When Fintech Meets Traditional Banking: Legal Lessons for Keeping Payments Moving

In 2024, a failure outside the banking system interrupted access to money held inside it. In the

background to its October 2024 custodial-recordkeeping proposal, the FDIC described Synapse

as a “middleware provider” connecting fintech applications with insured banks, reported its late-

April bankruptcy filing, and explained that consumers became unable to access funds after one

partner bank froze deposits. FDIC, Recordkeeping for Custodial Accounts, 89 FR 80135 (Oct. 2,

2024).

The FDIC reported difficulties obtaining and reconciling Synapse’s records and stated that none

of the banks in those arrangements had failed at that time. 89 FR 80135. The agency’s historical

account, not a claim about the bankruptcy’s present outcome, shows why a functioning app and

an insured banking partner are not enough. The practical lesson is to make data access,

reconciliation, and continuity part of the legal review, rather than treating them as matters to

resolve after a disruption. The cited document was a proposed rule; this article uses its factual

background, not its proposed requirements as binding law. 89 FR 80135.

Financial technology companies have transformed how businesses and consumers transfer funds,

manage accounts, and access financial services. A payment platform may allow merchants to

receive transactions from multiple countries, enable customers to transfer money within seconds,

or integrate financial services directly into an existing application. Yet the technology supporting

these products is only one component of their operation. Many fintech companies depend on

traditional banks to hold deposits, settle transactions, access payment networks, and provide

other regulated financial services. This article takes a U.S. legal perspective and offers practical

questions for fintech founders, payment executives, and their banking partners; it is not a survey

of every jurisdiction’s requirements.

That dependence creates a legal and commercial relationship that can become particularly

complicated when the fintech company and its banking partner operate under different regulatory

obligations, risk tolerances, and business objectives. A fintech company may prioritize

accessibility, transaction volume, and rapid expansion, while its banking partner must also

consider regulatory supervision, financial crime prevention, operational stability, and customer

protection. When these priorities are not addressed adequately, a profitable commercial

relationship can become vulnerable to disputes, service restrictions, or termination.

Map the Payment Flow Before Choosing a Regulatory Label

The legal issues begin with the structure of the proposed relationship. One company may provide

software that allows a merchant to initiate payments, while another may accept and transmit

customer funds or facilitate deposit products through a partner bank. Federal money-transmitter

status is expressly “a matter of facts and circumstances,” not simply a question of whether the

company calls itself a technology provider. 31 C.F.R. § 1010.100(ff)(5).

Federal rules define money transmission by reference to accepting currency, funds, or other

currency-substituting value from one person and transmitting it to another person or location, and

also cover “[a]ny other person engaged in the transfer of funds.” 31 C.F.R. § 1010.100(ff)(5)(i).

2. The exclusions are specific: a person that only provides delivery, communication, or network-

access services used by a money transmitter is excluded, as is a person that only acts as a

payment processor to facilitate a goods-or-services purchase or bill payment “through a

clearance and settlement system by agreement with the creditor or seller.” 31 C.F.R. §

1010.100(ff)(5)(ii). These are not blanket exemptions for every payment platform or every

company that outsources settlement. 31 C.F.R. § 1010.100(ff)(5).

Consider a hypothetical platform that collects customer payments and distributes funds to third

parties. Counsel should map who receives the funds, who controls payment instructions, whose

account holds the money, and what each intermediary actually does. A company that supplies

only the specified network services may fall outside the federal money-transmitter definition; a

company that itself accepts and transmits funds requires a different analysis. 31 C.F.R. §

1010.100(ff)(5). FinCEN registration is a separate question: covered money services businesses

generally must register “whether or not licensed ... by any State,” but a business that is an MSB

solely because it acts as another MSB’s agent is not required to register under that provision. 31

C.F.R. § 1022.380(a).

State licensing must be evaluated separately rather than assumed from the federal classification.

California, for example, prohibits money transmission and holding oneself out as providing it

unless the person is licensed, exempt, or an agent of a licensed or exempt person. Cal. Fin. Code

§ 2030. A bank partnership is not, by its label alone, one of those statutory alternatives; the

actual arrangement must support the claimed licensing or agency position. Cal. Fin. Code §

2030. Before launch or a material product change, build a jurisdiction-by-jurisdiction licensing

and exemption analysis instead of treating one federal registration or one banking relationship as

the entire answer.

