The model and its regulatory perimeter
is a business arrangement, not a single charter or a new exemption. A bank may originate loans, issue cards, hold deposits or provide payment access while a fintech supplies distribution, software, servicing or a customer interface. Each activity needs its own legal and economic map. A deposit program, a loan-origination program and a card network sponsorship should not be treated as interchangeable.
The agencies’ July 2024 statement on third-party deposit arrangements explains that outsourcing does not diminish the bank’s responsibility for applicable law. It identifies fragmented operations, missing records, compliance execution, rapid growth and concentrated funding as potential concerns. The statement reiterates existing guidance rather than creating a new licensing regime. [1]
Market status: active demand, demanding economics
As of September 29, 2026, the inspected evidence shows continuing relationships across consumer accounts, business banking, cards and payment infrastructure. Chime and Mercury identify banking providers in current disclosures; Pathward announced a longer TabaPay agreement in August; Cross River announced planned X Money support in July. These examples establish activity, not an industry growth rate or proof that every announced program is fully launched. [6][7][8][10]
Our assessment is that the durable competitive question is which bank and partner can operate a particular service profitably while retaining reliable records, controls and exit capacity. A technology platform, a payment processor and a bank charter contribute different things. The label “banking as a service” is too broad to identify which entity owes the customer money, funds credit or must resolve a failed payment.
The market map below is deliberately tied to specific functions. It is not a ranking, regulatory endorsement or exhaustive approved-bank list. Institutions can participate in more than one model, and a consumer’s operative agreement can be narrower than a partnership announcement.
Who is in the market: banks, partners and service scope
Current undated disclosures were checked on September 29, 2026. Dated announcements retain their original dates; future-tense language remains future tense.
Scroll horizontally to see all columns.
| Bank / banking group | Named relationship and role | Status and boundary |
|---|---|---|
| The Bancorp Bank, N.A.; Stride Bank, N.A. | Chime identifies these banks for banking services and card issuance. [6] | Current disclosure; the applicable bank depends on the product/card. Chime is a fintech, not an insured bank. |
| Column; Choice Financial Group | Mercury identifies banking providers; its Column legal page covers demand-deposit and debit services. [7] | Current legal disclosure. Do not assume every Mercury service is furnished by the same bank. |
| Cross River Bank | Announced support for X Money deposit accounts, debit and payment rails on July 27, 2026. [8] | An announced arrangement; the release does not establish availability to all X Money users. |
| Lead Bank | Visa identifies Lead Bank in the Bridge stablecoin-linked-card settlement pilot. [9] | March 3, 2026 evidence of pilot participation, not proof that all planned countries or services are live. Bridge is a Stripe company. |
| Pathward | Expanded TabaPay agreement includes acquiring sponsorship and disbursement/repayment capabilities. [10] | August 5, 2026 agreement extending through 2031. Payment-rail sponsorship is distinct from funding every underlying loan. |
| FinWise Bank / parent FinWise Bancorp | Parent acquired Tallied technology-platform assets supporting its co-branded-card program. [11] | July 20, 2026 completed asset/platform transaction. Bank credit exposure and parent technology ownership need separate analysis. |
| Coastal Community Bank / parent Coastal Financial Corporation | CCBX partner banking is visible in the parent’s quarterly disclosures. [12] | Q2 2026 results document activity and material partner-related expense. The affected partner is not identified here. |
Who is adopting, and why the use case matters
The verified examples span consumer financial apps (Chime), business financial platforms (Mercury), a planned social-platform money service (X Money), stablecoin-linked payment infrastructure (Bridge) and payment orchestration (TabaPay). Their needs differ: an account provider needs defensible ownership records; a card program needs issuing and network controls; a payout service needs settlement and reconciliation. They should not be counted as equivalent bank customers, deposit balances or loan originations. [6][7][8][9][10]
For buyers, a bank relationship may provide account infrastructure, network access, credit origination or settlement capabilities that the software business does not itself possess. For the bank, potential returns can come from deposits, fees, interchange or lending. Those incentives become misaligned if one party is paid for acquisition while the other absorbs fraud, complaints, servicing or costs. Evaluate the actual contract and operating flow rather than relying on the partnership label.
