Open almost any modern money app and somewhere near the bottom of the screen you will find a line of small grey text: "Banking services provided by [Some Bank You've Never Heard Of], Member FDIC." Most people scroll straight past it. That sentence is the single most important disclosure in the whole app, because it tells you the company whose logo you tapped is not the company holding your money.
This arrangement has a name — banking as a service, or BaaS — and it is how nearly every neobank, payroll card, and "get paid two days early" feature in the US actually works. It is also where things went badly wrong for about 100,000 people in 2024. Understanding the plumbing is worth twenty minutes of anyone's time.
The three-party stack
A licensed bank can hold deposits, move money over the payment rails, and carry FDIC insurance. It also has a charter, a primary regulator, and examiners who show up. Getting one of those from scratch takes years and a lot of capital.
So instead, a fintech rents access. The sponsor bank exposes accounts, cards, payments, and compliance tooling through APIs; the fintech builds the app, owns the customer relationship, and pays for the privilege. Between them there is usually a third layer — a middleware or BaaS platform that normalizes several banks behind one integration so the fintech doesn't have to rebuild for each one.
The money itself typically does not sit in individual accounts with your name on them at the bank. It sits pooled in a single omnibus account — often called an FBO, "for benefit of" — and a ledger somewhere records that $4,200 of that pool belongs to you.
// What the bank sees: one account, one balance
{ "account": "FBO-000148", "owner": "Fintech Co.", "balance": 41883204.55 }
// What the ledger claims: the actual ownership breakdown
[
{ "end_user": "u_9931", "balance": 4200.0 },
{ "end_user": "u_9932", "balance": 812.19 }
// ...times 100,000
]Those two views have to reconcile every single day. When they don't, nobody can prove who owns what.
Why the ledger is the whole product
FDIC insurance covers a bank failing. It does not cover a fintech or a middleware provider failing, because those aren't banks — there's no deposit insurance fund standing behind them. The concept that is supposed to bridge the gap is pass-through insurance: if the sponsor bank fails, coverage flows through the omnibus account to each individual behind it, up to $250,000 each.
But pass-through coverage has a precondition that a lot of marketing copy quietly skips. It only works if the records clearly identify each beneficial owner and their balance. No clean records, no pass-through. The ledger isn't an implementation detail; it is the thing the whole consumer protection story rests on.
Synapse Financial Technologies was one of those middleware providers. It filed for bankruptcy in April 2024, and roughly $265 million in end-user funds were frozen across partner banks. Law firm analysis during the bankruptcy identified a shortfall somewhere between $65 million and $95 million between what the banks were holding and what the ledgers said customers were owed. Users of apps built on Synapse — Yotta and Juno among them — spent months locked out, and some received a small fraction of their balances back. No bank had failed, so FDIC insurance was never triggered. The records simply did not add up.
What changed, and what didn't
Regulators moved on the bank side first. Consent orders landed on several prominent sponsor banks in the US, and Germany's BaFin took its own measures against Solaris. The practical effect was to end the era of a bank onboarding fintech programs and checking in quarterly. Oversight is now expected to be continuous, with the bank able to see the ledger rather than take a partner's word for it.
The FDIC also proposed a rule in September 2024 that would require insured banks holding custodial accounts with transactional features to either maintain the beneficial-owner ledger themselves or have unrestricted access to the provider's, reconcile daily, and certify annually. The comment period closed in January 2025. It has not been finalized, and industry groups have pushed for it to be withdrawn — so as of now, the strongest fix on the table is still a proposal rather than a rule.
Separately, in late 2025 the CFPB was reported to have allocated roughly $46 million from its Civil Penalty Fund toward compensating Synapse end users, which recovers part of the gap but is not a substitute for records that reconcile in the first place.
Reading the fine print
None of this makes BaaS a bad model. Pooled accounts and shared infrastructure are why a five-person company can ship a decent checking product at all, and the good operators reconcile daily because they understand what it protects. The useful shift is knowing what to look for: which bank is named in the disclosure, whether the app says funds are held at an FDIC-insured bank versus implying the app itself is insured, and how many intermediaries sit between you and the charter. Every extra hop is another ledger that has to agree with the one before it.
The FDIC's proposed rule on recordkeeping for custodial accounts is short and readable if you want the specifics.