a licensed credit institution. Fintech as a service also covers functions under other licenses, such as brokerage as a service for securities or crypto as a service for crypto assets, and functions like identity checks that need no license. All of them supply embedded finance, in which a non-financial brand sells the financial product.

A white label fintech platform is finished software, for example a banking app, a card portal or a trading front end, that a provider dresses in the brand of each buyer. With an API model the buyer builds its own front end instead and takes only the regulated back end from the provider, and many contracts combine both approaches for different parts of the product.

Payments as a service means that a provider runs payment acceptance, payouts or transfers for another company through APIs, under its own payment or e-money license. Stripe, for example, serves merchants in the EEA through an e-money institution authorized by the Central Bank of Ireland. The buyer builds the payment flow into its checkout or platform, a setup also known as embedded payments.

KYC as a service is the outsourcing of identity checks, sanctions screening and ownership checks to a specialized provider, usually through an API with video or eID verification. The bank or payment firm stays fully liable for the result, and from July 2027 the AMLR forbids it to hand over the decision on the risk profile and on accepting the customer. Such providers belong to the wider field of regtech in Europe.