FinWise illustrates a further choice: bringing technology in-house. Its acquisition of Tallied platform assets changes the ownership boundary, but ownership alone is not evidence of better controls. It also changes costs and credit economics. A bank-owned stack still needs independent validation, resilient operations, access controls and a tested migration path. [11]
Two disclosures show where apparent protection can fail
Coastal Financial Corporation reported a $42.1 million consolidated net loss for Q2 2026. It identified $68.8 million of expense associated with one CCBX partner: $22.8 million of provision and a $46 million adjustment to the value of credit enhancement. The company did not expect to collect the full indemnification amount. These are dated holding-company disclosures, not standalone loss figures for every partner bank or evidence of a sector-wide failure rate. [12]
The analytical lesson is to separate loan performance, an indemnity receivable and cash collateral that can actually be used. The accounting value of a claim on a partner can fall when protection is most needed. Management’s characterization of a problem as isolated should be attributed; it is not a substitute for testing concentration and correlated stress elsewhere.
FinWise’s July Tallied transaction provides a different example: approximately $50 million of card balances were expected to move from credit-enhanced treatment to standard retained bank credit risk. The bank would also retain interest and interchange economics. This is a deliberate change in the risk/revenue boundary, not merely a software acquisition. The FinWise profile examines the accompanying guidance and cost disclosures. [11]
Compare economics by service rather than by gross volume
The following is an analytical framework, not a quoted industry margin. A bank can generate attractive gross fees and still earn an inadequate return after staffing, losses, capital and costs.
Scroll horizontally to see all columns.
| Service | Potential value to assess | Costs and stress that must be included |
|---|---|---|
| Deposit and account programs | Stable usable funding and service fees | Deposit pricing, sweep arrangements, operational cost, concentrated outflows and restrictions on use of funds |
| Card issuing | Net interchange, program fees and interest where applicable | Network/processor expense, rewards sharing, disputes, fraud, credit losses and servicing |
| Lending programs | Origination/servicing fees and retained spread | Funding, liquidity, credit exposure, sale commitments, repurchases and partner-support collectability |
| Payments and settlement | Processing fees and relationship value | Prefunding, settlement timing, returns, sanctions controls, reconciliation and intraday liquidity |
The main challenges and what would improve the outlook
The operational bottleneck is frequently dependable ownership and transaction data across bank, fintech and processor. Daily balanced totals do not prove that each customer balance is correct. A bank needs the ability to identify customers, resolve discrepancies and continue critical service when a partner’s staff or system is unavailable. The existing and joint statement provide the risk-management context; the September 2026 proposal has not automatically replaced that framework. [1][2][3][4][5]
Other constraints include financial-crime controls, fraud and returns, customer complaints, lending compliance where relevant, privacy and access rights, and the cost of independent testing. Growth can increase the number of operational exceptions faster than revenue. A sponsor should be able to slow or stop onboarding and money movement under defined conditions without depending entirely on the commercial partner’s approval.
A stronger outlook would be supported by sustained positive returns after full control costs, reconciled customer-level records, diversified and usable funding, tested exits and credible evidence that indemnities remain collectible under stress. It would weaken with rising exceptions, repeated control failures, unsupported balances, large unfunded remediation needs or fee concentration in a partner that cannot absorb losses. These are decision criteria, not a forecast of a particular bank’s solvency.
The overall status is an active but selective market: the sources support continued partnerships and differentiated service models, while the reported risk examples show why headline volumes and signed contracts are inadequate quality measures. There is no verified market-share or industry-profitability estimate in this article.
