How FDIC and Fed Consent Orders Reshaped BaaS Banking After Synapse

Synapse filed for Chapter 11 in April 2024, and by May, trustee Jelena McWilliams reported a $65 million to $96 million gap between the middleware's records and partner-bank records, per court filings reported by Banking Dive. Between January and June 2024, the FDIC and the Federal Reserve publicly acted against six BaaS banks.

Nuv Media publishes information, not financial advice.

What Actually Broke at Synapse?

The reconciliation between a middleware ledger and the bank of record stopped matching. Synapse, which sat between roughly 100 fintech programs and their partner banks, filed Chapter 11 in April 2024, and the Associated Press reported on May 22, 2024 that thousands of depositors had lost access to funds.

The exposure was wide even where balances were small. Synapse indirectly served about 10 million retail customers through fintech clients including Dave and Honey, per TechCrunch's November 2024 reconstruction, and Fortune reported about $200 million in customer money frozen at the peak. Yotta's CEO said in November 2024 that 13,725 former customers lost deposited funds outright.

The regulatory lesson was definitional. Synapse was not an insured depository institution, so FDIC insurance ran, if at all, through the partner banks' records. When the middleware's ledger disagreed with the banks', insurance determinations stalled in bankruptcy court instead of resolving at the teller line.

Which Banks Received Consent Orders in 2024?

Six institutions, across three regulators, with banking-as-a-service programs at the center of each action. The dates come from the agencies' published enforcement records and contemporaneous tracking by Banking Dive.

The wave was not only post-Synapse. Lineage's order took effect in January 2024, before the bankruptcy filing, and the FDIC had acted against Cross River Bank in 2023 over its fintech lending partnerships. Regulators were already pressing the same points Synapse later dramatized.

What Do the Orders Require?

Board accountability, documented partner risk assessment and transaction lookbacks. Thread Bank's May 21, 2024 order requires board-approved risk tolerance thresholds for each fintech partner and an exit plan covering even third-, fourth- and fifth-party providers, per the FDIC document.

The lookbacks reached back years. Piermont must review all transactions since September 2022 for unreported suspicious activity and Electronic Funds Transfer Act disputes since August 2020. Sutton must implement a revised AML program within 180 days and review prepaid card customers back to July 1, 2020 to confirm true identities. Lineage had 60 days to file a contingency plan for terminating significant fintech partners.

Piermont's CEO Wendy Cai-Lee summarized the industry position to American Banker at the time: every bank touching BaaS was receiving an enforcement action. The orders pin compliance responsibility on the chartered bank regardless of which vendor caused the breakdown.

What Does Federal Guidance Demand of Partner Banks Now?

Life-cycle oversight of every third party that performs or supports a bank function. The Fed, FDIC and OCC finalized interagency guidance on third-party risk management in June 2023, transmitted by FDIC FIL-29-2023, which covers due diligence, contract governance, ongoing monitoring and exit planning, including subcontractors of fintech partners.

The Federal Reserve's Evolve order shows how that guidance converts to enforcement. Announced June 14, 2024, it requires remediation of anti-money-laundering, risk-management and consumer-compliance deficiencies across Evolve's fintech programs, per the Fed's press release, and the agency noted the action was independent of Synapse's bankruptcy.

Supervision now asks a bank to prove three things it once delegated: that it can see end-customer balances in near real time, that its BSA program covers partners' customers, and that it can exit any program without depositor disruption. Consent orders in 2024 repeatedly ordered all three in writing.

What Changed Practically for Partner Banks?

Some left. Metropolitan Commercial Bank disclosed in February 2024 that it would exit its BaaS relationships, telling investors the exit reduces exposure to heightened and evolving regulatory standards. Five Star Bank announced in September 2024 that it would wind down its BaaS business the following year.

Those staying rebuilt contracts. Program agreements now commonly require daily reconciliation between the middleware ledger and the bank core, read access to underlying data, beneficial-owner records clean enough to support FDIC pass-through determinations, and funded operational exit plans. These terms answer the specific failures the trustee documented: stale ledgers, disputed balances and no tested unwind.

The economics shifted too. Compliance build-outs ordered in 2024, from AML staffing to board risk committees, raise the fixed cost of every program, which pushes banks toward fewer, larger fintech partners with auditable controls. As of March 2026, no federal rule specifically regulates BaaS middleware; the binding constraints remain the Bank Secrecy Act, third-party guidance and the consent orders already on file.

What Should a Bank Board Track Going Forward?

Three artifacts: the bank's own enforcement posture, each fintech partner's financial condition, and reconciliation evidence that survives audit. The Synapse record shows why. A shortfall reported at $65 million to $96 million by the trustee in May 2024 was still being disputed in court filings months later, while end users waited. Boards that cannot independently verify balances now carry the supervisory burden Synapse proved no middleware can be trusted to hold alone.