When you split a dinner bill through a payments app, take a “buy now, pay later” option at an online checkout, or open a savings pot inside a ride-hailing app, you may think you are dealing with a tech company. In many cases, though, there is a bank quietly doing the heavy lifting behind the scenes. You never see its logo. It is the plumbing in the walls of your financial life.
This arrangement has a name: Banking-as-a-Service, or BaaS. A recent research asks a question that bank boards everywhere should be pondering. When banks open up their core services to technology partners, do they gain more than they risk? Or does all that openness invite the regulators to come knocking?
From bank branch to banking plumbing
For most of history, banking was a face-to-face business. You walked into a branch, met a manager, and opened an account. Over the past decade, smartphones and e-commerce changed that. Customers increasingly expect financial services to appear wherever they already are, inside shopping apps, accounting software, or even video games. One study cited by the authors found that more than half of banking services were first developed by non-financial firms.
Banks have responded by changing roles. Rather than doing everything themselves, many now provide the behind-the-scenes infrastructure, such as accounts, payments, and lending, while financial technology firms, or FinTechs, build the slick customer-facing apps on top. The connection between the two happens through APIs, which are essentially digital sockets that let one piece of software plug into another.
You may have heard of Open Banking, the European rules that require banks to share customer data, with permission, with approved third parties. BaaS goes further. It does not just share data; it lets partners embed full banking capabilities into their own products. If Open Banking is like letting someone read your recipe book, BaaS is like letting them cook in your kitchen.
Money on the table, and trouble in the kitchen
The benefits can be considerable. The study notes that Bank of America saw a 51 percent increase in clients using its business API platform in 2024. Each new partner and each new service is potentially a new stream of revenue that a bank would never reach through its own branches and apps.
But inviting outsiders into your kitchen has risks. The authors highlight the case of Germany’s Solarisbank, a leading BaaS provider that achieved impressive growth but then attracted scrutiny from the German financial regulator, which found that it had failed to manage risks arising from its network of partners. When a FinTech partner mishandles customer data, fails to check customers’ identities properly, or launches a product that breaks the rules, it is often the bank, as the licensed institution, that ends up answering to regulators.
Running BaaS also requires banks to overhaul their technology, moving from old, monolithic core systems to flexible modular ones that can connect to many partners. That transition introduces its own security headaches. And managing dozens of partnerships with fast-moving startups, each with its own agenda, is no small task for organisations known more for caution than agility.
A transaction cost lens
To make sense of these tradeoffs, the authors draw on transaction cost economics, a classic theory that asks what it costs to coordinate work across organisational boundaries. Every partnership involves searching for partners, negotiating terms, monitoring behaviour, and fixing problems when things go wrong. The more partners and services a bank supports through BaaS, the more complex and costly this coordination becomes, and the more exposed the bank is to the possibility that something slips through the cracks.
From this, the authors develop a set of predictions. Supporting more business functions through BaaS, and signing up more FinTech partners, should increase a bank’s revenue opportunities and therefore its performance. But both should also make the bank more susceptible to regulatory risk. And greater regulatory risk, in turn, should drag performance down. In short, BaaS is a balancing act. The same expansion that drives growth also builds up risk, and the question is which force wins.
How the study plans to measure it
This is ongoing research, and the paper sets out how the authors will gather evidence. They plan to combine financial reports, regulatory filings, bank websites and developer portals, technology news, and reports from consulting firms and regulators such as the Federal Reserve and the FDIC. Bank performance will be measured through standard indicators such as return on assets and market value, along with how diversified a bank’s revenue is.
One of the most creative parts of the design is how they measure regulatory risk. The authors distinguish between two kinds of APIs. Regulatory APIs are the ones banks are required to provide under Open Banking rules, which mostly offer read-only information like ATM locations or branch details. Strategic APIs are the ones banks offer voluntarily, which allow partners to actually do things such as make payments or transfers. The share of strategic APIs in a bank’s total offering serves as a gauge of how far a bank has gone beyond the minimum, and therefore how much third-party activity and compliance exposure it carries. To fill gaps in public data, the authors also plan to interview bank technology and business professionals.
Why it matters beyond banking
The question at the heart of this study applies far beyond finance. Many industries are opening up their core capabilities to partners through APIs, from retailers to telecom companies to healthcare providers. Openness creates ecosystems, innovation, and revenue. It also spreads responsibility across organisations in ways that are hard to monitor.
For bank executives, the practical message is that BaaS strategy cannot be only about growth. It must be paired with strong monitoring of how partners use bank APIs, sound technology infrastructure, and careful alignment between the services offered and the bank’s ability to oversee them. Signing up partners is easy; keeping them in line is the real work.
For customers, the study is a reminder to look past the shiny app. Behind your favourite payments service there may be a bank you have never heard of, carrying the regulatory responsibility for your money. Its ability to manage that responsibility matters more than the colour of the app’s buttons.
Banking-as-a-Service may well be the future of finance. But as this research suggests, letting everyone cook in your kitchen only works if someone keeps an eye on the stove.
Reference
Dai, W., & Saldanha, T. (2025). Banking-as-a-service: Tradeoffs in regulatory risk and bank performance. In ICIS 2025 Proceedings (Paper 11). Association for Information Systems.
