Most CEOs at mid-sized US banks will admit they do not fully control the technology behind their fintech partnerships. Yet when that technology fails, legal accountability sits squarely with them. The gap between operational control and liability is the real story behind fintech's supposed quiet takeover of banking infrastructure. It is also the most expensive lesson the sector has learned in recent years.
A Decade of Infrastructure Outsourcing, Exposed by a Single Collapse
Over the past decade, many banks lacking the appetite or capital to build digital products in-house turned to banking-as-a-service. The model is straightforward: a licensed bank provides the regulated infrastructure—deposit accounts, card issuance, payment rails—while middleware connects that infrastructure to fintech brands that do not need a banking charter. Non-financial companies now offer accounts, credit lines, and insurance by integrating an API, bypassing the multi-year process of becoming a bank. The embedded finance market has grown accordingly, with industry estimates placing it near US$150 billion in 2026 and on track to reach US$200 billion within the year. The banking-as-a-service layer alone is valued in the tens of billions and continues to expand.
For years, the growth looked like a clear fintech advantage: faster product launches, lower customer acquisition costs, and distribution banks could not match. That narrative changed in April 2024, when Synapse, a major banking-as-a-service middleware provider, collapsed into bankruptcy. The failure resulted from disputes between Synapse, its partner banks, and key fintech clients, made worse by mismatches between Synapse's internal ledgers and the funds actually held by banks. One partner bank demanded a large reserve and withheld payments, a major client withdrew deposits abruptly, and end-user funds went unreconciled. Tens of thousands of people lost access to their money. Synapse had connected about 100 fintechs to partner banks, serving nearly 10 million end users.
Who Actually Bears the Risk
The uncomfortable finding for bank leadership was not that a vendor failed. Vendors fail. It was who was left holding the liability once it did. Between 2022 and 2025, US banking regulators issued consent orders against multiple sponsor banks running these programs, and the pattern was consistent: regardless of what the partnership contract said about who owned compliance, it was the chartered bank, not the fintech partner, that faced the regulatory consequences.
This is the structural flaw CEOs cannot ignore. A bank can outsource the interface, onboarding, application, and even most of the engineering. It cannot outsource its charter. Regulators have made it clear they will not treat a technology partner as a shield. Recent enforcement actions confirm that outsourcing a function does not transfer accountability.
Regulators have moved to formalize what was previously ad hoc oversight. They are working with banking and fintech trade groups to establish a standard-setting body that certifies whether banks' technology partners meet federal risk-management expectations. This is a direct response to the gaps exposed by Synapse. Meanwhile, consumer protection authorities have spent more than a year distributing restitution to affected Synapse customers. When middleware fails, restoring customer funds becomes a slow, multi-agency process, not a simple write-off.
The Real Strategic Choice for Bank Leadership
This is where the quiet takeover narrative falls apart. Fintech has not captured banking infrastructure; it has rented access to it. The bank remains the entity regulators, courts, and class-action attorneys will hold responsible. That asymmetry is forcing executives to make a harder decision than most banking-as-a-service pitch decks ever acknowledged: build proprietary infrastructure and retain full control at higher capital cost, or continue partnering while investing in oversight, reconciliation, and real-time visibility into customer funds.
Practitioners who managed the Synapse fallout have reached similar conclusions. The banks and fintechs that emerged in better shape treated rigorous partner vetting and ongoing risk assessment as core business functions, not as friction to be minimized. That approach slows onboarding but reduces risk. Legal analysts have made the same point: what separates durable bank-fintech programs from failed ones is how seriously an institution approaches regulatory exams and record-keeping, not what the partnership contract says.
For bank CEOs considering fintech partnerships, the calculus in 2026 is not about speed to market. It is about who owns the ledger, who manages reconciliation, and who is accountable when a partner's technology fails. Institutions that treat these as governance questions from the outset are building durable partnerships. Those that treat them as afterthoughts are still answering to regulators.
Fintech did not seize banking infrastructure. It shifted the risk of running it. The cost is now clear for institutions that overlooked the fine print in their own charter.
The trade-off between owning infrastructure and partnering for it is not theoretical. It is a core strategic decision for bank leadership. The implications are operational, financial, and regulatory. Senior executives should be clear about where control ends and liability begins.
