Banking as a Service

Hey friends -

Banks are changing. You can access your bank on your phone, it seems just about everyone these days offers a credit card, and the number of neobanks is too many to count.

All this change rests on a foundation of technology wrapped around a bank. Some banks are building the tech and others are buying it from specialized vendors.

Like the banks themselves, the vendor landscape is changing too. Established, 40-year-old tech companies like Jack Henry are moving to the cloud. Hungry startups like Thought Machine are built cloud native from day one. It means cloud is finally coming for the beating heart of how banks work, transforming one of the oldest, slowest, and most conservative industries around.

Welcome to Banking as a Service.

Why Banks are Changing

Compared to most other businesses, banks are really good at not failing. It's not just regulations. Core to a bank's value proposition is that they're conservative and they'll always be there.

Banks don't fail because we've structured them not to fail.

But that comes with tradeoffs. They're generally pretty terrible at activities where taking risks and rapidly innovating are keys to success. Just think about how consumer-facing software is designed. You create a minimum viable product that you release into the wild - bugs and all - to generate rapid feedback from initial users. You use that feedback to iterate on the features you offer and the user experience, and to squash those ever-present bugs. You might ship new updates many times a day.

All of it is a cultural mismatch for most banks. They're fundamentally designed to be slow and not change.

But consumers want both. They want a conservative, reliable institution keeping their money safe and a sexy, fast-moving startup to create a world-class user experience that's regularly updated with new features and products.

It's what banking as a service (BaaS) unlocks.

BaaS is far more than just a digital presence, it's a rethinking of how those partner startups and end users will consume the bank's services. They may not want everything a bank has to offer and they may want to stitch together a credit card from one with a savings account from another. BaaS decomposes the bank's monolithic offering into a set of discrete, individually consumable services, surfaced as APIs.

APIs are the channel for modern banks

APIs - application programming interfaces - are the channel for modern banks. It's how customers ultimately interact with the bank. ATMs, branches, mobile apps, and APIs.

An API is a well-understood, published set of rules that allow two computers to talk to one another with predictable results. If I'm building a product, I can create a publicly accessible API that allows anyone with the appropriate permissions to access my product. If I'm a bank and I want to allow a mobile banking application to determine the amounts in someone's checking account, I can create an API endpoint that surfaces just that information. When I publish, that endpoint, I'll include documentation that describes not only how to access it but also what information has to be submitted when requesting the checking account amounts and what information will be returned.

Instagram may be more familiar than banking for most.?The API documentation is publicly available. If I want to find out about a user, I submit a request with my access token and the fields I want to see. Instagram will return a list of those fields and their associated values.

In practice, it looks like this:

Request

curl -X GET \
'https://graph.instagram.com/17895695668004550?fields=id,media_type,media_url,username,timestamp&access_token=IGQVJ...'\        

Response

{
"id": "17895695668004550",
"media_type": "IMAGE",
"media_url": "https://fb-s-b-a.akamaihd.net/...",
"username": "jayposiris"
"timestamp": "2017-08-31T18:10:00+0000"
}        

It's fundamentally no different for a bank. APIs allow banks to externalize the core functions of the bank so startup partners can use them, both for themselves and on behalf of customers.

How Mode Eleven delivers its services.

There's as much art as there is science to designing and documenting good APIs. You have to deeply understand what your users will want to request, what you will want to make available to them, how they will expect it to be delivered, how to prevent malicious actors from gaining access, and how to ensure all requests and responses are secure and compliant.

It's a fundamental rethink of the user base.

Bank APIs are smaller, deeper, and consumed by a new user

Bank APIs are a different product than what was sold before. It's a new user who has a new consumption model with new requirements. It's rethinking how the bank's value proposition is consumed from the ground up.

Almost every consumption model before BaaS was a simple two-party relationship between the bank and the end customer-user.

Not all that different than any other brick-and-mortar business.

If you wanted, you could break the bank down into component parts, a stack of services that build on one another. It's?the vision that Angela Strange of Andreessen Horowitz painted?when she stated "every company will be a fintech company." If you layer in the new startup intermediary, you appear to have a brand new business model.

Looks intuitive but it’s wrong. Nobody buys “payments” or any of those other boxes.

But it's wrong. It doesn't go far enough. Fintechs don't build on "payments" or "core systems." They build on debit cards, ACH, wires, deposits, and every other narrowly defined bank service. Each one of those seven unbundled bank component parts is made up of many, many more small services. That's the level at which fintechs operate. That's the level at which the bank has to be opened up.

For the bank, it means going deeper. For something as seemingly straightforward as determining the amounts in a customer's checking account, an API has to support requests for the current amounts, past amounts, and perhaps even the line-item debits and credits. That has to be done alongside an authentication service that demonstrates the fintech is entitled to access the account. The queries and data have to be encrypted at rest and in transit.

