Banking as a Service After the Consent Orders

Banking as a service spent several years as the quiet enabler of fintech. A chartered bank supplied the regulated rails, a technology platform supplied the software, and a fintech built a product on top without becoming a bank.

The structure worked commercially, but it spread the work of serving one customer across several companies, and that left a practical question at its center: when a program serving customers through three intermediaries fails, who is accountable? The BaaS consent orders, the enforcement actions federal regulators took against sponsor banks in 2024 over their fintech programs, made the regulators' answer plain: working through partners doesn't reduce the bank's responsibility. Several of those orders have since been lifted, and the answer hasn't changed.

Synapse answered it from the customer's side. The middleware company, which sat between fintech apps and their partner banks, filed for bankruptcy in April 2024. The Consumer Financial Protection Bureau later alleged that Synapse failed to keep adequate records of where consumers' money was and failed to make sure those records matched the banks'. The banks found a shortfall of $60 million to $90 million, and consumers were cut off from their money for weeks or months. The bankruptcy case was dismissed in November 2025, after the trustee reported there wasn't enough money to pay creditors and no buyer for the business.

Regulators answered it from the bank's side. In January 2024 the OCC replaced its 2022 formal agreement with Blue Ridge Bank with a consent order. The FDIC issued orders to several other sponsor banks that year. In June the Federal Reserve issued a cease-and-desist order against Evolve Bank & Trust, one of Synapse's partner banks; the Fed said its action was independent of Synapse's bankruptcy proceedings. In October the OCC entered a formal agreement with Axiom Bank. In between, in July 2024, the three federal bank regulators restated a principle already in their guidance: a bank's use of third parties "does not diminish its responsibility to comply with all applicable laws and regulations."

Key takeaways

• The 2024 orders against Blue Ridge Bank and Evolve Bank & Trust required regulators' sign-off before adding fintech partners or offering new products through existing ones, and the Blue Ridge, Evolve and Axiom Bank actions all addressed anti-money-laundering compliance.
• Several have ended: the OCC lifted Blue Ridge's consent order in November 2025 and Axiom's agreement in April 2026, and the FDIC lifted Thread Bank's in December 2025. As of early November 2026, the Federal Reserve hadn't announced an end to Evolve's order.
• The regulators' September 2026 proposal to replace their third-party guidance would soften the tone but keep the core: a bank's use of third parties "does not diminish its responsibility."

What did the BaaS consent orders require?

The BaaS consent orders are public, and to me they read like the start of a sponsor bank's diligence checklist.

Oversight of partners, down to the subpartner. Blue Ridge's order required a third-party risk program and defined third-party relationships to include the bank's "fintech partners and subpartners." Evolve's order required the bank to clearly define which ledger and sub-ledger responsibilities belong to the bank and which to its fintech partners, including in the event of a business disruption. That is the same question the CFPB later raised about Synapse's records.

Limits on new business. Blue Ridge could not onboard a new fintech partner, sign a new fintech contract or offer new products through existing partners without the OCC's written no-objection. Evolve needed its supervisors' prior written approval to add a fintech partner or offer new products to existing ones, on top of written approval from its own board.

Anti-money-laundering compliance. The OCC found that Blue Ridge's BSA/AML program had "systemic internal controls breakdowns," weak independent testing and insufficient staffing. Axiom's agreement addressed BSA/AML violations and required a third-party risk program covering its merchant processing and prepaid card partnerships. The Fed cited weaknesses in Evolve's anti-money-laundering, risk management and consumer compliance programs.

The orders cover more than this, and each was written for one bank. Still, in my view these three are where a sponsor bank's questions start, because they are what examiners pressed these banks on.

The market that resulted

The consent orders limited new business at the banks that received them. Other banks reconsidered banking as a service too: Five Star Bank said in September 2024 that it would wind its program down, citing evolving regulatory expectations and the investment it would need to reach scale.

