Banking-as-a-Service and card issuing platform testing
FintechAssuranceLabs engineers test Banking-as-a-Service and card issuing platforms, the category of products like Marqeta, Unit, and Galileo. Test scope covers reconciliation of the programme ledger against the partner bank core, for-benefit-of account sub-ledgers, programme limits, API contracts, and webhook delivery. FintechAssuranceLabs engineers have tested BaaS money flows and hand over test evidence that a partner bank can review.
What breaks between the programme ledger and the bank core
A BaaS platform earns a fee per API call and a percentage of programme volume. In a US programme that pools end-user funds in a for-benefit-of (FBO) account, the sub-ledger is the record of who owns which part of the FBO balance. Sources were checked on 2026-09-16.
- FBO total matches while end-user balances are wrong. An ACH return reverses a credit in the FBO account, and the platform posts the reversal to another end user with the same amount and date instead of matching the original trace number. The daily total check still agrees, one end user loses funds, and the volume fee stays billed on a credit that never settled. Where the bank's deposit account records disclose the custodial relationship, pass-through insurance needs each owner's interest to be ascertainable from those records or from records that the depositor, or a party keeping them for the depositor, maintains in good faith and in the regular course of business (12 CFR 330.5(b)(2)), so a misallocated sub-ledger puts coverage of the affected owners in doubt.
- Webhook retry posts a card clearing twice. The issuer processor retries a clearing webhook after a late response, and the handler deduplicates on the delivery ID, which changes on every retry, instead of the event ID. The end user's balance drops twice, the programme pays the per-call and volume fees twice, and the bank core shows one settlement. For a consumer account, a computational or bookkeeping error made by the financial institution relating to an electronic fund transfer is an error under Regulation E (12 CFR 1005.11(a)(1)(iv)).
- Programme limit enforced on one channel only. The platform checks the partner bank's daily ACH debit limit per end user in the dashboard but not on the direct API or batch upload. Debits above the limit earn the volume fee, and when funds are paid out before an R10 (unauthorised) return arrives, the programme reserve or the FBO account funds the negative balance. The FDIC consent order against Lineage Bank (FDIC-23-0041b, dated 30 January 2024) required its ACH policies to specify approval limits and authorities for customers (paragraph 23(a)).
- Sub-ledger unreadable without the platform. The daily export gives the partner bank balances without owner identifiers or transaction history. The FDIC's 2024 custodial accounts proposal describes a technology company bankruptcy after which consumers could not access funds at insured banks for months while the banks determined ownership. API calls and volume stop for every programme on a failed platform. The Federal Reserve cease and desist order against Evolve Bank & Trust (announced 14 June 2024) required the bank's plan to include controls so that ledger and sub-ledger responsibilities of the bank and its fintech partners are clearly defined, established, and maintained, including in the event of a material business disruption (paragraph 3(a)(iii)(C)); the Federal Reserve announced no termination as of 2026-09-16.
Licence flag and the evidence partner banks and supervisors ask for
BaaS carries the licence flag: a bank, e-money institution, or registered payment service provider holds the funds, and the platform acts as its service provider, agent, or distributor.
United States
The partner bank oversees the platform under the Interagency Guidance on Third-Party Relationships (88 FR 37920, 9 June 2023). Its typical monitoring activities include regular testing of the bank's controls over third-party risk, and based on risk a bank may also test the third party's own controls. Proposed interagency guidance published on 15 September 2026 would, once final, replace the 2023 guidance and the July 2024 joint statement on third-party deposit arrangements; comments close on 16 November 2026.
The FDIC proposed rule on recordkeeping for custodial accounts (2 October 2024) would require beneficial ownership records for each custodial deposit account with transactional features in a prescribed format (proposed 12 CFR 375.3(a)), daily reconciliation against those records (375.3(b)(2) and (c)(3)(ii)), and, where a third party keeps the records, direct, continuous, and unrestricted bank access, including in the third party's insolvency or bankruptcy (375.3(c)(1)). Status verified on 2026-09-16: comments closed on 16 January 2025; the Federal Register shows no final rule or withdrawal, and the proposal is not in force.
