Banking as a Service is the model by which a licensed banking-infrastructure provider exposes core banking capabilities — accounts, cards, IBAN issuance, payments, KYC — through APIs, allowing non-bank companies to embed those capabilities in their own products without holding a banking licence themselves. This guide covers BaaS end-to-end: definition, history, architecture, regulation, market size and how to choose a provider.
Banking as a Service, abbreviated BaaS, is a delivery model in which a licensed banking institution or electronic-money institution exposes its core banking capabilities — account opening, ledger entries, IBAN issuance, payment initiation, card issuing, foreign exchange, KYC and AML controls — through programmable APIs. A non-bank partner — a fintech, a marketplace, a software platform, a corporate treasury team — consumes those APIs to embed banking features into its own product, branded under its own name, while the underlying licence, capital adequacy, regulatory reporting and money-handling responsibilities remain with the BaaS provider.
The term is sometimes used interchangeably with embedded finance, but the two are not the same. Embedded finance describes the user-facing outcome — financial features available inside a non-financial product. BaaS describes the infrastructure stack underneath. Every embedded-finance product is enabled by some form of BaaS.
Building banking infrastructure from scratch is structurally hard. A new bank needs a banking licence (years of applications and capital lock-up), a regulated technology stack with anti-money-laundering, sanctions screening and transaction monitoring, scheme certifications for cards, settlement accounts at central banks or correspondent partners, and ongoing prudential supervision. The total cost is generally measured in tens of millions of euros and a horizon of two to four years before a single customer is onboarded.
BaaS compresses that path. A fintech using a BaaS provider inherits the licence, the regulatory infrastructure and the scheme relationships of the provider. Time-to-market drops from years to weeks. The regulatory perimeter shrinks because the partner is a distribution channel rather than a deposit-taker. Operational risk concentrates in the provider, who runs it as core infrastructure rather than as a side concern.
A modern BaaS stack typically has the following layers:
A BaaS provider that ships only one or two of these layers is more accurately described as a payments processor or a card-issuing platform. A full BaaS provider — like Codego BaaS — owns the stack from licence to API.
A consumer-facing app that offers accounts, cards and payments without a banking licence. The neobank operates the brand, the customer experience and the product surface; the BaaS provider operates the licence, the ledger and the rails. Most modern neobank MVPs are built this way.
SaaS platforms — especially in HR, expense management, marketplaces, gig-economy payouts and SME accounting — embed accounts, cards and payments to capture transaction economics. The platform owns the workflow; BaaS provides the financial primitives.
Crypto-native products use BaaS providers to issue fiat IBANs, run settlement accounts for fiat deposits and withdrawals, and issue crypto-funded cards that spend stablecoins or on-chain assets on Visa and Mastercard rails.
Corporates with high transaction volumes, multiple subsidiaries or international payouts use BaaS for branded virtual IBANs, automated reconciliation, and programmatic card issuance for vendor payments and expense management.
BaaS sits inside an established regulatory framework, not outside it. In the European Union, the relevant regimes are PSD2 for payment services, the EMI Directive for electronic-money institutions, the Capital Requirements Directive for banking, AMLD for anti-money laundering, and increasingly the AI Act and DORA for operational resilience. In the United Kingdom, FCA authorisation governs payment institutions and electronic-money institutions; the Bank of England oversees banks. In the United States, the regulatory perimeter is more fragmented — federal banking regulators, state-level money transmitter licences and the OCC's special-purpose national bank charter all play a role.
For partners, the practical implication is that the BaaS provider's licence sets the perimeter of what the partner can and cannot do. A provider with an EMI licence can issue electronic money, accounts and cards but cannot lend on its balance sheet. A provider with a full banking licence can take deposits and lend. The choice of provider therefore shapes the product roadmap.
Six questions decide most BaaS evaluations:
Codego's full BaaS stack — EU IBAN, SEPA, SWIFT, multi-currency wallets, card issuing, BIN sponsorship and KYC, on one regulatory umbrella.
How fintechs issue Visa and Mastercard cards without holding principal membership.
Card issuing end-to-end: lifecycle, EMV, PCI DSS, integration patterns.
European banking rails, virtual IBANs and real-time API issuance.