In BaaS, delegating a compliance task does not transfer accountability. BaaS compliance requirements in the EU apply across a partnership: a bank provides the banking infrastructure, while a non-bank business may offer branded financial services to its customers. In bank-led arrangements, the licensed institution remains accountable for AML/CFT compliance, even when a fintech partner performs AML functions.

That division can be easy to blur in practice. The EU’s Anti-Money Laundering Regulation, Regulation (EU) 2024/1624, and Digital Operational Resilience Act, Regulation (EU) 2022/2554, set important requirements for financial-sector compliance and resilience; the EU’s GDPR also governs personal-data protection.

This guide explains what BaaS means and how to navigate the regulatory landscape without mistaking delegation for a transfer of responsibility. It covers the EU rules and regulators involved, the role of data protection, and how banks and fintech partners can define their compliance responsibilities.

Key Takeaways

• Map which regulators oversee the bank and fintech roles in your BaaS model, then connect oversight to clear controls and records.
• Understand how EU requirements for anti-money laundering, operational resilience and data protection shape BaaS arrangements.
• Set out each partner’s compliance responsibilities clearly; delegating operational tasks doesn’t necessarily transfer legal accountability.
• Explore how licensing depends on the activities and role in the arrangement, and where KYC and AML support from Gemba may fit. Written by Alexander Legoshin.

Table of Contents

• Which regulators are involved in overseeing BaaS compliance?
• EU regulatory obligations in BaaS arrangements
• Compliance responsibilities in BaaS partnerships
• Which EU banking, payment services, and e-money licenses are required for BaaS providers?
• Gemba: KYC & AML Compliance Management

Which regulators are involved in overseeing BaaS compliance?

EU BaaS oversight involves financial supervisors and regulated institutions, with responsibilities shaped by each partnership’s activities. AMLA supports consistent supervision, while DORA sets ICT risk management and third-party oversight requirements for EU financial entities. A non-bank may operate through a licensed bank or electronic money institution, but should assess whether its own activities require authorisation. Operational functions can be outsourced, but the regulated institution retains oversight responsibilities.

Third-Party and Outsourcing Oversight

Third-party oversight means assessing and monitoring vendors that perform outsourced services or support payment and financial services. It matters because a vendor’s failure can affect service delivery, compliance, and operational resilience. The EBA Guidelines on outsourcing arrangements are relevant to this oversight; on 08.06.2022, the ECB notified the EBA of compliance or intention to comply with them.

For each vendor relationship, document the service, responsibilities, information access, monitoring arrangements, and escalation process. DORA requires EU financial entities to oversee ICT third-party risks, so include technology dependencies in risk assessments and continuity planning. AMLA also supports more consistent AML supervision across the EU. These controls help supervisors understand how outsourced work is governed.

License Reliance and Outsourced Activities

A bank or electronic money institution’s licence can underpin a BaaS arrangement, but it does not automatically authorise every activity a fintech partner performs. The activities, contractual role, and regulatory status of each party determine what the partnership can deliver and which functions may be outsourced. A partner can perform operational tasks, while the regulated institution retains oversight.

Record which party performs customer checks, processes payments, manages technology, and escalates compliance concerns. The agreement should specify access to relevant records and how the institution monitors outsourced work. For fintechs using a partner’s licence, the distinction is essential: outsourcing tasks is not the same as transferring regulatory accountability.

Boards and senior management should oversee BaaS relationships through documented risk assessments, control reviews, and clear reporting lines. Enforcement actions from 2022 to 2024 focused on third-party risk, board oversight, governance, IT security, and business continuity. Alexander Legoshin is the author of this article.

EU regulatory obligations in BaaS arrangements

BaaS compliance requirements in the EU depend on the activities and roles within each arrangement. Licensing, customer funds, AML controls, data protection, and operational resilience all shape the model.

Banking, Payment, and E-Money Licensing

Authorisation determines which entities may provide banking, payment, or electronic-money services. EU BaaS providers commonly operate as banks or electronic money institutions; non-bank businesses may be licensed as payment or e-money institutions. Some participants act as payment agents or e-money distributors. An EMI licence covers electronic-money issuance and payment services, while a bank licence permits a broader range of financial services. The right route affects product design and compliance responsibilities.

Safeguarding and Segregating Customer Funds

Safeguarding protects customer funds held by payment and e-money institutions. Segregation keeps those funds distinguishable from the institution’s own money, and records should make customer balances identifiable and reconcilable. Clear records help partners account for funds across the service and understand how balances are treated. The specific safeguards depend on the institution and applicable requirements.

According to the European Union, Regulation (EU) 2024/1624 concerns preventing the use of the financial system for money laundering or terrorist financing. It addresses due diligence, beneficial ownership, ongoing monitoring, and outsourced work. The European Union’s Regulation (EU) 2022/2554, the Digital Operational Resilience Act, establishes digital operational resilience requirements for the financial sector. GDPR also governs personal-data protection. Together, these BaaS compliance requirements in the EU shape partner controls and product operations.

