Embedded finance: financial services inside platforms

You shop in a store’s app and get an offer to pay in installments with credit “from the store itself.” Or you open a digital account inside a ride-hailing app. To you, everything looks like a product of the brand on the screen. In most cases, it is not.

This arrangement has a name: embedded finance. It is the offer of financial services, such as accounts, payments and credit, inside a platform whose main business is not financial. Behind it there is usually a model called Banking as a Service (BaaS), in which a licensed institution provides the service and the platform manages the customer relationship.

This article explains how the model works, what the Brazilian rule in force since November 2025 requires and which risks regulators point out.

Who does what in a BaaS arrangement

The Basel Committee, the forum of banking supervisors hosted by the Bank for International Settlements (BIS), defines BaaS as the provision of banking services by banks through non-bank intermediaries that act as the customer interface (Digitalisation of finance report, May 2024).

The report describes three roles:

• The bank (or licensed institution). Holds deposits, processes payments and grants credit. It is the one with the license.
• The platform provider. A technology company that connects banks and intermediaries, usually through APIs (interfaces that let one system request data or operations from another). Some banks use their own infrastructure and skip this link.
• The non-bank intermediary. A fintech, retailer, marketplace or other company that faces the customer.

The economic logic, according to the Committee, is to combine strengths. The bank has infrastructure, know-how and licenses that are expensive to replicate. The intermediary has product, data and user experience. If it works, the customer can get better and cheaper services.

The report makes two caveats. BaaS did not yet represent a significant share of banking services, with variation across countries. And many banks focused on this model are relatively small, using partnerships to reach customers outside their region.

The Brazilian rule: Joint Resolution No. 16/2025

Until 2025, these partnerships were governed only by private contracts. In October 2024, the Central Bank of Brazil (BC) opened Public Consultation No. 108/2024 on the subject, citing as goals reducing risks for customers and clearly defining the responsibilities of the companies involved.

The result is Joint Resolution No. 16, issued by the National Monetary Council (CMN) and the BC on November 28, 2025. It took effect upon publication, on December 1, 2025. The main points follow; for legal decisions, read the full text.

The parties

The rule uses three terms:

• BaaS service provider institution: the institution authorized by the BC (a bank, payment institution or other) that provides the service;
• BaaS service taker entity: the company established in Brazil that offers the service to its customers, such as the retailer or the app;
• customer: you, who have a contract with the provider for the financial service and with the taker for the other services.

What can be BaaS

The scope is closed. A BaaS contract may only involve:

1. opening, maintaining and closing demand deposit, savings, prepaid or postpaid payment accounts;
2. payments made through these accounts;
3. merchant acquiring for payment acceptance (the card machine service);
4. credit operations, from offer to collection;
5. other services the BC may add.

Two requirements change the structure of many products. The account must be held in the customer’s name at the provider institution. And payments must leave from or arrive in that account. In other words, the money cannot sit in a pooled account in the platform’s name.

The rule also says what is not BaaS: banking correspondents in the country, cloud services, payment sub-acquirers and Open Finance partnerships, which follow their own rules.

Prohibitions

The provider institution may not, among other things:

• use the BaaS contract to have the taker act as a correspondent on its behalf;
• contract with a taker that already has a contract with another provider for the same type of account (demand deposit, savings, prepaid or postpaid), except within the same conglomerate;
• contract with a taker that uses terms typical of a financial institution in its name, such as “bank,” without being authorized by the BC.

Responsibilities and transparency

The provider is responsible for the reliability, security and confidentiality of the service. It owns the policy and controls for customer identification and risk profiling, fraud prevention and anti-money laundering. It is also responsible for handling customer requests, although it may use the taker for ancillary tasks or as a channel.

If the partnership ends, the contract between the companies must state whether the provider will keep serving you, the taker must explain the consequences and you may choose to end the relationship.

For you, the most visible point is Article 14. The provider must appear in an “accessible and visible” way in channels, contracts, documents and payment instruments, such as the card. Fees follow the same rules that apply to authorized institutions.