Current guidance and the September 2026 proposal
The agencies announced proposed replacement third-party risk guidance on September 11, 2026; the Federal Register published it September 15, with comments due November 16. The release says existing guidance would be rescinded and replaced when the new guidance is finalized. That future step should not be treated as completed. The proposal emphasizes tailoring and is nonbinding , not a new sponsor-banking license or an exemption from consumer-protection requirements. [4][5]
For program planning, retain two documents: the controls supported by currently applicable law and existing guidance, and a separate assessment of proposed changes. A proposal can justify reviewing an inefficient diligence process; it does not justify abandoning ledger access, customer servicing or escalation. The recommendations below are operating judgments, not a claim that every listed metric is a regulatory mandate.
Accountability through the full relationship
The 2023 interagency guidance addresses the life cycle of third-party relationships and calls for practices suited to the institution and arrangement. It expressly says it does not impose new requirements. The useful principle is proportionality: understand what the partner actually does and scale diligence and oversight to the risk. [2]
Recommended division of responsibilities starts before launch. The bank should identify who approves underwriting changes, owns customer notices, investigates disputes, reconciles balances and can suspend activity. Contractual responsibility, operational capability and access to evidence must align. A contract that assigns the bank final approval is weak protection if the production system permits unlogged partner overrides.
For lending, review the economics and legal terms of origination, sale, retained exposure, servicing, repurchase obligations and any guarantee. A partner promise to absorb losses is itself counterparty exposure. It does not eliminate the bank’s need to assess the program or the enforceability and collectability of that promise.
The ledger is a customer-protection control
The deposit-arrangements statement warns that inadequate access to records can impair a bank’s ability to identify its obligations and delay customer access. It also distinguishes deposit insurance against bank failure from loss or disruption caused by a nonbank’s failure. Pass-through coverage depends on its requirements being met. [1]
Recommended test: choose a customer and reconstruct the opening balance, every transaction, pending items, fees and closing balance using records the bank can retrieve independently. Reconcile the aggregate customer ledger to the relevant bank accounts and settlement records. An omnibus balance that reconciles in total does not establish that every customer balance is correct.
Require a defined process for exceptions, including their age, owner and disposition. Differentiate timing items from unexplained differences. The strongest evidence is repeated successful reconstruction and correction; the weakest is an assurance that the middleware provider is handling everything.
Map the movement of funds, data and decisions
A useful program map follows one customer transaction through authorization, settlement, posting, servicing and dispute resolution. Identify the legal entity and system responsible at each step. Record whether money is at the bank, moving through a payment rail, or still held by a nonbank. A customer-facing balance can include pending items that are not settled deposits. Treat that distinction as an operational fact to explain, not as a reason to make a broader insurance promise.
The table is an illustrative control design. Assign a named bank owner, an evidence source and a backup operator to each row. A contractual right to inspect data is weaker than a tested ability to retrieve it promptly in a usable format. Bank oversight should reach material subcontractors even when the commercial contract runs through the program manager.
Scroll horizontally to see all columns.
| Control point | Evidence to obtain | Failure response |
|---|---|---|
| Customer and account mapping | Stable customer-to-account identifiers; ownership and authorization records | Stop ambiguous onboarding and resolve identity or mapping exceptions |
| Daily reconciliation | Customer ledger, bank account and settlement totals; transaction-level exceptions | Assign breaks by cause, dollar amount and age; investigate unexplained differences |
| Credit-policy changes | Approved policy version, production deployment log and override record | Suspend unapproved settings and quantify affected accounts |
| Disputes and complaints | Receipt time, legal deadline, case owner and resolution evidence | Escalate before deadlines; preserve a direct customer contact route |
| Partner exit | Readable exports, substitute servicing rights and a rehearsed transfer | Limit new exposure when continuity cannot be demonstrated |
Worked example: fee margin versus concentration
Illustrative economics: a program generates $5 million of annual fees, costs $2 million to operate and oversee, and requires $1 million of expected fraud, credit and remediation cost. The apparent contribution is $2 million before capital, tax and corporate overhead. If one stressed event creates $3 million of incremental loss, more than a year of contribution disappears.
A separate funding example: a single fintech supplies $200 million, or 40%, of a hypothetical $500 million deposit base. Its customers are numerous, but the bank still has a common distribution and operational dependency. Model a coordinated outflow after an outage or partner migration. Customer count alone does not establish diversified funding.