Enforcement actions involving BaaS relationships from 2022 to 2024 focused on AML/KYC controls, third-party risks, and governance. Institutions need practical evidence of monitoring, escalation, and control testing.

To launch a compliant product, define the activities, choose an authorisation route, and establish processes for customer funds, AML, data, and ICT. Costs depend on the product’s scope, licensing, technology, and ongoing compliance operations.

For infrastructure supporting payment products, consider embedded banking infrastructure as part of your delivery model.

Compliance responsibilities in BaaS partnerships

A BaaS partnership divides operational work between a licensed institution and its fintech partner, but delegation does not erase accountability. Under the EU Anti-Money Laundering Regulation, the licensed credit or financial institution remains fully responsible for AML/CFT compliance, even when a fintech performs AML functions. That makes a clear allocation of tasks essential.

The agreement should identify who owns each control and how the parties exchange information. For example, if the fintech collects customer details, the bank still needs access to relevant customer and transaction data to oversee the work. For each activity, define the responsible party, evidence retained, review frequency, and escalation route. Monitoring must continue in practice, not stop once the contract is signed.

• Customer due diligence: assign collection and verification of identification details, beneficial ownership information, and risk indicators.
• Transaction monitoring: specify who reviews alerts, investigates unusual activity, and escalates concerns for reporting.
• Data protection: document each party’s handling of personal data and oversight of outsourced processing.
• Customer communications: establish responsibility for clear, accurate information about fees, terms, and conditions.

The licensed institution’s oversight should include testing partner controls and addressing gaps. A fintech might handle customer onboarding, while the bank reviews samples, monitors exceptions, and checks that customer and transaction records remain accessible. If a payment process changes, reassess the associated risks and update control documentation. These steps make the operating model clear to decision-makers and supervisors.

Board oversight connects these procedures to governance. Senior leaders should receive reports on material risks, control failures, remediation, and business continuity. The partnership should also set out how incidents reach the right decision-makers and how corrective actions are tracked through to completion. Infrastructure can support shared delivery, but the arrangements must make clear which party performs, monitors, and remains accountable for each obligation.

Alexander Legoshin is the author of this article.

Which EU banking, payment services, and e-money licenses are required for BaaS providers?

The required authorisation depends on the financial activities each party performs, not simply on the BaaS label. A provider may be a bank or an electronic money institution, while a non-bank business may operate as a payment institution or e-money institution.

A bank licence supports a broader range of financial services. An electronic money institution licence authorises electronic-money issuance and payment services. This distinction matters when defining the product: the entity issuing electronic money, providing payment services, or supplying only technical infrastructure may each have a different regulatory role.

• Bank: may provide the wider range of financial services described in the licensing framework.
• Electronic money institution: may issue electronic money and provide payment services.
• Payment institution: may provide payment services within its authorised role.
• Agent or distributor: may participate in a BaaS arrangement under a bank or e-money institution.

Some fintechs operate as technical platforms or as payment initiation or account information service providers without handling money. A technical platform may rely on a bank in the background. This can shape the partnership model, but the label alone does not determine the permissions required.

Start by mapping the customer journey. Identify which entity provides the account, handles funds, issues electronic money, performs payment services, and delivers technology. Then align each activity with the relevant party’s authorisation and contractual role. If the fintech does more than provide technical support, its regulatory position may differ from that of a partner that only enables access to a bank’s services.

Choosing the right model also affects compliance ownership, customer disclosures, and operational design. A clear map of activities helps partners avoid treating a bank or EMI licence as blanket permission for every participant. For an embedded banking model, explore Gemba’s banking infrastructure as a way to support your product’s delivery.

Gemba: KYC & AML Compliance Management

Gemba’s KYC & AML Compliance Management helps businesses address customer verification and anti-money-laundering requirements when building branded financial services. It supports teams designing onboarding and compliance processes alongside a bank or other regulated partner. The service supports this work without transferring a regulated institution’s accountability for its obligations.

For businesses planning an embedded banking launch, Gemba also offers fast time to market embedded banking and a White-label Banking Interface. These offerings provide infrastructure for a branded service, with compliance responsibilities clearly allocated between partners.

Alexander Legoshin wrote this article. If you’re assessing KYC and AML needs for a BaaS arrangement, contact Gemba to discuss your project.

Build compliance into your next product decision

Your next decision is how to turn your operating model into a product customers can use with confidence. Build BaaS compliance requirements in the EU into the design from the outset, aligning the customer experience with your business priorities and long-term direction.

Gemba supports businesses planning branded financial services with banking infrastructure for non-banks. Its platform connects your product vision to a practical delivery model, while keeping accountability and customer trust central to the decisions ahead.

Move forward with a clear view of what your business wants to enable and the experience it intends to create. Thoughtful decisions now can lay a stronger foundation for your next stage of growth.

Discuss your BaaS plans with Gemba and take the next step with confidence.

Frequently Asked Questions

What is Banking as a Service (BaaS)?

Banking as a Service lets a non-bank offer branded financial services using infrastructure supplied by a regulated institution. For example, a business platform could present an account or payment feature within its own customer experience, while a financial institution supports the regulated service. The customer-facing brand and infrastructure provider may differ. BaaS describes a partnership model, not a single licence or universal operating structure.

