Fintech Arbitrage Is a Business Model Until the Bank Asks for the Ledger.

One sentence in fintech deserves precisely the response owed to a colleague announcing that the month-end numbers are basically right.

Put down the coffee.

We are not a bank.

Sometimes this means the firm has taken no deposits, lends from no balance sheet of its own, and holds no banking licence.

Entirely fair.

More often it means the firm has discovered that deposits, payment access, credit capacity, identity checks, transaction monitoring, safeguarding, regulatory reporting and the unfortunate ritual of explaining a ledger to a supervisor can all be obtained from a bank, placed behind an agreeable interface, and described as infrastructure.

Seven bank functions can be outsourced: deposit holding, payment access, credit funding, customer identification, transaction monitoring, safeguarding, regulatory reporting.

Seven, and no eighth.

A program can distribute all of them elsewhere. It cannot make them cease to exist.

You can make them less visible, which is a distinct commercial achievement and, on certain afternoons, an administrative one.

The arrangement can be genuinely useful.

A non-bank can reach customers who would never visit a branch, build a better interface, remove a merchant’s friction, or make a narrow product economical.

The partner bank earns fees and acquires deposits, payments volume or a distribution route without personally designing every notification.

Consumers and merchants get cheaper distribution.

Investors get a story with a pleasingly low ratio of buildings to users.

Then the bank asks for the ledger.

At which point the question is no longer whether the app is innovative. It is whether the regulatory perimeter created a new service, or merely moved a bank control into a thinner operating wrapper and left the bank to rediscover it during an incident.

The Bank Did Not Leave. It Took the Back Stairs.

Start at account opening, because that is where the arrangement writes its future correspondence.

The branded service receives identity, contact and device information. The bank and the fintech decide who verifies it, screens it, stores it, refreshes it, and later explains it.

In a money-services-business relationship, FinCEN describes due diligence as customer identification, confirmation of registration and licensing where applicable, confirmation of agent status where applicable, and a risk assessment.

Not the part that appears in the launch film. The part that determines whether money may arrive at all.

The arrangement then needs four operational answers.

Who your customer is.

Who may give instructions.

Where the authoritative balance sits.

And who may block or close the relationship.

All four must remain answerable when the fintech system is unavailable. The API is down is not a legal category, however successful it may be as a conversational one.

The bank may open an account directly for the customer, or hold a pooled account whose end-user allocation is administered through the program.

Those are not cosmetic variants.

A depositor is a creditor of the bank. The deposit is a contractual claim, not a box containing the customer’s own notes.

So the app can be the relationship a customer knows, while the bank remains the counterparty whose balance sheet and payment access make the claim usable at par.

The U.S. statutory reserve ratio on net transaction accounts has been 0% since March 2020. That does not turn deposits into costless decoration.

Deposits still bring servicing, fraud protection, deposit-insurance assessments, infrastructure, marketing, and liquidity held against outflows.

A sponsor-bank fee is therefore not a toll collected at a quiet bridge. It is a contribution toward keeping a promise operationally credible.

The Unit Economics Arrive in Several Ledgers

The good fintech slide shows acquisition, engagement, interchange, and an arrow pointing upward.

The bank’s version contains funding, settlement, compliance, operating cost, credit and fraud losses, capital, and the prospect of a complaint whose explanation opens with the customer was confused about who held the account.

Both slides may be true.

They are not the same slide.

Take an ordinary inbound transfer.

A customer moves money from an external account. The external bank accepts an instruction, debits the customer, and sends value toward the partner bank.

The partner bank records receipt.

The fintech then credits either the named account or the customer’s allocation inside a pooled balance.

Pending, available and settled have to describe actual rights, not your product team’s preferred emotional weather.

At scale the rail is not a small thing. U.S. card networks processed 100.70 billion debit and general-use prepaid purchase transactions worth $4.658 trillion in 2023.

