Embedded payments explained: who holds the money, what it earns and how to evaluate a provider

What are embedded payments and embedded finance?

Embedded payments are payment acceptance, payouts or bill payment that run inside software whose main job is something else: a restaurant point of sale, a marketplace, a vertical SaaS product, an ERP or an accounts-payable tool. Embedded finance is the wider version, adding deposit accounts, cards, lending and treasury to the same software. In both cases the software company owns the screen and the customer relationship; a licensed payments company processes the money; and a bank, or a licensed money transmitter that banks with one, holds it. When the bank is a partner that lends its charter, its BSA/AML programme and its access to the card networks and Federal Reserve rails to non-bank programmes, the industry calls it a sponsor bank, and the arrangement banking-as-a-service (BaaS).

The structure matters because money in these programmes is usually pooled. A fintech or middleware company opens one custodial account at the bank “for the benefit of” its users (an FBO account) and keeps its own sub-ledger of who owns what. The FDIC described the problem in its September 2024 proposal: custodial accounts “may hold funds of many thousands of consumers and businesses, and the bank may not readily know or be able to determine the individual owners of funds in the custodial account”. That is the gap that opened at Synapse, and it is why the bank in Figure 1 is drawn as the one party that holds the money and carries the legal duties.

There are three common shapes. In the payment-facilitator (PayFac) model the software company or its processor signs the merchant as a sub-merchant under its own acquiring relationship: Toast does this for its restaurants and Square for its sellers. In the platform model a processor such as Stripe Connect or Adyen for Platforms onboards the platform's users, and the platform earns a share of the fee. In the direct bank model the platform contracts the bank itself through APIs, without a middleware ledger in between: J.P. Morgan Wallet and Fifth Third's Newline sell this. AP-automation vendors split the same way on one question, covered in the evaluation section below: whether supplier payments leave the customer's own bank account or pass through funds the vendor holds.

Who supplies embedded payments: payment platforms, sponsor banks or large banks?

All three, and the lines are moving. Payment platforms are taking their own regulated licences so they depend less on a sponsor. According to the sources on our profiles, Stripe MALPB, a Georgia merchant acquirer limited purpose bank, became the acquirer for Stripe's Visa and Mastercard transactions under terms dated 28 May 2026 (Stripe); Checkout.com went live with US direct acquiring under its own Georgia charter in September 2026 (Checkout.com); PayPal applied in December 2025 for PayPal Bank, a Utah industrial loan company (PayPal); and Adyen is a licensed credit institution. Fintechs that rented charters are applying for their own: the American Banker reported on 11 September 2026 that Nubank launched in the US through a sponsor partnership with Lead Bank while it works through the OCC's conditions for its own charter. The table lists what each platform publishes; rows marked “profile” are sourced on the linked profile page. Volumes, prices and AI claims are the companies' own, with the date.

On the bank side there are two groups. Sponsor banks (Cross River, The Bancorp, Lead Bank and the smaller banks in the enforcement table below) provide the charter and the rails to many fintech programmes at once. Large banks sell embedded products to platforms and corporates directly, with the bank's own ledger as the system of record. Goldman Sachs is the counter-example: the firm agreed to transition the Apple Card, the best-known embedded consumer programme of the last decade, to another issuer, and its 2025 results show what leaving cost.

Two facts in that table explain most sponsor-bank risk. At The Bancorp three partners held 47% of deposits at year-end 2025, so a single programme leaving moves the bank's funding: Chime, one of them, said on 8 September 2026 that it would buy a bank of its own (see the Bancorp profile). And Cross River lists over 100 technology partners on one core, which is why a sponsor bank's third-party risk programme, not the fintech's, is what examiners test.

What went wrong in banking-as-a-service, from the Synapse collapse to the consent orders?

Synapse Financial Technologies sat between fintech apps and their partner banks, keeping the ledger of which end user owned which dollar in the banks' pooled accounts. It filed for Chapter 11 on 22 April 2024. According to the CFPB, “the partnering banks determined that the total funds they were holding for consumers was less than the total amount of consumer funds reflected in records Synapse provided to them, reflecting a shortfall of between $60 and $90 million”, and consumers “did not have any access to their funds for weeks or months”. The Bureau filed a complaint and proposed stipulated judgment on 21 August 2025; the court entered it on 12 September 2025 with a $1 civil money penalty, set at that level so the Bureau could pay victims from its Civil Penalty Fund. Evolve Bank & Trust, a Synapse partner, had been put under a Federal Reserve cease-and-desist order two months after the bankruptcy, on 14 June 2024, which the Board said requires Evolve to oversee its fintech partners “including through enhanced procedures related to recordkeeping”.

