License as a service

The European Banking Authority calls the model white labeling: a financial institution, the provider, supplies products that a partner offers to customers under its own brand, and the partner may or may not be regulated itself. In the EBA survey published in October 2025, 35 percent of the banks that answered its 2025 Spring risk assessment questionnaire used white labeling, mostly for accounts and payments, credit and open banking services.

The provider is the party the customer contracts with, so it bears the final responsibility for compliance: it runs the anti-money laundering checks, holds the customer funds, keeps the records, files the regulatory reports and handles complaints. The partner runs the app or website, collects the onboarding data and markets the product. Providers on this market differ mainly in the type of license they hold. lemon.markets offers securities trading under a German investment firm license, while Ephelia Group combines e-money, virtual asset and asset management licenses in several countries with core banking and stablecoin infrastructure. Seen from the brand that sells the product, the same arrangement is called embedded finance.

German law lets a firm offer investment brokerage, investment advice or placement business without a license of its own if it works exclusively for the account and under the liability of a bank or securities institution. The legal basis is section 2(10) of the Banking Act and section 3(2) of the Securities Institutions Act, and the arrangement is known in German as a Haftungsdach, a liability umbrella. The institution notifies BaFin of each tied agent, and BaFin publishes the entries in a public register of tied agents (in German), which since January 3, 2018 also lists the tied agents of institutions from other EEA countries.

Because the agent acts under the liability of the institution, a customer who suffers a loss from bad advice can hold the institution liable. Portfolio management and custody are not part of the umbrella, so a partner that wants to offer them needs its own license or a provider that performs them itself. Some offers of brokerage as a service use the tied agent route for their partners. In a supervisory briefing of February 2, 2022, ESMA asked national supervisors to look closely at tied agents that are legal persons and at tied agents controlled by firms outside the EU.

Article 19 of the EU Payment Services Directive lets a payment institution provide services through agents once it has notified its home supervisor. Article 20 of the same directive keeps the institution fully liable for every act of its agents, its branches and the companies it outsources to. Article 3 of the E-Money Directive allows an e-money institution to distribute and redeem electronic money through other companies acting on its behalf. Issuing electronic money through agents is not allowed, so the licensed institution remains the issuer of every balance a partner shows in its app.

Under MiCA, a crypto-asset service provider can outsource functions but cannot delegate its responsibility for them. ESMA told national supervisors in a supervisory briefing of January 31, 2025 that outsourced compliance, risk and ICT functions call for an elevated level of scrutiny. Where outsourcing goes so far that the supervisor can no longer supervise the firm effectively, the application should be rejected. Banks that offer crypto trading through a licensed partner use crypto as a service, and the EBA also observes stablecoins issued as a service for use in the ecosystem of a partner.

A Swiss bank or securities firm that hands functions to a technology provider follows FINMA Circular 2018/3 on outsourcing, which has applied to banks, securities firms and insurers since April 1, 2018. Under the circular (in German), the institution keeps the same responsibility toward FINMA as if it performed the outsourced function itself and has to ensure proper business conduct at all times.

Firms that want a Swiss license of their own for a deposit-based product can apply for the FINMA fintech license under Article 1b of the Banking Act. That license allows a firm to accept public deposits of up to CHF 100 million, provided the deposits are neither invested nor paid interest.

The EBA found that customers often cannot tell with whom they are contracting, and that some partners show the license of their provider on their websites in a way that suggests they are regulated themselves. When fraud or a complaint arises, the customer may not know whether to contact the brand or the institution behind it. A partner also depends on its provider: if the provider stops a product, fails or loses its license, the partner product stops as well, and that risk grows when one provider serves many partners.

Supervisors see the chain only in part, because a partner without a license is outside their direct reach, and the same arrangement may count as outsourcing in one member state and as an agency in another. The EBA found no need to change EU law, but it plans work on a common classification in 2026 and has added white labeling to the supervisory priorities for that year. In Germany, banking as a service showed the problem when BaFin limited the onboarding of new partners at one provider. Under DORA, license holders also have to document and test exit plans for their critical ICT providers.

License as a service means that a licensed bank, payment institution, investment firm or crypto-asset service provider lets a partner sell financial products under its license, usually together with the technology. The partner owns the brand, and the license holder stays responsible to its supervisor for the regulated activity.

A tied agent is a person or company that offers investment brokerage, investment advice or placement business on behalf of one institution and under its liability. In Germany such agents need no license of their own, and BaFin lists each of them with its liable institution in a public register.

No, portfolio management is not among the activities that the German tied agent rules cover, which are brokerage, advice and placement. A white label asset management offer therefore works the other way round: the licensed institution manages the portfolios, and the partner offers them to its customers under its own brand.

Regulatory hosting is the British name for a closely related licensing model. The UK Financial Conduct Authority defines a regulatory host as a principal firm that carries out little or no regulated activity itself and oversees the use of its permissions by appointed representatives. The principal remains ultimately responsible for overseeing these representatives, even where it outsources the monitoring work to others.

No, with compliance as a service a firm buys compliance work, such as transaction monitoring or regulatory reporting, from a specialist while it keeps its own license. In license as a service, the partner holds no license and works under the license of the provider. The software that firms use for outsourced compliance work is known as regtech.