Digital Banking, Explained: Channels, Cores and Charters

Key Takeaways

Digital banking can mean a bank's digital channels, a digital-only bank, or a fintech offering a partner bank's products; say which one you mean.
Every version rests on the same layers: the digital channel, an integration layer of APIs and middleware, the core banking system of record, and payments (our working model).
Taking deposits is regulated under 12 U.S.C. 378, and FDIC insurance requires a separate application, so a fintech without a charter works through a chartered partner bank.
A partner bank's responsibility is not diminished by outsourcing, and in banking-as-a-service the customer ledger may sit outside the bank's core, which makes reconciliation an architecture problem.
12 CFR part 328 binds anyone describing FDIC insurance, and insured banks must meet amended digital signage requirements by April 1, 2027.

Current as of November 8, 2026. Quotations come from the federal statutes, regulations, guidance and agency documents listed at the end. The working definition, the layer model and the interpretations are ours, and are labeled. This article describes United States rules; it is not legal advice.

Digital banking means three different things depending on who says it. To a bank's head of channels it is the website and the app. To an investor it can mean a bank built on digital channels instead of branches. To a fintech founder it can mean offering accounts that a partner bank actually holds. Each leads to a different architecture and regulatory position.

This article separates the three, describes the systems underneath each, and sets out why a bank that exists on a screen still needs a charter, or a chartered partner.

The short version

Digital banking can mean a bank's digital channels, a bank that delivers mainly through digital channels, or a non-bank offering a partner bank's products. Say which one you mean.
Underneath every version sit the same layers: the digital channel, an integration layer of APIs and middleware, the core banking system of record, and payments (our working model).
Federal law bars taking deposits unless the firm meets one of its conditions, such as being authorized and examined under federal or state law. A fintech without a charter works through a bank that has one.
How anyone, bank or not, may describe FDIC insurance is set by a binding FDIC regulation, 12 CFR part 328.

What is digital banking?

The OCC's Charters booklet defines digital banking in its glossary as "The automated delivery of new and traditional banking products and services directly to consumers through digital, interactive communication channels." Our working definition is wider: the delivery of banking products through websites, apps and other electronic channels rather than a branch, including through a partner, and to businesses as well as consumers. Three meanings follow.

1. A bank's digital channels. The same booklet, licensing guidance for new national banks and federal savings associations, notes: "Banks frequently use electronic, mobile, or digital channels for delivery of banking products and services." The FDIC's signage rule gives the channel a legal name for insured banks: "Digital deposit-taking channel means websites, banking applications, and any other electronic communications method through which an insured depository institution accepts deposits."

2. A digital-only bank. The same OCC passage continues: "In some cases, digital channels are the bank's primary delivery method." This is still a bank, with its own charter and deposits, that delivers mainly through digital channels.

3. A fintech working through a partner bank. In a July 2024 request for information (RFI), the OCC, the Federal Reserve Board and the FDIC described arrangements in which a fintech gives end users access to a bank's products, noting: "These arrangements are sometimes referred to as 'banking-as-a-service' or 'embedded finance' depending on the structure and parties involved in the arrangement." It adds: "Fintech companies that offer these services to end users through such arrangements are sometimes referred to as 'neobanks' or 'challenger banks.'" The agencies state that the RFI is not intended to impose obligations and is not an interpretation of any statute or regulation.

A company marketed as a neobank may be either meaning 2 or meaning 3, and the difference matters more than the label (interpretation). See also What is a banking-as-a-service (BaaS) ledger?

What are the layers of a digital banking architecture?

A digital banking architecture has four layers: the digital channel, the integration layer, the core banking system and payments, with security, fraud and compliance controls across all of them (our working model; banks draw the lines differently).

Digital channel. The website, the app and any channel embedded in a partner's product: sign-in, onboarding, servicing and moving money.
Integration layer (middleware and APIs). The services that turn channel requests into core and payment transactions and expose bank functions to partners. The 2024 RFI notes that some fintech intermediaries are "sometimes referred to as a 'middleware provider' or 'intermediate platform provider'", so this layer can belong to a third party (interpretation).
Core banking. The system of record for customers, accounts, balances, interest, fees and the general ledger. See What is a digital core in banking?
Payments. Connections to ACH, wire, card networks and instant payment services, and the processing that posts each payment to an account.

For a fuller diagram, see What Is a Reference Architecture for Digital Banking?

Where does the core banking system fit in a partner-bank model?

In a partner-bank model the bank's core still holds the deposits, but it may not hold the record of each customer's share of them. The 2024 RFI describes this directly: "These transaction records may not be reflected in the bank's core processing system. Instead, the bank's core deposit ledger may only include omnibus accounts, often titled to reflect that they are held for the benefit of (FBO) end users."

In those arrangements, the bank's ledger may know only a pooled balance, while the fintech's or platform's ledger knows who owns which part (interpretation). The RFI notes that these arrangements "often involve heightened levels of operational complexity, including as it relates to reconciliations". The architect's question is which ledger is authoritative for a customer's balance, and how a break is found and fixed (interpretation).

For choosing a core, see the buyer guides on core banking systems for neobanks and cloud-based core banking systems.

How do payments work in digital banking?

Payments in digital banking travel over established networks such as ACH, wire and card networks, and many fintechs reach them through a sponsoring partner bank. The 2024 RFI states that "Many fintech companies enter these arrangements with banks in order to gain access to existing payment systems and card networks."

The RFI calls the bank's side sponsorship, which may entail agreeing with network operators to sponsor the fintech's payment activity, monitoring it against network rules, or accepting liability for losses. The payment layer therefore has two owners: the fintech builds the experience, and the bank answers to the network (interpretation).

