BaaS atlas · 2026-09-05

The bank is the clerk. Middleware is not.

The sponsor bank is the clerk for insured deposits and BSA. Middleware is a sub-ledger. Synapse showed the two can diverge. SSDF publishes a machine-readable atlas of that surface, the public docket, and Florida ch. 560 against a national BaaS pitch.

Map the actors. Credential the purchase. Do not become the bank, the middleware, or the MSB. That is the title-file rule on a different clerk.

Three objects

Sponsor bank (OCC, Fed, or state)

Charter / deposits

SSDF sells: Nothing. The bank holds the FBO.

BaaS platform (Synapse was this)

Middleware ledger

SSDF sells: A map of who failed and who was ordered. Not a replacement ledger.

SSDF INC, merchant of record

First-party SKU

SSDF sells: This atlas, and a Passport over the purchase.

Hard rules

  • SSDF is a Florida C-Corp merchant of record. SSDF is not a bank, not BaaS middleware, and not a money services business.
  • The sponsor bank is the clerk for insured deposits and BSA. Middleware is not the clerk.
  • An FBO omnibus account is the bank's ledger. A middleware sub-ledger is not FDIC insurance and is not a substitute for daily reconciliation.
  • Fla. Stat. ch. 560 has no clean agent-of-the-payee walkaway. Florida looks at whether money was received and then sent onward.
  • Accepting USDC for first-party SKUs is SSDF retail settlement. Issuing accounts, cards, or agent wallets is someone else's charter.
  • A Passport attests that a buyer paid a SKU. It is not CIP, not KYA, not a QEAA, and not 'this agent is the bank's customer.'
  • Map the actors. Do not endorse a BaaS provider. Do not sell a bank.

Roles

The clerk for deposits

Sponsor bank

Chartered depository. Holds the for-benefit-of (FBO) omnibus account. BSA/AML, fair lending, and reconcilation stay with the bank even when a fintech faces the customer. Outsourcing the activity does not outsource the charter.

SSDF does not sponsor programs and does not hold FBO funds.

GET /api/baas/sponsor_bank

Ledger in the middle

BaaS middleware

Connects fintech brands to sponsor banks. Typically no bank charter and no FDIC insurance of its own. The Synapse failure was a recordkeeping failure: no single party had a complete, accurate map of which end user owned which dollars at which bank.

SSDF is not middleware. This atlas maps that layer. It does not replace it.

GET /api/baas/middleware

The face, not the charter

Program manager / fintech brand

Customer-facing app. Sells the checking account, card, or wallet UX. Relies on the sponsor bank for the regulated activity and often on middleware for the sub-ledger.

SSDF is a first-party store, not a program manager for other merchants.

GET /api/baas/program_manager

The person who could not get the money

End user

Consumer or small business whose balance sat in an FBO. After Synapse, many could not withdraw for months while bank ledgers and middleware ledgers disagreed.

SSDF's buyer is a purchaser of a digital SKU. Not a depositor.

GET /api/baas/end_user

The actual clerk

Regulator

OCC, FDIC, Federal Reserve, CFPB, and state OFRs. Consent orders after 2022–2025 ran against the chartered banks, not only the middleware. Florida OFR licenses money transmitters under ch. 560.

SSDF maps the surface. SSDF does not examine banks and does not license MSBs.

GET /api/baas/regulator

SSDF's actual seat

First-party merchant

Sells its own digital goods. Prices in USD. Settles in USDC on Base through Coinbase Business. Does not hold third-party balances, does not issue accounts or cards, and does not transmit value between other people's customers.

This is SSDF. A Passport over a purchase is not a bank onboarding file.

GET /api/baas/merchant

Clerks

National banks

OCC

Office of the Comptroller of the Currency. Consent orders against sponsor banks (including Blue Ridge on BSA/AML) treated the bank as responsible for the fintech program. Interpretive letters on crypto activity do not turn a Florida merchant into a bank.

GET /api/baas/occ

Deposit insurance + state nonmembers

FDIC

After Synapse, FDIC proposed daily reconciliation requirements for banks holding fintech custodial / FBO accounts. Confirm whether a given notice is a final rule, withdrawn NPR, or supervisory guidance before citing it as binding. The operational lesson is independent bank-side records of beneficial owners.

