What Is Fintech & Transfers?
Fintech covers the technology-driven transformation of financial services — from digital wallets and neobanks to real-time payment rails, open banking APIs, and cross-border transfer infrastructure that moves trillions globally.
📂 Explore by Sub-Topic
Digital Payments
Contactless, wallets, QR codes, tokenization, card-present
Cross-Border Transfers
SWIFT, remittances, international money movement
Neobanks & Banking-as-a-Service
Digital banks, BaaS, embedded finance, challenger banks
Open Banking
APIs, data sharing, account-to-account payments
Payment Rails & Infrastructure
Real-time rails, ISO 20022, gateways, acquiring banks
Emerging Fintech
BNPL, biometrics, embedded payments, Stripe case study
Related Finance Sub-Topics
Latest Fintech & Transfers Articles
Recently published expert guides from the Fintech & Transfers hub.
Banks Push Back on AI Agents: Who Pays When Software Moves Your Money?
Major banks are starting to draw lines around AI agents that act on customers' behalf. JPMorgan, Citi and Bank of America have restricted third-party agents, and RBC's chief executive is weighing whether to block Meta's agent. The sticking point is liability: if an agent moves money in error, who pays? Until that is settled, expect restrictions, not open doors.
For two years, the pitch for AI agents in personal finance has been simple: give the software access to your accounts and let it pay bills, shop for better rates, rebalance a portfolio or book a trip. In late October 2026 the banks that hold those accounts are pushing back. Reports from across North America describe a growing list of lenders that are restricting, or considering restricting, outside agents from reaching customer accounts.
This article explains what is happening, why liability is at the centre of the dispute, what it means for customers and fintechs, and how finance teams should think about agent access in their own banking relationships.
What the banks are actually saying
The most direct public warning has come from Jamie Dimon at JPMorgan Chase. Coverage of his remarks describes a "liability transfer": when a customer hands an agent the keys to an account, the customer, not the bank, is expected to carry the risk of what the agent does. JPMorgan has been reported as blocking external AI agents from customer accounts altogether.
Citi and Bank of America have also restricted third-party agents. Bank of America's Brian Moynihan was quoted as saying the bank is limiting access while it develops protocols to establish which party is liable for payments authorised by artificial intelligence. That phrasing matters. It does not describe a permanent ban; it describes a pause until the rules of responsibility exist.
In Canada, the debate reached the front page of the industry press this week. Finextra reported that the chiefs of RBC and BMO were the latest bank leaders to warn customers about the dangers of linking accounts to AI agents. The detail in other reporting is more precise: RBC's chief executive, Dave McKay, said on Bloomberg Television that the bank is weighing whether to block Meta's agent from reaching customer information, with no final decision made. He raised unauthorised data access, fraudulent consent and liability as autonomous agents increasingly carry out transactions. BMO's contribution, from its chief AI and quantum officer Kristin Milchanowski, was less a warning than a forecast: people will be using AI agents for shopping and investing within six months, and consumer-facing companies must think about how they interact with and market to agents as well as to humans.
Why liability is the real fight
Consumer banking law in most markets was written around a human who initiates, or authorises, each payment. Protections such as chargebacks, unauthorised-transaction refunds and fraud liability limits assume that either the customer did something or a criminal did. An agent introduces a third category: a transaction the customer technically authorised in general terms but never approved in detail.
Consider three scenarios banks are worried about:
- The misread instruction. A customer tells an agent to "pay off the card". The agent pays the full balance from a savings account that was earmarked for tax. Was that authorised?
- The manipulated agent. A malicious web page or email contains hidden instructions that steer an agent into moving funds. The customer did not act; the agent did, but it was deceived.
- The over-broad consent. A user clicks through a permission screen granting an agent wide access, then disputes a transaction they did not expect. "Fraudulent consent" is the phrase McKay used for this family of problems.
In each case the bank is the party with the deepest pockets and the regulatory duty, yet it has no visibility into the software making the decisions. From a risk officer's perspective, blocking agents until responsibility is allocated is the conservative move. From a product perspective, it is a way to keep control of the customer relationship while the bank builds its own agents.
The competitive subtext
It would be naive to read the restrictions as purely defensive risk management. Banks have fought for years over who owns the customer interface. Open banking regimes and data-aggregation APIs forced them to share data with fintechs under defined terms. General-purpose AI agents threaten to go further by sitting on top of the bank app and turning it into a back-end utility. If an agent chooses the savings account, the card and the loan, the bank's brand stops mattering to the customer.
That is why the language from executives mixes safety and strategy. Banks want agent traffic to arrive through sanctioned channels, with authentication, spending limits and audit trails they define. They also want the economics: who pays for the API calls, and whether the agent's operator shares revenue. BMO's remark that companies must learn to market to agents is a tell. Agents will be a distribution channel, and the question is on whose terms.
What a workable framework might look like
Nobody has published a settled standard, so this section describes the components most proposals share rather than a finished rule.
- Delegated, scoped credentials. Instead of handing over a password, a customer issues a token limited by action (view, pay existing payees), amount, merchant category and time. The token can be revoked instantly.
- Agent identity. The bank can see which agent, run by which operator, is making a request, rather than an anonymous session that looks like a customer.
- Step-up confirmation. Payments above a threshold, or to new payees, require the human to approve in the bank's own app.
- A liability matrix. Contracts or regulation specify who bears losses when an agent errs, is manipulated, or is compromised. This is the missing piece Moynihan referred to.
- Logs. A tamper-evident record of what the agent was told and what it did, so disputes can be resolved on evidence.
None of these is technically exotic. Payments already uses tokenisation, strong customer authentication and mandate-based direct debits. The hard part is commercial and legal agreement across thousands of institutions and a handful of dominant AI platforms.
What this means for customers
If you are an individual using, or considering, an AI agent with financial access, the practical implications are straightforward.
- Assume you carry the risk. Dimon's liability-transfer framing is a signal that banks may not reimburse losses caused by an agent you authorised.
- Prefer read-only access first. Letting an agent analyse spending is much safer than letting it move money.
- Use separate accounts. If you experiment, keep a small balance in an account the agent can touch, and the rest out of reach.
- Check whether your bank will block it. An agent that works today may stop working if your bank tightens rules, which can leave bills unpaid if you relied on it.
What this means for fintechs and AI platforms
Fintechs that built businesses on data aggregation have seen this film before, when banks restricted screen scraping in favour of APIs. The agent era will probably follow a similar arc: a period of blocking and negotiation, followed by formal access agreements for operators that accept liability, security requirements and fees. Startups that can offer compliant agent infrastructure, such as identity, consent management, monitoring and insurance, may find a market selling to both sides.