The provider must also list the takers with active contracts on its website and report them to the BC. This registration in the BC’s registry (Unicad) was detailed by BCB Normative Instruction No. 754/2026 and, after the deadline adjustment made by BCB Normative Instruction No. 776/2026, took effect on October 1, 2026.

Deadlines

According to the BC’s note, the rule applies immediately to new contracts. Existing contracts that are compatible with the regulated models have until December 31, 2026 to adjust. Until then, you may still find products in transition.

The risks regulators point out

The Basel Committee report lists risks for banks that enter these arrangements:

• Strategic: relying on the partner to originate business can take away the bank’s control over volume and product design, while it remains responsible for the risks. If the partner takes the customers away, the loss can be sudden.
• Reputational: problems at the partner, such as a data leak, fall on the bank, which is seen as the guardian of the money and data.
• “Step-in”: the bank may feel compelled to act to maintain the service or protect customers when the partner runs into trouble.
• Conduct: the report cites, among others, slow error resolution and misleading information about deposit insurance.

In the United States, the Federal Reserve, the FDIC and the OCC published a joint statement in July 2024 on such arrangements for deposit accounts. It highlights three points:

• the customer may not know that access to their money depends on a third party;
• US deposit insurance does not cover losses caused by that third party’s failure;
• if the bank has no access to the record of who owns how much, it is hard even to know how much it owes each customer.

The statement also notes that using third parties does not reduce the bank’s responsibility to comply with the law.

The Synapse case

The risk stopped being theoretical in the United States. Synapse Financial Technologies was a platform provider: software that bridged fintechs and partner banks. The Basel Committee report cites it as an example of this type of company.

According to the Consumer Financial Protection Bureau (CFPB) action, the federal financial consumer protection agency, Synapse failed to keep adequate records of where consumers’ money was. Its records did not match the banks’. When the accounts were reconciled, the banks held 60 to 90 million dollars less than Synapse’s records indicated. Consumers went weeks or months without access to their money, and many did not recover their full balance.

The CFPB filed the case on August 21, 2025, in the bankruptcy court handling the company’s restructuring, and the settlement was approved on September 12, 2025. It includes a ban on selling customer data and a symbolic fine of one dollar, which allows the agency to use its fund to compensate those harmed.

The lesson applies outside the US: in an arrangement with several links, the question “who holds the official record of my balance?” is the most important one. The Brazilian requirement of an individual account in the customer’s name at the licensed institution points in that direction.

How to evaluate a financial service inside an app

Before opening an account, keeping money or taking credit on a non-financial platform, it is worth checking a few points:

1. Who the provider institution is. The name should be in the app, the contract and on the card. If it is not, ask. Then confirm it is authorized by the BC.
2. Whose name the account is in. Under the rule, the account must be yours, at the provider institution.
3. Who handles complaints. Responsibility lies with the provider, even if service runs through the app.
4. Total cost of credit. “Easy” installments at checkout are still a credit operation, with interest and charges.
5. What happens if the partnership ends. The contract between the companies must state how you will be informed and what your options are.

Scammers also exploit the confusion between brand and institution. Be wary of “accounts” that ask for deposits in the name of an individual or of a company that is not the stated institution. The guide to digital financial scams shows how to react.

If your interest is the public infrastructure behind payments, see how Pix, Brazil’s instant payment system, works and the status of Drex, the BC’s project for tokenized assets.

Key takeaways

• Embedded finance is the customer experience; BaaS is the structure behind it. The financial service is provided by a licensed institution, not by the app’s brand.
• In Brazil, Joint Resolution No. 16/2025 closed the scope of BaaS, requires an account in the customer’s name and visible identification of the provider, and gives until December 31, 2026 for older contracts to adjust.
• The biggest risk is not knowing who holds the official record of your money. The Synapse case showed that, when records diverge, the customer can lose access to their balance.