Understand Why the Bank Keeps Asking Questions

Banking relationships introduce a second layer of responsibility. In June 2023, the Federal

Reserve, FDIC, and OCC issued final interagency third-party risk-management guidance

explaining that using third parties “does not diminish or remove banking organizations’

responsibilities” for safe, sound, and legally compliant activities. Interagency Guidance on

Third-Party Relationships: Risk Management, 88 FR 37920 (June 9, 2023). The guidance

supports due diligence and ongoing monitoring tailored to the risk and complexity of the

relationship, rather than an identical checklist for every fintech partner.

The guidance “does not have the force and effect of law and does not impose any new

requirements on banking organizations.” It is supervisory guidance for banks, not a new

licensing rule for fintech companies. Its due-diligence and monitoring framework nevertheless

helps explain why a bank may ask about a partner’s financial condition, controls, technology,

compliance capabilities, and subcontractors, and seek reporting, assessments, and access to

records. 88 FR 37920.

From the fintech company's perspective, those demands can appear burdensome, particularly

when the business is relatively new or attempting to scale rapidly. But the bank's regulatory

responsibilities explain why commercial discussions frequently extend beyond transaction fees

3. and expected revenue. A banking partner may need sufficient information to determine whether

the fintech company can perform its responsibilities consistently and whether the proposed

arrangement creates risks that the bank can adequately manage.

Build Compliance That Can Keep Up With Growth

Anti-money laundering compliance is particularly important. An MSB covered by the federal

rule must “develop, implement, and maintain an effective anti-money laundering program,”

reasonably designed to prevent use of its services for money laundering and terrorist financing.

31 C.F.R. § 1022.210(a). The program must be written and “commensurate with the risks” posed

by the business’s location, size, and the nature and volume of its financial services. 31 C.F.R. §

1022.210(b)–(c).

The mandatory minimums are policies, procedures, and internal controls; a person responsible

for day-to-day compliance; appropriate personnel education or training; and independent review

with a scope and frequency commensurate with risk. 31 C.F.R. § 1022.210(d). Independent

review need not always be outsourced: an officer or employee may perform it if that person is

not the designated compliance person. 31 C.F.R. § 1022.210(d)(4). Customer-identification,

reporting, and recordkeeping requirements must be incorporated “to the extent applicable” to the

MSB; the rule does not impose one universal identification procedure on every fintech customer.

31 C.F.R. § 1022.210(d)(1).

In a hypothetical cross-border expansion, a fintech company facilitating international merchant

payments may experience a substantial increase in transaction volume after entering a new

market. Although commercially successful, the expansion could change its financial crime

exposure and transaction-monitoring needs; the MSB’s program must remain “commensurate

with the risks” of its operations. 31 C.F.R. § 1022.210(b). The bank’s ongoing risk review may

also lead it to request additional controls or reconsider the arrangement. 88 FR 37920. The

precise availability of transaction restrictions, suspension, or remediation procedures should be

evaluated under the agreement and applicable law, not assumed from supervisory guidance

alone.

These circumstances demonstrate why compliance cannot be treated solely as a condition for

obtaining an initial banking relationship. The parties should establish procedures for reassessing

risks as the business changes, including when new products are introduced, transaction volumes

increase, or customers begin operating in additional jurisdictions. The contract should also

distinguish between matters requiring immediate corrective action and deficiencies that can

reasonably be addressed through a documented remediation process.

Negotiate for Disruption, Not Just Launch

Contractual terms become especially important when a bank identifies potential compliance

concerns. Banking agreements frequently address transaction limits, prohibited activities,

reporting obligations, audits, suspension rights, indemnification, and termination. A fintech

company reviewing such an agreement should consider not only whether the provisions are

commercially acceptable at signing, but also how they would operate during a regulatory

4. Investigation, technology failure, or disagreement concerning the company's compliance

practices.

