As financial services become increasingly digital, interconnected, and embedded into everyday platforms, the lines between banks, fintechs, and technology companies continue to blur. Banking-as-a-Service (BaaS) sits at the center of this transformation, enabling new business models while simultaneously raising critical questions about security, compliance, and consumer trust. Understanding how these systems work and the risks they introduce requires insight from professionals who operate at the intersection of finance, technology, and regulation.
In the following article, Michael William Brescia explores how regulations such as the European Union’s Payment Services Directive 2 (PSD2), along with broader domestic and international banking rules, influence how BaaS platforms are built, governed, and scaled.
Understanding PSD2 and Its Objectives
PSD2, enacted in 2018, represents a major update to the EU’s original Payment Services Directive. The directive was designed to enhance competition, security, and innovation in the payments space. Key objectives include:
Opening access to banking data: PSD2 mandates that banks provide licensed third-party providers (TPPs) access to customer account data, with the customer’s explicit consent.
Promoting competition: By enabling fintechs and other non-bank entities to offer payment and account-related services, PSD2 reduces the dominance of traditional banks.
Enhancing security: Strong Customer Authentication (SCA) and strict regulatory technical standards aim to reduce fraud and increase trust in digital payments.
For BaaS providers, PSD2 fundamentally changes the landscape by formalizing the legal framework for API-driven banking and embedded financial services.
PSD2’s Direct Effects on BaaS Adoption
Facilitating Open Banking
One of PSD2’s most significant impacts has been the promotion of open banking. By requiring banks to share account information and payment initiation capabilities with third parties, PSD2 has created a regulatory foundation for BaaS models. Fintech companies can now build products that leverage customer banking data without needing to become banks themselves, accelerating adoption and innovation.
For example, a fintech offering automated budgeting tools can integrate directly with multiple bank accounts to provide users with consolidated insights. Similarly, payment platforms can initiate transfers and manage accounts through standardized APIs, all under a legally compliant framework. Without PSD2, such integrations would have been technically and legally cumbersome.
Driving Innovation While Ensuring Customer Protection
PSD2’s focus on Strong Customer Authentication (SCA) and fraud prevention ensures that new BaaS offerings maintain high levels of security. While this initially introduced compliance complexity for fintechs, it ultimately fosters trust among users and regulators. A secure, standardized framework enables companies to adopt BaaS more confidently, knowing that regulatory compliance and consumer protection measures are embedded into the ecosystem.
Regulatory Challenges
While PSD2 creates opportunities, it also introduces compliance burdens that influence adoption. BaaS providers and their fintech clients must navigate multiple layers of regulatory oversight:
Data Privacy and Protection
PSD2 intersects with the General Data Protection Regulation (GDPR), adding complexity for companies handling customer data. Consent management, secure data storage, and transparent data usage policies are essential for compliance. Missteps can result in substantial fines and reputational damage, especially when customer financial information is involved.
Licensing and Liability
Although BaaS providers typically operate under a partner bank’s license, liability for certain operational and compliance failures may still rest with the provider. Regulatory scrutiny extends to areas such as transaction monitoring, AML/KYC processes, and reporting obligations. BaaS adoption is therefore contingent not just on technology integration but also on the ability to maintain rigorous compliance frameworks.
Cross-Border Considerations
For global BaaS expansion, providers must account for diverse regulatory regimes beyond PSD2. In the United States, for instance, fintech companies must navigate regulations from the Consumer Financial Protection Bureau (CFPB), the Office of the Comptroller of the Currency (OCC), and individual state banking regulators. Similarly, markets in Asia and Latin America have varying requirements for licensing, data localization, and consumer protection. Adapting BaaS offerings to multiple regulatory frameworks is a key determinant of adoption speed and success.
The Role of Other Key Regulations
Anti-Money Laundering (AML) and Know Your Customer (KYC) Laws
AML and KYC regulations are fundamental in preventing financial crimes. BaaS providers must implement robust processes to verify customer identities, monitor transactions for suspicious activity, and report violations. While these obligations can slow onboarding and increase operational costs, they also build credibility and trust with banks, regulators, and consumers – critical factors in driving adoption.
Consumer Protection and Payment Regulations
Regulations such as the EU’s Consumer Credit Directive and the U.S. Electronic Fund Transfer Act require transparency in fees, interest rates, and transaction disclosures. BaaS platforms must integrate these protections into their services, ensuring that end-users are fully informed and protected. Failure to do so can trigger legal action and erode confidence in the BaaS model.
Cybersecurity Standards
As BaaS relies on cloud infrastructure and APIs, regulators increasingly emphasize cybersecurity standards. For example, PSD2 requires banks and TPPs to implement secure communication protocols for payment initiation and data access. In the U.S., guidance from the Federal Financial Institutions Examination Council (FFIEC) sets expectations for secure banking infrastructure, risk assessment, and incident response. Meeting these standards is essential for BaaS adoption, especially among risk-conscious banks and enterprises.
How Regulations Shape Adoption Strategies
Partnerships With Licensed Banks
Because most BaaS platforms operate under a partner bank’s license, choosing the right banking partner is critical. Regulatory alignment, operational readiness, and compliance expertise influence adoption. Providers that partner with banks capable of meeting PSD2 and other regulatory requirements can scale faster and more confidently.
Investments in Compliance and Security
BaaS providers often invest heavily in compliance, AML/KYC automation, and cybersecurity solutions. While these investments increase operational costs, they reduce regulatory risk and enhance trust among clients and end-users. Providers that fail to prioritize these areas may struggle to gain adoption, particularly in regulated markets.
Innovation Within Regulatory Boundaries
Regulations like PSD2 encourage innovation by setting clear boundaries. BaaS providers can focus on developing user-friendly financial products and value-added services while adhering to legal standards. For example, fintechs can create budgeting tools, lending algorithms, or payment platforms that operate securely within the PSD2 framework, ensuring both compliance and competitive differentiation.
Future Outlook
PSD2 and similar regulations are not static; they evolve in response to technological change, market developments, and emerging risks. BaaS providers must stay ahead of updates to maintain compliance and capitalize on adoption opportunities. Some emerging trends include:
Expansion of open banking beyond Europe: Regulators in Asia, Latin America, and the U.S. are exploring open banking frameworks inspired by PSD2, creating new adoption opportunities for BaaS providers.
Increased focus on cybersecurity and fraud prevention: As digital financial services grow, regulators are emphasizing proactive risk management, making robust security a prerequisite for adoption.
Cross-border standardization: Harmonized regulatory standards could simplify BaaS adoption in multiple markets, reducing operational complexity and encouraging innovation.
By aligning operations with evolving regulatory expectations, BaaS providers can not only mitigate risk but also accelerate adoption, create trust, and position themselves as leaders in the embedded banking ecosystem.
Regulation as an Enabler, Not a Barrier
While regulations like PSD2, AML/KYC laws, and cybersecurity standards introduce complexity, they also serve as enablers of BaaS adoption. By creating a legal framework for open banking, establishing consumer protections, and mandating security standards, regulators provide the foundation upon which innovative BaaS models can scale safely.
Successful providers recognize that regulatory compliance is not merely a checkbox exercise, it is integral to their value proposition. Companies that invest in robust compliance programs, partner with capable banks, and integrate security and consumer protection into their platforms are better positioned to win client trust, expand adoption, and thrive in an increasingly regulated global financial landscape.
As BaaS continues to evolve, the interplay between regulation and innovation will shape the future of digital finance, demonstrating that careful adherence to legal frameworks can drive growth, security, and long-term market success.
