Fintech Architecture — Deep Reference

Fintech architecture is the engineering discipline that turns financial primitives — accounts, balances, payments, credit decisions, identity attestations — into composable software services. The stack as it exists in 2026 is the product of a decade-long collapse of the monolithic core banking platform (Fiserv DNA, FIS Profile, Temenos T24 legacy, Jack Henry SilverLake) into cloud-native, ledger-centric, API-first systems and the parallel rise of real-time payment rails that obsoleted T+1 batch settlement for retail flows. This note maps the modern stack: core banking modernization (Mambu + Thought Machine + 10x + Pismo + Tuum + FintechOS), real-time payment rails (FedNow + RTP + UK Faster Payments + SEPA Instant + Pix + UPI + PayNow + NPP + BI-FAST + PromptPay + CoDi + PayShap), card issuing platforms (Marqeta + Lithic + Stripe Issuing + Highnote + Galileo + Bond), KYC/AML stack (Alloy + Persona + Onfido + Jumio + Veriff + Sumsub + SEON + Sardine + Unit21), open banking APIs (Plaid + Finicity + MX + Yodlee + Akoya + Dwolla + Atomic + PSD2/PSD3 + UK Open Banking + Brazil Open Finance + Australia CDR), embedded finance (BaaS — Synapse collapse + Unit + Treasury Prime + Column + Increase + Synctera; embedded payments — Stripe + Adyen + Mollie; embedded lending — Affirm + Klarna + Pipe + Capchase + Parafin; embedded insurance — Cover Genius + Tint + Boost), neobank stacks (Chime + Varo + Dave + Aspiration + Greenwood + Step + Monzo + Starling + Revolut + Nubank + C6 + Inter + KakaoBank + Toss + WeBank), fraud and risk (Sift + Forter + Riskified + Signifyd + DataVisor + Featurespace + Hawk AI + ComplyAdvantage), crypto rails (Fireblocks + Anchorage + Coinbase Custody + BitGo + Copper + Komainu + USDC + USDT + PYUSD + RLUSD + USDe + DAI), regtech (compliance.ai + Saifr + Pendo Systems + Behavox), real-time risk (Drift + Apex Clearing + Pershing X + DriveWealth + Alpaca + Public.com), and back-office broker-dealer infrastructure.

1. Core banking modernization — the post-monolith stack

The legacy core banking stack — Fiserv DNA, FIS Profile and Horizon, Jack Henry SilverLake, Temenos T24 — emerged from 1970s-1990s mainframe era when batch overnight posting was the only realistic settlement model. Each platform fuses customer master, account master, general ledger, transaction processing, statement generation, and regulatory reporting into a single application running on IBM z/OS or AIX, with COBOL or PL/1 business logic and DB2 or VSAM persistence. The 2010s saw a wave of cloud-native rebuilds that decompose this monolith into: (1) a ledger engine that records balances and journal entries with strong consistency, (2) a product engine that defines account types, fee schedules, interest accruals, and lifecycle events as configuration, (3) an event bus that publishes balance changes to downstream consumers (regulatory reporting, fraud, marketing, statements), and (4) a clean API surface for fintechs to consume.

Mambu (Berlin, founded 2011 by Eugene Danilkis, Frederik Pfisterer, Sofia Nunes) is the first cloud-native core, originally built for microfinance institutions in emerging markets. The Mambu Process Orchestrator defines lending and deposit products as YAML configuration; the engine handles accrual, dunning, restructuring without code changes. Mambu raised $235M Series E in December 2021 at a $5.3B valuation. Production customers include N26, OakNorth, ABN AMRO New10, Mercedes-Benz Bank Solutions, BancoEstado Microempresas (Chile).

Thought Machine (London, founded 2014 by Paul Taylor, ex-Google) built Vault Core as a Kubernetes-native banking platform. Smart Contracts in Python define product behavior — interest formulas, fee triggers, transaction validation — executed by a custom contract VM. Vault separates the ledger (event-sourced double-entry) from the product layer, and runs on AWS, GCP, or Azure. Customer base: Lloyds, Standard Chartered Mox (Hong Kong), Curve, Atom Bank, JPMorgan Chase UK (the Chase consumer brand outside the US, launched September 2021 on Vault). JPMorgan led a $200M Series D in 2022 at $2.7B valuation.

10x Banking (London, founded 2016 by Antony Jenkins, ex-Barclays CEO) sells 10x SuperCore with a similar event-sourced ledger and product-config separation. Westpac launched its BT consumer-banking platform on 10x in 2023. Chase US has reportedly piloted 10x for some product lines. Funding: $187M Series C from BlackRock 2022.

Pismo (São Paulo, founded 2016 by Ricardo Josua, Daniela Binatti) provides processing for cards, banking, and payments across LATAM. Visa acquired Pismo for $1B announced June 2023, closing January 2024 — Visa’s bet on owning issuer processing infrastructure that competes with Marqeta and Galileo for the new neobank/BaaS issuer wave.

Tuum (Tallinn, founded 2019 by Vilve Vene ex-Estonian-Banking-IT) is a Mambu-style modular core targeting EU community banks and fintechs. Customers: LHV Bank UK, Pacific Western Bank EU operations, ASA Bank.

FintechOS (Bucharest, founded 2017 by Teodor Blidarus, Sergiu Negut) is an “evolutive infrastructure” platform that sits on top of legacy cores and adds digital-first product origination, onboarding, servicing for banks that cannot rip-and-replace. Customers: Erste Group, Raiffeisen Bank, Howden Group.

The architectural contract common to all of these: the ledger is the source of truth for balances and entries; products are pure configuration or Python/DSL scripts; events stream out to Kafka, Pub/Sub, or Kinesis; the API is REST or gRPC with OAuth2 and idempotency keys. Compare this to the legacy stack where business logic, ledger, and reporting all live in a single COBOL codebase querying VSAM files. The new core typically processes 10,000-100,000 transactions per second per cell, with horizontal scaling via cell-based architecture; legacy cores are vertically scaled with overnight batch windows.