In my view, compliance capability became a qualifying criterion. For communications, that means being ready to explain which compliance functions your company performs for the bank and who is responsible for them, in descriptions your bank and counsel have approved.

Concentration risk became visible. Blue Ridge wound down its banking-as-a-service business: by the end of 2024 it had exited 45 fintech deposit partnerships, and its deposits from those programs fell by $445 million. To me, having a plan for losing your bank went from prudent to expected.

Middleware came under the same question. Synapse showed what happens when nobody can say whose ledger is right.

Some banks left banking as a service, while others kept their fintech partnerships. The two OCC cases show both paths: Blue Ridge went back to community banking, while Axiom, when its agreement ended, said it would focus on "scaling our FinTech partnerships." As I see it, the market didn't disappear; it professionalized.

Where do the BaaS consent orders stand now?

Several of the 2024 BaaS enforcement orders have now been lifted. The OCC terminated Blue Ridge's consent order in November 2025, saying the bank's "safety and soundness" and its compliance with the law no longer required it. The FDIC terminated Thread Bank's 2024 consent order in December 2025, and the OCC ended Axiom's agreement in April 2026. The Federal Reserve has not announced an end to Evolve's order.

Enforcement hasn't stopped. In April 2026 the OCC put Community Federal Savings Bank under a consent order, finding that its controls hadn't kept pace with the growth of its payment processing business, which included cross-border activity.

The regulators have also proposed softer guidance. In September 2026 the bank regulators proposed replacing their 2023 third-party risk guidance, which they said "has been read to discourage arrangements with newer and innovative third parties," along with the 2024 bank-fintech statement. The proposal still says a bank's use of third parties "does not diminish its responsibility" to meet its obligations "to the same extent as if the activities were performed by the banking organization internally." The tone would change. Where the responsibility sits wouldn't.

How should a fintech talk about its sponsor bank?

A fintech should be ready to answer for its sponsor bank's regulatory record, for how much it depends on that bank, and for where customer money sits.

Know your bank's record before a reporter does. The OCC, FDIC and Federal Reserve publish their enforcement orders and the orders that end them. A reporter covering you can find out in minutes whether your sponsor is under an order, and when one was lifted. Have the facts and dates ready, and be able to describe the oversight structure. Companies that stay vague invite the assumption that there's a reason for the vagueness.

Treat your bank's status as a fact with an expiration date. The fact bank behind our own pitches works that way: each fact records where it came from and when it expires, and it's renewed only with fresh proof, never because it seems plausible. An order from 2024 may have ended, and one that's still open may end next month.

Have an answer about concentration. "Which bank, and what happens if that relationship ends" is a question investors and large partners ask. Not having a response is itself an answer.

Be exact about where the money sits. The regulators' 2024 statement warned that customers may not realize access to their funds can depend on the fintech, and that deposit insurance "does not protect against losses resulting from the failure of the third party." Synapse's customers, many of whom still hadn't received their full balances when the CFPB brought its case in 2025, are the case in point. Say which bank holds the funds, who keeps the records, and what the insurance does and doesn't cover, in wording your bank and counsel have approved.

Why I think it's a better market

Banking as a service supplies infrastructure to a regulated industry, and in my experience regulated industries eventually impose their standards on their suppliers. That happened here, and lifting the orders doesn't undo it.

My read is that companies that treated compliance as overhead had the harder time, and companies that built it into the product have something a competitor can't copy quickly. I think that's a better market for companies that take the work seriously than the one before it.

Common questions

What is banking as a service? An arrangement where a chartered bank provides regulated banking infrastructure, such as accounts, cards, payments and lending, that a non-bank company uses to offer financial products, usually through a technology platform in between.

What happened to Synapse? Synapse, a middleware company between fintech apps and their partner banks, filed for bankruptcy in April 2024. The CFPB alleged it failed to keep adequate records of where consumers' funds were, and the banks found a shortfall of $60 million to $90 million. The bankruptcy case was dismissed in November 2025.