For AI platforms, the lesson is that general-purpose capability does not equal permission. Having an agent that can use a browser does not give it the right to operate inside a bank's authenticated session. The platforms that win financial use cases will likely be those that sign agreements with banks early.
What finance teams should do now
Corporate treasury and finance functions are experimenting with agents too, for reconciliations, payment preparation and cash reporting. The same questions apply at larger scale, and the stakes are higher.
- Inventory agent access. List every tool, employee-built automation or vendor feature that touches bank portals, and what credentials it uses.
- Separate preparation from release. Agents can draft payment files; humans or controlled systems should approve and release them. Dual control still applies.
- Ask your bank. Find out the bank's position on agent access, API options and liability allocation before rolling anything out.
- Update policy. Add agent-specific rules to your delegation-of-authority and information-security policies.
- Test for manipulation. Treat content an agent reads, such as invoices and emails, as untrusted input that could carry instructions.
The resilience link
The agent debate also intersects with operational resilience. This week UK and EU regulators sought answers from Google over a major cloud outage, a reminder that banks and fintechs depend on shared infrastructure. As agents add another dependency layer, a single failure in an agent platform could affect many customers' payments at once. Regulators who already scrutinise concentration risk in cloud services are likely to ask similar questions about agent providers.
What to watch next
- Whether RBC finalises a decision on blocking Meta's agent, and how Meta responds.
- Whether other large banks publish formal agent-access policies, or standard terms for sanctioned agents.
- Any regulatory guidance clarifying liability for agent-initiated payments. In the absence of new rules, existing unauthorised-transaction frameworks will be stretched.
- Pilot programmes where banks launch their own agents or approve selected partners.
Bottom line
The banks are not rejecting AI agents; they are refusing to underwrite them on someone else's terms. Until the industry agrees who bears the loss when software makes a mistake with real money, expect a patchwork of blocks, pilots and carefully scoped permissions. Individuals should treat agent access to money as a risk they personally carry, and finance teams should apply the same controls to agents that they apply to people: limited authority, separation of duties and clear audit trails.
Sources and further reading: Finextra reporting on bank limits for agent access (22 October 2026); coverage of JPMorgan, Citi and Bank of America restrictions on third-party agents; reporting on remarks by RBC's Dave McKay and BMO's Kristin Milchanowski. Details reflect public reports as of 25 October 2026 and may change. This article is general information, not financial or legal advice.
Cloud Outages and AI Agents: Fintech’s Resilience Test After the Google Cloud London Outage
Two stories this week point at the same weakness in modern finance: dependence. A Google Cloud outage in London disrupted banks and Revolut, prompting questions from UK and EU regulators, while Canadian bank chiefs warned customers about linking their accounts to AI agents. Fintech’s next test is less about new features and more about resilience, control and trust.
The Week Fintech Met Its Dependencies
Financial technology has spent a decade promising speed, convenience and lower costs. This week’s headlines show the other side of that bargain. According to The Guardian and Finextra, a major outage in Google’s London cloud region on October 20, 2026 caused problems at banks, at the digital bank Revolut and even at court video systems. Days later, Finextra reported that the chief executives of two of Canada’s largest banks, RBC and BMO, have warned customers about the dangers of linking their accounts to AI agents.
One story is about infrastructure that sits beneath the financial system; the other is about a new type of software that wants to act on customers’ behalf. Both raise the same question: when the technology does something unexpected, who is responsible, and how quickly can the damage be contained? This guide examines both, adds context from the week’s other fintech news, and ends with a practical checklist for fintech founders, bank technology teams and business customers.
The Google Cloud Outage in Detail
The Guardian’s live coverage reported that Google apologised after a power issue caused a major Cloud outage in its London region, leading to problems at banks, Revolut and court video cameras. Later in the day, the paper reported that problems had been fixed for most customers while regulators pushed for details. Finextra followed up that the European Banking Authority and the UK’s Financial Conduct Authority have been in contact with Google over the outage that knocked services offline earlier in the week.
It is worth being precise about what is known. Public reporting identifies a power issue in one cloud region, affecting multiple customers, with regulators asking questions. It does not tell us how long individual firms were affected or what, if any, customer losses resulted. Any commentary beyond that is inference, and we flag it as such.
Why a single region matters
Cloud providers divide infrastructure into regions and availability zones so that a failure in one place does not take everything down. Customers are supposed to design for that, spreading workloads across zones or regions. But doing so costs money and adds complexity, and many firms concentrate in one region for latency, data-residency or cost reasons. When a regional problem bites, the firms that chose the cheaper design find out at the worst possible time.
For regulated financial firms, this is not only a technical choice but a compliance one. Supervisors in the UK and EU have been building frameworks around operational resilience and third-party risk, and the fact that two regulators reached out to the provider this week shows the topic is live. Banks must be able to demonstrate that important business services can stay within tolerated disruption levels, including when a supplier fails.
AI Agents and the Bank Account Question
The second story is newer and, in some ways, more unsettling. AI agents are software programs that can take actions for a user, such as comparing offers, paying bills or moving money, rather than just answering questions. To do that, an agent needs access to accounts. Finextra reports that the CEOs of RBC and BMO are the latest bank chiefs to warn customers about the dangers of linking their accounts to such agents.
The reasons are easy to imagine, though the reporting we reviewed gives only the headline warning. Agents can be manipulated by malicious instructions hidden in the content they read. They can make mistakes with real money. They may operate with broad credentials that customers granted without understanding the scope. And when something goes wrong, liability is unclear: is it the customer, the agent developer, the bank or the platform hosting the model?
The security backdrop is not reassuring. CoinDesk reports that Bitcoin Core developers changed their security policy because AI now makes finding code bugs dangerously easy, ending a months-long embargo for flaws that a chatbot could rediscover, after a summer in which AI found hundreds of bugs. The same capabilities that help defenders find flaws also help attackers. A financial system increasingly connected to AI agents is a larger surface to defend.
What banks are likely to do
Without speculating about any particular bank’s plans, the options are fairly predictable. They can restrict agent access by default, require customers to opt in with explicit scopes, offer read-only connections, set transaction limits for agent-initiated payments, or build their own sanctioned agent interfaces. Each choice trades convenience for control. The warnings from large bank CEOs suggest the early posture will lean toward control.
Money Keeps Flowing In Anyway
Caution at the large institutions has not slowed investment in the sector. Finextra’s headlines this week include several funding and deal items:
- Coast, a New York-based fintech building a payments platform for companies in the physical economy, raised $35 million.
- Cognitive Credit closed a $40 million strategic growth investment led by Summit Partners to scale specialist data and AI for corporate credit markets.