2. Real-time payment rails — the global map

The shift from T+1 batch ACH to instant settlement is the most visible structural change in retail payments since the introduction of the credit card. By 2026 the major rails:

United States — FedNow launched July 20, 2023 by the Federal Reserve as a 24/7/365 instant payment service between depository institutions, settling on Fed master accounts. Initial limit $500K per transaction, raised in stages. By Q4 2025 over 1,300 banks and credit unions participate. FedNow uses ISO 20022 messaging. Competes with RTP from The Clearing House.
United States — RTP (Real-Time Payments) launched November 2017 by The Clearing House Payments Company (owned by 24 large US banks). RTP cleared earlier than FedNow and has broader reach among large banks; by 2025 over 60% of US deposit accounts have RTP-reachable account numbers. Limit $10M per transaction (raised from $1M in February 2024). ISO 20022 messaging; settlement on a prefunded Joint Account at the Federal Reserve.
United Kingdom — Faster Payments Service (FPS) launched May 2008, the first major real-time payment scheme. Operated by Pay.UK (successor to FPSL). Limit £1M per transaction (raised from £250K in February 2022, then to £1M). Round-the-clock settlement. Processed ~4.5B transactions in 2024.
European Union — SEPA Instant Credit Transfer (SCT Inst) launched November 2017 by the European Payments Council. EUR 100,000 per transaction (raised from EUR 15,000 in 2020). The Instant Payments Regulation (Regulation EU 2024/886) mandates all EU banks receive SCT Inst by January 2025 and send by October 2025 — fundamentally restructuring SEPA from an opt-in rail to a mandatory baseline.
Brazil — Pix launched November 16, 2020 by Banco Central do Brasil. Pix is the canonical case study of state-driven payment rail success: 24/7 instant transfers, free for consumers, mandatory participation for all licensed banks above a size threshold. By end-2024 over 160M Brazilian adults used Pix and the rail processes more transactions than credit cards. Pix Automatic (recurring payments) launched 2024; Pix Internacional under development. BCB also runs DREX (the wholesale CBDC pilot) on the same operational team.
India — UPI (Unified Payments Interface) launched April 2016 by NPCI (National Payments Corporation of India). UPI processes ~12 billion transactions per month (2024) — the largest real-time payment volume of any single system in the world. Operates over the IMPS rail; consumer apps include PhonePe (Walmart-owned), Google Pay, Paytm (PayTM Payments Bank shut by RBI March 2024), Amazon Pay, BHIM. UPI Lite enables small-value offline transactions; UPI International launched in Singapore (PayNow link), UAE, France, Mauritius.
Singapore — PayNow launched July 2017 by ABS (Association of Banks in Singapore), interlinked with India’s UPI February 2023, Thailand’s PromptPay April 2021, Malaysia’s DuitNow March 2023.
Australia — NPP (New Payments Platform) launched February 2018, operated by NPP Australia Limited (now the entity AusPayNet). PayID overlay (proxy address); Osko service for consumer instant transfers (BPay-operated).
Indonesia — BI-FAST launched December 2021 by Bank Indonesia, replacing the SKNBI clearing service. Processing over 1B transactions/year by 2024.
Thailand — PromptPay launched January 2017 by Bank of Thailand and ITMX. Foundational for QR-code payments via the Thai QR Standard.
Mexico — CoDi launched September 2019 by Banco de México on the SPEI rail (which itself runs near-instant since 2004). Adoption has been slower than Pix or UPI.
South Africa — PayShap launched March 2023 by BankservAfrica and the major South African banks (Absa, FNB, Nedbank, Standard Bank, Capitec).
Hong Kong — FPS (Faster Payment System) launched September 2018 by HKMA, the first major real-time multi-currency rail (HKD + RMB).
Canada — RTR (Real-Time Rail) under development by Payments Canada, target launch 2026 after multiple delays. Will replace the existing AFT batch system for low-value instant.

ISO 20022 is the messaging standard adopted by every major modern RTP rail. Compared to legacy fixed-format messages (ANSI X9.5, MT messages from SWIFT), ISO 20022 is XML or JSON with structured remittance data, enabling rich invoice-linked reconciliation. SWIFT’s MT-to-MX migration completed November 2025 for cross-border CBPR+ messages.

The economic structure of these rails varies. FedNow and RTP charge banks per-transaction fees ($0.045 + small participation fees); the banks may or may not pass these to merchants/consumers. Pix is free for consumers and free for natural persons by BCB mandate, with merchant fees capped. UPI is free for consumers (Indian government subsidizes NPCI). UK FPS charges only inter-bank settlement. The “free for consumer” model in Pix and UPI drove the explosive adoption that has not yet materialized in the US.

3. Card issuing platforms — modern issuer processors

Historically, card issuing was vertically integrated inside large banks (Chase, BofA, Citi, Capital One) or outsourced to a few processors (TSYS — now part of Global Payments; FIS; Fiserv; First Data — also Fiserv). The 2010s saw a wave of API-first issuer processors built to serve fintechs that didn’t want to integrate with a 1990s-vintage mainframe.

Marqeta (Oakland, founded 2010 by Jason Gardner) was the pioneer. Marqeta processes physical and virtual card transactions on rails it leases from issuing banks (Sutton Bank, Bancorp, Pathward NA, ICBA Bancard). Real-time authorization via webhooks enables programmable cards: just-in-time funding (the card is loaded with funds only when the authorization request arrives), per-merchant restrictions, dynamic limits. Marqeta IPO June 2021 at $25/share (NASDAQ: MQ), peaked at $37, traded $3-5 by 2024 amid takeover speculation. Major customers: DoorDash (Dasher payment cards), Instacart, Uber, Klarna, Square (Cash App debit), Affirm.

Lithic (founded 2014 as Privacy.com by Bo Jiang and Jason Kruse) splits between a consumer product (Privacy.com — virtual card numbers for online privacy) and a B2B issuer-processor (Lithic). Lithic competes directly with Marqeta on programmable card APIs.