That scale does not excuse a small program from accounting properly. It explains why the network, the processor, the acquirer, the issuer-side program and the bank all insist on files, reference numbers, cut-offs and rules which look unromantic right up until the balance disagrees.

Consider a single online purchase.

The merchant sends an authorisation through its acquirer and the network. The issuer-side processor and the partner-bank program test credential, account status, amount, velocity, merchant category, available balance and fraud signals.

Approval places an authorisation hold.

It does not settle the purchase.

The merchant still submits for clearing.

The final amount can differ.

The hold can expire.

The authorisation can be reversed.

An interface that calls all of this paid has not simplified the event. It has made the future support call more literary.

Card-not-present transactions were 34.4% of U.S. debit and prepaid volume in 2023, at a higher average value than card-present purchases. These are not fraud thresholds and should never be treated as such.

They explain why authentication, limits and review may vary by channel. They also explain why an inexpensive-looking payment business eventually employs people who know the difference between authorisation evidence and proof of authorisation.

The reported average authorisation, clearing and settlement cost for covered U.S. debit issuers was $0.041 per transaction in 2023, excluding fraud losses.

That is not the all-in cost of any particular fintech. Processor fees, rewards, customer support, sponsor-bank sharing, fraud operations and compliance all sit above it.

The same distinction applies to interchange.

It is revenue inside an economic system that also contains network assessments, merchant service, restitution, technology, and somebody reconciling a file at an hour when even the risk committee has gone home.

The Ledger Is the Product When the Partnership Is Under Stress

A pooled program is an elegant bargain while every record agrees.

The bank sees the aggregate balance.

The program allocates it to customers.

The processor and network report transactions.

The app shows a human being what appears to be money.

It is the sort of architecture that looks simple only from sufficiently far away.

The daily control reconciles three positions: the bank’s aggregate balance, the sum of end-user allocations, and unsettled payment obligations.

Reconciling only two can conceal money held for an authorisation or awaiting a return. And an aggregate match can conceal one customer short by the exact amount another customer is long.

That is not a rounding inconvenience.

It is a claim to money without an agreed location.

For a debit purchase, preserve three linked identifiers: the customer-facing transaction ID, the authorisation or network reference, and the bank or processor posting reference.

The triangle identifies a completion, a duplicate authorisation, a released hold, a reversal, or a posting to the wrong customer. It also identifies which system made the decision, a fact that becomes unexpectedly fashionable the moment a downstream participant asks for evidence.

When the numbers diverge, the response is not to adjust the customer ledger until it looks calm.

Contain.

Preserve.

Identify.

Correct.

Communicate.

Stop further exposure where a bad balance can create loss.

Preserve the relevant ledgers and files.

Identify affected accounts.

Classify the difference as timing, data, fraud or actual loss.

Correct under controlled approval.

Tell customers what is restricted and when the next update comes.

The U.S. agencies set out the safety, compliance and consumer risks in third-party deposit arrangements in 2024, and the point is entirely prosaic.

A recurring reconciliation exception tells the sponsor it may not be able to control the program bearing its name.

The expensive question is not why a fintech had an incident.

Every operating system has incidents.

The expensive question is whether you can prove who was owed what while the incident is still running.

A Licence Can Be Partnered. A Remediation Duty Cannot Be Made Atmospheric.

The most seductive form of regulatory arbitrage is not evasion. It is division of labour with excellent typography.

The branded fintech receives the complaint.

The processor holds the message.

The program manager holds the allocation.

The bank retains the legal duty.

Each firm has a reasonable sentence about its own role.

The customer receives a relay race.

For a debit-card pass-through payment, the CFPB says the account-holding institution keeps full Regulation E error-resolution responsibility.

A U.S. institution reports investigation results within three business days of completing them and corrects a determined error within one. Those are not universal service promises; other limits and provisional-credit requirements can apply.