- Fireblocks pushed back on reports of $2.5 billion acquisition talks with Visa, saying the reports were news to the company. That is a denial worth noting: the story was circulating, but the company says it is not true as reported.
- Finextra also reports that pay for quantitative finance professionals continues to rise despite the AI revolution, according to recent research.
In the wider technology world, TechCrunch reports that Daytona, a cloud for AI agents that gives each agent its own computer, hit a $1 billion valuation. That suggests investors expect agents to be a large category, which only increases the importance of the safety questions banks are raising.
Stablecoins and Cross-Border Rails: The Context
Alongside the resilience debate, fintech is busy building new payment rails. HSBC launched its first stablecoin for public use, and Thailand and Malaysia backed Singapore’s BLOOM cross-border digital money initiative, according to Finextra. Yet research from the Bank for International Settlements, also covered by Finextra, finds that fintechs such as Wise and Remitly have cut retail cross-border costs substantially relative to bank wires, while stablecoins still suffer from friction. The takeaway for fintech builders is humbling: customers reward measurable cost and speed improvements, not technology labels.
It also ties back to resilience. New rails create new dependencies, whether on a blockchain, a cloud region or a model provider. Every new dependency needs an answer to the question, what happens when it fails?
What Google Trends Shows
We checked Google’s daily trending searches for the US, UK, Hong Kong, Canada and India on October 24. Fintech terms did not appear among the top trending searches, which were dominated by sports and entertainment. That is typical: infrastructure outages and agent-security debates rarely trend with the general public, even when they matter greatly to professionals. The implication for content and communications teams is that the audience for these topics is specialist. Reach them through trade media, regulators’ publications and professional networks rather than waiting for a search surge.
A Resilience Checklist for Fintech Teams
- Map critical dependencies. List every cloud region, payment processor, identity provider and data vendor your top customer journeys rely on.
- Define tolerances. Decide how long each journey can be disrupted before customers are harmed, then compare against tested recovery times.
- Design for regional failure. For services that matter, run active-active or at least warm-standby across regions, and test failover on a schedule.
- Prepare customer communications. Pre-write status page and in-app messages. During the outage, silence erodes trust faster than the outage itself.
- Know your regulator’s expectations. Incident reporting timelines and third-party risk rules differ by jurisdiction. Confirm them before you need them.
A Control Checklist for the Agent Era
- Scope access narrowly. Prefer read-only or limited-permission credentials for any agent connection.
- Set limits. Apply per-transaction and daily caps to agent-initiated payments, with step-up authentication above them.
- Log everything. Keep an auditable record of what an agent did, on whose instruction, and with what permissions.
- Plan for prompt injection. Assume content an agent reads may contain hostile instructions. Separate what an agent may read from what it may execute.
- Clarify liability in the terms. Make clear who bears losses from agent errors, and document the customer consent flow.
What Business Customers Should Do
If you are a company that depends on a bank or fintech for payments and payroll, have a fallback. Keep a secondary bank account with a different provider, know the manual payment procedures, and hold enough buffer to bridge a day or two of disruption. If your staff are experimenting with AI agents, set a policy: no connecting corporate bank or card accounts to experimental tools without security review. The Canadian bank chiefs’ warnings are a useful prompt to write that policy now.
Frequently Asked Questions
Was customer money lost in the Google Cloud outage?
The reporting we reviewed describes service disruption at banks and Revolut but does not describe customer losses. Check your provider’s communications for specifics.
Are AI agents banned from bank accounts?
No. The reporting describes warnings from bank CEOs, not bans. Policies vary by institution and are likely to evolve.
Did Visa agree to buy Fireblocks?
No acquisition has been announced. Fireblocks said reports of $2.5 billion talks were news to the company.
Does multi-cloud solve resilience?
It can help, but it adds cost and complexity, and poorly executed multi-cloud can create new failure modes. Testing matters more than the architecture diagram.
The Bottom Line
Fintech’s glossy promise rests on layers of infrastructure and, increasingly, on autonomous software. This week showed both layers under scrutiny: a cloud region failure that touched banks and neobanks, and bank leaders urging caution over AI agents. Neither story means the sector is in crisis; investment and product launches continue. But the firms that earn lasting trust will be the ones that treat resilience and control as core product features rather than compliance chores.
Sources
- The Guardian: Google Cloud outage, problems fixed for most customers as regulators push for details
- Finextra: Banks move to limit agents’ access to customer accounts
- Finextra: Fintechs top banks and stablecoins for cheap cross-border payment, BIS research
- Finextra: HSBC launches first stablecoin
- CoinDesk: Bitcoin Core changes security rules as AI makes finding code bugs dangerously easy
- TechCrunch: Agent cloud startup Daytona hits $1B valuation
Fintech Funding Fell 21% in Q3 2026: Fewer Deals, Bigger Bets and What It Means
Fintech startups raised $10.6 billion globally in the third quarter of 2026, down 21.4% from a year earlier and 28.4% from Q2. Deal count fell to 687, the lowest in any quarter since Crunchbase’s data begins in 2018. Money did not vanish; it concentrated in fewer, larger, more proven companies, with payments, infrastructure and stablecoin rails drawing the most interest. For founders, the message is to bring evidence, not narrative.
Every quarter, venture data tells a slightly different story about the same industry. The third quarter of 2026 tells one of selectivity. According to Crunchbase News, fintech startups worldwide raised $10.6 billion in July through September, a drop of 21.4% from the $13.5 billion raised in Q3 2025 and a steeper 28.4% decline from the $14.9 billion raised in the second quarter. The number of funding rounds fell even faster. Just 687 deals were recorded globally, down nearly 31% year over year and 12.9% from the previous quarter.
That deal count is the figure worth dwelling on. Crunchbase tracks quarterly fintech data back to the first quarter of 2018, and Q3 2026 is the lowest deal count in that entire window. Dollars are down, but the number of companies getting funded is down by much more. This is what a narrowing market looks like, and it matters for anyone building, buying or investing in financial technology.
The headline numbers, in context
It helps to put the quarter’s figures side by side:
- Funding: $10.6 billion in Q3 2026, versus $14.9 billion in Q2 2026 and $13.5 billion in Q3 2025.
- Deal count: 687 rounds, versus 789 in Q2 and 995 a year earlier.
- Large rounds ($100 million or more): $5.15 billion in Q3, down 43.3% from $9.07 billion in Q2.
- Smaller rounds (under $100 million): down just 5.1% from the prior quarter.
The quarter-over-quarter decline is almost entirely a story about big checks. The pullback in rounds of $100 million or more accounts for roughly 93% of the overall dollar decline from Q2. In other words, Q2 was unusually rich in mega-rounds, and Q3 did not repeat the performance. That is a different thing from a collapse in early-stage activity.