Synapse was the visible failure inside a wider wave. Between March 2023 and April 2026 the FDIC, the OCC and the Federal Reserve put banks with fintech, prepaid and payment-processing programmes under formal orders; the table covers the eight we read in full, so it is a sample, not a census. It reads each order's own text: who issued it, when it was signed or issued, and what it requires. The pattern is consistent. The bank must inventory its fintechs and their downstream partners, rebuild BSA/AML monitoring for customers it never onboarded directly, look back over past transactions, write exit plans, and, in the stricter orders, get the regulator's or the board's approval before adding a partner or product.

The orders also show the wave turning without ending. The OCC terminated Blue Ridge Bank's order on 13 November 2025, saying the bank's safety and soundness no longer required it, while new orders kept arriving: the OCC's order against Community Federal Savings Bank, signed 24 April 2026, says the bank “has significantly grown its payment processing line, relative to its size” since 2020 and that its monitoring thresholds had not been tuned to that line. Orders are modified and lifted over time, so check the FDIC, OCC and Federal Reserve enforcement databases for current status before relying on any row. Supervisory expectations did not change with the administration: the interagency third-party risk guidance of June 2023 applies to every programme in this table.

What happened to the FDIC's custodial-account recordkeeping rule?

On 17 September 2024 the FDIC board proposed a rule for certain custodial accounts holding deposits that non-banks accept on behalf of consumers and businesses: banks holding them would have to keep accurate records to determine the individual owner of the funds, “including a requirement to reconcile the account for each individual owner on a daily basis”, and these duties would apply even if the bank uses a third party to keep the records. Then-Chairman Martin Gruenberg tied it directly to deposits “placed in a bank by a third party such as Synapse”. On 3 March 2025 the FDIC board withdrew three outstanding proposals (brokered deposits, corporate governance and the Change in Bank Control Act) and incentive-compensation authority; the custodial-account proposal was not among them. We found no final rule and no withdrawal on fdic.gov as of October 2026, so the proposal remains open but not in force. Banks running FBO accounts are being held to its substance one consent order at a time: Lineage's 2024 order already required a review of reserve-account adequacy for all fintech liabilities, and Evolve's requires better recordkeeping.

What do embedded payments earn: take rates from the companies' own filings?

“Take rate” means different things in different filings, so the table puts each company's revenue line next to the volume it reports for the same period and divides one by the other. The ratio is our arithmetic; the inputs are quoted from the filing or release. The spread is wide because the numerators differ: Toast reports gross fintech revenue, before it pays interchange to card issuers, while Adyen and Marqeta report net revenue after those pass-through costs; PayPal reports both a gross figure and transaction margin dollars after transaction expense and losses.

Three conclusions follow for a platform deciding whether to embed. First, the money in card acceptance is mostly interchange that passes through: Toast's 2.59% gross becomes far less after issuers are paid, and Adyen's 0.16% net is closer to what a processor keeps. Second, B2B payables earn less per dollar than consumer card acceptance but more per transaction: BILL earns about 0.33% of TPV in transaction fees, and AvidXchange earned $5.80 per transaction in Q4 2024. Third, float is a real line for anyone who holds funds in transit: BILL earned $148.4 million of interest on customer funds in fiscal 2026. Stripe's own Connect price list, retrieved in October 2026, shows the platform side: where the platform handles pricing it pays $2 per monthly active account and 0.25% + 25¢ per payout, and keeps whatever markup it sets on top of the processing fee. None of these companies discloses a separate take rate for its embedded or platform segment; that figure is not on the record.

How should a software platform or ERP evaluate an embedded-payments or AP-automation provider such as Medius?

Start with the question that separates the vendors, not with features: where does the money sit between the approval and the supplier's bank? Medius, an AP-automation vendor, launched Medius Payments on 24 June 2025 as “an embedded payment solution that enables finance teams to securely approve and execute payments, all within one unified accounts payable platform”, and its release says “payments are routed through customers' existing bank accounts, allowing them to retain control over their cash”. It supports ACH, SEPA, BACS, CHAPS, BankGiro, wire, checks and virtual cards, with “Straight Through Payments” that build and execute batches from Medius without ERP file uploads or middleware. BILL, Tipalti and AvidXchange run payments through their own platforms: BILL, for example, reports float revenue on “funds held for customers”. Neither model is wrong, but they put different parties in the Synapse position, and a buyer should know which one it is signing.

Medius's claims are its own: it says its AI is trained on “over $400 billion of annual transaction data” and that it was named a Leader in Gartner's 2026 Magic Quadrant for Accounts Payable Applications (dated 18 June 2026); Medius publishes no payment volume, revenue or take rate, so its economics cannot be compared with BILL's. This site no longer profiles Medius as a vendor, and nothing here is an endorsement. The checklist below is the same for any provider in the table.