They are, however, a persuasive reason to record the notice date, channel, account holder, rule, customer narrative, authorisation data, device and login events, token or card data, transaction messages, prior contacts and recovery attempt.

The fintech should own the customer communication even where the bank makes the legal decision. A case number, a current status, the requested documents, a deadline and a reasoned result are not ornamental.

They are the part of the partnership a customer can actually observe. An opaque hand-off between brand and sponsor is a control failure wearing a pleasant support script.

The same holds at exit.

The interagency third-party framework puts termination inside relationship management.

A credible plan has two deliverables: a successor account or return route for every customer, and the complete records needed to calculate and support that move.

A termination clause that lets the bank end a contract but does not let a customer receive money is a very well-drafted way to begin a difficult week.

Who Got the Distribution

Consumers and merchants did, wherever distribution became cheaper, more reachable and less dependent on a branch network.

A specialised interface can make an account, a payment feature or a credit-adjacent service usable by a group that never wanted an appointment with a bank.

That benefit is real.

A better interface is not a crime, and neither is a bank letting somebody else build it.

Fintech investors did, through the relative economy of an operating model that need not hold deposits, maintain payment access, or fund credit from its own balance sheet.

The firm concentrates its capital on acquisition, product, support and systems. All the appeal of being invited to host the dinner without being asked to own the building.

Partner banks did too.

They earn program fees, obtain payments activity, and use distribution they did not build.

The arrangement can extend an existing banking capability into a product or an audience the bank would never have reached through ordinary channels.

Not evidence that banks are dupes.

Evidence that a bank can price access to its balance sheet, its licence and its rails.

Who Kept the Duty

The sponsor bank paid, in control functions.

Onboarding decisions.

Identity and monitoring arrangements.

Oversight.

Payment access.

Reconciliation.

Complaints.

Regulatory reporting.

Termination readiness.

A bank is not relieved of any of it because another firm owns the nicer interface. It has simply acquired another system whose records have to be explainable. Several systems, where the program has grown ambitious before lunch.

Customers paid whenever operational discontinuity made a balance unavailable although the funds remained at a regulated institution.

A processor, a ledger host, an identity vendor, a program manager or a partner-bank change can interrupt account opening, card authorisation, payment initiation, support, or access to records.

The danger grows sharply when one vendor controls the interface, the allocations, the credentials and the reconciliation files.

Money can be entirely present and still socially unavailable, which is rather the opposite of what a payment product is for.

Some customers also paid for ambiguity about protection. The FCA’s consumer comparison sets out four protection columns: e-money institution, authorised payment institution, small payment institution, and bank or building-society account.

Electronic-money and authorised-payment institutions must safeguard funds.

The bank-account category carries compensation-scheme protection.

Small payment institutions need not safeguard at all.

Protected is therefore not an answer unless it names the counterparty, the protection and the recovery route.

The historical consequences are not decorative either. The FCA reported average safeguarding shortfalls of 65% of customers’ funds in UK payment-firm insolvencies over a five-year period.

That is not an expected loss rate for any current provider. It is a lesson in why safeguarding and deposit insurance are not interchangeable nouns.

When a provider fails, the questions are which legal entity failed, where the money was held, and whose records establish the claim.

The firms doing compliance work without owning the customer interface paid as well. Operations, risk, treasury, financial-crime, complaints and reconciliation teams receive the consequences of product decisions taken elsewhere.

Not an injustice.

An allocation.

But a business model treating those functions as a residual cost centre eventually discovers that the residual has names, deadlines, and firm views about dual control.

So the honest retrospective is neither that fintech is banking in disguise nor that the bank is a dumb pipe.

Non-bank distribution creates real reach and useful competition. It also redistributes responsibility into a chain that only becomes visible when a payment is disputed, a ledger breaks, a sponsor exits, or a supervisor asks the sort of question that wants a full record rather than a charming answer.

When a product claims to be non-bank, find the bank function it still needs and price the accountability around it.