The year-over-year picture flips the emphasis. Compared with Q3 2025, funding from rounds of $100 million or more fell only 7%, while funding from smaller rounds dropped 31.4%. So large transactions have proven comparatively resilient over twelve months, and the smaller-round segment is where the longer-term squeeze has been felt. Both observations can be true at once: the biggest rounds are lumpy from quarter to quarter, yet the broad middle and early stage of the market has thinned out over the year.
A bifurcated market
The most useful framing in the Crunchbase report comes from investors themselves. Laura Bock, a partner at QED Investors, described the market as “bifurcated — AI vs. not and market leaders vs. not.” Kirsten Green of Forerunner made a similar point, describing capital concentrating in fewer, larger rounds, with infrastructure, payments and stablecoin rails attracting interest, supported by greater regulatory clarity.
Two dividing lines run through this description. The first separates companies with a credible AI story from those without one. The second separates category leaders from everyone else. A fintech that is both, or even one of them, can still raise capital on attractive terms. A fintech that is neither faces a market that has become considerably more disciplined.
Bock illustrated the point by comparing two similarly sized businesses, Ramp and Monzo, which command very different valuations. She attributed Ramp’s premium to investor enthusiasm for its AI momentum and growth trajectory. Green said much the same from another angle: a small group of companies with clear momentum command aggressive valuations, while others face greater pricing discipline. For founders, the practical takeaway is that comparable revenue no longer implies comparable valuation. The narrative around where a company’s growth is heading now carries real weight in pricing.
What investors now want to see
Green’s comments set out the new bar fairly directly. Investors want stronger evidence of performance before writing checks. In emerging categories, actual usage and momentum can matter more than revenue multiples. Ahead of a large Series B, investors want efficient growth, a credible path to profitability and stronger evidence of lasting customer demand.
That is a meaningful shift from the earlier part of the decade, when growth at almost any cost could carry a story to the next round. Today the sequence is reversed: prove the demand, show the efficiency, and the capital follows. The companies that do not make it through this filter are not necessarily failing; many are simply being asked to wait, raise smaller amounts, or find other forms of financing.
Which brings up another trend noted in the report. More startups are combining debt and equity to limit dilution. For a business with predictable receivables or lending books, blending a debt facility with an equity round can stretch the capital further and preserve ownership. It also signals to equity investors that lenders have underwritten the business’s cash flows. Expect to see more of this structure in fintech, where the underlying assets often suit it.
Where the money went: geography
The United States remained the largest fintech funding market, with startups attracting $5.38 billion, or 50.5% of the $10.64 billion global total. After that came a more varied group:
- Singapore: $1.28 billion (12.1%), heavily concentrated in Ant International’s $1.2 billion round.
- Saudi Arabia: $626.6 million (5.9%).
- India: $452 million (4.2%).
- Brazil: $352 million (3.3%).
- United Kingdom: $337.8 million (3.2%).
One detail stands out: although the U.S. led in total dollars, the quarter’s five largest funding rounds all went to companies based outside the United States. Singapore’s number is the clearest example of how a single transaction can reshape a country’s ranking. Without Ant International’s round, Singapore would not have placed second. This is a reminder that country-level fintech statistics are sensitive to individual deals, and a single quarter should not be read as a durable shift in where fintech is being built.
Saudi Arabia’s presence in third place is consistent with the broader story of Gulf capital and regulatory development drawing fintech activity, while India and Brazil continue to appear as large, populous markets with active payments and lending sectors. For readers following regional markets, it is worth pairing this global picture with local data: Crunchbase’s Q3 analysis of Latin America, for instance, shows a region where total venture investment rose 26% year over year to $1.3 billion, with Mexico’s startups raising more than Brazil’s across the first three quarters of 2026, even as Brazil retained more breadth in the number of deals.
Why infrastructure, payments and stablecoins
The categories singled out by investors are not random. Infrastructure, payments and stablecoin rails share a few features that make them attractive in a selective market. They tend to be tied to transaction volume, which gives investors observable usage data rather than projections. They can serve many end customers at once, which supports the “market leader” thesis that investors are prioritizing. And, as Green noted, greater regulatory clarity reduces one of the largest sources of uncertainty for these businesses.
For companies that sit at the application layer, such as consumer budgeting apps or niche lending products, the picture is harder. These businesses are more exposed to customer acquisition costs and competition, and they may not have the same transaction-linked metrics to point to. That does not make them uninvestable, but it does mean the burden of proof is higher.
What this means for different readers
For founders
Plan for a longer, more demanding process. With fewer deals closing, investors have room to be choosy, and they are using it. Lead with usage, retention and unit economics. If your product has a credible AI-driven efficiency or growth angle, make it concrete and measurable rather than rhetorical. Consider whether a mix of debt and equity could extend your runway without heavy dilution, and talk to lenders alongside investors.
For finance teams and buyers of fintech
A thinner funding market has procurement implications. Vendors that cannot raise their next round may cut costs, change pricing, narrow their product lines or look for acquirers. When you select a payments, expense or banking-infrastructure provider, ask about runway and funding history alongside features. Dependence on a vendor that is struggling to raise can become an operational risk. Our guides to free and low-cost financial tools are a useful place to compare options, but it is wise to keep a fallback provider in mind for critical flows.
For investors and limited partners
A quarter of falling deal count and concentrated capital supports the case for careful selection and, for some, for reserving capital for follow-on rounds in proven winners. It also suggests that valuation dispersion will stay wide. If Ramp and Monzo, similarly sized, can attract such different pricing, then benchmarking against averages is less informative than looking at each company’s specific momentum.
How to read the next quarter’s data
When Q4 figures arrive, a few questions will help separate noise from signal. Does deal count stabilize, or does it keep falling? Do smaller rounds, which have fallen 31.4% year over year, begin to recover, or does the squeeze on early-stage companies continue? Do large rounds rebound to Q2 levels, which would suggest the Q3 dip was timing, or stay near $5 billion, which would suggest a lower baseline? And does the AI-versus-non-AI split in valuations persist or narrow?
Another factor to watch is exit activity. Crunchbase has separately reported that acquirers have been buying startups from the 2021 boom era that have not raised funding in years, often at valuations well below their peaks. A funding market with few new rounds and an active acquisition market tend to go together: companies that cannot raise on acceptable terms look for buyers instead. If that pattern continues, fintech consolidation may become a bigger part of the story in the coming quarters.
Key takeaways
- Q3 2026 fintech funding was $10.6 billion, down 21.4% year over year and 28.4% quarter over quarter.
- The 687 deals recorded are the fewest of any quarter since Q1 2018 in Crunchbase’s data.