Stripe Issuing launched 2018 as part of Stripe’s bundle. Tightly integrated with Stripe payment processing — a Stripe merchant can issue cards to its workers, vendors, or customers without leaving Stripe’s stack. Widely used by marketplaces, gig-economy companies, and B2B fintechs.

Highnote (founded 2020 by John MacIlwaine ex-Marqeta CTO) targets enterprise issuers with modern programmable-card capabilities and full ledger integration.

Galileo Financial Technologies (founded 2000 by Clay Wilkes in Salt Lake City, acquired by SoFi April 2020 for $1.2B) was the OG modern issuer processor — powered Chime, Robinhood, Varo, and many other early neobanks. Post-SoFi acquisition Galileo has expanded into BaaS and other services but lost share in the issuer-processor segment to Marqeta and Lithic.

Bond Financial Technologies (founded 2019, acquired by FIS December 2023) bundled BaaS and issuer processing; was a notable BaaS player before consolidation.

Episode Six (Austin) and Apto Payments (Oakland) are smaller players in enterprise issuer processing.

The economic model: issuer processors charge per-authorization fees (a few cents per transaction) plus monthly platform fees. The interchange fee (1.5-2.5% of transaction value for credit cards; 0.05% capped for debit under Durbin) is split between issuing bank (which takes the majority), the network (Visa/Mastercard — ~0.15%), and the processor (sometimes a small share). Programmable card volumes have grown 40-60% YoY through 2022-2024; the segment is one of the most-funded in fintech.

4. KYC and AML — the identity stack

Bank Secrecy Act (1970), Patriot Act (2001), and FinCEN regulations require depository institutions to verify customer identity and screen for sanctions, PEPs, and adverse media. The legacy approach — paper forms, manual review — does not scale to digital-first onboarding. A modern identity stack typically composes 4-6 vendors:

Identity verification (IDV): collect government-issued ID, selfie, run liveness check, OCR the document, verify against issuer database. Onfido (London, founded 2012, acquired by Entrust March 2024 for $650M) and Jumio (Palo Alto, founded 2010) are the legacy IDV market leaders. Persona (founded 2018 by Rick Song ex-Square, raised Series D $150M at $1.5B valuation 2021) modernized the API and UX. Veriff (Tallinn, founded 2015), Sumsub (founded 2015, London-based), and iProov (London, founded 2011, biometric face verification specialist) compete in adjacent segments.
KYC orchestration: aggregate multiple data sources (IDV, credit bureaus, sanctions screening, device intelligence) into a single decision engine. Alloy (founded 2015 by Tommy Nicholas, Charles Hearn, Laura Spiekerman, NYC, raised $165M Series C September 2022 at $1.55B) is the segment leader. Alloy customers include Ally, HMBradley, Brex, Petal, Public.com.
Fraud and risk intelligence: device fingerprinting, behavioral biometrics, transaction anomaly detection. SEON (Budapest, founded 2017) provides device intel + behavior; Sardine (founded 2020 by Soups Ranjan ex-Coinbase, Aditya Goel) focuses on fintech-specific fraud incl. ACH, instant payments, and crypto onramps; Unit21 (San Francisco, founded 2018) targets the AML/financial-crime workflow with case management.
Sanctions, PEP, adverse media screening: ComplyAdvantage (London, founded 2014), Refinitiv World-Check (LSEG-owned), Dow Jones Risk & Compliance Data, LexisNexis Bridger, Quantifind.
Continuous transaction monitoring (AML transaction monitoring system, TMS): Hawk AI (Munich, founded 2018), NICE Actimize (legacy enterprise), SAS Anti-Money Laundering (legacy enterprise), ThetaRay (founded 2013, Israel/UK), Quantexa (London, founded 2016, raised $129M Series E June 2023 at $1.8B). FinCEN’s Suspicious Activity Reports (SARs) and Currency Transaction Reports (CTRs) flow out of these systems.

Identity Trust Score — composite scores combining IDV, device, behavior, and consortium-data signals — have replaced single-vendor decisioning at most modern neobanks. Alloy’s Identity Decisioning Platform exemplifies the pattern.

Regulatory backdrop: the FinCEN Customer Due Diligence (CDD) Rule effective May 2018 requires identification of beneficial owners (≥25% equity holders) of legal-entity customers. The Corporate Transparency Act (CTA, January 2024) extended beneficial-ownership reporting directly to FinCEN (the BOI database), generating ~30M new filings in 2024-2025 before a December 2024 federal court injunction paused enforcement, then re-instated and modified through 2025. EU’s 6AMLD (effective June 2021) harmonized AML criminal penalties across member states; the EU AML Authority (AMLA) under the new AML Package (2024) takes direct supervision of high-risk cross-border firms from 2026.

5. Open banking APIs — the data-portability layer

Open banking — consumer-permissioned API access to bank account data and payment initiation — is a regulatory and engineering category that emerged from EU PSD2 (Payment Services Directive 2, adopted 2015, applied January 2018) and UK Open Banking (CMA Order 2017).

United Kingdom — Open Banking mandated the nine largest banks (CMA9) implement standardized APIs by January 2018, with the Open Banking Implementation Entity (OBIE) operating the standards. AISPs (Account Information Service Providers) and PISPs (Payment Initiation Service Providers) are licensed by FCA. The Joint Regulatory Oversight Committee (JROC) now oversees the next phase including variable recurring payments (VRP) and commercial models for ecosystem sustainability.

European Union — PSD2 required all banks to expose account-information and payment-initiation APIs to licensed TPPs (third-party providers) by September 2019. SCA (Strong Customer Authentication) — two-factor authentication on most card-not-present transactions — is the consumer-facing artifact. PSD3 (draft proposed June 2023) and the parallel Payment Services Regulation (PSR) are working through EU legislative process for 2025-2026 adoption; key changes include mandatory API performance standards, strengthened SCA exemptions, expanded scope to crypto-related services. FIDA — Financial Data Access Regulation (proposed 2023) extends data portability beyond payment accounts to investments, insurance, pensions.