• Flow of funds. Ask for the funds-flow diagram. Does money leave the customer's own account (Medius Payments, bank-owned AP), or move into a vendor-controlled or FBO account first? If the latter, which bank holds it, under what licence, and is the vendor's sub-ledger reconciled to the bank's daily, as the FDIC's 2024 proposal would require?
• Sponsor-bank health. Name the bank and check it against the enforcement table above and the regulators' order databases. An order that requires regulator non-objection for new partners (Cross River 2023, Blue Ridge 2024) can delay a launch by months.
• Concentration and exit. How many programmes share the bank, and what happens if it exits the vendor? Thread Bank's order required an exit plan covering third, fourth and fifth parties; ask the vendor for its equivalent, and for a data-export path for payee, remittance and ledger data.
• Rails and methods. ACH, same-day ACH, wire, RTP or FedNow, cross-border, virtual card, check. Who pays the card interchange and who keeps the rebate? Virtual-card programmes are where AP vendors earn per-transaction revenue.
• Pricing basis. Per transaction, per active account, basis points on volume or subscription. Compare to the published references: Stripe Connect at $2 per active account and 0.25% + 25¢ per payout; AvidXchange's $5.80 transaction yield; BILL at about 0.33% of TPV.
• Fraud controls. Vendor bank-detail changes are the main AP fraud vector. Ask how the provider verifies a changed bank account, whether it scores payees, and who bears the loss on a misdirected payment.
• AI with an override. Ask which steps an AI model or agent performs, whether a human approves releases of funds, and how decisions are logged. Tipalti's release says users can review and override AI decisions on approvals and payments; Coupa describes its payment-batch agent as running batches autonomously, so ask where the human release step is.
• ERP integration and reconciliation. Native connectors to the ERP, posting of payments and fees back to the general ledger, and remittance data to suppliers. Medius says its ERP integration gives a synchronised audit trail; test it on your own close.
• Regulatory perimeter. Money-transmitter licences in each US state (or a bank), EMI or PI licences in Europe, sanctions screening, 1099/W-9 handling, and SOC 2 reports.
• Bank-owned alternatives. If the platform has scale, price a direct bank API (J.P. Morgan Wallet, Newline, U.S. Bank) against a vendor: one ledger, the bank's balance sheet, and no middleware between the two.

Where does AI sit in embedded payments and AP automation?

AI shows up at four points, and the vendors' own numbers are concentrated in two of them. Fraud and risk is the oldest: Stripe said in May 2025 that its Payments Foundation Model, trained on tens of billions of transactions, raised its detection rate for card-testing attacks on large businesses by 64%; Marqeta added an AI risk score to authorisation decisions in March 2026; Elavon's AI-driven Pay Defense won an industry award in 2026 (all on the linked profiles). Routing and acceptance is the second: Checkout.com says Intelligent Acceptance has unlocked over $20 billion of merchant revenue and runs 26,000 optimisations a minute (June 2026, profile), and Adyen says Uplift and Dynamic Identification raised customer conversion by 0.9 percentage points on average by the end of H1 2026.

Invoice capture and coding is the third, and the core of AP automation: Tipalti lists a tax-form scan agent and a purchase-request agent, and a customer quoted in its release credits invoice capture; BILL lists W-9 filings, touchless transactions and automatic reconciliation among the first BILL AI agents launched in fiscal 2026, and Medius describes approval rules, fraud detection and audit trails built into its payment workflow. Reconciliation and payment operations is the fourth and newest: Coupa says its Navi Payment Batch Creation Agent ran 14 payment batches of 2,395 payments worth $20.1 million in its first five weeks in production for about $27 of AI credits (August 2026). Banks are opening their own systems to these agents: Fifth Third's Newline runs a Model Context Protocol server, extended with Skills in April 2026, so that clients' AI models can call the bank's payment tools (profile), and U.S. Bank lists agentic commerce among its embedded-payments initiatives.

Two cautions. None of the AP vendors publishes an error rate for its extraction or coding models, so accuracy claims cannot be compared; ask for the customer's own touchless rate after ninety days. And the sponsor-bank orders above are mostly about monitoring: a bank that cannot see its fintechs' end customers cannot score them, which is why The Bancorp says its first in-house AI tool writes financial-crimes narratives (see its profile and our AI for AML page).

Which profiled banks disclose embedded-finance, BaaS or fintech-partner AI?

Computed from this site's bank profiles: every recorded use case whose name or detail mentions embedded payments or finance, banking-as-a-service, a sponsor bank or fintech partners, sorted by status and then by assets. 7 entries match. Most are announcements, which is the honest state of the record: few banks disclose AI inside their embedded or BaaS businesses specifically. The profiles also record embedded-payments partners that are not AI, such as Huntington's Payabli integration for business clients and FNBO as originating bank for dhango's SaaS payments.

