Compliance Bottleneck for BaaS Growth
Cross River Bank
Compliance is becoming a real scale bottleneck in BaaS, not just a background cost. In this model, the bank is still legally responsible for what happens inside every fintech program, even when the customer only sees the app. That means growth adds engineers, auditors, case managers, monitoring systems, and approval steps alongside revenue, and regulators can slow expansion by requiring signoff before new partners or products go live.
-
Cross River already operates under that constraint. Its 2023 FDIC consent order required stronger fair lending controls and regulatory non objection before adding new credit products or fintech partners, which turns compliance work into a gating item for growth, not just an operating expense.
-
This is an industry pattern, not a one off. Evolve Bank & Trust received a Federal Reserve consent cease and desist order in June 2024, and regulators followed with joint guidance and an RFI on bank fintech arrangements that stressed banks cannot outsource legal responsibility to middleware or fintech partners.
-
The practical burden is visibility. In BaaS, many end customer accounts sit inside pooled FBO structures, so a bank can miss what is happening unless it has real time ledger data, case management, and rule based review. That is why tech forward banks like Cross River and Column carry heavier fixed costs, but also why they can win share as weaker compliance setups get squeezed out.
The next phase of BaaS will favor banks that treat compliance infrastructure like product infrastructure. Growth will concentrate in providers that can show regulators and fintechs the same live view of customers, transactions, exceptions, and approvals. That points toward fewer, larger, better tooled bank partners, with slower onboarding but more durable market share.