United States — no comparable open-banking statute existed until the CFPB’s Personal Financial Data Rights Rule (Section 1033 of Dodd-Frank, final rule October 2024, effective 2026-2030 in phases). The rule mandates that depository institutions and credit-card issuers make consumer transaction data available via API. Reverse-engineering of bank website screen scrapes (Plaid’s original approach) declines as API access becomes mandatory.

Plaid (San Francisco, founded 2013 by Zach Perret, William Hockey) is the dominant US aggregator. Plaid sits between consumer apps (Venmo, Coinbase, Robinhood, Acorns) and banks, providing standardized account-balance, transaction-history, and identity APIs. Visa announced $5.3B acquisition January 2020; DOJ sued November 2020 to block on competition grounds; Visa abandoned January 2021. Plaid raised $425M Series D April 2021 at $13.4B valuation. Plaid has been migrating from screen scraping to official bank APIs as availability expands; the 2024 Section 1033 rule will accelerate this.

Finicity (acquired by Mastercard November 2020 for $825M), MX (Lehi UT), Yodlee (acquired by Envestnet 2015 for $590M, now Envestnet | Yodlee), and Akoya (the bank consortium platform launched 2020 by Fidelity, with JPM, BofA, Wells Fargo, US Bank participating) compete in the US aggregation segment. Akoya’s pitch: API access without screen scraping, with token-based revocation. Dwolla is a payments-focused ACH-rails specialist that also handles bank-account verification. Atomic Financial (Salt Lake City, founded 2018) focuses on payroll-account connections — direct-deposit switching, paycheck-linked products.

Brazil — Open Finance rolled out in four phases (Phase I institution sharing 2021, Phase II consumer account-data sharing 2021, Phase III payments and credit 2022, Phase IV insurance and investments 2022-2023). BCB-mandated, free between institutions, with detailed performance SLAs. ~50M consumers had granted Open Finance consents by 2024.

Australia — Consumer Data Right (CDR) went live for banking July 2020, energy November 2022, telco under consideration. ACCC and Treasury jointly administer. CDR specifies standardized APIs and consumer dashboards.

The economic model has been disputed: TPPs argue APIs should be free (data belongs to consumers); banks argue they bear infrastructure cost without commensurate revenue. The UK JROC, EU PSR drafts, and US Section 1033 implementation are all wrestling with this question, with various premium-API and value-added-service models proposed.

6. Embedded finance — Banking-as-a-Service and embedded payments

Embedded finance is the delivery of financial products inside non-financial software — a SaaS payroll provider offering an Earned Wage Access (EWA) card; a Shopify merchant getting a working-capital advance; a marketplace platform settling instant payouts to sellers. The pattern requires a BaaS (Banking-as-a-Service) layer that brokers the relationship between the fintech-style frontend and the chartered bank that holds funds and assumes regulatory responsibility.

6.1 BaaS — the 2024 Synapse collapse and aftermath

Synapse Financial Technologies (founded 2014 by Sankaet Pathak) was a leading BaaS platform brokering between fintechs (Yotta, Juno, Mercury for some time, Copper) and partner banks (Evolve Bank & Trust, Lineage Bank, AMG National Trust, American Bank). Synapse filed Chapter 11 bankruptcy April 22, 2024 and converted to Chapter 7 May 24, 2024. The collapse exposed a $65-95M reconciliation gap between Synapse’s internal ledger and the partner banks’ for-benefit-of (FBO) accounts holding consumer funds. As of late 2025 over $80M of consumer funds remain frozen and unaccountable across thousands of end users.

The Synapse collapse was the wake-up call for BaaS regulatory scrutiny. Federal interagency guidance on third-party risk management (June 2023) and the OCC’s enforcement actions against several BaaS partner banks (Blue Ridge Bank, Cross River Bank, Choice Financial Group, Sutton Bank, Lineage Bank — consent orders and OCC Matters Requiring Attention through 2023-2025) raised the regulatory cost of bank-fintech partnerships substantially. Several BaaS-focused banks have wound down or sold partnership books (Evolve Bank, Lineage Bank).

Surviving and active BaaS platforms:

Unit (NYC, founded 2019 by Itai Damti, Doron Somech, raised $100M Series C May 2022 at $1.2B). Powers Sleek, Honeybook payments, several other vertical-SaaS embedded-banking products.
Treasury Prime (San Francisco, founded 2017 by Chris Dean, Jim Brusstar). The Treasury Prime “Bank-Direct” model emphasizes the fintech contracting directly with the partner bank and Treasury Prime providing only software, addressing the Synapse-style reconciliation risk.
Increase (founded 2020 by Garry Tan and Justin Overdorff at Initialized, now CEO Garry Tan separately at Y Combinator). Engineering-heavy, API-first, sub-100 ms latency on most operations.
Synctera (founded 2020 by Peter Hazlehurst ex-Uber Money, raised $33M Series A 2020). FedNow and RTP enablement.
Column (founded 2022 by Will Hockey ex-Plaid co-founder) — uniquely owns its partner bank (Northern California National Bank acquired 2021), removing the BaaS-platform-plus-third-party-bank dual-control problem that bit Synapse.

6.2 Embedded payments

Stripe Connect (launched 2012, the original “embedded payments” product) supports marketplace, platform, and SaaS payment flows: split payments, multi-party payouts, refunds, instant payouts to debit cards. Used by Lyft, DoorDash, Shopify, Instacart, Substack, Patreon.

Adyen for Platforms (Adyen NV, Amsterdam, listed AMS:ADYEN since June 2018) competes directly. Adyen’s integrated acquirer-processor-gateway pitch suits enterprise platforms; eBay migrated from PayPal to Adyen for managed payments 2020-2022.

Mollie (Amsterdam, founded 2004) targets European SMBs with simpler integration than Stripe; raised $800M Series C September 2021 at $6.5B valuation.

Checkout.com (London, founded 2012 by Guillaume Pousaz) — a global enterprise card-acquirer-processor that competes for large fintech customers. Last private valuation $40B early 2022, marked down significantly in subsequent years.

