Banking as a Service: who is behind your fintech app?

The app where your salary lands may not be a bank. Behind hundreds of European fintechs sits a company most users have never heard of, the one that actually holds the license, issues the IBAN and answers to the regulator. That layer has a name, Banking as a Service, and 2026 is the year it stopped being invisible.

What is Banking as a Service?

Banking as a Service (BaaS) is a model where a licensed financial institution rents out its regulatory permissions and technical plumbing, accounts, cards, payments, through an API, so that another company can offer those services under its own brand. The fintech builds the interface; the BaaS provider holds the authorization.

European law makes this split explicit. Two directives do the heavy lifting: the Payment Services Directive (PSD2), which lets a licensed payment institution operate through agents while remaining fully responsible for what they do, and the e-money directive, which created the electronic money institution, a license lighter than a full banking one, with an initial capital requirement of 350,000 euros, that authorizes issuing account balances and cards but not lending from deposits. A license obtained in one EU country can be “passported” across the whole Union, which is why one French or Luxembourgish provider can power apps in thirty countries.

Who are Treezor, Swan and Mangopay?

Three companies show three versions of the model. Treezor, registered in Paris in 2014 and licensed as an e-money institution by the French regulator ACPR in 2016, was the quiet engine behind the first wave of French fintech: Lydia, Qonto and Shine all launched on its rails. Qonto later outgrew it, obtaining its own payment institution license in 2018 and moving accounts onto its own systems, which is the occupational hazard of the whole model: the most successful clients eventually graduate. Société Générale bought it in a deal announced in 2018. It now claims more than 130 billion euros of processed flows and over 8 million cards issued. In January 2026, Société Générale entered exclusive negotiations to sell it to Shares, a fintech founded in 2021; as of this writing the deal has not closed.

Swan, founded in 2019 in the eFounders startup studio, is the API-first generation: software companies embed accounts, cards and IBANs directly into their product, so an accounting tool like Pennylane can hold money without ever showing the user a separate bank. It holds a French e-money license, has raised about 95 million euros, including a 42 million euro round in January 2025, and reports more than 1.5 billion euros in monthly transactions across 30 countries.

Mangopay, spun out of the gift-pot service Leetchi in 2013 and licensed in Luxembourg, specializes in marketplaces: it holds and routes money between buyers and sellers on platforms like Vinted, Leboncoin and Chrono24. Crédit Mutuel Arkéa bought it in 2015; the private equity firm Advent International took a majority stake in 2022, injecting 75 million euros of fresh capital.

Where is your money, actually?

Not on the fintech’s balance sheet, if the rules are followed. European law requires safeguarding: client funds must be kept separate from the provider’s own money, deposited in dedicated accounts or invested in low-risk assets, so they can be returned if the company fails. E-money balances are protected by this segregation mechanism, which is a different construction from the deposit guarantee that covers a classic bank account.

The fine print matters in one more way: eligibility. BaaS providers publish lists of businesses they will not serve, and they are long. Swan’s public documentation, for instance, excludes crypto exchanges and custody businesses along with gambling and several other sectors. Companies that move stablecoins typically reach bank details through a different route, specialized virtual-account providers, precisely because classic BaaS stays away.

What happens when a BaaS provider fails?

The last three years supplied real answers. In April 2024, France’s ACPR sanctions committee issued Treezor a reprimand and a 1 million euro fine over anti-money-laundering failures found in a 2021 inspection: risk profiles that classified 99% of clients as low-risk, weak transaction monitoring, and suspicious-activity reports filed late or not at all. The regulator noted the significant remediation Treezor had undertaken since.

Germany’s Solaris, once Europe’s BaaS flagship, spent years under reinforced supervision by the regulator BaFin, which appointed a special monitor and restricted new partnerships. In February 2025 an emergency 140 million euro round made Japan’s SBI Group its majority shareholder, and in June 2025 BaFin fined it again, 500,000 euros, for repeatedly exceeding large-exposure limits. In the UK, Railsr went through a rescue sale in March 2023. The pattern is consistent: the failure mode of BaaS is rarely a lost database, it is compliance debt coming due.

The US offers the starkest contrast. When the American middleware firm Synapse filed for bankruptcy in April 2024, more than 200 million dollars of end-customer funds were frozen, and the court-appointed trustee, a former FDIC chair, estimated a shortfall of 65 to 95 million dollars that may never be recovered. Europe’s safeguarding rules exist precisely to make that scenario harder, and the European failures so far have hurt investors and partners rather than stranding customer balances.

Where is the sector heading?

Two directions at once: consolidation and tighter rules. Every major European BaaS story of the past four years ends with a change of owner: Mangopay to private equity, Railsr to a rescue consortium, Solaris to SBI, Treezor in talks with Shares. Meanwhile the regulatory floor keeps rising. The EU’s Instant Payments Regulation made receiving instant euro transfers mandatory in January 2025 and sending them, with a free name-check on the recipient, in October 2025. Since October 2025, e-money and payment institutions that meet the conditions can also access the Eurosystem’s own payment systems, loosening their historical dependence on sponsor banks. A third payment services directive, PSD3, was politically agreed in November 2025 and is working through formal adoption, with application expected around 2028.

For users, the practical lesson is simpler and worth keeping: the brand on the app and the institution holding the money are often two different companies, and knowing who actually holds the license is the single most useful question you can ask of any finance app.

In embedded finance, the logo you see is rarely the company holding your money.

Sources

• EUR-Lex, Payment Services Directive (PSD2): safeguarding, agents and passporting.
• EUR-Lex, E-Money Directive (EMD2): the e-money institution license and fund protection.
• ACPR, sanctions committee decision on Treezor (April 2024).
• Shares, exclusive negotiations to acquire Treezor from Société Générale (January 29, 2026).
• Bpifrance, Swan’s 42 million euro Series B extension and business figures (January 30, 2025).
• Mangopay, Advent International majority investment (April 7, 2022).
• European Central Bank, Instant Payments Regulation deadlines and payment-system access.
• BaFin, fine against Solaris SE (June 13, 2025).
• CNBC, the Synapse bankruptcy and frozen customer funds (June 2024).
• Swan, public documentation on restricted activities.