GET /api/baas/fdic

State member banks

Federal Reserve

June 2024 cease-and-desist against Evolve Bank & Trust cited an ineffective risk-management framework for fintech partnerships. The order ran at the bank, not at the middleware.

GET /api/baas/fed

Consumer harm

CFPB

August 2025 adversary proceeding against Synapse; stipulated judgment September 2025. November 2025: about $46.2 million from the Civil Penalty Fund for affected end users — reported as the first such use in a BaaS failure. Figures are the Bureau's, not SSDF's audit.

GET /api/baas/cfpb

Ch. 560 clerk

Florida OFR

Office of Financial Regulation. Money transmitters, payment-instrument sellers, and (after HB 273, effective 1 Jan 2023) virtual-currency transmission. Florida has no statutory agent-of-the-payee exemption of the Texas/California type. Closed-loop store credit redeemable only at SSDF is the existing posture for Desk Credits.

GET /api/baas/fl_ofr

Docket

Sponsor bank

2024-01

FDIC consent order — Lineage Bank

FDIC consent order against Lineage Bank on related BaaS / fintech-program grounds, before the Synapse petition. Pattern: the chartered bank is the examination target.

Clerk: FDIC

GET /api/baas/lineage-fdic

Middleware failure

2024-04-22

Synapse Chapter 11

Synapse Financial Technologies, Inc. filed Chapter 11 in the Central District of California, Case No. 1:24-bk-10646. Middleware connecting fintech apps to partner banks. It did not hold a bank charter. Reported estimates of end-user funds frozen exceed $200 million; ledger shortfall estimates cluster around $85–95 million. Those are reported ranges, not an SSDF count.

Clerk: U.S. Bankruptcy Court, C.D. Cal.

GET /api/baas/synapse-petition

Sponsor bank

2024-06

Federal Reserve C&D — Evolve Bank & Trust

Federal Reserve cease-and-desist against Evolve, a primary Synapse partner bank, citing ineffective risk management of fintech partnerships. Partnership agreements that assigned compliance to the fintech did not move the order off the bank.

Clerk: Federal Reserve

GET /api/baas/evolve-fed

Watch the NPR

2024-10

FDIC custodial-account recordkeeping proposal

FDIC proposed that banks holding custodial accounts for fintech middleware maintain their own daily reconciled records of beneficial owners rather than relying on the middleware ledger. Subsequent coverage reported the NPR was withdrawn. Treat the operational floor as independent bank-side reconciliation; do not cite a withdrawn NPR as a final rule.

Clerk: FDIC

GET /api/baas/fdic-fbo-proposal

Consumer fund

2025-09

CFPB stipulated judgment — Synapse

CFPB adversary proceeding August 2025; stipulated final judgment September 2025. November 2025 Civil Penalty Fund allocation of about $46.2 million for affected end users. First reported use of that fund in a BaaS collapse.

Clerk: CFPB

GET /api/baas/cfpb-synapse

Congressional clerk

2026-05-20

House Financial Services — Synapse record

Subcommittee hearing BA21, 20 May 2026. Written testimony restates the middleware-vs-bank split: Synapse reconciled FBO sub-ledgers; partner banks held the pooled accounts; end users waited while each party pointed at the other.

Clerk: U.S. House, Financial Services

GET /api/baas/house-baas-2026

Actors — mapped, not endorsed

The middle ledger

failed

Synapse Financial Technologies

California middleware. No bank charter. Chapter 11 in April 2024 after FBO reconciliation broke. Catalogued as the failure mode, not as a vendor to buy.

GET /api/baas/synapse

Primary Synapse partner bank

enforcement

Evolve Bank & Trust

Chartered bank that held FBO accounts used by Synapse programs. Federal Reserve cease-and-desist June 2024.

GET /api/baas/evolve

FDIC order, then Synapse fallout

enforcement

Lineage Bank

Sponsor bank named in FDIC consent (Jan 2024) and later in Synapse-related litigation coverage.