6.3 Embedded lending and BNPL

Affirm (founded 2012 by Max Levchin) is the largest US BNPL provider. Affirm IPO January 2021 (NASDAQ: AFRM) at $49/share, peaked $166 November 2021, traded $10-50 through 2022-2024 amid rate-cycle pressure on consumer-credit lenders. Affirm offers 4-installment 0% APR and longer-term interest-bearing installment loans. Major merchant partner Amazon (2021) and Apple Pay integration (October 2023).

Klarna (Stockholm, founded 2005 by Sebastian Siemiatkowski, Niklas Adalberth, Victor Jacobsson) — Europe’s largest BNPL. Klarna IPO filed February 2025 (NYSE: KLAR) at $15B valuation, traded as high as $48B in 2021. Klarna offers Pay-in-4 and longer-term installments globally.

Afterpay (founded 2014 Australia, acquired by Block August 2021 for $29B in stock — the largest Australian-company acquisition ever).

Pipe (founded 2019 by Harry Hurst, Josh Mangel, Zain Allarakhia) — pioneer of “trading SaaS revenue like a security” for software-company financing. Stepped back from this model in 2022-2023 amid execution challenges.

Capchase, Wayflyer, Clearco (formerly Clearbanc), Founderpath — alternatives in the recurring-revenue financing segment.

Parafin (founded 2020 by Sahill Poddar, Vineet Goel, Ralph Furman) — embedded SMB lending for marketplace platforms (DoorDash, Mindbody, Worldpay). Capital provided through partner financial institutions; Parafin handles underwriting and servicing.

6.4 Embedded insurance

Cover Genius (Sydney, founded 2014 by Angus McDonald, Chris Bayley) is the leading global embedded-insurance platform. Distributes travel insurance via Booking.com, eBay shipping protection, etc.

Tint (founded 2020 by Vinay Pai, Jamie Hale) provides white-label embedded P&C insurance for SaaS platforms.

Boost Insurance (founded 2017 by Alex Maffeo) acts as an MGA + reinsurance for fintech-distributed insurance products.

7. Neobank stacks — the global map

United States:

Chime (founded 2013 by Chris Britt, Ryan King) — largest US neobank by user count (~22M users 2024). No-fee checking and savings, early direct deposit, secured credit-builder card. IPO filed late 2024 (NASDAQ: CHYM) and went public 2025. Powered by Galileo (issuer), Stride Bank and Bancorp (sponsors), Plaid (account verification).
Current (NYC, founded 2015 by Stuart Sopp) — teen banking and EWA. Partner bank Choice Financial Group.
Varo Bank — first consumer fintech to receive a US national bank charter (OCC granted July 2020 — De Novo charter, the first granted to a digital-only consumer bank). Originally Varo Money; rebranded Varo Bank post-charter. Founder Colin Walsh.
Dave (NASDAQ: DAVE) — cash advances and budgeting; SPAC-merged January 2022 at $4B valuation, traded under $1 by 2023, recovered through 2024.
Aspiration (founded 2015 by Andrei Cherny, Joe Sanberg) — climate-positive banking. SPAC plan collapsed 2023; restructured 2024.
Greenwood Financial (founded 2020 by Andrew Young, Killer Mike, Ryan Glover) — Black-focused community banking.
Step (founded 2018 by CJ MacDonald) — teen banking with parent oversight; partnership with Charlie Munger-backed Evolve Bank pre-Synapse.
Acorns (founded 2012 by Walter and Jeff Cruttenden) — micro-investing roundups; raised $300M growth round 2021 at $2B.
Stash (founded 2015) — subscription-based investing and banking.

United Kingdom:

Monzo (founded 2015 by Tom Blomfield, Jonas Templestein, Jason Bates, Paul Rippon, Gary Dolman) — largest UK neobank. ~10M UK accounts; UK banking licence (full, not restricted) 2017; reported its first full-year profit FY2024. IPO speculated for 2025-2026.
Starling Bank (founded 2014 by Anne Boden) — full UK banking licence 2016, EU passporting via Ireland post-Brexit. Strong SMB-banking segment; engineering-led culture.
Revolut (founded 2015 by Nikolay Storonsky, Vlad Yatsenko) — multi-currency wallet origin, now a full bank in the EU (Lithuania licence 2018) and UK (granted with restrictions July 2024, full authorisation expected 2025-2026). ~45M global customers. Last private valuation $45B 2021; secondary tender ~$45B 2024.

Latin America:

Nubank (São Paulo, founded 2013 by David Velez, Cristina Junqueira, Edward Wible) — largest non-Asian digital bank globally. 100M+ customers across Brazil, Mexico, Colombia by 2024. NYSE: NU since December 2021 IPO at $9/share peak $50 valuation $45B. Berkshire Hathaway disclosed $1B stake mid-2021; trimmed 2024. Profitable since 2022.
C6 Bank (Brazil, founded 2019, JPMorgan acquired 40% stake 2021).
Banco Inter (Brazil, founded 1994, listed Inter & Co NASDAQ: INTR June 2022). Full-stack super-app — banking, investing, shopping, travel.

Southeast Asia and Korea:

KakaoBank (Korea, launched July 2017) — Korea’s first internet-only bank; IPO July 2021 KOSPI valuation $25B+, settled lower since.
Toss Bank (Korea, banking launched October 2021) — under Viva Republica which also operates Toss payments + Toss Securities + Toss Insurance.
GoTyme (Philippines, joint venture Tyme Group + Gokongwei) — launched October 2022.
Sea Money (under Sea Limited NYSE: SE) — SeaBank Singapore, SeaBank Indonesia, MariBank Singapore. Linked to ShopeePay.
WeBank (China, founded by Tencent 2014) — China’s first internet-only bank, ~400M customers, leverages WeChat distribution.

8. Fraud and risk — the ML layer

Fraud detection has been ML-driven for two decades but the model surface has expanded dramatically with synthetic identity, account takeover, BIN attacks, and instant-payment authorized push payment fraud.

