Embedded finance for vertical SaaS: models and risks

Embedded finance for vertical SaaS means an industry-specific software company, a restaurant point-of-sale system, a salon booking tool, a property-management platform, selling payments, accounts, cards or loans inside its own product while a bank, acquirer or licensed lender holds the regulated role. That line can be most of the revenue: Toast reported financial technology solutions of $1,570 million out of $1,908 million in the second quarter of 2026.

What vertical SaaS platforms add

The product list is short and it usually starts with the payment the software already touches: the restaurant check, the service invoice, the class booking, the rent payment. Accounts, cards and credit come later, underwritten on transaction data the platform already holds.

Toast processes payments for about 180,000 restaurant locations and reported gross payment volume of $60.7 billion in the quarter, up 22% year over year, in its second-quarter 2026 results. Next to processing it runs Toast Capital working-capital loans “issued by our bank partner” and repaid from daily transactions, plus a payroll card offered together with that bank partner, whose interchange the Durbin Amendment and Regulation II limit, according to Toast’s FY2025 10-K.

ServiceTitan, which sells to the trades and field services, routes payments and end-customer financing to third-party processors and earns fees from them. Phreesia, in healthcare, began with patient card payments and added financing fees after closing its acquisition of AccessOne on November 12, 2025; both now sit in one payment solutions line. AppFolio, in property management, sells online payments beside tenant screening and risk mitigation and reports the three together as Value Added Services. Mindbody, which serves fitness, salons and spas, is private and publishes no revenue figures.

For the definition and the wider product map, see what is embedded finance and b2b embedded finance. The card side is covered in debit card issuing, and consumer installment offers at the point of sale work the way a pos financing platform does.

What the public companies report

Each company draws the line in a different place, so these figures are not like-for-like and the order carries no meaning. Shares are arithmetic on the reported amounts.

A large revenue line is not a large profit line. Toast’s $1,570 million carried $1,211 million of cost, leaving $359 million of gross profit, $302 million of it from payments and $57 million from non-payment products. AppFolio records payments fees “gross of any interchange and payment processing related fees”, per its Q2 2026 Form 10-Q, which has the same effect on the top line.

Toast also treats payments as a recurring stream: a payments annualized recurring run-rate of $1,199 million at June 30, 2026, against $1,210 million for subscription, with Toast Capital excluded. On AppFolio’s second-quarter call the company said Value Added Services revenue “grew 22 percent year-over-year to $219 million dollars”, led by risk mitigation, screening and online payments. Shopify, not a vertical platform but a useful reference, reported Shopify Payments penetration of 68% of GMV, or $78.1 billion, in its second-quarter release.

Concentration comes with the partner model: fees from a single third-party processor were about 12% of ServiceTitan’s total revenue in the quarter ended April 30, 2026, per its Form 10-Q.

Three ways the same revenue line gets built

Registered payment facilitator. Toast is registered as a payment facilitator and master merchant under its acquiring processor agreements, which the 10-K says makes it liable for “chargebacks and other financial losses if such amounts cannot be recovered” from the customer. Phreesia processes patient card payments as a payment facilitator and acts as a gateway to other processors for the rest. Network registration rules and thresholds are in payfac vs payfac as a service.

Referral to a partner processor. ServiceTitan’s usage revenue is mainly fees from third-party processors for payments and consumer financing. In the filing’s words, “The third-party processor determines the eligibility of the end customer” and “is responsible for the provision of the payment or financing services”. Usage also covers other Pro products and Virtual Agents, so the line is not purely financial.

Platform payments on a provider. Mindbody built Mindbody Payments on Stripe Connect, and its support FAQ says the product is “powered by Stripe” while “Stripe does not support Mindbody customers”, so service stays with the platform. Mindbody publishes a per-transaction fee model with “no additional monthly fees, setup fees, or long-term contracts”, no rate, and says an in-house risk team handles fraud. The four-party mechanics and charge types are in embedded payments.

Build options for accounts, cards and lending

Order carries no meaning.

Unit’s two models differ mainly in who absorbs fraud. On Managed Solutions, “Unit underwrites and absorbs fraud losses directly”, and terms such as deposit rates, KYC rules and approval criteria are set by Unit with the bank rather than by the platform; Unit says a managed program is “designed to get you to market in three weeks or less”. Building on the platform gives better economics, and Unit’s guide states “You bear the risk per your agreement”.

