2.1 Neobanks, Challenger Banks, and Digital Banking Models

The rapid expansion of financial technology has transformed consumer banking through the emergence of branchless, digital-first banking entities. Compliance professionals must distinguish between distinct institutional models, recognize how commercial revenue incentives drive customer onboarding friction, and evaluate how digital payment rails intersect with physical cash placement risks under the Bank Secrecy Act (BSA) and international anti-money laundering (AML) standards.

Architectural Models: Direct Charters vs. Sponsor Bank Partnerships

In the digital banking ecosystem, market participants fall into two primary structural categories:

1. Chartered Challenger Banks: Entities that have independently secured a de novo national or state banking charter (such as Varo Bank, N.A. or SoFi Bank, N.A.). These institutions hold their own deposits, maintain direct Federal Deposit Insurance Corporation (FDIC) insurance, possess primary Federal Reserve master accounts, and bear direct statutory responsibility for BSA/AML, Office of Foreign Assets Control (OFAC) sanctions compliance, and consumer protection regulations.
2. Neobanks (Non-Bank FinTechs): Technology companies that provide digital front-end customer interfaces, mobile applications, and financial management tools but do not hold a banking charter (such as Chime or Current). To offer demand deposit accounts, debit cards, and payment services, neobanks operate through a Banking-as-a-Service (BaaS) or partner bank sponsorship model, partnering with chartered depository institutions (such as The Bancorp Bank, N.A. or Stride Bank, N.A.).

In the partner bank model, the technical interface and customer relationship management reside with the FinTech, but the customer's legal deposit account is opened on the ledger of the partner bank. Consequently, pass-through FDIC insurance protects customer balances only if the partner bank maintains appropriate custodial and sub-accounting records. Most critically, federal banking regulators (including the OCC, FDIC, and Federal Reserve) hold the chartered partner bank accountable for BSA/AML compliance across its FinTech partner programs, even when the FinTech performs the day-to-day work. A FinTech that is itself a registered money services business also carries its own BSA obligations.

In international jurisdictions such as the United Kingdom and the European Union, digital competitors often begin under alternative legal regimes, such as licensed Electronic Money Institutions (EMIs) or Payment Institutions (PIs) supervised by the UK Financial Conduct Authority (FCA) or national European regulators. Unlike banks, EMIs cannot accept deposits or lend out customer funds; they must safeguard the funds they receive, usually in segregated accounts at a bank or through an insurance or guarantee arrangement.

Speed vs. Customer Due Diligence (CDD) Friction

Neobanks compete aggressively on customer acquisition cost (CAC) and conversion speed. Traditional brick-and-mortar account opening requires in-person branch visits, physical document inspection, and manual verification, often requiring days to activate an account. Neobanks optimize their acquisition funnels for completion in under three minutes through mobile applications.

This commercial imperative creates acute tension with Customer Identification Program (CIP) requirements under Section 326 of the USA PATRIOT Act (31 CFR § 1020.220) and the FinCEN Customer Due Diligence (CDD) Rule. To minimize customer drop-off, neobanks deploy automated electronic identity verification (eIDV) engines that query credit bureaus, identity aggregators, and alternative data sources via application programming interfaces (APIs).

To balance speed and regulatory exposure, many platforms implement tiered onboarding:

• Tier 1 (Restricted Access): Applicants submit basic identifiers (full legal name, date of birth, physical address, and partial or full taxpayer identification number). Automated database checks verify identity without manual document upload. Accounts are granted low transactional limits (e.g., maximum balance of $500, restricted P2P velocity, and blocking of international wires or cash withdrawals).
• Tier 2 (Full Functionality): Unlocking higher transactional limits (e.g., $10,000 monthly velocity, direct deposit, and external ACH transfers) requires enhanced verification, including government-issued photo identification uploads, biometric facial liveness matching, and proof of address verification.

While tiered onboarding reduces immediate drop-off, it exposes platforms to automated testing. Illicit networks deploy credential-stuffing bots to test stolen identity credentials across low-friction Tier 1 accounts, later exploiting them for short-term illicit funnels.

Economic Engine: Durbin Amendment Interchange Arbitrage

Understanding the revenue mechanics of neobanks is vital for financial crime compliance because business models shape risk appetites. Most neobanks do not charge monthly account maintenance fees, overdraft fees, or minimum balance penalties. Instead, their primary revenue stream is generated through debit card interchange fees—the fee paid by the merchant's acquiring bank to the card-issuing bank on every card transaction.

Under Section 1075 of the Dodd-Frank Wall Street Reform and Consumer Protection Act (the Durbin Amendment, implemented via Federal Reserve Regulation II, 12 CFR Part 235), interchange fees are strictly capped for large depository institutions:

• Covered Banks (Assets ≥ $10 Billion): Debit card interchange is capped at $0.21 plus 5 basis points (0.05%) of the transaction value, with an optional $0.01 fraud prevention adjustment. In August 2025 a federal district court in North Dakota (Corner Post v. Board of Governors) vacated the fee standard but stayed its order pending appeal, so the cap remains in effect while a separate Federal Reserve proposal to lower it is pending.
• Exempt Banks (Assets Under $10 Billion): Depository institutions with consolidated assets under $10 billion are statutorily exempt from the cap, allowing them to receive the higher interchange rates set by card networks (Visa and Mastercard). Federal Reserve data have consistently shown average fees for exempt issuers well above the regulated cap.