Do not combine all these numbers into an industry forecast. Their purpose is to reveal which assumptions drive a specific program’s economics: loss allocation, reserve collectability, deposit stability and the cost of independently maintaining controls.
Growth gates and exit readiness
A useful launch sequence is limited-volume operation, observed reconciliation, sampled compliance outcomes and only then wider distribution. Define measurable gates for new products, merchants, geographies and credit-policy changes. A volume milestone should not override a growing queue of unresolved customer errors.
The community-bank third-party guide provides a practical framework for planning, diligence, contracts, monitoring and termination. Use it to organize evidence, not as proof that an arrangement is safe merely because each box is checked. [3]
Recommended exit exercise: assume the partner is unavailable tomorrow. Can the bank identify customers, receive payments, respond to disputes, service loans, communicate accurate balances and transfer records? Identify which subcontractors must cooperate and whether the bank has direct rights to their data. Price the transition and identify the staff who would actually execute it.
What to watch in credit and fraud
Track underwriting exceptions, approval changes, first-payment defaults, losses, dispute timeliness, ledger breaks and customer complaints by partner and product. Review concentration in both assets and funding. Investigate whether a partner’s incentives reward originations while leaving losses or remediation with the bank.
My assessment favors sponsor programs where independent control, loss-adjusted economics and credible exit capability grow with the business. The case weakens when fee revenue depends on continued rapid expansion, bank staff cannot reproduce the ledger, or contract reserves are small relative to plausible exposure. The question is not whether partnerships are inherently good or bad; it is whether the bank can demonstrate control over the risks it accepts.
Two stress tests that a profitable program can still fail
Hypothetical reconciliation test: an omnibus account contains $100 million and the customer subledger also totals $100 million. Customer A is understated by $50,000 and customer B is overstated by $50,000. Aggregate reconciliation passes while both customers’ records are wrong. A stronger test reconciles transaction identifiers and customer balances, tests duplicate and missing postings, and follows corrections through the bank and partner systems. Zero net difference is not the same as zero unresolved errors.
Hypothetical test: the earlier $200 million partner-sourced deposit channel loses 30% of its balances, a $60 million outflow. Assume the bank has $20 million of available cash plus $50 million of unencumbered securities that can raise $45 million after an assumed 10% haircut. Gross resources of $65 million leave only $5 million before other obligations. If the securities are already pledged, the apparent second source disappears. Haircuts, encumbrance and access timing should be separate inputs; this is not a regulatory liquidity-ratio calculation.
Partner indemnities require a comparable stress. Assume a $1 million funded reserve supports a $3 million incident. The remaining $2 million is an unsecured claim unless another enforceable funding source exists. If the incident also causes the partner’s failure, its promise is least useful when needed most. Review reserve control, replenishment triggers, collateral rights and claim priority with counsel; do not net an uncertain recovery against immediate customer obligations.
Management should compare growth requests with these stress results. Useful release conditions include reproducible customer records, timely resolution of aged exceptions, available contingency funding and successful servicing transfer tests. There is no universal acceptable break count or reserve percentage: the board needs limits tied to plausible loss, customer impact and operational capacity. A program with lower fee revenue can have better economics if its controls and exit costs are demonstrably manageable.
Research update triggers
Revisit the analysis when a program changes its legal entities, product set, ledger provider, servicing model or loss allocation. Also monitor authoritative supervisory changes and public enforcement findings. This is an operating-model deep dive; it does not infer a confidential rating or allege a problem at a named .
For a bank considering entry, the next decision should be a scoped pilot supported by a full cost model and a tested customer-service path. For a bank already operating at scale, independent record access and exit testing should precede another growth commitment.
A wind-down plan starts before termination
Recommended planning identifies which activities must continue even if new business stops: customer access, settlement, disputes, record retention and required communications. Ending a commercial agreement does not end every customer obligation. Assign an owner and a funded operating path for each continuing function.