1. Synapse Financial Technologies, Inc. (enforcement action) — Consumer Financial Protection Bureau, Sep 15, 2025 (consumerfinance.gov)
2. FDIC Proposes Deposit Insurance Recordkeeping Rule for Banks' Third-Party Accounts — FDIC, Sep 17, 2024 (fdic.gov)
3. FDIC Board of Directors Withdraws Four Outstanding Proposed Rules — FDIC, Mar 3, 2025 (fdic.gov)
4. Federal Reserve Board issues an enforcement action against Evolve Bancorp, Inc. and Evolve Bank & Trust — Federal Reserve Board, Jun 14, 2024 (federalreserve.gov)
5. Consent Order FDIC-22-0040b, Cross River Bank — FDIC, Mar 8, 2023 (orders.fdic.gov)
6. Consent Order FDIC-23-0041b, Lineage Bank — FDIC, Jan 29, 2024 (orders.fdic.gov)
7. Consent Order FDIC-23-0110b, Sutton Bank — FDIC and Ohio Division of Financial Institutions, Feb 1, 2024 (orders.fdic.gov)
8. Consent Order FDIC-23-0038b, Piermont Bank — FDIC, Feb 26, 2024 (orders.fdic.gov)
9. Consent Order FDIC-24-0022b, Thread Bank — FDIC, May 21, 2024 (orders.fdic.gov)
10. Consent Order AA-ENF-2023-68, Blue Ridge Bank, N.A. — Office of the Comptroller of the Currency, Jan 24, 2024 (occ.gov)
11. Order Terminating the Consent Order AA-ENF-2025-58, Blue Ridge Bank, N.A. — Office of the Comptroller of the Currency, Nov 13, 2025 (occ.gov)
12. Consent Order AA-ENF-2025-21, Community Federal Savings Bank — Office of the Comptroller of the Currency, Apr 24, 2026 (occ.gov)
13. Stripe Connect pricing — Stripe, Oct 16, 2026 (stripe.com)
14. Adyen publishes H1 2026 financial results — Adyen, Aug 13, 2026 (adyen.com)
15. PayPal Reports Second Quarter 2026 Results (Exhibit 99.1) — PayPal Holdings via SEC EDGAR, Jul 28, 2026 (sec.gov)
16. Block Q2 2026 Shareholder Letter (Exhibit 99.1) — Block, Inc. via SEC EDGAR, Aug 5, 2026 (sec.gov)
17. Toast Announces Second Quarter 2026 Financial Results — Toast via Business Wire (Yahoo Finance), Aug 4, 2026 (finance.yahoo.com)
18. BILL Holdings Annual Report on Form 10-K for fiscal 2026 — BILL via SEC EDGAR, Aug 19, 2026 (sec.gov)
19. BILL Reports Fourth Quarter and Fiscal Year 2026 Financial Results — BILL via Business Wire (Yahoo Finance), Aug 19, 2026 (finance.yahoo.com)
20. AvidXchange fourth quarter and full year 2024 results (Exhibit 99.1) — AvidXchange via SEC EDGAR, Feb 26, 2025 (sec.gov)
21. TPG & Corpay Complete Acquisition of AvidXchange — AvidXchange via GlobeNewswire (Yahoo Finance), Oct 15, 2025 (finance.yahoo.com)
22. Medius Launches Medius Payments to Fully Embed Payment Execution Into AP Automation — Medius via PR Newswire, Jun 24, 2025 (prnewswire.com)
23. Medius placed in 2026 Gartner Magic Quadrant for Accounts Payable Applications — Medius via PR Newswire, Jun 23, 2026 (prnewswire.com)
24. Tipalti Secures $200 Million in Growth Financing to Drive Next Wave of AI Innovation in Finance — Tipalti via PR Newswire, Sep 24, 2025 (prnewswire.com)
25. Coupa's September Release Accelerates Agentic Spend Capabilities — Coupa via Yahoo Finance, Aug 20, 2026 (finance.yahoo.com)
26. Cross River Receives $50M to Fuel Expansion Across AI, Crypto, and Embedded Finance — Cross River via Business Wire, Mar 31, 2026 (businesswire.com)
27. Nubank launches in the U.S. through a sponsor bank — American Banker, Sep 11, 2026 (americanbanker.com)
28. BILL Transforms SMB Payments With Embedded Finance (J.P. Morgan Wallet) — J.P. Morgan Payments, May 20, 2026 (jpmorgan.com)
29. U.S. Bancorp investor conference presentation (Form 8-K exhibit) — U.S. Bancorp via SEC EDGAR, Nov 6, 2025 (sec.gov)
30. Goldman Sachs Reports Fourth Quarter and Full Year 2025 Earnings Results — Goldman Sachs via SEC EDGAR, Jan 15, 2026 (sec.gov)