What does it mean when a bank is under a consent order? The bank has agreed to an enforcement order from its regulator. In the OCC's orders against Blue Ridge Bank and Community Federal Savings Bank, the bank neither admits nor denies the findings. The order requires the bank to correct the problems it identifies, can limit new business, as Blue Ridge's did for new fintech partners, and stays in force until the regulator ends it in writing.

Are the BaaS consent orders still in effect? Some have ended. The OCC terminated Blue Ridge Bank's consent order in November 2025 and Axiom Bank's formal agreement in April 2026, and the FDIC terminated Thread Bank's consent order in December 2025. The Federal Reserve has not announced an end to its 2024 order against Evolve Bank & Trust.

Does the 2026 guidance proposal change who is responsible? No. The proposal would replace the 2023 third-party guidance and the 2024 bank-fintech statement, but it still says a bank's use of third parties does not diminish its responsibility to meet its obligations, to the same extent as if it did the work itself.

Should a fintech have more than one sponsor bank? It depends on the program. Blue Ridge Bank's 2024 consent order limited new products through its existing fintech partners, and the bank later exited its fintech deposit partnerships altogether. That shows the concentration risk, but it doesn't mean every fintech needs several banks. Be ready to explain how much you depend on your sponsor and what would happen if that relationship ended.

Sources

• Office of the Comptroller of the Currency, Consent Order, In the Matter of Blue Ridge Bank, N.A. (AA-ENF-2023-68), January 24, 2024
• Office of the Comptroller of the Currency, Order Terminating the Consent Order, Blue Ridge Bank, N.A. (AA-ENF-2025-58), November 13, 2025
• Board of Governors of the Federal Reserve System, Federal Reserve Board issues an enforcement action against Evolve Bancorp, Inc. and Evolve Bank & Trust, June 14, 2024, and the cease-and-desist order, June 11, 2024
• Office of the Comptroller of the Currency, Agreement by and between Axiom Bank, N.A. and the OCC (AA-SO-2024-83), October 3, 2024
• Office of the Comptroller of the Currency, Termination of the Agreement, Axiom Bank, N.A. (AA-SO-2026-26), April 29, 2026
• Federal Deposit Insurance Corporation, Order Terminating Consent Order, Thread Bank (FDIC-24-0022b), December 22, 2025
• Office of the Comptroller of the Currency, Consent Order, In the Matter of Community Federal Savings Bank (AA-ENF-2025-21), signed April 24, 2026, released in OCC Announces Enforcement Actions for May 2026, May 21, 2026
• Federal Reserve, FDIC and OCC, Joint Statement on Banks' Arrangements with Third Parties to Deliver Bank Deposit Products and Services, July 25, 2024
• OCC, Federal Reserve, FDIC and NCUA, Proposed Third-Party Risk Management Guidance, Federal Register, September 15, 2026
• Consumer Financial Protection Bureau, Synapse Financial Technologies, Inc., enforcement action, judgment entered September 12, 2025
• Gabrielle Saulsbery, Synapse bankruptcy case tossed, Banking Dive, November 14, 2025
• American Banker, Fed hits Synapse partner Evolve Bank with cease-and-desist order, June 14, 2024
• Banking Dive, A running list of BaaS banks hit with consent orders in 2024, December 18, 2024
• Dan Ennis, NY's Five Star Bank pivots away from BaaS, Banking Dive, September 20, 2024
• Blue Ridge Bankshares, Blue Ridge Bankshares, Inc. Announces 2024 Fourth Quarter and Full Year Results, PR Newswire, January 30, 2025
• Axiom Bank, Axiom Bank Resolves OCC Formal Agreement, Enters New Era of Strength and Strategic Growth, Business Wire, May 27, 2026

Salient PR works with fintech, payments and embedded finance companies. Regulatory details come from the agencies' own orders and statements, listed above. Nothing here is legal advice.