Embedded finance trends in 2026: four dated signals and what each changes in testing

Four embedded finance trends in 2026, each with a dated data point

We checked every figure and status below against the primary source on 22 September 2026. The scope is United States bank and fintech partnerships, where a sponsor bank holds the charter and a fintech builds the product on top of it.

1. Non-bank brands set up their own insured banks

On 14 May 2026 the FDIC approved the deposit insurance application submitted by a car maker's US finance arm to establish Stellantis Bank USA, which will be a Utah-chartered industrial bank; the charter comes from Utah and the FDIC grants deposit insurance. The FDIC release describes the planned funding from "deposits from affiliated entities, brokers, and listing services, as well as consumers and businesses nationwide via the bank's website and mobile application", and a condition to "maintain a minimum 15 percent tier 1 leverage ratio". On 10 August 2026 the FDIC announced a two-phase review that gives de novo applicants who satisfy relevant requirements "a contingent authorization within 120 days of receiving the application" and "approval within the subsequent 12 months following the receipt of additional information and completion of key organizational steps."

One approved brand will take deposits in its own bank. For a brand that makes this move, the product ledger becomes, or feeds, the bank's deposit records, and every account opened in the app becomes a deposit of that bank. The migration is the test risk: each customer balance, pending payment, and scheduled transfer has to arrive at the new core once, with the same amount and history, on the cutover date.

2. Sponsor bank orders reach into the fintech partner's monitoring systems

The FDIC consent order against Hatch Bank (FDIC-24-0062b, dated 3 April 2025) requires periodic reviews of any third party that performs a Bank Secrecy Act (BSA) function for the bank. The reviews assess whether the third party's systems that risk rate customers and detect suspicious activity "have been appropriately validated, including a validation of the accuracy, completeness, and consistency of the system's information", and whether its documentation "accurately reflect[s] the rules, thresholds and scenarios in use by the Bank" (section II.B.2). The order also requires "appropriate risk-based transaction testing" in the bank's independent testing procedures (section II.C.3).

A fintech that runs transaction monitoring for its partner bank needs evidence that each documented rule fires at its documented threshold, on production configuration, with no silent gaps in the data feed. In a synthetic example, the rule document says "alert on cash-like transfers above a set amount within 24 hours" while the deployed rule counts per calendar day; documentation and deployed rule then disagree, which is the gap section II.B.2 asks the bank to find.

3. Bank AML program rules are being rewritten, with independent testing kept

On 10 April 2026 the OCC, FDIC, and NCUA published a proposed AML and countering the financing of terrorism (CFT) program rule (91 FR 18304), aligned with a FinCEN proposal published the same day. The Federal Reserve Board followed with its own proposal on 9 July 2026 (91 FR 42363), with comments to 8 September 2026. As of 22 September 2026, the Federal Register shows these as proposed rules only.

The April proposal "retains the existing requirement for banks to establish independent AML/CFT program testing" and states that independent testing "should be focused on whether the AML/CFT program is effective". The agencies propose an effective date "12 months from the date of issuance of the final rule". In our practice, a fintech partner shows effectiveness with outcomes: alerts raised on seeded suspicious patterns, cases closed with a documented reason, and reports filed on time. Test data that seeds known patterns and checks the outcome serves that evidence request under the current rule and the proposed one.

4. Stablecoins and tokenized deposits get a federal rulebook

The GENIUS Act (Public Law 119-27, approved 18 July 2025) takes effect on "the earlier of (1) the date that is 18 months after the date of enactment of this Act; or (2) the date that is 120 days after the date on which the primary Federal payment stablecoin regulators issue any final regulations implementing this Act" (section 20). Eighteen months after enactment is 18 January 2027. Treasury, the OCC (first proposal 91 FR 10202, 2 March 2026), the FDIC, and the NCUA have published proposals through 2026; the Federal Register shows no final GENIUS Act rule as of 22 September 2026.

The FDIC proposal of 10 April 2026 (91 FR 18534) states that "the technology or recordkeeping utilized by an IDI to record its deposit liabilities does not affect whether those liabilities constitute 'deposits.'" A tokenized deposit that meets the statutory definition is insured like any other deposit, and the FDIC asks for comment on how pass-through insurance rules apply when account titling or recordkeeping differs. For an embedded product that moves customer funds as tokens, the on-chain record and the bank's deposit account records must agree per owner, the same reconciliation that custodial accounts already need.

Why these trends change test scope for partner bank programmes

The FDIC order against Hatch Bank, dated 3 April 2025, is one example of what a supervisor asks a sponsor bank to show about its fintech partners: validated third-party systems and risk-based transaction testing. The FedNow payment data for 2026 is covered in our post on 2026 payment data.

Across the four trends, the evidence request lands on the same money flow. A migrated balance, an AML alert, and a tokenized transfer each have to trace from the product ledger to the bank's records, per end user, with a date. Our BaaS segment page lists the ledger and webhook failure patterns behind those traces. What changes in 2026 is who holds the records: a brand with its own bank holds them itself, and token platforms add a second ledger between the end user and the bank.

What to test in the next release cycle

This list is our practice for a fintech on a sponsor bank or a brand moving to its own charter. It is drawn from the sources above, and none of them prescribes it.

1. Charter migration parity. Before and after a rehearsal cutover, export every synthetic customer balance, pending payment, and scheduled transfer from the old and new systems. Assert one record per item on each side, equal amounts and dates, and no payment executed twice across the cutover.
2. Cutover-day reconciliation. On the charter migration cutover day and the days after it, run the item-level match of product ledger postings against the new bank core, and assert zero unmatched items older than the agreed age. The ledger reconciliation testing guide holds the matching rules.
3. Rule-to-document conformance. For each monitoring rule in the documentation, seed synthetic transactions just below, at, and above the threshold and window. Record the alert result next to the documented rule, so the partner bank can compare the two in one table.
4. Screening outcome sets. Score a labelled synthetic name set against the screening configuration in production and record matches, misses, and false alerts per threshold, as in our sanctions screening false positive guide.
5. Token and deposit record agreement. For any tokenized balance, rebuild each owner's balance from the token ledger and from the bank's deposit records, and assert equality per owner at day end.
6. Dated evidence per run. Store the build, configuration version, run date, and result for each of the above. Those records are the input for a sponsor bank compliance audit, and our BaaS and partner bank integration testing delivers them as a partner bank due diligence test evidence pack.