And that's just a subset of what a checking account API needs. Scale that up to all of the deposit services, then all of the core system services, then all of the bank services. The scope of work explodes.

It's a hard problem. It requires both significant investment and specialized skills. But get it right and it can be wildly profitable.

BaaS unlocks new, highly profitable revenue for banks

The upside for banks that successfully implement banking as a service is immense. Many of the banks' equity and asset return profiles way outpace industry averages.

Successful enough a model that Cross River is venture capital backed (source).

It's not just the returns - many banks are getting access to customers they simply could not have reached otherwise. Most banks are located in small rural or suburban communities. BaaS opens the bank up to be consumed by startups around the country who have access to end users - individuals and businesses - that never would have engaged the bank on their own.

Coastal Bank is a great example. They're a local bank located just north of Seattle and, until recently, just serving the local community. They launched a BaaS division dubbed CCBX and signed their first customer in 2018. Check out this headline from their recent earnings release:

Deposit growth of $212.7 million, or 9.0%, to $2.58 billion for the three months ended March 31, 2022, compared to $2.36 billion at December 31, 2021. CCBX deposit growth of $183.2 million, or 25.6%.

It's wild! Successful banks are getting bigger AND with higher returns.

The challenge is how to open up the bank, rethink the technology, and make the services available as APIs. A multitude of different strategies have emerged.

Old, New, Big, Small - Everyone's Trying Something

There are two big strategies in BaaS - keep it in-house or outsource it.

“Fintech application layer” can be in-house or a separate company.

But that doesn't really tell the whole story. Keeping it in-house can mean building it yourself from the ground up or it can mean working with a core banking technology vendor. The banks and the vendors vary enormously, from decades-old established public companies to cloud-native startups.

Outsourcing can be more straightforward but introduces a new risk - you allow the vendor to disintermediate you. They now own the customer relationship.

New banks on the block keep it in house

New banks like Column and Mode Eleven keep the technology in-house. It's their competitive edge.

New, as-a-service-focused banks are typically revamped old banks. Federal bank charters are hard to come by, just 27 have been approved since 2017. Most "new" banks purchase an existing bank instead. Federal charters have many advantages, critically including access to Fedwire so you can transfer money with other banks.

While easier than launching a de novo bank, updating an existing bank is still a multi-year, 10's of millions of dollars affair. Column, for instance, acquired Northern California National Bank in 2019. They only just launched as "Column" a few months ago.

A typical structure is to create a bank holding company that in turn owns (at least) two separate legal entities - the regulated bank and the BaaS startup. Such a structure can solve multiple concerns for both regulator and bank. Firstly, it enables the bank holding company to isolate startup-specific risks like bankruptcy from the bank. Secondly, it allows the bank holding company to create two distinct cultures - the bank can continue to be conservative and slow to change while the BaaS startup moves faster with higher risk.

The products fintechs can offer can be just awesome. Column makes Fedwire fully available to partners. They can transfer funds between any bank account and process both domestic and international wires instantly, 22 hours a day, 6 days a week. The only constraint is the hours that the Federal Reserve is open.

From Column’s wire service (source).

If you're not in the banking world, this may sound ordinary - TikTok's available all the time after all. In the banking world, it's a completely wild idea. Sending wires without talking to a banker, at all hours of the day, even on a weekend?! Blasphemy!

Mode Eleven is awaiting regulatory guidance to offer digital asset solutions including trust, custody, and payments. Stablecoins like USDC and USDP can move instantly, freeing up huge amounts of trapped capital for enterprises managing money across multiple accounts. It can mean loans that are funded near-instantly, speed and control around the money that can make all the difference when closing a deal with a customer.

Building these services is hard. Not only do you need a team with the full complement of software engineering skills, but you also need product managers and designers who can engage with fintechs and end customer-users to deeply understand their needs. That then has to get translated at least twice - once so the software engineering team can build and again so compliance can evaluate and protect. Once the services are live, you need entire organizations that can support live customers and monitor the ongoing usage.

A few small, existing banks like Coastal Community Bank have successfully built teams with these skills. But they're the exception rather than the rule. Most small banks work with vendors instead.

Established small banks work with third-party vendors for BaaS

Small banks already have existing core banking technology from an established vendor. It's a mature market that's consolidated over the years. Fiserv, FIS, Jack Henry, and the recently rebranded Finastra (private equity-backed merger of Misys and D+H) control almost the entire US market. There are only one or two more major vendors as you go global.