GET /api/baas/lineage

OCC BSA/AML

enforcement

Blue Ridge Bank

OCC consent order on Bank Secrecy Act / AML deficiencies in a BaaS-active bank. Same lesson: the charter is where the order lands.

GET /api/baas/blue-ridge

OCC-chartered digital asset bank

agentic_bank

Anchorage Digital Bank

May 2026 Agentic Banking: institutional rails so AI agents can hold funds and pay under KYA, policy, and audit. Federally chartered crypto bank. This is a bank product. It is not a merchant atlas.

GET /api/baas/anchorage

Card for agents

msb

Interlace Agent Card

Virtual Visa/Mastercard for AI agents with spend caps, merchant allow-lists, time windows, and just-in-time funding. Publicly described as MSB-licensed and PCI DSS Level 1. Card-network controls are not x402 exact.

GET /api/baas/interlace

Embedded-finance platform

mapped

Unit

API-first accounts, cards, payments, lending via sponsor banks. Catalogued as a national BaaS pitch, not a Florida OFR opinion and not an SSDF integration.

GET /api/baas/unit

US bank-partner coordination

mapped

Treasury Prime

US API layer sitting on sponsor banks. Same national pitch: the platform is not the charter.

GET /api/baas/treasury-prime

EU BaaS bank

mapped

Solaris

German bank / BaaS platform. Different clerk (BaFin, DORA). Included so an agent does not treat a US FBO story as an EU passport.

GET /api/baas/solaris

Embedded treasury for Stripe users

mapped

Stripe Treasury

Treasury-as-a-service on sponsor banks for platforms already on Stripe. SSDF's checkout custodian is Coinbase Business, not Stripe Treasury.

GET /api/baas/stripe-treasury

Florida 560 vs the national pitch

National pitch

The national BaaS pitch

License the bank. Embed accounts, cards, and payouts via API. Hold end-user balances in an FBO. Let middleware sub-ledger the beneficial owners. Sell the brand, not the charter.

Synapse showed the sub-ledger can diverge from the bank. Post-2024 orders showed the charter still eats the exam. Florida showed the exemptions you were counting on may not exist.

Residual

Fla. Stat. ch. 560 (Money Services Businesses)

The national BaaS pitch (API + sponsor bank + FBO + program manager) is written for a 50-state product. Florida is the residual risk point because the statute does not give the same exemptions. This atlas exists so an agent does not paste a national pitch over ch. 560.

Florida ch. 560 lacks a Texas/California-style agent-of-the-payee exemption and a clean closed-loop gift-card walkaway. OFR declaratory practice looks at the economics. Contract paper that says 'we are the merchant's agent' is not bulletproof here.

Part II — payment instruments and funds transmission

The transmission question. Intermediated models — receive, then send onward — are the risk. First-party sale of a digital SKU settled by Coinbase Business is retail, not a third-party send.

Part V — payment stablecoin issuers

Florida's stablecoin-issuer chapter. SSDF accepts USDC. SSDF does not issue a payment stablecoin. Circle is the USDC issuer. GENIUS is the federal clerk for issuers, not for retailers.

Part VI — virtual currency kiosk businesses

Kiosk operators. Irrelevant to an electronic catalog. Listed so an agent does not confuse a storefront with an ATM.

Closed loop

Desk Credits are closed-loop store credit, redeemable only for SSDF SKUs, never cash, never a third-party merchant. That is the existing Ch. 560 posture. Opening those credits to other brands would reopen the analysis.

A Florida retailer that prices in USD and lets Coinbase Business take USDC on Base for its own SKUs is not, on that fact alone, a money transmitter. A marketplace, an agent wallet SSDF custodied, or a card SSDF issued would be a different fact pattern.

GET /api/baas/florida

Agent accounts vs merchant 402

Anchorage sells regulated accounts for agents. Interlace sells a card the agent cannot take to an ATM. x402 exact is a typed USDC authorization to a merchant payTo. Coinbase Spend Permissions and card-network rules do not bind an exact PAYMENT-SIGNATURE. SSDF is the merchant on that last rail.

A Passport attests that a buyer paid a SKU. It is not CIP, not KYA, and not 'this agent is the customer.' Sit this atlas next to Agent Identity Protocol.