Banking as a platform means a bank opens its own products and data to outside developers through APIs, or sells other firms’ products inside its own app, while keeping its brand and its customer. In banking as a service (BaaS), a licensed bank’s accounts and cards reach users under a non-bank’s brand. Neither label is defined in US rules: federal banking agencies say only that such arrangements are “sometimes referred to” as BaaS.
Banking as a platform vs BaaS at a glance
The rows describe published offers. The order carries no meaning.
| Question to ask | Banking as a platform | Banking as a service |
|---|---|---|
| Status of the term | Industry shorthand, no US legal definition found; Starling sells BaaS accounts under this label | Industry shorthand; the federal agencies say arrangements are “sometimes referred to” as BaaS |
| Brand the customer sees | The bank’s own app or developer portal | The non-bank’s brand |
| Who holds the customer | The bank; partners sell inside its channel or build on its APIs for its clients | The brand markets and distributes; the account sits at the bank |
| License | The bank’s own | The bank’s; the brand need not become a regulated entity |
| Compliance | The bank for its own products, partners for their own services | The bank stays responsible even when a third party does the work |
| Revenue, where published | Commission and referral fees from partners; core software licensed to other banks | Banks name revenue, deposits and reach as motives; splits with brands are not published |
| US data rule in play | CFPB Section 1033 rule, compliance dates stayed since October 2025 | Not BaaS-specific; the July 2024 interagency statement covers deposit arrangements |
Two industry terms, no legal definition
US bank regulators define neither model. In their joint statement on bank arrangements with third parties to deliver deposit products of July 25, 2024, the Federal Reserve, FDIC and OCC put the label in a footnote: such arrangements are “sometimes referred to” as banking-as-a-service or embedded finance, depending on the structure and the parties involved. The same statement says it “does not alter existing legal or regulatory requirements”, so the label decides nothing by itself.
Banks have used the terms differently for years. BBVA’s 2019 explainer says open banking, open APIs and BaaS are “not the same and definitely not interchangeable”: open banking gives third parties access to the data of existing bank customers, while BaaS gives third parties bank functionality so non-banks can serve users under their own brand. BBVA also noted that the US at that time had no regulatory open-banking initiative comparable to the UK’s or the EU’s.
Starling shows how little the label settles. Its “Banking as a platform” page sells “Banking-as-a-Service accounts” with “Your brand on GBP accounts”, which US usage would call BaaS. Four questions sort the models more reliably: whose brand, whose customer, whose license, and who books the revenue.
Banks that open their own APIs
DBS launched a banking API developer platform in Singapore on November 2, 2017 with 155 APIs across more than 20 categories, including funds transfers, rewards, PayLah! and real-time payments, aimed at other brands, corporates, fintechs and software developers. More than 50 companies joined at launch, among them AIG, McDonald’s, MSIG and PropertyGuru, and McDonald’s used PayLah! APIs for McDelivery. DBS called it the world’s largest such platform run by a bank, its own claim. Shee Tse Koon, DBS Group Head of Strategy and Planning and Head of Ecosystems, framed the launch as banking “with the customer at the heart of the banking experience”.
On October 28, 2024, Citi expanded its Developer Portal with file, API and pre-built connectivity so corporate, financial institution and commercial clients can reach products such as instant payments, virtual cards and real-time balances. Citi said its Services business passed 10 billion API calls on the CitiConnect platform that month since inception. The portal groups “Consumer APIs”, covering credit cards, deposits, lending and open banking, alongside institutional ones. Corporate integration of this kind is the subject of our guide to b2b embedded finance.
J.P. Morgan’s Payments Developer Portal publishes documentation, a sandbox and code samples so developers can build “without needing to establish a formal client relationship first”, with APIs grouped into accepting payments, managing funds, sending payments and account protection. Goldman Sachs Transaction Banking sells an API-first treasury platform with virtual account APIs, a rail-agnostic single payment API across ACH, wire and real-time rails, real-time ledger data and “40+ APIs” in its sandbox; the services come from Goldman Sachs Bank USA, a New York State chartered bank and FDIC member. In each case the user is the bank’s own client, onboarded by the bank.
Third-party products in the bank’s own channel
Starling’s Marketplace puts other firms’ products, among them Wealthify, Anorak, So-Sure, Habito and CreditLadder, inside the Starling app and connects them to the customer’s account through APIs. Starling says it receives commissions or a referral fee on some products, with “no impact on the cost to you”. Its help page adds that the commission is paid for every customer who purchases and that the fee varies between partners.
Citi describes its own marketplace as “similar to a banking app store for corporates” and claims the largest marketplace of direct connectivity to third-party applications, again the bank’s claim. The J.P. Morgan Payments Partner Network is a B2B marketplace built on Salesforce Commerce Cloud where J.P. Morgan clients find partners already integrated with J.P. Morgan Payments: treasury management systems, ERPs, POS hardware, gateways and accounts-payable automation. It launched as a beta, with no launch date shown on the page, and J.P. Morgan cites hundreds of third-party integrations and $9.6 trillion moved per day, from its own 2021 data.