A broadly drafted suspension provision, for example, may permit a banking partner to restrict

services when it identifies circumstances presenting regulatory or operational concerns. Some

immediate suspension rights may be necessary to address fraud, sanctions exposure, or other

significant risks. Nevertheless, the agreement should be reviewed to determine whether it

distinguishes urgent protective measures from ordinary contractual breaches and whether notice,

communication, and remediation procedures are available when appropriate.

Termination provisions deserve equally careful attention. A fintech company may depend on a

banking partner for functions that cannot be transferred immediately to another institution.

Losing that relationship could prevent customers from completing transactions, interrupt access

to funds, or require substantial modifications to the company's technology and operating

procedures. The commercial consequences may extend far beyond the fees payable under the

banking agreement.

A negotiated termination process can address advance notice where legally and operationally

feasible, customer communications, outstanding transaction settlement, access to necessary

records, and cooperation during migration. The parties should also determine which obligations

survive termination, including confidentiality, applicable record retention, dispute resolution, and

treatment of unsettled transactions. These provisions cannot guarantee uninterrupted services, but

they can reduce uncertainty when a relationship ends. The interagency guidance likewise

recommends considering orderly transition, data return, allocation of exit costs, and termination

when formally directed by the bank’s primary federal regulator. 88 FR 37920.

Treat Customer Records and Insurance Claims as Different Risks

The handling of customer funds presents another significant legal issue. Some arrangements use

a bank account held by an intermediary for customers whose interests are recorded in separate

ledgers. For deposit-insurance purposes, actual ownership and the account and supporting

records matter; an app’s displayed balance is not itself a coverage determination. 12 C.F.R. §

330.3; 12 C.F.R. § 330.5. The Synapse example illustrates a separate operational concern: access

to customer funds can be interrupted even when the bank itself has not failed. FDIC,

Recordkeeping for Custodial Accounts, 89 FR 80135 (Oct. 2, 2024).

For fiduciary-based coverage, the FDIC recognizes a claim “only if the relationship is expressly

disclosed” in the insured bank’s deposit-account records; ownership details must also be

ascertainable from those records or qualifying good-faith, regular-course records maintained by

the depositor or its recordkeeper. 12 C.F.R. § 330.5(b). Funds owned by principals and deposited

through an agent, custodian, or nominee are insured “to the same extent as if deposited in the

name of the principal(s),” subject to the applicable coverage conditions. 12 C.F.R. § 330.7(a).

Deposits held for the same owner in the same right and capacity at the same insured institution

are aggregated, not separately insured merely because different apps or accounts are used. 12

C.F.R. § 330.3(a).

5. Deposit insurance is not a guarantee against a fintech’s own failure. The nonbank disclosure rule

states that “FDIC insurance only covers the failure of the FDIC-insured depository institution.”

12 C.F.R. § 328.102(b)(5). A nonbank’s insurance-related marketing must clearly and

conspicuously disclose that it is not an insured bank and that insurance covers the insured bank’s

failure; representations that an advertised product is insured must also identify the bank or banks

into which deposits may be placed, and pass-through claims must disclose that conditions apply.

12 C.F.R. § 328.102(b)(5). Before publication or launch, review the actual app screens, account-

opening disclosures, and advertising, not just the bank agreement.

In a hypothetical pooled-account arrangement, the platform’s ledger identifies individual

customer balances while a partner bank holds the aggregate funds. If the platform, processing

intermediaries, and bank cannot reconcile their records, identifying what belongs to each

customer becomes an operational problem. As practical safeguards, agree on the frequency of

reconciliation, responsibility for correcting discrepancies, and access to a usable customer-level

ledger if an intermediary stops operating. Test the recovery process before it is needed. These are

operational recommendations, not a claim that the 2024 FDIC proposal made them universally

mandatory.

Separate Consumer Payments From Business Payments

Consumer protection requirements require a separate scope analysis. Regulation E’s account

definition focuses on accounts established “primarily for personal, family, or household

purposes.” 12 C.F.R. § 1005.2(b). Its general coverage addresses electronic transfers debiting or

crediting consumer accounts, not every business payment, and excludes certain transfers,

including Fedwire and similar wire-system transfers used primarily between financial institutions

or businesses. 12 C.F.R. § 1005.3(a), (c)(3). For covered errors, the rule generally requires

qualifying notice within 60 days after the institution sends the statement first reflecting the error

and prompt investigation, ordinarily within 10 business days; longer investigations depend on

provisional-credit conditions and stated exceptions, including special periods for certain new-

account, point-of-sale, and foreign-initiated transfers. 12 C.F.R. § 1005.11(b)–(c).

