17.4 How Banking Partners' Terms of Service Relate to the FinTech's Own Terms
Key Takeaways
BaaS customers are usually bound by both the partner bank's deposit or cardholder agreement and the FinTech's own terms of service, which must not contradict each other.
The bank's prohibited-activity list, rights to request information, and rights to restrict, freeze or close accounts need to appear in the FinTech's customer terms.
Under the FDIC's deposit insurance advertising rule (12 CFR Part 328), non-banks must not misrepresent deposit insurance and should name the insured bank holding the funds.
Changes to customer-facing terms or marketing in a BaaS programme normally need the partner bank's prior review and approval under the programme agreement.
CAFCA sub-topic 4.8 asks how banking partners' terms of service relate to the FinTech's terms. This matters in investigations and offboarding. The FinTech can restrict, question or exit a customer only if the documents the customer agreed to give it that right, and those rights must match what the bank requires.
The document stack
| Document | Between | Typical content |
|---|---|---|
| Programme agreement | Bank and FinTech | Roles and responsibilities; compliance obligations; approvals; audit rights; data access; termination |
| Deposit account or cardholder agreement | Bank and end customer | The legal account relationship; the bank's rights and the customer's rights |
| FinTech terms of service | FinTech and end customer | App use, fees, features, acceptable use, communications |
| Privacy notices | Bank and customer; FinTech and customer | What data is collected, shared and kept |
| Marketing and disclosures | FinTech to the public | Product claims; deposit-insurance statements; naming the bank |
The FinTech's terms usually incorporate or link the bank's agreement. Where the two conflict, the programme agreement normally requires the FinTech to fix its terms. The bank, as the regulated entity, cannot accept customer terms that undermine its controls.
Clauses that must line up for AML purposes
| Clause area | What the bank needs | How the FinTech terms reflect it |
|---|---|---|
| Prohibited activities | Lists of restricted or prohibited uses (for example gambling, unlicensed money transmission, certain crypto activity, business use of consumer accounts) | Same restrictions in the acceptable-use section; clear consequences |
| Information requests | The right to request information and documents about the customer and their transactions | Customer agrees to provide information when asked, within stated periods |
| Restriction, freezing and closure | Rights to hold, reject or reverse transactions, freeze funds and close accounts, including without notice where the law allows | Matching rights in the FinTech terms, with consistent notice periods |
| Sanctions | Prohibition on sanctioned persons and countries | Representation and warranty from the customer; right to block |
| Data sharing | Consent or a legal basis to share data between bank, FinTech and vendors | Privacy notices and terms that explain the sharing |
| Deposit insurance | No misrepresentation; name the bank; insurance covers only bank failure | Accurate disclosures under 12 CFR Part 328 in the US |
| Disputes and errors | Who handles disputes and error resolution under consumer law | A clear process and the responsible party |
| Programme termination | A transition plan if the programme ends | Notice of how funds will be returned or moved |
Why it matters in practice
- Investigations: an RFI is easier to enforce, and refusal can lead to restriction, when the terms say the customer must provide information.
- Holds and freezes: a FinTech that promises "instant withdrawals, always" cannot easily apply a fraud hold the bank requires. The marketing and the terms create conflicting expectations and complaint risk.
- Exits: when the bank decides to exit a customer, the FinTech must carry out the exit consistently with both documents, without disclosing confidential reasons (Chapter 15).
- Programme failure: the 2024 collapse of middleware provider Synapse showed what happens when customers do not understand which bank holds their money and how records are kept. Clear terms and disclosures reduce harm.
Who acts, and who tells the customer
When the bank and the FinTech share a customer, the agreement should settle three practical questions in advance:
- Who decides to restrict or close? The bank usually keeps the final say over its own accounts, even where the FinTech recommends the action.
- Who carries it out? The FinTech often applies holds in its app, while the bank applies them on its core system. Both must happen at once to avoid gaps.
- Who communicates? Usually the FinTech, as the customer-facing brand, using wording the bank has approved. A message such as "Your bank closed this account" can mislead or invite questions that risk tipping off. Agreed neutral wording avoids both problems.
Document these points in the programme agreement and the operating procedures, and test them in incident simulations.
Change control
Most programme agreements require the bank's prior review and approval of changes to customer-facing terms, fee schedules, product features and marketing materials. A FinTech that changes its terms on its own, for example by allowing transfers to crypto exchanges that the bank prohibits, breaches the agreement and exposes both parties.
Realistic exam scenario
A FinTech's app terms say that customers may "send money anywhere in the world instantly". The bank's cardholder agreement prohibits transfers to certain jurisdictions and allows the bank to hold suspicious transfers. A customer complains that a held payment breaks the FinTech's promise. The FinTech should apply the hold, because the bank's agreement and the law allow it. It should then correct its terms and marketing with the bank's approval, so that the documents line up, and log the complaint. Releasing the payment to honour the inaccurate marketing would undermine the bank's controls.
Common exam traps
- Assuming the FinTech's terms override the bank's agreement. The bank's controls must be preserved.
- Changing terms or marketing without bank approval.
- Marketing that implies the FinTech is a bank or is FDIC-insured.
- Promising features, such as instant unconditional withdrawals, that conflict with required controls.
A FinTech's terms allow customers to use consumer accounts for business sales, but the partner bank's agreement prohibits business use of consumer accounts. What should happen?
Change its terms to match the bank's, with bank approval, and apply the restriction
The FinTech's terms prevail because the customer signed them most recently
The bank must change its own agreement so that it matches the FinTech's terms
Nothing, because conflicts between the documents do not matter legally
Why should a FinTech's customer terms include a duty to provide information when requested?
Because it removes the need for ongoing transaction monitoring entirely
So RFIs during CDD and investigations are contractually backed, with restriction if refused
To allow the FinTech to send marketing surveys to customers
To let the FinTech share SAR contents with customers who ask
Which marketing statement is most consistent with US deposit insurance rules for a non-bank FinTech?
"FDIC insurance protects your balance if our app or company shuts down."
"We are an FDIC-insured bank offering full protection on every account."
"Banking services by Example Bank, N.A., Member FDIC; insurance covers only Example Bank's failure."
"Your crypto holdings are FDIC-insured up to $250,000 through our bank partner."
Sections you finish are checked off in the contents.