Banking as a service: the bank behind another brand
On the BaaS side the customer-facing work moves out. The 2024 joint statement describes arrangements in which “a third party, rather than the bank, typically markets” and distributes the deposit product to the end user. Starling’s launch release is explicit about the consequence: brands build savings or current accounts and debit cards on Starling’s license, and because they use that license they need not become regulated, since “customers will be opening Starling accounts”. Raisin UK was the first partner at launch. Anne Boden called it “the next significant step in Starling’s banking as a service offering”. On its platform page Starling says it takes on “all the regulatory aspects, scheme compliance” plus anti-money-laundering and know-your-customer checks.
Apple Card’s Savings account is provided by Goldman Sachs Bank USA, Salt Lake City Branch, member FDIC. In January 2026 Apple and JPMorganChase announced that Chase will become the new issuer of Apple Card, with a transition expected in approximately 24 months, Mastercard staying as the network and the portfolio purchase estimated at over $20 billion of card balances, subject to regulatory approvals. The brand keeps the customer while the bank behind it changes.
J.P. Morgan sits between the two models with Embedded Payments: a platform’s clients receive Limited Demand Deposit Accounts “in their own name and Tax ID”, with the platform acting as their agent and J.P. Morgan running verification and due diligence through its Digital Onboarding API. Our guide to embedded payments covers that layer.
Some banks sell the program directly. Column describes itself as “the first nationally chartered bank created to serve developers and builders” and lets customers open FDIC-insured accounts at Column programmatically on behalf of their own customers. Cross River runs “a proprietary API-driven bank core” with built-in risk management and compliance infrastructure, routes across RTP, FedNow and its own CRNow, and offers BIN sponsorship and FDIC-insured account programs. Both appear in our comparison of BaaS platforms, next to the profile of Cross River Bank.
Whoever performs the work, the bank answers for it. The joint statement says “the bank remains responsible for failure to comply with applicable requirements” and names the middle layer it has in mind: intermediate platform providers, processors, middleware providers, aggregation layers and program managers. The agencies also list the motives banks bring to these deals, “to increase revenue, raise deposits, expand geographic reach”. Enforcement documents are where the responsibility becomes concrete; see how to read a consent order and the sponsor bank enforcement actions tracker.
Which banks publish which offer
The order carries no meaning. Pricing is not published by any bank below.
| Bank | Offer on its own site | Model | Who uses it |
|---|---|---|---|
| DBS | API developer platform, 155 APIs at launch in November 2017, 50+ companies | Open APIs | Brands, corporates, fintechs, developers |
| Citi | Developer Portal with file, API and pre-built integrations; corporate marketplace | Open APIs and marketplace | Corporate, FI and commercial clients |
| J.P. Morgan | Payments Developer Portal; Payments Partner Network; Embedded Payments limited accounts | Open APIs, marketplace and embedded accounts | Developers, clients, software platforms |
| Goldman Sachs | Transaction Banking APIs, 40+ in sandbox; bank behind Apple Card Savings | Open APIs and bank behind a brand | TxB clients; Apple customers |
| Starling | Marketplace on commission; BaaS accounts on its license; Engine software | All three | Its own customers, brands, other banks |
| Column, Cross River | Bank-owned developer APIs for fintech account and card programs | BaaS sold by the bank | Fintechs and platforms |
Open banking and Section 1033 in the US
The data-sharing side of platform banking rests on a rule that is currently on hold. The CFPB’s Personal Financial Data Rights rule under Section 1033 was published at 89 FR 90838 on November 18, 2024 and took effect January 17, 2025, requiring data providers to make covered data available to consumers and authorized third parties, with compliance phased from April 1, 2026 through April 1, 2030. On August 22, 2025 the CFPB issued an advance notice of proposed rulemaking to reconsider who may act as a consumer’s representative, fees, data security and data privacy. On October 29, 2025, the CFPB records, the compliance dates were stayed by the court in Forcht Bank, N.A., et al. v. Consumer Financial Protection Bureau, et al. in the Eastern District of Kentucky, so the April 1, 2026 date never took effect and no replacement date has been set. OIRA received a proposed rule titled “Personal Financial Data Rights Reconsideration” for review on August 4, 2026; its text is not public, and no proposal has been published. None of this is BaaS-specific.
Where the lines blur
Starling runs all three models at once: the Marketplace on the platform side, accounts on its license for other brands, and Engine, its core banking software sold to other banks. In its FY26 results for the year to March 31, 2026, published May 21, 2026, Starling said Engine grew revenue 25% as its client base doubled and has “secured £70 million of committed annual recurring revenue”, including a ten-year agreement with Tangerine, a Scotiabank subsidiary. Engine sells technology to licensed banks rather than a license to brands, and its site directs brands that want a UK BaaS solution to Starling’s B2B team.
J.P. Morgan covers the same range with a developer portal, a partner marketplace and embedded limited accounts. In a vendor conversation, ask the four questions rather than the label: whose brand the customer sees, whose license the account sits on, who performs each compliance function and who answers for it, and how money moves between the parties. The bank side of those questions runs through BaaS and sponsor banks and the BaaS guides.
