White label banking

The customer signs the contract with the provider, even when the app, the card design and the marketing belong to the partner. In its report on white labeling, the EBA describes the provider as the entity that bears the ultimate responsibility for regulatory compliance. The provider typically runs the money laundering checks, controls the customer funds, keeps the records for regulatory reporting and handles complaints in the end, while the partner runs the customer interface, collects onboarding data and markets the product.

The partner usually works under the license of its provider, as a payment agent, an e-money distributor or a tied agent, a setup also called license as a service. A partner that takes over a licensed activity itself, for example by holding customer money, needs a license of its own. Before signing, providers check the business model and the owners of a prospective partner, because anti-money laundering rules require them to assess the risks of their distribution channels.

The EBA groups the products that banks and payment firms sell through partners into three clusters. The first covers accounts and payments, including deposit accounts, e-money, card issuing and card acquiring for merchants. The second covers credit, from buy now, pay later to loans for small and medium-sized companies, and the third covers open banking services such as account information. Credit institutions and e-money institutions are the most common providers, followed by payment institutions.

White labeling now reaches beyond accounts and cards into crypto assets and investment funds. The EBA expects the model to spread in the crypto sector, where firms can offer crypto services under their brand without applying for a MiCA license, the model that banks use in crypto as a service. In funds, a licensed management company launches a white label fund for an initiator whose strategy, and often whose name, the fund carries.

When the partner collects identity data during onboarding, the EBA sees two possible legal forms. In an outsourcing, the partner applies the anti-money laundering measures on behalf of the provider and as the provider specifies, and the provider remains fully responsible for them. In a reliance arrangement, a partner that is itself subject to anti-money laundering rules runs its own customer checks, and the provider relies on them under Articles 25 and 26 of the Anti-Money Laundering Directive.

In both forms the provider needs access to the KYC records, transaction data and monitoring results that the partner holds, or it risks breaching its own anti-money laundering duties. Partner apps and interfaces that the provider depends on fall under the ICT third-party rules of DORA, while for other services the EBA published guidelines on third-party risk in September 2026 that replace its outsourcing guidelines of 2019 once they apply. In Switzerland, FINMA Circular 2018/3 (in German) requires that the bank, its audit firm and FINMA can audit an outsourced function at the service provider at any time and without restriction.

Money in a white label account at a bank is protected by the deposit guarantee scheme of that bank, not by the partner. The EU Deposit Guarantee Schemes Directive covers up to EUR 100,000 per depositor and per credit institution, and it adds up all deposits at the same bank. A customer who keeps money in two apps that run on the same partner bank therefore has one cover of EUR 100,000 for both. The directive requires banks that operate under different trademarks to inform depositors clearly about this.

An e-money institution does not take deposits, so a brand that runs on an e-money license offers no deposit guarantee at all. The e-money institution safeguards the customer money apart from its own assets instead, so that customers get it back if the institution fails.

On 26 June 2020 the UK Financial Conduct Authority barred Wirecard Card Solutions, the UK e-money issuer of the Wirecard group, from carrying on regulated activities because of events at its German parent Wirecard AG. Cardholders could not use their cards until the FCA allowed the firm to resume issuing e-money and providing payment services at 00:01 on 30 June, and the FCA told customers with remaining problems to contact their card provider directly. The EBA lists the same dependence as a risk: a partner loses its product when the provider fails or loses its license.

The EBA also describes step-in risk, where a financial institution supports a partner outside its group to protect its own reputation, as several banks did for funds they had referred clients to during the financial crisis of 2008 to 2010. Banks have to identify such risks in advance for their capital planning, while other types of financial institution face no such requirement.

White label banking is a setup in which a licensed bank or payment firm provides the account, card or loan and a partner sells it under the brand of the partner. The customer contracts with the licensed provider, so complaints, deposit protection and supervision follow the provider and not the brand on the app.

The two overlap, but the EBA treats them as separate concepts in its report. Banking as a service is the delivery of bank services through non-bank intermediaries, and it counts as white labeling only when the brand of the partner alone faces the customer. A co-branded card that shows the names of both the bank and the partner falls outside the EBA definition of white labeling.

A licensed issuer, usually a bank or an e-money institution, issues the card and holds the money or the credit line behind it, while the brand designs the card and runs the app in which customers use it. For a credit card the issuer grants the credit, so the issuer is responsible for the creditworthiness check even when the brand collects the application data.

The partner needs no license of its own as long as everything it does is covered by the license of the provider, for example as a payment agent or as a tied agent of an investment firm. BaFin enters payment agents in its public register of payment institutions, so the register shows which institution stands behind a brand that offers payment services.

Banks in Germany sell crypto trading under their own name through Bitpanda Enterprise, and the Volksbanken offer meinKrypto with custody by Boerse Stuttgart Digital. Among the providers for accounts and cards, Ephelia Group supplies accounts, payments and card issuing as a white-label product to fintechs and asset managers.