Ledger as a service is a double-entry ledger that a fintech or software platform rents through an API instead of building itself. It records every money movement as balanced debit and credit entries and keeps each customer’s balance. It does not replace the bank’s core: it is the program’s own subledger, and the sponsor bank relies on it to know whose money sits in a pooled account.
What a ledger as a service does
A bank’s core system keeps the bank’s accounts. Our guide to what is core banking covers it. A fintech program usually holds its customers’ money in one pooled for-benefit-of (FBO) account at the bank. The core then sees one large balance. Someone still has to know that $40 of it belongs to one user and $1,200 to another, and which card authorizations are holding part of it.
That record is the program ledger. Teams can build it on their own database, run an open-source ledger, or call a managed ledger API. “Ledger as a service” is the managed option. Modern Treasury, Fragment and Twisp sell one; Formance and TigerBeetle publish open-source software that teams run themselves.
The data model
The providers use different names for the same idea. Money moves only in transactions, and every transaction writes at least two entries whose debits and credits are equal.
| Provider | Objects, as its documentation names them | Rule it enforces |
|---|---|---|
| Modern Treasury Ledgers | Ledger, ledger accounts, ledger transactions, ledger entries; account categories group accounts | A ledger transaction has at least two entries, and its credit and debit entries “must sum to the same amount” |
| Twisp | Journals, accounts, entries, transactions, balances | “The only way to write to a ledger is through a transaction,” and each posting creates at least two entries |
| Formance Ledger | Accounts and multi-posting transactions, written in its Numscript language | Atomic transactions with several postings, stored in PostgreSQL |
| TigerBeetle | Accounts and transfers | A database built on debit/credit; transfers can be reserved first and resolved later |
| Fragment | A chart of accounts defined as a schema; ledger entries posted through a GraphQL API | Each entry type maps an event in the funds flow to balanced lines |
Modern Treasury notes that a ledger transaction writes to only one ledger, so moving value between two ledgers takes two transactions. It also supports currencies and currency-like values such as rewards points.
Pending, posted and available balances
Card programs and bank transfers do not settle at once. A ledger has to show money that is promised but not yet moved.
Modern Treasury defines three balances on each account. The posted balance is the sum of posted entries. The pending balance is the sum of pending and posted entries. The available balance is posted incoming entries minus pending and posted outgoing amounts. A card authorization therefore lowers the available balance before the transaction settles.
Twisp uses layers for the same job: a settled layer, a pending layer for holds and authorized transactions, and an encumbrance layer for expected or scheduled transactions. TigerBeetle calls it a two-phase transfer. A pending transfer reserves funds; it is then posted, voided or left to expire. A partial post moves part of the amount and returns the rest.
Why the sponsor bank cares about your ledger
FDIC pass-through insurance depends on records. Under 12 CFR 330.5(b)(2), when a bank’s account records show a fiduciary or custodial relationship, “the details of the relationship and the interests of other parties in the account must be ascertainable” either from the bank’s records or from records “maintained, in good faith and in the regular course of business” by the depositor or by “some person or entity that has undertaken to maintain such records.” For many fintech programs, that entity is the program ledger.
Cross River Bank’s documentation shows how a sponsor bank turns this into operating rules. When Cross River holds customer funds in an FBO account, it says partners “must make beneficial owner identity and ownership interests ascertainable for FDIC pass-through insurance.”
| Cross River model | Who holds funds | What the partner’s ledger must send |
|---|---|---|
| Card-only BIN sponsorship | Not Cross River | Daily transaction file; no balance sync, since no customer funds are held |
| FBO subledger | Cross River, pooled FBO account | Customer balances synced into the bank’s subledgers, plus a daily balance file and daily transaction file |
| FBO pooled account | Cross River, pooled FBO account | Daily balance file with individual customer balances, plus a daily transaction file |
In the subledger model, Cross River writes, the bank “becomes the system of record through these subledgers.” Each customer subledger that changed during the day posts one book transfer against an implicit subledger, which collects small timing differences as the program’s net position. The models are also described in our guide to bin sponsorship.
When a program ledger and the bank’s records disagree, end users can lose access to their money while the gap is worked out. The synapse bankruptcy shows what that looks like.
Managed API or open source
| Option | Examples | What you run |
|---|---|---|
| Managed ledger API | Modern Treasury Ledgers, Fragment, Twisp | Your integration; the provider runs the ledger. Twisp lets one account provision several accounting-core instances, each with one ledger |
| Open-source ledger | Formance Ledger (MIT license) | The ledger service and its PostgreSQL database; Formance supports production use through its Kubernetes operator, or as part of the Formance Platform |
| Open-source ledger database | TigerBeetle (Apache License 2.0) | A database cluster; your application defines accounts and transfers on top |
A ledger is also part of many card and BaaS platforms. Cross River’s partner-managed models assume the partner keeps its own ledger, while a platform that acts as program manager may keep it for you. Ask which party holds the ledger of record before signing; how to choose an issuer processor covers that question for card programs.
What to check before choosing
- Immutability and history. Modern Treasury documents how to read prior states of a ledger; Fragment’s API returns balance history by period. Ask how you would prove a customer’s balance on a past date.
- Idempotency. Fragment’s entry calls carry an idempotency key, so a retried request does not post twice. Ask every vendor how retries are handled.
- Concurrency. Modern Treasury exposes a lock version and balance conditions on entries, so two writes cannot overspend one account. Ask what happens when two authorizations hit the same balance at once.
- Holds. Check that pending, posted and available balances, or equivalent layers, exist natively.
- Bank files. Check that the ledger can produce the daily balance and transaction files your sponsor bank asks for, at the customer level.
- Reconciliation. Fragment publishes a guide to reconciling payments against the ledger. Ask how breaks between the ledger and bank statements are found and cleared.
For a bank changing its own core, read core banking migration. For how fintechs reach bank accounts and payments, see api banking.
