Should BaaS still be outsourced?

This article first appeared in the May BAI Executive Report: Unlocking value through technology optimization. Find more articles within covering the tech decision-making spanning CX, fraud, core updates and more.

With recent regulatory scrutiny and customer losses surrounding Banking-as-a-Service (BaaS), is it still most efficient to outsource BaaS or foster this growth in-house?

It depends, experts say. But no matter which route banks ultimately take, one thing is certain: they need to take more control over the process.

Outsourcing BaaS is still the most efficient route, but not always the best route. It depends on a bank’s maturity, risk appetite and strategic priorities, says Elizabeth Gujral, a director at Cornerstone Advisors, headquartered in Scottsdale, Ariz.

“Efficiency” isn’t the only metric anymore, with the increased regulatory scrutiny, brand risk and operational complexity that come with BaaS and third-party partners, Gujral says.

“At the end of the day, the bank needs to lead the relationship and own the data,” she says. “Reconciliation and ledgering are no easy feats, but they should never be outsourced to a third party unless there is the utmost confidence in the relationship.”

When deciding which route to take, Gujral recommends that bankers ask themselves these questions:

• Can the bank’s systems support real-time payments, open APIs and partner integrations? If not, outsourcing might be a faster first step, but developing in-house does give the bank more control.
• Does the bank have the in-house expertise in engineering, compliance and API management to build and manage a BaaS offering?
• Can the bank prove to regulators that it understands and can control third-party risk?

The increasing scrutiny from regulators necessitates robust and transparent ledgering capabilities, making ownership and control even more important, Gujral says.

“The banks that lead the relationships, own their data and put risk and compliance first are not the ones making the news,” she says.

Even for banks that outsource BaaS because they do not have the resources to build capabilities in-house, the more they control the process, the better, says Richard Rosenthal, a principal with Deloitte & Touche LLP, based in New York City.

But what does that look like?

“In the historical setup, the fintech at the end of the day would send the total balance of customer money and reconcile with the bank,” Rosenthal says. “Now, more control could be first, understanding the actual customer balances within that total and really understanding who the fintech is facing. Who are their customers and what does that dynamic look like? A more proactive approach to risk management and financial control.”

Second, more control could be the bank directly interacting with customers without the fintech or other program managers, he says.

More banks are exploring BaaS as a business segment and are considering building in-house capabilities, Rosenthal says. Some are in it for more deposits, or they want to diversify—or they see an opportunity to do it better and safer. However, they are still going to outsource some technology and support functions, so it will be a hybrid approach for many.

“This business model requires a significant investment of infrastructure, it is an investment of people and it really takes a bank that is really committed to the business to be successful,” he says. “Because in many cases, these banks that are in the BaaS business have 400 fintech partners. That’s a lot, and a much different frame than most other banks.”

There’s always some level of outsourcing within the value chain, Rosenthal says, “but I do think banks are generally trying to look at, what’s their starting point?”

New York City–based BNY, which bills itself as “the bank of banks,” is enhancing its BaaS platform to provide its treasury services bank customers additional financial services technology and capabilities, says Carl Slabicki, executive platform owner, treasury services.

“It’s a mix of helping them offer a really great user experience, helping them compete on a great 24/7 instant service model with robust features and functionality, such as their ability to settle fast, their ability to transact to offer competitive pricing and so on and so forth,” Slabicki says. “So, it’s actually critical for us to lead with the resiliency of our infrastructure and the technology that we offer.”

BNY manages its own data centers, as well as the cybersecurity of its treasury services platforms, and it processes payments on behalf of its bank customers through its own API stack and capabilities, he says. However, for customers with niche processing needs, BNY will also partner with fintechs whose APIs can provide very custom workflows or user experiences, or workflow automation processes that can be bundled with BNY’s in-house capabilities.

“We are finding entities that are going to be our partners within the space, and we are taking a very diligent and intentional process to ensure that they are taking the same principles and standards around compliance, AML controls, KYC controls and resiliency oversight very seriously,” Slabicki says.

Moreover, BNY is now leveraging AI and machine learning to increase controls and oversight to get better transparency over the data and transactions that it processes on behalf of its bank customers, he says.

“I think it’s going to add a tremendous value to how we pattern recognition over transactions, how we do fraud anomaly protection, how we get better and faster at analyzing things like sanction sets, payment repairs for cross-border payments and payment routing for optimization of efficiency,” Slabicki says.

All of those capabilities not only move payments faster and more seamlessly; they also increase the safety and speed of executing controls and oversight, he says.

“This is really the core foundational piece of what we in the industry need to do to continue to raise the bar for keeping the space safe,” Slabicki says. “I think they’re very complimentary.”

At the other end of the spectrum, the $5.4 billion asset First International Bank & Trust (FIBT) based in Watford City, N.D., has built a BaaS platform in-house, Kavinu, and is now inviting fintechs to provide embedded financial services to more than two million consumers receiving payroll processed by the bank’s ACH processor, Kotapay.

FIBT’s chief payments officer Trent Sorbe wrote in an earlier Banking Strategies article that the time is right for BaaS 2.0—a new model without middleware designed for stability and security—so banks can take back the reins and move beyond the challenges of BaaS 1.0.

In this BaaS 2.0 model, the bank serves as the motherboard of the system, maintaining control of the ledger and the operational and technical switch, Sorbe wrote. Direct partnerships allow banks to appropriately serve as the hub for fintech relationships, fully controlling infrastructure and ensuring compliance at every step.

Restoring banks back to their central role can elevate the entire industry to a more developed financial ecosystem that balances innovation with stability to carve a sustainable path, he wrote. This approach strengthens everyone’s business model without sacrificing quality and risk controls or innovation.

Katie Kuehner-Hebert is a contributor to BAI.