No person may knowingly make false or misleading representations about deposit insurance (12 CFR 328.102(b)(1)). Material omissions include a nonbank statement implying FDIC insurance that does not identify the insured bank ((b)(5)(i)), a nonbank statement that does not disclose that the nonbank is not an insured bank and that insurance covers only the bank's failure ((b)(5)(ii)), and a pass-through statement without its conditions ((b)(5)(iv)). Amended digital sign rules for insured banks' own channels (91 FR 3801) require compliance by 1 April 2027. Evidence a partner bank asks for (sponsor bank compliance audit scenario):
- item-level reconciliation results per business day, with every break and its resolution;
- a sub-ledger export test that rebuilds each end user's balance without the platform's API;
- programme limit results for the API, dashboard, and batch channels;
- webhook retry results with the ledger posting per event;
- a screen review of deposit insurance statements against 328.102(b)(5).
European Union
An e-money institution may distribute and redeem e-money through persons acting on its behalf but may not issue e-money through agents (Directive 2009/110/EC, Article 3(4) and 3(5)). An agent providing payment services for it starts only once the competent authority enters the agent in the register (Directive (EU) 2015/2366 Article 19(2), applied by Directive 2009/110/EC Article 3(5)), and the institution remains fully liable for acts of its employees, agents, branches, and outsourced entities (Directive (EU) 2015/2366 Article 20(2), applied by Directive 2009/110/EC Article 3(1)). Under DORA Article 28(3), the institution registers its ICT third-party service arrangements, including one with a BaaS platform. The competent authority can request:
- issuance and redemption at par value tested for every distributor flow (Directive 2009/110/EC Article 11(1) and 11(2));
- safeguarding timing results for funds received by payment instrument against the five-business-day limit in Article 7(1);
- an agent and distributor list matching the platform's payment channels.
Canada
A platform that holds end-user funds or initiates electronic funds transfers at an end user's request, as a business activity not incidental to another, is a payment service provider under the Retail Payment Activities Act (section 2). Section 9(a) excludes banks, and section 10 excludes an agent of a registered provider only while it acts within its authority and appears on the provider's list under paragraph 29(1)(e), kept updated under subsection 59(1). The Bank of Canada can request the ledger of funds held for each end user at the end of each day (RPAR 15(2)(b)(ii)) and evidence that those funds sit in a trust account, or an insured or guaranteed account, used for no other purpose (RPAA 20(1)(a) and (c); see the RPAA page).
BaaS test scenarios
- Item-level FBO reconciliation. Each sub-ledger posting matches a bank core entry by trace number or end-to-end ID, and an injected misallocated return raises a break although totals agree (ledger reconciliation guide).
- Cut-off boundary. Items posted between the platform's and the bank's day close become breaks if unmatched after a set age.
- Card holds and clearing. Expired holds release, and a clearing above the authorised amount or without an authorisation posts once.
- Webhooks and API calls. Duplicate, replayed, and out-of-order events produce one posting and one billable call, and a reused idempotency key with a different body is rejected (webhook reliability guide).
- Programme limits. Per-end-user, per-programme, and daily limits apply on every channel, and a limit lowered mid-day blocks the next request.
- Returns and reserve. R01 and R10 returns after a payout debit the programme reserve.
- Ledger export and programme exit. Balances rebuilt from the export equal the sub-ledger, and a programme moved to another bank leaves every sub-ledger at zero.
Integrations and protocols to cover
- Partner bank core. FBO and reserve balances, ISO 20022 camt.053 and camt.054 statements, or BAI2 files.
- ACH. Nacha files with PPD and CCD entries, returns, and notifications of change.