Sift (San Francisco, founded 2011 by Jason Tan) — real-time payment-fraud scoring + content abuse.
Forter (NYC + Tel Aviv, founded 2013 by Michael Reitblat, Liron Damri) — e-commerce identity-based fraud prevention; chargeback guarantee model.
Riskified (Tel Aviv, founded 2013, NYSE: RSKD since July 2021) — chargeback-guarantee e-com fraud.
Signifyd (San Jose, founded 2011) — competitor to Forter and Riskified.
DataVisor (Mountain View, founded 2013 by Yinglian Xie, Fang Yu, both ex-Microsoft Research) — unsupervised-learning fraud detection.
Featurespace (Cambridge UK, founded 2008 — Adaptive Behavioral Analytics for transaction fraud) — acquired by Visa September 2024 for $1.0B, closing 2025. Featurespace’s Adaptive Behavioral Analytics platform is widely deployed at Tier-1 banks (HSBC, NatWest, TSB, RBS).
ThetaRay (founded 2013, Israel/UK) — AI-driven correspondent-banking AML; major customers among cross-border payment networks.
ComplyAdvantage (London, founded 2014) — sanctions + adverse media + PEP screening with AI-driven matching.
Hawk AI (Munich, founded 2018) — transaction monitoring with explainable AI for AML SAR generation.
NICE Actimize (legacy enterprise, part of NICE), SAS Anti-Money Laundering, Oracle Financial Services Analytical Applications (OFSAA) — enterprise legacy stack.

Authorized Push Payment (APP) fraud is the dominant fraud typology for real-time payments — the victim is socially engineered into authorizing a transfer to a fraudster’s account. UK Payment Systems Regulator’s mandatory reimbursement rule (effective October 2024) requires sending banks to reimburse APP-fraud victims up to £85K under most circumstances, splitting cost 50/50 with receiving banks. This shifted incentives: receiving banks now invest heavily in fraud prevention on inbound transfers, not just outbound.

9. Crypto rails and custody

Crypto rails sit alongside (and increasingly inside) the traditional fintech stack. The institutional crypto custody market matured dramatically post the 2022 FTX collapse — institutional flows now require qualified custodians with regulatory oversight.

Custody platforms:

Fireblocks (founded 2018 by Michael Shaulov, Idan Ofrat, Pavel Berengoltz) — MPC (multi-party computation) custody. $8B valuation 2022 Series E. Serves over 1,800 institutions.
Anchorage Digital (founded 2017 by Diogo Mónica, Nathan McCauley) — first federally chartered crypto bank (OCC national trust charter January 2021).
Coinbase Custody Trust (NY trust charter 2018) — Coinbase’s institutional arm.
BitGo (founded 2013 by Mike Belshe, Ben Davenport, Will O’Brien) — multi-sig pioneer; processed >20% of global BTC transactions at peak.
Copper (London, founded 2018) — UK-headquartered; serves European institutional clients.
Komainu (founded 2018, joint venture Nomura + Ledger + CoinShares).
Zodia Custody (Standard Chartered + Northern Trust JV, founded 2020).
Crypto.com Capital, Standard Custody (now part of BitGo after acquisition 2024), Cobo (Singapore + Asia) — additional institutional custodians.

MPC vs cold storage: traditional cold-storage custody requires physical access to hardware-isolated keys for any transaction; MPC distributes key shares across multiple parties and uses threshold signing, allowing operationally efficient transactions without single-point key compromise. Curv (acquired by PayPal April 2021 for $200M) pioneered enterprise MPC; Fireblocks is the dominant MPC vendor today.

Stablecoin rails are the most rapidly growing payment use of crypto:

USDC (Circle, since 2018) — $45B circulating Q4 2025. Backed by US Treasuries and bank deposits at BNY Mellon. Circle filed S-1 January 2024, IPO June 2024 (NYSE: CRCL).
USDT (Tether, since 2014) — $140B circulating Q4 2025, largest stablecoin globally. Reserves disclosed quarterly; primarily T-bills with smaller equity, gold, and crypto exposure.
PYUSD (PayPal USD, launched August 2023, issued by Paxos Trust) — first major US-issued stablecoin by a regulated US financial institution.
RLUSD (Ripple USD, launched December 2024, issued by Standard Custody, regulated by NYDFS).
USDe (Ethena, launched February 2024) — synthetic “stablecoin” backed by ETH/BTC delta-hedged via short perpetual futures, generating positive funding-rate yield. $5B+ supply by late 2024.
DAI (MakerDAO, since 2017; rebranded USDS with Sky Protocol 2024) — first decentralized over-collateralized stablecoin.
GHO (Aave, launched 2023) — AAVE-protocol’s native stablecoin.
BUSD (Binance USD, paused issuance February 2023 after NYDFS enforcement against Paxos, wound down).
crvUSD (Curve, launched 2023) — LLAMMA (lending-liquidating AMM) collateral model.

Stablecoin regulation 2024-2026: MiCA’s stablecoin provisions applied June 2024 in the EU — non-EU issuers of significant tokens face usage caps in the EU. GENIUS Act and Clarity for Payment Stablecoins Act progressed through US Congress in 2024 but did not pass; market-structure regulation expected 2025-2026. The Hong Kong Stablecoin Bill passed mid-2025, creating a stablecoin issuer licensing regime in HK; Singapore MAS Single-Currency Stablecoin (SCS) framework went into effect mid-2024.

10. Regtech and compliance automation

Compliance.ai (founded 2016, San Francisco), ComplyAdvantage (London, also under fraud above), Saifr (originally Fidelity Labs spin-out 2018, sold to FactSet/MJH groups 2023) — automated regulatory-change tracking and compliance-content review.

Pendo Systems (founded 2007) — unstructured data extraction from financial documents; acquired by Smart Communications 2022.

Behavox (founded 2014, London + Montreal) — communications surveillance (Bloomberg chat, Symphony, Teams, voice) for trading-floor compliance; major customers among Tier-1 banks.

