Banking-as-a-Service providers are moving fast, but their compliance frameworks are moving slowly — and regulators are noticing the gap. Embedded finance compliance challenges that seemed theoretical two years ago are now landing on examination reports, and most BaaS platforms lack the documented controls to defend themselves.
The Embedded Finance Compliance Problem Nobody Wants to Admit
Embedded finance is reshaping how consumers access credit, payments, and investment products. A fintech lender embeds lending into a retailer’s checkout. A payroll provider embeds investment tools into employee dashboards. A marketplace embeds BNPL directly into transaction flows. Each integration looks straightforward from a product angle. From a compliance angle, it’s a minefield.
The problem is jurisdictional fracture. When a BaaS provider partners with a non-bank to embed financial services, nobody owns the full compliance stack cleanly. The sponsoring bank is liable for the customer-facing experience but often doesn’t control the technology layer. The fintech controls the user interface and data architecture but isn’t regulated as a bank. The third-party embedded service provider sits in the middle, holding customer data and transaction logic, with unclear responsibility for AML, KYC, fair lending, and consumer protection.
Regulators — the Federal Reserve, OCC, FCA, ECB, and MAS — haven’t yet issued unified embedded finance compliance frameworks. Instead, they’ve issued scattered guidance documents, bank examination priorities, and enforcement actions. A compliance officer at a BaaS platform in New York must cross-reference Fed guidance on third-party relationships, OCC bulletins on operational resilience, and CFPB expectations on consumer data handling. None of them explicitly address the embedded finance chain. That silence is dangerous.
Where Regulators Are Actually Looking: Recent Enforcement Signals
The enforcement data tells you what compliance actually matters. In the last 18 months, bank examiners have issued informal enforcement actions (cease-and-desist letters, memoranda of understanding, and capital restrictions) against six mid-sized regional banks and five fintechs for embedded finance compliance failures. The violations cluster around four areas.
First: Third-party control and due diligence. Banks were licensing their deposit insurance and payment rails to fintech partners without conducting adequate initial due diligence on the fintech’s technology risk, data security, or operational continuity. When the fintech experienced a service outage or data breach, regulators found that the bank couldn’t articulate what systems the fintech was running, how data flowed, or what backup protocols existed. This is a third-party risk management failure, and it’s expensive to remediate.
Second: Consumer data handling and privacy. Embedded finance moves customer data across multiple entities — from the merchant’s system to the BaaS platform to the sponsor bank to the embedded service provider. Regulators found that data lineage was not documented, encryption standards were not uniform, and data retention policies differed by counterparty. One large regional bank had embedded lending through a fintech partner; the fintech kept customer data for five years after the loan closed, but the bank’s own policy was three years. Regulators cited this as inadequate governance.
Third: KYC and AML in fast-onboarding scenarios. Embedded finance is built on speed. But speed and AML compliance are often in tension. Examiners found that some BaaS platforms had accelerated KYC for embedded lending or payments to match product speed targets, without validating that abbreviated KYC still detected beneficial ownership, PEP status, or sanctions matches. One BNPL platform embedded in a major US e-commerce site had a three-minute KYC flow; it missed a sanctioned entity in the first 20 days of operation.
Fourth: Liquidity and operational risk documentation. When embedded finance fails — the BNPL platform crashes, the embedded lending portal goes down, or the payroll investment integration breaks — consumers lose access to their money and data. Examiners found that BaaS providers had not documented failover procedures, had not tested them with sponsor banks, and had not disclosed the recovery time objectives (RTOs) to customers. One embedded payments platform had an RTO of 48 hours, but customers believed their money was live.
The Specific Regulatory Gaps: What the Guidance Actually Says (and Doesn’t)
The Federal Reserve’s guidance on third-party risk management is the closest thing to an embedded finance compliance standard in the US. But read it carefully — it doesn’t explicitly address embedded finance architectures. It assumes the bank has a direct, contractual relationship with the third party. In embedded finance, the chain is longer: bank → BaaS platform → embedded fintech → merchant. The Fed’s guidance doesn’t say how to audit the entire chain or who’s responsible if the embedded fintech fails.
The OCC’s recent bulletin on operational resilience asks banks to ensure they can recover critical functions within four hours in the event of a cyber event, technology failure, or third-party service disruption. Good guidance. But for banks sponsoring embedded finance, the recovery window isn’t four hours — it’s the time it takes the BaaS provider to recover the embedded fintech’s technology stack. That might be minutes, or it might be days. The OCC doesn’t clarify.
The FCA’s approach to embedded finance is closer to a framework. The FCA distinguishes between the authorized firm (the bank) and the embedded service provider (the fintech). The authorized firm is responsible for ensuring the embedded provider complies with FCA rules on consumer data, fair treatment, and complaints handling — even though the authorized firm doesn’t control the embedded provider’s systems. That’s a regulatory stretch, and it leaves BaaS platforms in the middle with ambiguous liability.
The ECB’s Digital Finance Strategy mentions embedded finance but doesn’t prescribe specific controls. The MAS has issued technology risk management guidelines that apply to banks using third-party AI and data systems, which covers some embedded finance scenarios — but only those involving automated decision-making, not the full spectrum of embedded services.
The Four Compliance Architectures BaaS Providers Are Building (and Why They’re All Incomplete)
To work around the regulatory gaps, BaaS platforms are experimenting with four different compliance architectures. None of them solves the full problem.
Architecture 1: Sponsor bank owns everything. The sponsor bank builds the embedded product itself, with the BaaS provider supplying only the technical rails (API, data storage, failover). Compliance is centralized in the bank. This works if the BaaS provider is truly a utility, not a product platform. But most BaaS platforms want to own the customer relationship and the product logic, not just rent pipes. This architecture doesn’t scale to multiple products.