The July 2024 deposit-arrangements statement highlights record-access and fragmentation risks. The following framework turns those concerns into a hypothetical operating exercise; it is not an agency-prescribed timetable. Separate a bank failure from a nonbank partner outage or insolvency, because their legal consequences and available remedies differ. [1]
Scroll horizontally to see all columns.
| Milestone | Demonstration | Unresolved risk if it fails |
|---|---|---|
| Containment | Stop new unsupported activity while preserving necessary servicing | Exposure continues growing after control loss |
| Reconstruction | Produce customer-level positions from bank-accessible evidence | Aggregate cash cannot be reliably allocated |
| Continuity | Process essential payments and disputes through a tested path | Customer harm persists despite a reconciled ledger |
| Transfer or closure | Reconcile migrated records and residual obligations | Lost history or duplicate balances |
| Residual claims | Fund disputes, recoveries and correction work | Commercial exit leaves an unfunded servicing tail |
Separate an indemnity from available cash
Hypothetical: a partner promises to reimburse $2 million of losses but fails while only $300,000 of usable collateral is available. Counting the full promise as immediate protection overstates accessible support by $1.7 million before uncertain recoveries. Legal priority, restrictions and enforcement affect what can actually be collected.
Recommended contracts and operating plans distinguish who initially funds corrections, who ultimately bears loss, and who handles customer communications. A disagreement over indemnification should not be mistaken for evidence that no correction obligation exists. Assess whether reserves, guarantees and insurance are independent or depend on the same distressed counterparty.
Prove reconstruction without the partner’s help
Choose a recent date and disable reliance on the partner’s staff for the exercise. Recover the bank-accessible snapshot, apply subsequent verified transactions and reconcile customer-level positions with actual money movements. Document uncertain ownership, pending transactions and unresolved exceptions rather than forcing a false zero difference.
Set recovery objectives from customer promises, settlement constraints and applicable obligations; this article prescribes no universal recovery time. Test who can authorize access and whether critical credentials, data formats or reconciliation logic remain controlled by the failed provider. A data-export clause offers limited comfort if nobody can interpret the export.
Finally, connect the result to a business decision: remediate the missing capability, limit growth or restrict the affected activity. Repeat after material architecture changes. The point is not to predict that a partner will fail, but to show that the bank can meet its responsibilities when a consequential dependency stops working.
Sources
- Banking agencies, Joint Statement on Banks’ Arrangements with Third Parties to Deliver Bank Deposit Products and Services; July 25, 2024Official sourceBack to text: ↑1↑2↑3↑4↑5
- Federal Reserve SR 23-4, Interagency Guidance on Third-Party Relationships: Risk Management; June 7, 2023Official sourceBack to text: ↑1↑2
- Federal Reserve SR 24-2, Third-Party Risk Management: A Guide for Community Banks; May 7, 2024Official sourceBack to text: ↑1↑2
- Banking agencies and NCUA, proposed third-party risk management guidance announcement; September 11, 2026, page updated September 15, 2026Official releaseBack to text: ↑1↑2
- Federal Register, Proposed Third-Party Risk Management Guidance, 91 FR 58536; September 15, 2026; comments due November 16, 2026Official sourceBack to text: ↑1↑2
- Chime: current banking-provider disclosures; undated, reviewed September 29, 2026SourceBack to text: ↑1↑2↑3
- Mercury: Column legal and banking-provider disclosures; undated, reviewed September 29, 2026SourceBack to text: ↑1↑2↑3
- Cross River: X Money partnership announcement; July 27, 2026SourceBack to text: ↑1↑2↑3
- Visa: Bridge collaboration and Lead Bank settlement pilot; March 3, 2026SourceBack to text: ↑1↑2
- Pathward: expanded TabaPay agreement; August 5, 2026SourceBack to text: ↑1↑2↑3
- FinWise Bancorp: Tallied technology-platform and asset acquisition; July 20, 2026SourceBack to text: ↑1↑2↑3
- Coastal Financial Corporation: Q2 2026 results; July 30, 2026; reporting period ended June 30SourceBack to text: ↑1↑2