By deliberately partnering with community and regional banks possessing balance sheets below the $10 billion threshold, neobanks capture exempt interchange rates. The partner bank and neobank share this revenue under their programme agreement, often with most of it passing to the FinTech. This dynamic creates a powerful structural bias: the FinTech's commercial viability depends directly on maximizing consumer transaction volume and payment velocity, creating operational resistance to transaction monitoring rules that pause or delay payment execution.

Cash Loading via Retail Networks: The Physical Placement Risk

Because neobanks operate without physical branches or proprietary ATM deposit networks, they rely on third-party retail cash-in networks to accept physical currency deposits. Prominent networks include Green Dot @ the Register, InComm Payments' Vanilla Direct, and Western Union retail integrations at convenience stores, dollar stores, and pharmacies.

In a standard retail cash reload:

1. The customer generates a dynamic barcode within the neobank mobile application.
2. The customer presents the barcode and physical cash (e.g., $500) to a cashier at a participating retail outlet (such as 7-Eleven or Walmart).
3. The retail point-of-sale register scans the barcode, accepts the physical currency, and transmits a credit notification to the retail network.
4. The retail network routes the funds through an ACH or proprietary network to the partner bank, crediting the customer's digital ledger balance within minutes.

This mechanism creates a severe placement vulnerability in the anti-money laundering framework. The retail clerk scanning the barcode is an employee of a convenience store chain, not a trained BSA compliance officer. Retail registers typically enforce only per-transaction limits (e.g., $500 to $1,500) and lack systemic cross-store visibility.

Money launderers exploit this loophole through structuring and smurfing. An illicit network recruits runners who visit multiple retail locations across a metropolitan area, depositing structured cash amounts of $800 to $1,500 at each register under the $10,000 Currency Transaction Report (CTR) threshold (31 CFR § 1010.311). The aggregated funds appear in the digital account almost instantaneously, converting illicit street cash into liquid electronic funds without in-person bank scrutiny.

Comparative Operational Models

The following table analyzes structural, regulatory, and financial crime distinctions across digital and traditional banking models:

Remote Fraud, Money Mules, and FinTech Typologies

The combination of digital account opening, retail cash placement, and instant payment rails creates unique financial crime typologies:

• Money Mule Recruitment: Criminal rings target students, economically vulnerable individuals, and gig workers via social media ads, offering payments for opening neobank accounts or surrendering debit card credentials. Once established, these accounts serve as intermediary nodes to move fraud proceeds.
• Funnel Accounts and Rapid Pass-Through: Illicit funds arrive through mobile deposits of altered checks, unauthorized automated clearinghouse (ACH) debits, or peer-to-peer (P2P) transfers from compromised accounts. Rather than seasoning, the funds are immediately liquidated within minutes via out-of-network ATM withdrawals, retail gift card purchases, or debit card transfers to offshore virtual asset service providers (VASPs).
• Account Takeover (ATO): Automated credential-stuffing attacks hijack dormant accounts, allowing criminals to bypass initial CIP defenses and leverage seasoned account limits to execute illicit flows.

Realistic Exam Scenario

An AML transaction monitoring investigator at a chartered partner bank reviews an alert generated by a 24-year-old customer account opened through an affiliated neobank partner. The account was boarded 14 days earlier via automated eIDV with an unverified self-employment profile.

Over a consecutive 48-hour weekend period, the account recorded eight separate cash deposits of $950 each (totaling $7,600) processed through retail barcode reload terminals across six distinct convenience stores in a 15-mile radius. Within 45 minutes of each cash reload, the account executed outbound debit-card push transactions to an unhosted cryptocurrency wallet gateway, leaving an ending balance of $18.

Compliance Analysis: The investigator identifies multiple compounding red flags:

1. Structured retail cash reloads just below the $1,000 internal monitoring threshold, demonstrating intentional circumvention of reporting limits.
2. High-velocity pass-through activity with near-zero balance retention, typical of money mule and placement operations.
3. Immediate conversion into non-custodial digital assets, extinguishing the transactional audit trail.

Under BSA regulations (31 CFR § 1020.320), the partner bank must file a Suspicious Activity Report (SAR) within 30 calendar days of initial detection. The bank's compliance officer must also assess whether the neobank's retail cash velocity rules require tightening and consider immediate administrative account closure.

Common Exam Traps

• Trap 1: Misallocating BSA Legal Responsibility: Candidates frequently assume that because a neobank possesses customer-facing brand ownership, it holds statutory liability for BSA/AML program enforcement. Regulators hold the chartered partner bank accountable for compliance across its sponsored FinTech programs. A FinTech that is a registered MSB has its own obligations too, but the bank cannot outsource its responsibility.
• Trap 2: Misunderstanding FDIC Pass-Through Criteria: Believing that any funds deposited through a neobank are automatically FDIC-insured. Pass-through insurance requires that the partner bank maintain granular sub-ledger records identifying individual beneficial owners and account balances.
• Trap 3: Conflating the Durbin Exemption Threshold: Assuming the $10 billion Durbin Amendment threshold applies to the FinTech's annual transaction volume or corporate valuation. The exemption is governed strictly by the consolidated assets of the chartered depository institution issuing the card.
• Trap 4: Overlooking Retail Cash Network Vulnerabilities: Assuming retail cash reload points conduct independent Customer Due Diligence. Cashiers at retail registers perform no customer identification beyond scanning the presented barcode, shifting the entire AML detection burden to post-transaction monitoring engines.