Architecture 2: Embedded fintech is fully regulated. The embedded service provider (the fintech) becomes a licensed bank, money transmitter, or lending platform depending on jurisdiction. Each embedded fintech is separately regulated. This is theoretically clean but practically expensive — a fintech that embeds into 50 merchant platforms would need 50 separate regulatory licenses (or at least 50 separate compliance frameworks). Almost no one does this.
Architecture 3: Shared compliance responsibility with detailed API contracts. The sponsor bank, BaaS platform, and embedded fintech all sign agreements defining which party owns which compliance task. The embedded fintech owns KYC data validation; the BaaS platform owns data encryption and operational resilience; the sponsor bank owns regulatory reporting and consumer complaints. Examiners hate this. When something fails, everyone points at the contract instead of the control.
Architecture 4: Embedded fintech operates in a sandbox with limited scope. The fintech operates under explicit regulatory exemptions or safe harbors that limit the products it can offer, the customer base it can serve, or the transaction volume it can process. The sponsor bank monitors the sandbox boundary. This is the cleanest approach but requires regulators to issue sandbox guidance first — and most don’t.
How to Actually Document Embedded Finance Compliance Right Now
Given the regulatory gaps, what should a BaaS compliance officer do today? Build a three-layer control framework that regulators are already looking for, even if it’s not yet codified in embedded finance guidance.
Layer 1: Third-party due diligence and governance. Document the full embedded finance chain — every API, every data handoff, every vendor. For each embedded service provider, conduct an initial technology assessment that covers cybersecurity, data residency, business continuity, and audit rights. Don’t contract with fintech partners that won’t grant audit rights to your examiners. Establish a third-party monitoring program that includes quarterly reviews of the embedded provider’s security, operational metrics, and compliance posture. This isn’t optional; examiners are checking for this specifically.
Layer 2: Data governance and consumer protection. Map where customer data lives in the embedded finance chain. Define data classification standards (PII, sensitive customer data, transaction data). Specify encryption requirements for data in transit and at rest — AES-256 for PII, at minimum. Document retention schedules and ensure they’re consistent across all entities in the chain. Test data flows quarterly. For products that touch lending or credit, document the fair lending controls: how you avoid disparate impact in embedded lending, how you validate ECOA compliance, how you handle fair credit reporting act obligations across the embedded chain.
Layer 3: Operational resilience and incident response. Define recovery time objectives (RTOs) for each embedded finance service, and make sure they’re realistic. A one-hour RTO for embedded lending is good; a 24-hour RTO is bad, and you must document why. Test failover with the BaaS platform and embedded service provider at least twice per year. Document incident response procedures that name the teams, tools, and escalation paths if an embedded service fails. Create a customer communication template that explains what data is affected if an embedded provider is breached.
If your firm isn’t doing these three things today, you’re exposed. Examiners are asking for this during embedded finance examinations, and the enforcement data shows they’re not patient with firms that claim “the other guy owns that control.”
The Specific Question Regulators Are Actually Asking
If an embedded service provider fails, can your organization recover customer transactions, identify which customers were affected, notify them, and process disputes — all without losing control of the regulatory narrative? If the answer is “we’re not sure,” you have a gap.
That clarity matters because embedded finance is growing, and regulatory clarity lags growth. The OCC, Federal Reserve, and CFPB are building guidance on embedded finance for 2026 and 2027, but it won’t be here for months. By then, examiners will have already seen non-compliant implementations and embedded the exam findings into their frameworks. Build your controls now as if that stricter guidance is already law.
The Algoy Perspective
The silence on embedded finance compliance is the real risk. Regulators aren’t saying “embedded finance is unregulated” — they’re saying “the bank is responsible for the entire chain, and we’re going to examine it like a direct subsidiary.” Most BaaS platforms have organized around product speed, not chain accountability. They’ve hired product managers and engineers, not compliance architects who understand chain-of-custody across multiple entities. Third-party risk management frameworks that were designed for banks with one or two vendors now have to cover ecosystems with dozens of embedded fintechs, each moving at startup speed with bank-like liability.
The firms that will win are those building compliance as part of the product architecture, not as an afterthought. That means embedding audit trails, data lineage, and incident response into the BaaS rails from day one. It means hiring compliance engineers who can write code, not just policies. It means testing your controls with examiners before they show up for the exam.
Frequently Asked Questions
Who is legally responsible if an embedded fintech violates AML rules?
The sponsor bank is ultimately liable to regulators, even if the embedded fintech committed the violation. The sponsor bank must have contracted audit rights and due diligence obligations to the embedded provider. If the embedded provider violated AML rules and the bank didn’t detect it, that’s a bank AML failure, not an embedded fintech problem.
Can a fintech operate as “embedded” without a banking license?
Yes, depending on the product and jurisdiction. A fintech can embed lending without a lending license if the sponsor bank is the lender of record. A fintech can embed payments without a money transmitter license if the sponsor bank holds the funds. But the fintech still has to comply with the data, consumer protection, and operational rules that apply to that product — the sponsor bank can’t exempt them.
What’s the minimum KYC time for embedded finance?
There’s no regulatory minimum, but examiners are looking at whether your KYC speed sacrificed accuracy. If your embedded KYC flow is three minutes but it’s missing beneficial ownership verification or sanctions checks, you’re exposed. Build KYC speed after you’ve confirmed it catches everything, not before.
How often should we audit embedded service providers?
At least quarterly for critical services like lending or payments infrastructure, and at minimum annually for non-critical embedded services. Examiners expect to see audit schedules, findings, and remediation tracking for every embedded partner that touches customer data or processes transactions.