Most of these vendors are sitting fat and happy. There's little incentive to make the significant investments required to decompose these monolithic services into component parts, shift them to the cloud, and offer them as APIs. Core banking technology is extraordinarily sticky. Switching vendors is a high-risk, multiyear, many millions of dollars transformation. Much of their customer base isn't pushing them to do so either - just 47% of small banks have even begun their transition to cloud.

That's created three openings in the market:

• Existing core banking vendors who will invest in cloud,
• Startups that integrate with and build on top of core banking, and
• Cloud-native core banking startups.

Jack Henry and Finastra are smaller than FIS and Fiserv, and are looking to cloud-native core banking as their wedge to gain market share. We're well beyond talk, both are investing huge sums to transform their existing product suite.

Jack Henry in particular has been aggressively transforming its existing product suite into a cloud-native core banking platform that forms the basis of a holistic BaaS offering. It's a transformation led by David Foss, the company's Chairman and CEO. Don't let his 23-year tenure at the company fool you - he was a computer science undergraduate in the '80s and started out as a programmer. This is someone who deeply understands tech.

Listen to how he talks?about the transformation he's leading at Jack Henry:

We’re unbundling all those components in the core. We’re making them standalone features that sit on the public cloud on this platform. We’re giving the bank the flexibility to couple our components with components that they might get from a fintech to create that differentiated experience, create that differentiated story for their customers.?

[A customer will] be able to decide, pick and choose which pieces they want, and then put them together in their own bundles. And so certainly you have to price by the component as opposed to today, where you buy this monolithic core... The idea is not to try and charge for every single time that a transaction flows back and forth between the fintech. That’s not philosophically who we are. It’s not the way we do business. We will certainly charge for that connection from a customer, but it is not our intent to charge for every single transaction that flows across that platform to and from a fintech.

That's not the strategy you expect to hear from your 45-year-old core banking provider. It's an enormous shift.

Where you do hear this type of strategy is from startups integrating with core banking providers and those cloud-native core banking startups. Companies like Sandbox Banking flaunt their integrations with Jack Henry and others. They're betting on banks not wanting to undertake the risk of a core banking replacement or that the core banking providers won't shift to the cloud. With the notable exception of Jack Henry, it seems to be a winning strategy.

Keep your core provider AND get cloud (source).

To their credit, Jack Henry has welcomed these startups - they count over 850 fintechs as partners. It's an acknowledgment that these fintechs can innovate on top of Jack Henry to extend the BaaS services that the company already provides to serve ever an ever broad array of use cases. Startup Bankable has an offering specifically targeted to enabling "yacht brokers to segregate accounts and cards for each yacht with a real-time control." That's likely too narrow for Jack Henry to target, but through fintech partners, it's nonetheless within reach.

The competitor cloud-native core banking startups are betting they can do it better. Thought Machine is the vendor of choice for Atom, a digital challenger bank in the UK. That "digital" part is critical - many of these new cloud-native vendors don't have products that meet the needs of traditional, brick-and-mortar branches. That's a problem for most regional banks in the US.

But it's not a problem for JP Morgan's new UK retail bank.

Big banks work with vendors and build

Big banks work with vendors and build to create their BaaS offerings. Banks like JP Morgan are simply too big and too complex for any vendor to meet their needs out-of-the-box. Yet they have the sophistication and the money to build cloud-native services that can compete with any fintech.

JP Morgan is the most mature of any of the big banks globally. The company pursuing a dual strategy with its cloud-native services - consume them itself to create new digital-first banks and open them up to third parties. The new JP Morgan UK retail bank - Chase - is the most prominent example of the former. The company's push into blockchain with Liink is among the latter.

The scale at which JP Morgan can invest is hard to comprehend. The bank may be slower to get going than startups, but they make up for it with size:

• Chase, the UK retail bank, is?anticipated to lose $1 billion over the next few years?as JP Morgan invests in its growth. Few startups can sustain those types of losses.
• $1.5 billion has been invested into Treasury Services in the past five years, driving an incremental $4 billion in revenue and growing market share from 4.5% to 7.2%.
• Over?1000 APIs are now available for customers to consume.
• In total - the company spends?$12 billion per year on technology and employs 50,000 technologists.

They are formidable competition for everyone in BaaS, banks and startups alike. But like the APIs they offer, smaller players can outcompete by getting more specific, creating solutions to solve ever more niche needs.

BaaS Competes By Getting Small

The essential value proposition for every BaaS provider offers starts the same. From there it's all about getting smaller, deeply understanding a specific subset of users' needs, and crafting solutions that can directly provide value.