Continuity (now part of Pioneer Square Labs) — community-bank regulatory-change automation.

Cube Global (acquired Hudson Cook 2024) — regulatory intelligence + change management.

11. Real-time risk and brokerage infrastructure

The retail brokerage stack changed structurally after the January 2021 GameStop / Robinhood T+2 settlement-liquidity event, when Robinhood faced a $3B DTCC margin call and had to restrict GME, AMC, and other meme-stock purchases. T+1 settlement (effective May 28, 2024) has reduced but not eliminated this risk.

Apex Clearing (founded 2012, ex-Penson, headquartered Dallas) — clearing platform for digital brokerages. Powers SoFi, Webull, Public.com, M1 Finance. Apex SPAC merger announced 2021 was terminated; Apex remained private. Apex Crypto and Apex Silver business lines.
Pershing X (a Bank of New York Mellon platform launched 2023) — wealthtech platform under BNY Pershing. Targets RIAs and broker-dealers.
DriveWealth (founded 2012, NYC) — fractional-share API specialist; powers many international retail-brokerage products that need US-equity exposure.
Alpaca Markets (founded 2015, San Francisco) — commission-free brokerage API for fintechs and trading algorithms.
Public.com (founded 2017) — social investing app on Apex.

Drift Capital is a Solana-based perpetuals DEX, separate from the brokerage infrastructure but sometimes mentioned in adjacent “real-time risk” contexts.

12. Back-office broker-dealer infrastructure

Beyond customer-facing platforms, the institutional broker-dealer back-office relies on:

Goldman Marquee — Goldman’s institutional-client API and analytics platform; provides risk analytics, execution APIs, structured-product issuance.
JPMorgan Markets + TradingHub — JPM’s institutional-client portal.
Morgan Stanley QSI/Speedway — algorithmic execution.
Velocity Modular (acquired by Broadridge 2022) — broker-dealer post-trade processing.
Broadridge (NYSE: BR) — the dominant post-trade processor for North American broker-dealers; processes proxy voting, regulatory communications, transaction reporting.
DTCC (Depository Trust and Clearing Corporation) — US central counterparty (NSCC for equities, FICC for Treasuries and MBS), central securities depository (DTC), and trade-reporting hub (Global Trade Repository).

13. The architectural ledger pattern — double-entry on Postgres or Cassandra

A common pattern across modern fintech infrastructure is the double-entry ledger as a service:

Ledger entry = (debit_account, credit_account, amount, currency, timestamp, idempotency_key, metadata).
Account balance = monoidal sum of entries indexed by (account, currency).
Posting rules enforce double-entry invariants ( $\sum debits = \sum credits$ ) at write time.

Implementations: TigerBeetle (open-source, written in Zig, founded 2020 by Joran Dirk Greef in Cape Town; designed for 1M+ transactions/sec); Modern Treasury Ledger (commercial); Increase (internal); Stripe Ledger (internal); Coinbase Tigris (internal ledger built on Cassandra). The pattern decouples balance-tracking from product configuration and downstream effects, mirroring the Mambu/Thought Machine architecture noted earlier.

Money math: amount fields are stored as fixed-point integers in the smallest currency subunit (cents for USD; satoshis for BTC; yoctoether for ETH). Floating-point representation is universally rejected because $0.1 + 0.2 \neq = 0.3$ in IEEE 754. Currency-conversion paths are tracked as discrete entries to avoid losing audit trail.

14. Notable failures and risk events

Wirecard collapse June 2020: $2B+ in claimed cash balances did not exist; CEO Markus Braun arrested; auditor EY criticized; restructured German fintech regulation (BaFin reform 2021-2022).
Greensill Capital collapse March 2021: SoftBank-backed supply-chain finance firm; spillover to Credit Suisse supply-chain funds ($10B AUM frozen, ultimately contributing to CS demise March 2023).
FTX collapse November 2022: $8-10B customer-fund commingling/loss; SBF convicted October 2023, sentenced 25 years March 2024.
SVB collapse March 2023: $200B+ deposit run over 36 hours; FDIC bridge bank, sold to First Citizens. Triggered the BTFP emergency Fed facility and the broader regional-bank stress.
Synapse collapse April 2024 (see §6.1): $80M+ of consumer funds stranded; the BaaS-model wake-up call.
Evolve Bank cyber breach June 2024: customer data of Affirm, Mercury, Wise customers leaked.
TabaPay-Synapse failed acquisition May 2024: TabaPay had a tentative agreement to acquire Synapse before the bankruptcy; the failure to close exposed the depth of Synapse’s ledger reconciliation gap.
Curve Finance July 2023 exploit: $70M lost via Vyper compiler bug; partial recovery via white-hat negotiation.

15. Software engineering patterns

Idempotency keys on every mutating API. Every Stripe-style API requires the client to supply a unique key per logical operation; the server stores the response and returns it on retry, preventing duplicate charges/transfers under network failure.
Event sourcing with immutable append-only logs — Kafka, Kinesis, Pulsar — feeding downstream consumers for reporting, fraud, marketing.
Saga pattern for cross-service transactions — payments often span account hold, network authorization, ledger entry, fee posting, and webhook delivery; each step is reversible via compensating transactions.
At-least-once delivery + idempotent consumers is the standard messaging guarantee. Exactly-once requires expensive distributed transactions; idempotent consumers achieve the same effect more cheaply.
CQRS (Command Query Responsibility Segregation) separates the high-throughput write path (ledger entries) from the high-throughput read path (account balances, statements) — common in core-banking ledger services.
Outbox pattern for transactional event publishing — write the domain event and the outbox row in the same DB transaction; a separate poller picks up outbox rows and publishes to Kafka with at-least-once semantics.

Latency budgets: card authorization round-trip should fit inside 1.5 seconds (Visa Authorization Time-out is 7 seconds at terminal, but ISO+network adds overhead — leaving ~1-2 sec for the issuer-processor + bank-decisioning combined). Real-time payment posting should be <10 seconds from initiation to receipt confirmation. KYC decisioning typically <60 seconds end-to-end.