- Wires and instant payments. Fedwire Funds, RTP, and FedNow messages in ISO 20022 pacs.008 and pacs.002.
- Issuer processor and network clearing. ISO 8583 authorisation and reversal messages, real-time authorisation webhooks with response deadlines, stand-in rules on timeout, and clearing files. Card numbers in these messages are cardholder data.
- Fintech-facing APIs. OpenAPI contracts, idempotency keys, and HMAC webhook signatures.
- KYC and KYB vendor APIs. Verification results that gate account opening and card issuing.
- EU and Canada rails. SEPA credit transfers as pain.001 and pacs.008, and Canadian automated funds transfer files.
Related
Standards
- Nacha Operating Rules for ACH
- Electronic Fund Transfer Act and Regulation E, including the remittance transfer rule
- GLBA and US state money transmitter requirements
- EU AML directives and regulation, KYC obligations
- PCI DSS 4.0
- EMV chip and contactless
- EMV 3-D Secure 2
- ISO 20022
- SOC 2
- ISO 27001
- PSD2 and Strong Customer Authentication
- Digital Operational Resilience Act
- GDPR for financial data
- Retail Payment Activities Act
- PCMLTFA and FINTRAC obligations
Services
- Card issuing and processing testing
- Ledger and reconciliation testing
- Bank transfers and payment rails testing
- BaaS and partner bank integration testing
- API and webhook testing
- KYC, AML and fraud testing
- Data and platform migration testing
- Performance and load testing
- Operational resilience testing
- Security testing
- Test automation
- Audit and certification test evidence
- QA audit and test strategy
- Dedicated fintech QA team
Guides
- How to test ledger reconciliation against settlement files and bank statements
- How to test webhook delivery from BaaS and payment providers
- How to test payment idempotency
- How to test Nacha return codes: ACH return entries, time frames, and ledger effects
- How to reconcile camt.053 statements: format, batch entries, reversals, and MT940 mapping
- How to test Same Day ACH cutoff times and settlement timing across time zones
- How to use test card numbers in payment testing
Sample deliverable
Sample, synthetic data
| ID | Scenario | Expected ledger entries | Amount (XTS) | Expected reconciliation result |
|---|---|---|---|---|
| REC-01 | Processor settlement file repeats the settlement line for one capture | Dr Processor receivable / Cr Merchant payable, posted once | 120.00 | Break: the second settlement line has no matching capture and is flagged as a duplicate |
| REC-02 | Partial refund on a capture that settled the day before | Dr Merchant payable / Cr Processor receivable | 45.50 | Match: the refund line matches the refund entry and the original capture stays settled |
| REC-03 | FX rounding difference between the capture amount and the settled amount | Dr FX rounding expense / Cr Processor receivable | 0.01 | Match with a rounding entry when the difference is inside the configured tolerance |
| REC-04 | Processor fee line missing from the settlement file | Dr Processing fee expense / Cr Processor receivable | 2.90 | Break: net settlement is lower than gross captures and a missing fee exception opens |
| REC-05 | Chargeback reversed after the merchant wins representment | Dr Processor receivable / Cr Chargeback liability | 80.00 | Match: the reversal line clears the open chargeback entry |
| REC-06 | Refund request retried after a timeout, with the same idempotency key | Dr Merchant payable / Cr Processor receivable, posted once | 30.00 | Break: the settlement file has two refund lines for one refund entry, and the second line is flagged as a duplicate refund |
| REC-07 | Partner bank credits the payout one business day after the expected value date | Dr Partner bank cash / Cr Processor receivable | 1,000.00 | Match on the payout reference, with the value date difference logged as a timing item |
Amounts use XTS, the ISO 4217 code reserved for testing. Account names are generic ledger accounts.
Questions
What is banking as a service?
How does banking as a service work?
How does card issuing work?
Scope your BaaS testing
Send your partner bank model, ledger of record, and issuer processor, and we return a test scope with the evidence each regulated flow needs.
Scope your testing