Stripe splits the stack across products: Connect for payments, Stripe Treasury for platforms for accounts “eligible for FDIC insurance” with live use behind a form and a Stripe review, Issuing for cards, and Capital for financing, where “Stripe manages the underwriting and servicing” and a platform can onboard even when it processes elsewhere. Adyen for Platforms lists embedded issuing, interest-bearing business accounts and Adyen Capital “instant loans up to $100k”, and lets a platform outsource user risk management to Adyen. Parafin pays the platform “a share of the capital fee when a customer converts” and keeps underwriting, compliance, servicing and support. For the layer itself, see baas platform and BaaS vs banking as a platform.

Risks and obligations the platform takes on

Losses and reserves. On Stripe Connect either the platform or Stripe can be responsible for connected accounts’ negative balances; where the platform is, Stripe may hold reserves on the platform account and draws on them after 180 days of a negative balance. Stripe’s risk documentation adds that “Your platform is always responsible for its own negative balances.” Issuing supports only connected accounts where “your platform is responsible for requirements collection and loss liability”.

Credit. Lending against the platform’s own data reaches the balance sheet. Toast’s contingent liability for expected credit losses on loans it must buy from the originating bank was $53 million at June 30, 2026, up from $46 million at December 31, 2025, with $73 million of restricted cash held as collateral with that bank, per the Q2 2026 Form 10-Q.

Licences. Toast’s subsidiary Toast Processing Services is registered as an MSB with FinCEN and “is licensed as a money transmitter in most states” for payroll processing, and the 10-K notes that state loan brokering, loan servicing and debt collection laws may apply to services it provides for its bank partner.

Bank control. In Unit’s model banks contract with each platform directly, and “Banks must approve all partner marketing” as well as any change to program features or limits; banks can also freeze and close accounts. Unit’s own disclosure is that “Unit is a financial technology company and not a bank”. Enforcement against sponsor banks shapes those terms: see how to read a consent order and the sponsor bank enforcement actions tracker.

Deposit-insurance wording. FDIC Part 328 subpart B reaches any person, including nonbanks. The FDIC’s list of violations includes a nonbank implying it is insured, or making a deposit-insurance statement without saying that it is itself not insured and that insurance applies only if an insured bank fails, without naming the insured banks holding the funds, and without stating that conditions must be met for pass-through insurance. The amended digital-sign requirements were published in the Federal Register on January 29, 2026, took effect March 2, 2026 and must be complied with by April 1, 2027; the FDIC’s Q&A says display of the official digital sign by nonbank third parties is “generally improper”. Unit states that pass-through insurance applies only when its requirements are satisfied.

Supervisory attention. The Federal Reserve, FDIC and OCC issued a joint statement on July 25, 2024 on bank arrangements with third parties to deliver deposit products, “sometimes referred to as ‘banking-as-a-service’ or ‘embedded finance’”. It does not establish new supervisory expectations, and it says “the bank remains responsible for failure to comply with applicable requirements” even where a third party performs the function. The FDIC separately proposed a recordkeeping rule for custodial deposit accounts with transactional features on September 17, 2024, citing the Synapse bankruptcy; it is a proposal.

Program paperwork. Stripe Capital asks platforms to forward all Capital complaints to Stripe, keep marketing, customer and disclosure records “for at least 5 years”, follow CAN-SPAM and UDAP guidance, and renew written permission for testimonials every 24 months.

Questions to ask a provider

1. Who is the merchant of record, and who is registered with the networks as the payment facilitator?
2. Who carries negative balances and unrecovered chargebacks, and can the provider hold a reserve against our account?
3. Who is lender of record, who underwrites, and do we guarantee or repurchase anything?
4. Which bank approves our marketing and program changes, and can it freeze customer accounts?
5. What conditions must be met for pass-through deposit insurance, and how must the bank be named?
6. Which licences do we need ourselves, including money transmission and state loan-brokering rules?
7. Is the revenue share published? Unit, Parafin, Stripe and Adyen do not publish their rates.