16. The 2024-2026 frontier

AI-native banking — Bunq (Netherlands) launched generative-AI assistant; Klarna deployed OpenAI-powered customer service replacing 700 agents (announced February 2024). LLM-driven KYC adverse-media analysis (Persona, Alloy partnerships).
Stablecoin payment processors — Bridge (founded 2022 by Sean Yu, Zach Abrams ex-Coinbase, acquired by Stripe October 2024 for $1.1B). Bridge enables merchants to accept stablecoin payments and receive fiat settlement; Stripe acquisition validates the embedded-stablecoin-payments thesis.
Tokenized money market funds — BlackRock BUIDL (March 2024, on Ethereum), Franklin Templeton BENJI (since 2021, on Stellar and Polygon), Ondo USDY, Hashnote USYC. By Q4 2025 cumulative tokenized money-market-fund AUM exceeded $3B.
Account abstraction (ERC-4337, live since March 2023) — smart-contract wallets with social recovery, gasless transactions, batch operations. Major implementations: Safe (formerly Gnosis Safe), Stackup, Pimlico, Biconomy, ZeroDev, Soul Wallet.
Cross-border instant payments via interlinks — UPI-PayNow (India-Singapore, February 2023), Project Nexus (BIS-coordinated multilateral instant-payment interlink prototype, with India, Singapore, Malaysia, Thailand, Philippines participating).
CBDC pilots — Project Agora (BIS multi-jurisdictional wholesale CBDC, 2024-2025), Brazil DREX (wholesale, retail pilot), ECB Digital Euro preparation phase (Nov 2023 - 2025), India e₹ (pilot since 2022, ~10M users 2024), China e-CNY ($250B+ cumulative transaction volume by 2024).

17. Notable people

Stripe: Patrick and John Collison (founders, brothers from Limerick, Ireland; YC W10).
Square (Block): Jack Dorsey, Jim McKelvey.
Adyen: Pieter van der Does, Arnout Schuijff.
Plaid: Zach Perret, William Hockey.
Affirm: Max Levchin (also PayPal co-founder).
Klarna: Sebastian Siemiatkowski.
Nubank: David Velez, Cristina Junqueira, Edward Wible.
Revolut: Nikolay Storonsky, Vlad Yatsenko.
Monzo: Tom Blomfield (also Starling for a few months early on), Jonas Templestein.
Starling Bank: Anne Boden (departed 2023).
Marqeta: Jason Gardner.
Chime: Chris Britt, Ryan King.
Robinhood: Vlad Tenev, Baiju Bhatt.
Mambu: Eugene Danilkis.
Thought Machine: Paul Taylor.
10x Banking: Antony Jenkins.
Pismo: Ricardo Josua, Daniela Binatti.
Fireblocks: Michael Shaulov, Idan Ofrat, Pavel Berengoltz.

18. Regulatory landscape summary

United States: OCC (national banks, including De Novo charters), FDIC (deposit-insurance backed banks), Federal Reserve (bank holding companies, payment systems, FedNow), CFPB (consumer protection including Section 1033), state banking regulators (NYDFS, California DFPI, etc.), SEC and FINRA (broker-dealers), CFTC (crypto-derivatives and commodity-pool components), Treasury OCC and FinCEN (AML/BSA).
European Union: ECB (significant credit institutions under SSM), national competent authorities (BaFin, ACPR, etc.), EBA (Banking Authority), ESMA (Markets Authority), AMLA (new EU AML Authority operational 2025-2026), national consumer protection.
United Kingdom: PRA (prudential), FCA (conduct), Bank of England (financial stability and payment systems), Payment Systems Regulator (payment networks).
Singapore: MAS (single integrated regulator).
Hong Kong: HKMA (banking), SFC (securities including VATP licences).
Brazil: Banco Central do Brasil (Pix, Open Finance, payment institutions, banks), CVM (securities).
India: RBI (banking, payment systems including UPI via NPCI), SEBI (securities).
Australia: APRA (prudential), ASIC (conduct), AUSTRAC (AML/CTF), RBA (payment systems).

19. Production examples

Chase UK on Thought Machine Vault: greenfield retail bank in the UK launched September 2021, processing customer transactions on Vault Core. Achieved 1M+ customers in first year. Demonstrates that a Tier-1 global bank can ship a cloud-native consumer brand on an external core platform.
Westpac BT on 10x SuperCore: incumbent migration of an existing wealth platform onto a modern core.
DoorDash Dasher prepaid cards on Marqeta: just-in-time funding — the card is loaded only when the driver completes a qualifying action — eliminates float and theft.
Stripe Issuing inside Ramp: Ramp issues cards via Stripe Issuing, sets per-merchant limits programmatically, and receives webhook events to enrich its expense-management UX.
Cash App + Square Banking: same parent company (Block), separate ledger and product config; bidirectional money movement via internal rails.

Compendium

Explorer

Fintech Architecture — Deep Reference

Fintech Architecture — Deep Reference

See also

1. Core banking modernization — the post-monolith stack

2. Real-time payment rails — the global map

3. Card issuing platforms — modern issuer processors

4. KYC and AML — the identity stack

5. Open banking APIs — the data-portability layer

6. Embedded finance — Banking-as-a-Service and embedded payments

6.1 BaaS — the 2024 Synapse collapse and aftermath

6.2 Embedded payments

6.3 Embedded lending and BNPL

6.4 Embedded insurance

7. Neobank stacks — the global map

8. Fraud and risk — the ML layer

9. Crypto rails and custody

10. Regtech and compliance automation

11. Real-time risk and brokerage infrastructure

12. Back-office broker-dealer infrastructure

13. The architectural ledger pattern — double-entry on Postgres or Cassandra

14. Notable failures and risk events

15. Software engineering patterns

16. The 2024-2026 frontier

17. Notable people

18. Regulatory landscape summary

19. Production examples

Further reading

Adjacent

Graph View

Table of Contents