- Large rounds drove the sequential decline; smaller rounds drove the year-over-year decline.
- Investors describe a bifurcated market split by AI exposure and by market leadership.
- Infrastructure, payments and stablecoin rails are drawing interest, helped by greater regulatory clarity.
- The U.S. took 50.5% of global funding, but the five largest rounds all went to non-U.S. companies.
- Founders are being asked for evidence of usage and efficiency, and many are blending debt with equity.
Conclusion
The third quarter of 2026 does not describe a fintech funding drought so much as a funding filter. Capital is available for companies that can show momentum, efficient growth and a place at the front of their category, and it is much harder to find for those that cannot. The record-low deal count, paired with resilient large rounds, is the clearest sign of that concentration. Whether you are raising money, buying software or allocating capital, the sensible response is the same: look past the narrative and examine the evidence.
Sources and methodology: funding figures, deal counts and investor quotes are drawn from Crunchbase News coverage of Q3 2026 fintech and Latin America venture funding and its analysis of acquisitions of older venture-backed startups. Figures are as reported by Crunchbase and may be revised as additional rounds are recorded. This article is for information only and is not investment advice. Google Trends topic-level data was not available to this edition’s research.
The Fintech Charter Boom: Why Fintechs Are Racing to Become Banks in 2026
More than 30 fintechs, neobanks and non-bank lenders are seeking bank or industrial loan charters in 2026, including PayPal, Affirm, Stellantis and World Liberty Financial. A charter removes reliance on a sponsor bank, lowers funding costs and cuts compliance risk — but it also brings full prudential regulation, capital requirements and years of review. For finance and treasury teams, the wave signals which fintech partners are becoming more durable, and which sponsor-bank-dependent platforms carry more counterparty risk.
A record number of financial technology companies are applying to become banks in 2026, and a fintech bank charter is now one of the clearest signals of which platforms are built to last. Federal regulators are processing an unprecedented pipeline of de novo bank and industrial loan company (ILC) applications from neobanks, payment platforms, auto lenders and even a cryptocurrency venture tied to the Trump family. This guide explains why the rush is happening now, what a charter actually changes, and what it means for businesses that rely on fintech partners for banking, payments or lending.
This guide provides general information, not legal or regulatory advice. Bank chartering rules vary by regulator and jurisdiction; consult qualified counsel before relying on any fintech’s regulatory status.
What is a fintech bank charter?
A license — full bank, trust bank or industrial loan company (ILC) — that lets a fintech hold deposits and lend directly, without routing transactions through a sponsor bank.
Why is 2026 different?
Over 30 companies are in the pipeline, including PayPal, Affirm, Stellantis, Nissan and World Liberty Financial, more than in any prior year on record.
What should businesses do?
Treat a partner’s chartering status as a due-diligence signal: chartered institutions carry direct federal oversight and deposit insurance that sponsor-bank arrangements do not guarantee.
What is driving the fintech bank charter boom in 2026?
The 2026 surge is driven by regulators approving more charters faster, and by fintechs wanting to escape costly sponsor-bank partnerships after years of enforcement actions against that model. Over 30 neobanks, lenders, payment firms and digital-asset companies are now in the federal charter pipeline.
Banking Dive and American Banker both describe an “explosion” of charter applications processed by the OCC, FDIC and state regulators through 2026. The applicant list spans consumer fintech (rent-payment platform Flex, buy-now-pay-later leader Affirm, payments giant PayPal), captive auto lenders (Ford Credit Bank, GM Financial Bank, Stellantis Bank, Nissan), a wealth manager (Edward Jones Bank) and even World Liberty Financial, the cryptocurrency platform associated with the Trump family, which received conditional trust-charter approval. Dutch neobank Bunq, by contrast, had its US charter application denied — a reminder that approval is not automatic.
Why do fintechs want to become chartered banks instead of using sponsor banks?
Fintechs pursue charters to cut the cost of routing deposits and payments through a partner bank, to reduce dependence on a single sponsor’s risk appetite, and to gain direct access to payment rails and deposit insurance. A charter converts a fragile partnership into a regulated, standalone banking business.
For most of the last decade, non-bank fintechs relied on “bank-as-a-service” arrangements: a chartered sponsor bank held the actual deposits and licenses, while the fintech built the app and customer relationship. That model has come under sustained regulatory pressure. The Federal Reserve’s own September 2026 press releases show agencies actively tightening oversight of this arrangement — including new proposed third-party risk-management guidance and a statement on how community banks should engage with core service providers, alongside a separate move to ease exam burdens for smaller, well-run community banks. Sponsor banks that mismanaged fintech partnerships have faced consent orders and enforcement actions in the past two years, and fintechs increasingly see chartering as the more durable, lower-risk long-term structure.
What is the difference between a full bank charter and an industrial loan company (ILC) charter?
A full national or state bank charter permits deposit-taking and lending under comprehensive prudential regulation, typically with Federal Reserve oversight of any parent company. An ILC charter, chartered mainly through Utah, offers FDIC-insured deposit-taking and lending without subjecting the parent company to full bank holding company regulation.
The ILC route has become the preferred path for commercial parents that do not want to become regulated bank holding companies — notably auto manufacturers’ finance arms. Since January 2026, the FDIC has conditionally approved ILC deposit insurance applications from Ford Credit Bank, GM Financial Bank, Edward Jones Bank and Stellantis Bank, with additional applications filed by Nissan, OneMain and Affirm. Rent-payment fintech Flex filed a similar ILC application with the FDIC and the Utah Department of Financial Institutions in 2026. Regulatory law firms including Freshfields and Goodwin describe this as a structural shift in “the regulatory perimeter” for fintechs, payments companies and industrial parents alike.
How long does it take to get a bank charter approved in 2026?
Approval timelines vary widely and can run well over six months even for conditional approval. World Liberty Trust Company’s conditional approval took 221 days, while Bunq’s denial took 212 days — illustrating that a long review period does not by itself predict the outcome.
Applicants typically clear several sequential hurdles: a charter approval from the primary regulator (OCC for national banks and trust banks, state regulators for ILCs), a separate deposit insurance application to the FDIC, and — for companies that will operate as bank holding companies — Federal Reserve approval of the holding company structure. Each stage involves capital adequacy review, business-plan scrutiny, management background checks and, increasingly, cybersecurity and anti-money-laundering readiness assessments. Experts quoted by Banking Dive expect the pipeline to keep growing through the rest of 2026 as more fintechs conclude that regulatory certainty is worth the wait.
What does the fintech charter trend mean for the wider finance and payments industry?
The trend signals a maturing fintech sector where scale players are converting temporary bank partnerships into permanent regulatory infrastructure. It also means more of the payments and lending stack is moving under direct federal supervision rather than indirect oversight through sponsor banks.