What does Banking-as-a-Service (BaaS) mean in the EU, and which business models are covered?

In the EU, BaaS can describe bank-led partnerships, arrangements involving electronic money or payment institutions, and non-banks acting as agents or distributors. A business may also provide a technical platform without handling customer money, or operate as a payment initiation or account information service provider. The relevant model depends on what each party actually does, especially who provides payment services, handles funds, or issues electronic money.

What EBA rules and guidelines apply to outsourcing and third-party risk in BaaS arrangements?

The EBA Guidelines on outsourcing arrangements are relevant when a financial institution outsources functions to a BaaS partner. They help the institution assess and oversee outsourced arrangements. In practice, document the service, responsibilities, information access, monitoring, and escalation process. DORA also sets ICT risk management and third-party oversight requirements for EU financial entities, so technology dependencies belong in the institution’s risk oversight.

What are the EU AML/CFT, customer due diligence, sanctions screening, and transaction monitoring requirements for BaaS?

EU AML/CFT controls should address customer identity, beneficial ownership, risk, and activity over time. Customer due diligence may include verifying identification documents and source of funds, with enhanced checks for high-risk customers. Screening and monitoring should cover relevant sanctions lists and transactions, with processes to investigate alerts and escalate suspicious activity for reporting. The EU sanctions regime is relevant to BaaS providers and fintech businesses.

How do GDPR and EU data protection rules apply to BaaS customer data, processing, and international transfers?

GDPR is relevant when a BaaS arrangement processes personal data, so partners should map which customer information each party collects, accesses, and shares. That map helps clarify data flows across onboarding, account servicing, and payment operations. For transfers from the European Economic Area to jurisdictions outside it, appropriate safeguards, transfer impact assessments, and detailed transfer records are important parts of the arrangement.

What DORA requirements apply to BaaS providers and their financial institution partners, including incident reporting and resilience testing?

DORA, Regulation (EU) 2022/2554, establishes digital operational resilience requirements for the financial sector. EU financial entities need ICT risk management and oversight of third-party providers. In a BaaS relationship, partners should define how technology incidents are escalated, who communicates with the institution, and how service continuity is assessed. Resilience exercises can help test whether agreed response roles and recovery arrangements work in practice, while managed security specialists such as cyberone.security can help organisations maintain continuous threat monitoring and incident response readiness.

Frequently Asked Questions

What is Banking as a Service (BaaS)?

Banking as a Service lets a non-bank offer branded financial services using infrastructure supplied by a regulated institution. For example, a business platform could present an account or payment feature within its own customer experience, while a financial institution supports the regulated service. The customer-facing brand and infrastructure provider may differ. BaaS describes a partnership model, not a single licence or universal operating structure.

What does Banking-as-a-Service (BaaS) mean in the EU, and which business models are covered?

In the EU, BaaS can describe bank-led partnerships, arrangements involving electronic money or payment institutions, and non-banks acting as agents or distributors. A business may also provide a technical platform without handling customer money, or operate as a payment initiation or account information service provider. The relevant model depends on what each party actually does, especially who provides payment services, handles funds, or issues electronic money.

What EBA rules and guidelines apply to outsourcing and third-party risk in BaaS arrangements?

The EBA Guidelines on outsourcing arrangements are relevant when a financial institution outsources functions to a BaaS partner. They help the institution assess and oversee outsourced arrangements. In practice, document the service, responsibilities, information access, monitoring, and escalation process. DORA also sets ICT risk management and third-party oversight requirements for EU financial entities, so technology dependencies belong in the institution’s risk oversight.

What are the EU AML/CFT, customer due diligence, sanctions screening, and transaction monitoring requirements for BaaS?

EU AML/CFT controls should address customer identity, beneficial ownership, risk, and activity over time. Customer due diligence may include verifying identification documents and source of funds, with enhanced checks for high-risk customers. Screening and monitoring should cover relevant sanctions lists and transactions, with processes to investigate alerts and escalate suspicious activity for reporting. The EU sanctions regime is relevant to BaaS providers and fintech businesses.

How do GDPR and EU data protection rules apply to BaaS customer data, processing, and international transfers?

GDPR is relevant when a BaaS arrangement processes personal data, so partners should map which customer information each party collects, accesses, and shares. That map helps clarify data flows across onboarding, account servicing, and payment operations. For transfers from the European Economic Area to jurisdictions outside it, appropriate safeguards, transfer impact assessments, and detailed transfer records are important parts of the arrangement.

What DORA requirements apply to BaaS providers and their financial institution partners, including incident reporting and resilience testing?

DORA, Regulation (EU) 2022/2554, establishes digital operational resilience requirements for the financial sector. EU financial entities need ICT risk management and oversight of third-party providers. In a BaaS relationship, partners should define how technology incidents are escalated, who communicates with the institution, and how service continuity is assessed. Resilience exercises can help test whether agreed response roles and recovery arrangements work in practice.