For a consumer product, determine which accounts and transfers are covered before assigning

complaint-handling tasks. The agreement should identify who receives notices, investigates

disputed transactions, funds any required provisional credit, and communicates results, with a

process designed around the applicable deadlines and exceptions. 12 C.F.R. § 1005.11. Do not

allow internal escalation between a fintech, processor, and bank to become the reason a

customer’s notice sits unanswered.

Recheck the Model Before Crossing Borders

As fintech companies expand internationally, counsel should revisit the fund-flow map for each

market: who is serving the sender and recipient, where funds are received and held, and which

local permissions and restrictions need review? Do not assume that a U.S. classification resolves

the foreign-law analysis. Even within U.S. law, consumer remittance transfers have a distinct

scope: the sender must be a consumer in a State acting primarily for personal, family, or

household purposes, and the provider must offer remittances in the normal course of business;

6. The definition includes exclusions and a safe harbor for persons making 500 or fewer remittances

in both the prior and current calendar years. 12 C.F.R. § 1005.30. That consumer framework

should not be presented as a blanket rule for cross-border B2B merchant payments.

Cross-border operations also require careful contractual planning. The parties should identify

responsibility for foreign exchange disclosures, settlement timing, rejected payments,

intermediary bank charges, transaction reversals, and compliance with applicable restrictions.

They should also consider which party bears losses when payments cannot be completed because

of sanctions screening, inaccurate beneficiary information, or changes in a participating

institution's requirements. These issues may be especially consequential when several banks or

payment service providers participate in a single transaction.

Disputes are more difficult to resolve when responsibility is fragmented among multiple

participants. A merchant may contract with a fintech platform, the platform may depend on a

payment processor, and the processor may rely on one or more banking institutions. When funds

are delayed or a transaction is rejected, each participant may have different information and

contractual obligations. A useful agreement should establish communication channels, escalation

procedures, documentation requirements, and an appropriate mechanism for determining

responsibility.

The negotiation of liability limitations and indemnification provisions is particularly important in

these arrangements. A provider may seek to limit its exposure to the fees received under the

agreement, while its counterparty may face substantially greater losses following a prolonged

interruption of payment services. The parties should evaluate how contractual limits interact with

confidentiality obligations, data incidents, regulatory violations, third-party claims, and failures

to perform essential services. The appropriate allocation depends on the services provided, each

party's ability to control the underlying risk, and the commercial terms of the relationship.

Fintech businesses should also consider concentration risk. Relying on a single banking partner

may simplify implementation and reduce immediate operating expenses, but it can create

significant vulnerability if that institution changes its compliance policies, restricts a product, or

withdraws from a business segment. Maintaining alternative arrangements may not always be

feasible, particularly where integration costs or regulatory requirements are substantial. Even

then, companies can evaluate contingency options, preserve necessary transaction records, and

establish contractual procedures that make a potential transition more manageable.

Five Questions to Ask Before Signing

The practical takeaway is to review the legal structure, the operating model, and the bank

agreement together. Before signing or expanding, ask five questions: Who is authorized to

perform each regulated activity? Who owns and can access the customer-level records? What

changes trigger renewed risk review? What happens if a payment or account is suspended? And

how will customers receive funds and information if a partner exits? A contract review that never

tests those questions against the actual payment flow leaves the most important dependencies

unexplored.

A sustainable fintech banking relationship ultimately requires a clear understanding of each

participant’s role, an appropriate compliance structure, reliable customer and transaction records,

and contractual provisions that address both ordinary operations and foreseeable disruptions. The

goal is not simply to get a product launched. It is to build a payment operation whose

responsibilities, records, and exit arrangements remain workable when something goes wrong.

For fintech teams preparing to launch or renegotiate a banking partnership, a focused review of

the fund-flow diagram, compliance responsibilities, and suspension and exit terms is a practical

place to start. This article is for general information, not legal advice; requirements depend on

the product, participants, jurisdictions, and facts.