This has knock-on effects across the industry covered in Kurums’ Fintech & Transfers hub. As stablecoin issuers pursue trust-bank charters for dollar-backed tokens — Sony Bank’s OCC-approved trust subsidiary is one recent example — the line between “fintech” and “bank” keeps narrowing, a shift already visible in Kurums’ stablecoin regulation guide. At the same time, the sponsor-bank model itself is under renewed scrutiny following a string of consent orders, a dynamic explored in Kurums’ coverage of 2026 sponsor-bank consent orders. Search interest in “bank charter” has spiked around specific applicants — Google Trends shows “world liberty financial bank charter” as the single largest related query in the category this month — suggesting public and investor attention is now tracking individual filings rather than the trend in the abstract.
How should a business evaluate a chartered fintech versus a sponsor-bank fintech partner?
Businesses should weigh three factors: deposit insurance clarity, regulatory accountability and continuity risk. A chartered fintech carries its own federal or state banking license, while a sponsor-bank fintech’s stability depends on a third-party relationship that can be terminated or restructured with little customer warning.
In practice, that means checking whether customer funds sit in FDIC-insured accounts at the fintech itself or are “pass-through” insured via a partner bank, reviewing whether the sponsor bank has any recent consent orders or enforcement history, and building a contingency plan in case a banking partnership is unwound — as has happened abruptly at several sponsor-bank fintechs in the past two years. Finance and procurement teams that formalize this review as part of vendor onboarding avoid being surprised by a sudden loss of banking services.
Frequently Asked Questions
Is a fintech with a bank charter safer than one using a sponsor bank?
Generally yes for continuity and regulatory accountability, because the fintech itself is directly supervised and insured rather than depending on a third-party bank relationship that can change.
Which companies received bank or ILC charters in 2026?
Approvals and pending applications in 2026 include Ford Credit Bank, GM Financial Bank, Edward Jones Bank, Stellantis Bank, Sony Bank’s trust subsidiary and World Liberty Trust Company, among more than 30 applicants overall.
What is an industrial loan company (ILC)?
An ILC is an FDIC-insured lender, chartered mainly in Utah, that lets a commercial parent take deposits and make loans without becoming a regulated bank holding company.
Does a bank charter application always get approved?
No. Denials happen — Dutch neobank Bunq’s 2026 US charter application was rejected after a 212-day review, showing regulators still apply meaningful scrutiny.
How does this affect businesses that use fintech payment or lending platforms?
It changes counterparty risk. A charter gives businesses clearer recourse and deposit protection, so vendor due diligence should now include a partner’s chartering status alongside its pricing and features.
Last updated: September 13, 2026. Sources: American Banker, Banking Dive, Goodwin, Freshfields, Federal Reserve Board press releases.
Agentic Payments Arrive in Production: What Blik’s First AI-Agent Transaction and the New Know-Your-Agent Framework Mean for Finance Teams
Last Updated: September 11, 2026
By the Kurums.com Finance Desk
Agentic payments moved from pilot to production this week. Polish payment network Blik confirmed it processed its first agentic payment transaction on September 11, 2026, where a user authorized an AI agent to find a product and pay for it automatically once available. A day earlier, Ant International, Visa, and Mastercard announced a joint “Know-Your-Agent” (KYA) framework to identify and vet AI agents across card networks and wallets. The catch: new Visa research shows only 23% of US consumers trust generative AI to handle payments on their behalf, and a fresh $7.3 million funding round for agentic governance-risk-compliance platform HelmGuard signals that risk teams are racing to catch up with the technology, not ahead of it.
What Just Happened With Agentic Payments?
Blik, Poland’s dominant mobile payment network, confirmed it has processed the first agentic payment transaction on its rails: a user pre-authorized an AI agent to search for a specific product and complete payment automatically the moment it became available.
This is a meaningful shift from earlier “AI shopping assistant” demos, most of which stopped at generating a product shortlist or a draft cart that a human still had to check out manually. In Blik’s case, the agent held standing authorization to both search and pay within pre-set conditions, without a human confirming the final transaction. For finance teams, that single detail changes the risk conversation from “AI helps a customer shop” to “an autonomous system is initiating an actual movement of money,” which is a fundamentally different category of operational, fraud, and reconciliation risk.
What Is the Know-Your-Agent (KYA) Framework?
Know-Your-Agent, or KYA, is a proposed interoperability standard from Ant International, Visa, and Mastercard designed to identify, verify, and onboard AI agents consistently across card networks, digital wallets, and marketplaces.
KYA is explicitly modeled on Know-Your-Customer (KYC) obligations that banks already run for human account holders, extended to a non-human actor that can now initiate a payment. The framework aims to answer three questions before an agent is allowed to transact: which platform or company deployed this agent, what spending limits and merchant categories is it authorized for, and how can a receiving bank or merchant confirm the agent’s authorization has not been revoked or spoofed. Three of the largest players in global payments backing the same framework at the same time is a strong signal that card networks expect agent-initiated transactions to scale quickly enough that fragmented, network-by-network agent verification would become unworkable within a year or two.
Why Is Consumer Trust Still So Low?
New Visa research found that only 23% of US consumers trust generative AI to handle payment transactions on their behalf, even as AI-assisted shopping and product discovery adoption keeps climbing.
That gap between behavior and trust is the central tension finance and product teams are navigating right now. Consumers are comfortable letting an AI agent research, compare, and recommend, but handing over the actual payment step is a different psychological threshold — closer to handing someone a credit card than asking them for advice. Two things are likely driving the gap: consumers have limited visibility into what an agent is authorized to spend and on what, and there is no widely understood, bank-grade recourse process yet for an agent-initiated transaction gone wrong, comparable to a chargeback. Until frameworks like KYA translate into consumer-visible controls — spending caps a person can see and adjust, real-time transaction alerts, and a clear dispute path — trust is likely to keep lagging usage.
Why Is Funding Flowing Into Agentic GRC Platforms Right Now?
Agentic governance-risk-compliance platform HelmGuard raised $7.3 million in seed funding this week, using AI agents to automate governance, risk, and compliance monitoring inside regulated sectors including financial services.
The timing is not a coincidence. As agent-initiated payments move into production, compliance teams need tooling that can monitor agent behavior at the same speed the agents themselves operate — a rules engine or a quarterly audit cycle cannot catch a misbehaving agent that can execute thousands of transactions in an hour. Investors backing agentic GRC platforms are effectively betting that “AI to watch the AI” becomes a standard line item in compliance budgets over the next 12 to 24 months, in the same way fraud-detection software became a standard line item once card-not-present transactions scaled in the 2000s.