There are four key value propositions a bank offers fintechs:

• Access to funds?-?banks offer a source of money to fund loans.
• Infrastructure?- banks move money. It can be to-and-from an account, in between banks, across accounts, and domestically and internationally. Each manifests differently as debit, treasury, wire, ACH, and many other services.
• Regulatory compliance?- banks are compliance experts. While fintechs must maintain their own compliance operations, banks establish a critical baseline that protects consumers and prevents criminal activity.
• Trust?- banks benefit from regulations that keep them solvent and resolution authorities that protect consumers if they fail. FDIC insurance for deposit accounts is just one prominent example. Fintechs building on banks gain user trust by "passing through" through protections.

In return, banks get access to customers and new businesses they wouldn't have otherwise been able to access.

From that base value proposition, it's all about getting small.?The Financial Brand put together a top-five consumer-focused feature?list from Chime, MoneyLion, and other fintechs. Every single one is built on top of a bank's BaaS offering. It's a great insight as to the type of specificity BaaS has to unlock.

1. Early Wage Access?- many people live paycheck to paycheck. Payday loans and checking cashing is a $19 billion per year industry. Accelerating payday by up to two days is a short-term, low-risk loan that massively benefits consumers.
2. Temporary Advances & Friendly Overdraft Policies?- similar to the early wage access, short-term loans can be low risk and incredibly valuable.
3. Building Better Credit Tools?- the gap between how we live our lives and what's actually reflected in a credit score is big and widening. Regular, on-time rent and bill payments can only contribute to better scores if they're reported.
4. Easy Cash Deposits?- there's rarely a shortage of ways to withdraw money, but as the number of banks in the country continues to decline, consumers are increasingly challenged to deposit money. Partnerships like how fintech Chime accepts deposits via Walgreens create thousands of mini bank branches that dramatically extend a bank's reach.
5. Budgeting & Financial Planning?- it's a feature set that was pioneered by Mint in the early 2000s, but it meant giving an unknown and untrusted third party access to your bank accounts. Fintechs and banks together can provide the same insights through trusted, secured channels with controlled read-only access.

These are nuanced offerings. Each one of them can break down even further to target specific demographics like making the service available natively in Spanish. What this leads to is specialization - each small bank becomes really good at offering small, narrowly focused products to specific types of customers.

Just a sampling. This list gets ever longer. (source)

The strategy works because the fintechs operate at internet scale. Even a niche as seemingly small as yacht brokers can be large compared to the scale of a regional bank. It's also in these niches that the greatest profits can be found - they offer the potential for new mini oligopolies not unlike those previously defined by geography, instead driven by the specificity with which the bank service can be tailored.

BaaS will unlock huge profits for winners and be unforgiving for losers

BaaS will unlock huge revenues and even bigger profits for winners.

Coastal Community Bank appears to be one of those. They made a decided choice to invest - heavily - in their BaaS offering. But it's important to keep in mind?how they arrived at that decision:

The board considered three strategies: sell to another bank, stay independent and private, or go public. Ultimately, the board decided to go all-in on pursuing BaaS and voted to go public to raise the capital to do so.

I expect most banks won't make that pivot. We're over 20 years into cloud and still, less than half of banks have gotten a move on. Even fewer - just 36% - have deployed APIs.

What it means is that most banks simply won't make it. It's a point I made previously in the?letter on embedded finance. It's a point Jamie Dimon more recently thought important enough to?highlight in his annual shareholder letter:

It seems unlikely to me that all the banks, shadow banks and fintech companies will thrive as they strive to take share from each other over the next decade. I would expect to see many mergers among America’s 4,000+ banks — they need to do this, in some cases, to create more economies of scale to be able to compete. Other companies will try different strategies, including bank-fintech mergers or mergers just between fintechs. You should expect to see some winners and lots of casualties — it’s just not possible for everyone to perform well.

It's the reality banks now face. Welcome to the world of digital, cloud, and competition. You will never meet most of your customers in person, but you'll have to earn their trust all the same. Some of them may engage with you directly, but many more will benefit from your services without ever realizing you exist. To them, you'll be an unread line in the terms of service, "Banking services provided by." And yet if you invest in this future today, the returns will be great. You'll enjoy revenues many multiples bigger than what you generate today at margins that you can hardly imagine.

Or you can try to let it pass you by, instead focus your efforts on the traditional products and channels that have served the bank well all this time. The bank won't fail. It'll just get smaller, slowly, as geography-unbounded competitors eat away at the moats you thought deep enough to hold them off. But don't worry. At some point, you'll be small enough - cheap enough - that someone gets interested. They'll have a different vision, one that's digitally native and cloud-first, but they'll need a banking license to make it happen. They'll make the decision and the investments you didn't, but now competing off their back foot, needing to hustle to rebuild relevance.

Welcome to the world of Banking as a Service.