What Does This Mean for Finance and Treasury Teams?
Finance and treasury teams should treat agent-initiated payments as a new transaction category requiring its own authorization limits, monitoring, and reconciliation logic, rather than folding it into existing card-not-present or automated-payment policies.
Four practical steps are worth prioritizing now, ahead of broader adoption. First, define an explicit spending envelope for any AI agent a company authorizes to transact on its behalf — per-transaction cap, daily cap, and an approved merchant category list — the same discipline already applied to corporate card programs. Second, confirm with payment processors and card networks what agent-verification standard, such as KYA once finalized, they plan to support, since a business accepting agent-initiated payments will eventually need to distinguish a verified agent transaction from an unverified one at the point of sale. Third, build agent-specific fraud monitoring rather than assuming existing fraud models transfer cleanly, since an agent’s “normal” transaction pattern — rapid, narrow-purpose, time-triggered — looks anomalous under models trained on human purchasing behavior. Fourth, revisit dispute and chargeback procedures with the assumption that a customer may need to contest a transaction their own authorized agent initiated, which is a scenario most current dispute workflows were not built to handle.
What Changes for Accounting and Reconciliation?
Agent-initiated purchases complicate reconciliation because the transaction record no longer maps cleanly to a single human decision-maker, which is the assumption most expense and accounts-payable workflows are built on.
Finance teams running procurement or expense software should expect a near-term need to capture an additional data field alongside every transaction: which agent, under whose authorization, executed the purchase, and against which pre-approved policy. Without that field, an auditor reviewing a spend report a year from now has no way to distinguish a legitimate agent-initiated purchase from an anomaly, and internal controls built around “who approved this” break down when the answer is “an agent, acting on a standing policy” rather than a named employee. Finance software vendors serving mid-market and enterprise clients are the ones most likely to ship this capability first, since their customers face the compliance pressure earliest.
Key Takeaways on Agentic Payments
Is agentic payment technology now live for ordinary consumers? Partially — Blik’s transaction shows the capability is technically live on at least one major payment network, but broad consumer rollout is still gated by trust, regulatory clarity, and merchant readiness.
Does KYA replace existing KYC obligations for banks? No — KYA is designed to sit alongside KYC, adding a verification layer specifically for non-human agents acting on behalf of an already-verified human or business customer.
Are agentic payments currently regulated the same way as card payments? Not specifically — most jurisdictions are still applying existing card and payment-services rules to agent transactions rather than having agent-specific regulation in force.
Should a mid-size business start accepting agent-initiated payments now? Most payment and risk advisors recommend waiting for a published verification standard such as KYA to stabilize before actively marketing agent-payment acceptance, while still monitoring the space closely.
How Does This Fit Into the Broader Fintech Picture?
Agent-initiated payments are arriving alongside several other structural shifts in how money moves in 2026, and finance teams evaluating one typically need to evaluate all of them together.
Kurums.com’s guide to Embedded Finance Trends 2026 covers the broader restructuring of where and how payment functionality gets built into non-financial products, which is the same infrastructure layer agentic payments plug into. Businesses evaluating whether to hold reserves or settle in stablecoins alongside agent-payment rails should also see Stablecoins and Business Finance in 2026 for why adoption still trails infrastructure readiness — a dynamic that closely mirrors the consumer-trust gap in agentic payments. For the full range of banking, payments, and fintech regulation coverage, visit the Kurums.com Finance department hub.
Frequently Asked Questions About Agentic Payments
What is an agentic payment, exactly?
An agentic payment is a transaction initiated and completed by an AI agent acting under a standing authorization from a human or business, without a person approving that specific transaction at the moment it occurs.
How is this different from a recurring subscription payment?
A recurring payment executes a fixed amount on a fixed schedule that a person set in advance, while an agentic payment involves the agent making a real-time decision — what to buy, when, and sometimes from which merchant — within broader limits a person defined.
Who is liable if an AI agent makes an unauthorized or mistaken purchase?
Liability frameworks are still being worked out; card networks developing standards like KYA are expected to define clearer liability allocation between the agent platform, the card issuer, and the merchant over the next one to two years.
Can businesses block agentic payments from being used at checkout?
Yes, in most current implementations a merchant or payment processor can choose not to accept agent-initiated transactions, similar to how some merchants restrict certain card types today.
Is agentic GRC software only relevant to large financial institutions?
No — any business authorizing AI agents to transact on its behalf, including mid-size e-commerce and B2B companies, faces the same monitoring need, though enterprise financial institutions are adopting agentic GRC tooling fastest due to regulatory exposure.
Sources
Banking-as-a-Service Under the Microscope: What the 2026 Sponsor Bank Consent Orders Mean for Fintech Platforms
Regulators Are Naming the Bank, Not the Fintech
Kurums.com’s recent coverage of embedded finance’s regulatory reckoning outlined why sponsor banks and platforms both need to fix compliance gaps now. Two consent orders issued in the months since make the shape of that reckoning concrete: regulators are consistently naming the sponsor bank as the responsible party, even when the underlying failure originates in a fintech partner’s product or middleware.
Between 2022 and 2025, the FDIC, the Office of the Comptroller of the Currency, and the Federal Reserve issued consent orders against seven sponsor banks running Banking-as-a-Service programs. Two fresh cases in 2026 — Community Federal Savings Bank and Lineage Bank — confirm the pattern is accelerating rather than settling, and they carry specific lessons for every platform that depends on a sponsor-bank relationship to operate.
The OCC’s April 2026 consent order against Community Federal Savings Bank — an $866 million-asset, single-branch bank — cited BSA/AML failures tied directly to its rapid expansion into fintech-adjacent payment processing. Lineage Bank took a second FDIC consent order on June 24, 2026. In every case since 2022, the sponsor bank, not the fintech partner, is the named party, and regulators are now requiring independent testing and look-back reviews as standard remedies, not exceptional ones.
What Actually Happened at Community Federal Savings Bank?
The OCC made public an April 2026 consent order against Community Federal Savings Bank, a single-branch institution holding roughly $866 million in assets, over Bank Secrecy Act and anti-money-laundering failures tied directly to its rapid expansion into payment processing and fintech-adjacent business lines.
The core problem was a mismatch of scale: a small, single-branch bank took on the transaction-monitoring and customer-due-diligence burden of a national payments platform without proportionally scaling its BSA/AML infrastructure. That mismatch is common across the BaaS sector — sponsor banks are frequently small institutions chosen precisely because they are willing to move fast and share revenue with fintech partners, which is the same flexibility that leaves their compliance functions structurally under-resourced for the volume they end up processing.
Why Did Lineage Bank Receive a Second Consent Order?
Lineage Bank received a second FDIC consent order on June 24, 2026, indicating that remedial steps taken after its first enforcement action did not resolve the underlying compliance gaps regulators identified.
A second order is a materially different signal than a first one. It tells the market that a sponsor bank’s remediation plan — typically involving new compliance hires, updated policies, and third-party reviews — either wasn’t implemented with enough rigor or wasn’t sufficient to address the volume and complexity of the fintech programs running through it. For any platform whose sponsor bank has already taken one consent order, a second is now a realistic scenario to plan around, not a worst case to dismiss.
Who Is Actually Liable When a BaaS Program Fails Compliance?
The sponsor bank is named in every enforcement action to date, because regulators hold the chartered institution — not its fintech or middleware partners — ultimately responsible for Bank Secrecy Act, Know Your Customer, and consumer protection compliance across the program it sponsors.
This creates an asymmetry that catches fintech platforms off guard: the fintech designs the product experience and often builds the transaction-monitoring logic, but the bank absorbs the regulatory and reputational cost when that logic fails. Legal analysis of BaaS liability allocation increasingly frames this as a contractual gap rather than a regulatory one — indemnification clauses and audit rights in bank-fintech agreements often lag well behind the actual division of operational responsibility on the ground.
What Do Regulators Now Expect as Standard Remediation?
Regulators increasingly require an independent third-party risk management program with ongoing testing and look-back reviews as a standard consent-order remedy, not an unusual add-on reserved for the worst cases.
- Independent testing of BSA/AML controls, performed by a party with no role in building or operating the original program.
- Look-back reviews of historical transactions to identify suspicious activity that should have been flagged in real time but wasn’t.
- Formal third-party risk management programs that specifically govern the bank’s fintech relationships, not just its traditional vendor relationships.
- Documented escalation paths for when a fintech partner’s product changes in ways that affect the bank’s risk profile.
For platforms, this means sponsor banks are likely to push more compliance obligations — and more compliance cost — down to the fintech side of the relationship going forward, even absent a change in the underlying law.
How Should Fintech Platforms Assess Sponsor-Bank Risk Today?
Fintech platforms should treat their sponsor bank’s regulatory history as a direct operational risk to their own business continuity, since a bank losing its charter or exiting BaaS entirely can shut down a platform’s payment rails with little warning.
Public trackers such as sponsor-bank registers now catalog enforcement status and dates across roughly fifteen active US sponsor banks, giving platforms a way to benchmark their own bank’s regulatory standing against peers before signing a new agreement or renewing an existing one. Diversifying across more than one sponsor bank — long considered an operational nicety — is increasingly treated as a basic resilience requirement, comparable to how platforms already diversify payment processors.
What Should Platforms Negotiate Into Sponsor-Bank Agreements Now?
- Clear audit rights that let the platform see the bank’s BSA/AML testing results relevant to its own program, not just a summary attestation.
- Indemnification tied to actual operational responsibility, rather than boilerplate language that assumes the bank bears all regulatory risk regardless of who built the failing control.
- Advance notice provisions for any change in the bank’s enforcement status, so a platform isn’t blindsided by a public consent order affecting its own operations.
- A documented transition plan to a backup sponsor bank, tested before it is needed rather than improvised during a crisis.
How Does This Enforcement Pattern Compare to Earlier BaaS Cases?
The 2026 cases extend, rather than break from, a pattern established between 2022 and 2025, when the FDIC, OCC, and Federal Reserve issued consent orders against seven sponsor banks — but the remedies attached to the newer cases are noticeably more prescriptive than earlier ones.
Enforcement trackers covering the 2025–2026 period describe a marked shift toward more public and more specific consequences, including a Pennsylvania bank required to implement a third-party risk management program with independent testing and look-back reviews after being cited for unsafe BSA/AML practices. Earlier in the cycle, consent orders more often required general policy updates; the newer generation of orders names specific structural remedies — independent testing, documented look-back periods, formal third-party risk programs — that leave far less room for a bank to interpret compliance loosely.
What Does This Mean for Embedded Finance Growth Going Into 2027?
Tighter sponsor-bank oversight is likely to slow the pace of new BaaS launches without stopping embedded finance growth outright, since well-capitalized platforms with strong compliance functions can absorb the new diligence burden while thinner operators cannot.
The practical effect is consolidation. Sponsor banks facing regulatory pressure are becoming more selective about which fintech programs they onboard, favoring platforms that can demonstrate mature transaction-monitoring and KYC infrastructure of their own rather than depending entirely on the bank’s controls. For platforms currently shopping for a sponsor-bank relationship, this means slower onboarding timelines and more extensive due diligence than the market saw even two years ago — a cost that ultimately favors larger, better-capitalized embedded finance players over early-stage entrants.
Frequently Asked Questions
Can a fintech platform be directly fined in a BaaS enforcement action?
Direct fines have so far been issued against the sponsor bank, not the fintech partner, though the fintech can lose its banking relationship or face contractual liability under its agreement with the bank.
Why are small, single-branch banks common sponsor banks for large fintech platforms?
Smaller banks are often more willing to share revenue and move quickly on partnerships, but that same flexibility frequently means their compliance infrastructure is under-scaled for the transaction volume a national fintech program generates.
Why does a second consent order matter more than a first?
A second order signals that the bank’s initial remediation was insufficient, raising the likelihood of further restrictions, higher compliance costs, or an eventual exit from BaaS partnerships altogether.
Should platforms rely on a single sponsor bank?
Increasingly, no — diversifying across more than one sponsor bank is becoming standard practice to avoid a single enforcement action disrupting the platform’s payment operations entirely.
What Should Be on a Fintech Platform’s Compliance Checklist This Quarter?
Four concrete steps reduce a platform’s exposure to sudden sponsor-bank disruption without waiting for the next enforcement action to force the issue:
- Request the bank’s most recent exam findings summary, not just a compliance attestation letter, to gauge how close the relationship is to an enforcement event before it becomes public.
- Build transaction-monitoring capability that doesn’t depend entirely on the sponsor bank’s systems, so a bank-side control failure doesn’t automatically become the platform’s outage.
- Model the financial impact of a 90-day sponsor-bank transition, including customer communication and payment continuity, before it is needed under pressure.
- Track public consent-order trackers and sponsor-bank registers quarterly, treating a peer bank’s enforcement action as an early warning for shared risk factors across the sector.
None of these steps require waiting for new legislation. They reflect where regulators have already told the market they are looking, and platforms that act on that signal now will spend less time reacting to their sponsor bank’s next consent order than those that don’t.
Last Updated: August 29, 2026 · kurums.com Fintech Desk
Related reading: the 2026 fintech bank charter boom.