Does a digital-only bank need a bank charter?

In practice yes, if it takes deposits in its own name: federal law (12 U.S.C. 378) bars taking deposits unless the firm is subject to examination by a banking authority, and two of the statute's three routes also require authorization or permission by law; for a bank, that means a charter (interpretation). The statute makes it unlawful for a person or organization to engage "in the business of receiving deposits subject to check or to repayment upon presentation of a pass book, certificate of deposit, or other evidence of debt, or upon request of the depositor" unless it meets one of the conditions in the statute, such as being "incorporated under, and authorized to engage in such business by, the laws of the United States or of any State, Territory, or District" and subject to examination and regulation. That is 12 U.S.C. 378(a)(2), from section 21 of the Banking Act of 1933. The statute lists further routes; how it applies to a given structure is a question for counsel.

A charter alone does not make deposits FDIC-insured. Under 12 U.S.C. 1815, a depository institution may become insured "upon application to and examination by the Corporation and approval by the Board of Directors" of the FDIC. The OCC's Charters booklet says organizers of a new national bank or federal savings association "should file an interagency application for deposit insurance with the FDIC when it submits its charter application to the OCC, if the proposed bank will offer insured deposits." A company that will control a bank may also need Federal Reserve Board approval, as the same booklet notes.

Being digital does not change the test. The OCC's booklet says that "The OCC approves proposals to establish banks that will use digital delivery channels provided the bank satisfies the OCC's chartering requirements, including that the bank reasonably may be expected to operate in a safe and sound manner." It also warns that "excessive reliance on deposits generated by digital solicitations can raise special concerns." The booklet is licensing guidance; its December 2021 edition is the one the OCC lists.

What does a partner bank remain responsible for?

The partner bank remains responsible for operating safely and soundly and complying with the law in the activities it outsources, to the same extent as if it did them in-house. The Interagency Guidance on Third-Party Relationships: Risk Management, issued by the Federal Reserve Board, the FDIC and the OCC in June 2023, says: "A banking organization's use of third parties does not diminish its responsibility to meet these requirements to the same extent as if its activities were performed by the banking organization in-house."

The guidance says it is relevant to all banking organizations those agencies supervise, and it is guidance, not a rule: "Supervisory guidance does not have the force and effect of law and does not impose any new requirements on banking organizations." The underlying requirements, safe and sound operation and compliance with law, are binding in their own right.

It is under revision. On September 11, 2026, the OCC, the Federal Reserve Board, the FDIC and the NCUA proposed guidance (published in the Federal Register on September 15) that would tailor oversight to the assessed risk of each relationship. Comments are due November 16, 2026, and the proposal states: "Any finalized guidance would replace the 2023 Guidance and the Supplemental TPRM Resources." Until that happens, the 2023 guidance is the current interagency text.

The split of duties is commonly written into the contract. Describing deposit arrangements, the 2024 RFI observes that "The contracts governing these arrangements commonly set forth the operational responsibilities of each party, such as record-keeping and access to records, end-user on-boarding, compliance management, transaction monitoring, and complaint handling." Each is a system as well as a duty, so the contract and the architecture should name the same owner (interpretation). See How to Build a Third-Party Risk Management (TPRM) Questionnaire Workflow.

What can a fintech say about FDIC insurance?

Nothing that misrepresents it, and the rule is binding on non-banks. Subpart B of 12 CFR part 328, an FDIC regulation adopted in 2022 and since amended, "applies to any person who" uses the FDIC's name or logo to falsely represent that something is insured, knowingly misrepresents whether or how far it is insured, or aids or abets either.

Among the omissions it treats as material is a statement about deposit insurance by a person that is not an insured depository institution that "fails to clearly and conspicuously disclose that the person is not an FDIC-insured depository institution and that FDIC insurance only covers the failure of the FDIC-insured depository institution." Another is a statement about pass-through coverage that "fails to clearly and conspicuously disclose that certain conditions must be satisfied for pass-through deposit insurance coverage to apply." Those disclosures belong in the channel design, not just the terms and conditions (interpretation).

Insured banks have a separate duty for their own channels. Section 328.5, as amended, requires an insured bank's digital deposit-taking channel to display the FDIC official digital sign on the homepage, the login page, and the "Page or screen where the consumer first initiates a deposit account opening." The FDIC amended those requirements in a final rule published January 29, 2026 and effective March 2, 2026, which states: "Compliance is required by April 1, 2027."

How do the three models compare?

Rows citing a document follow it; the other cells apply our working model, and the last row is our interpretation.

Question	Traditional bank with digital channels	Digital-only bank	Fintech through a partner bank
Who holds the charter and takes the deposits	The bank	The bank	The partner bank
System of record for each customer's balance	The bank's core	The bank's core	May be the fintech's or a platform's ledger over the bank's FBO accounts (2024 RFI)
Who owns the customer-facing channel	The bank, often built with vendors	The bank	The fintech
Describing FDIC insurance	The bank, with the digital sign (12 CFR 328.5)	The bank, likewise	The fintech, only with the disclosures in 12 CFR 328.102
Access to payment networks	Through the bank	Through the bank	Often through the partner bank's sponsorship (2024 RFI)
Who answers to supervisors for the activity	The bank	The bank	The partner bank, undiminished by outsourcing (2023 guidance)
Hardest architecture problem (interpretation)	Fitting new channels onto an older core	Building every layer at once, under chartering scrutiny	Keeping two ledgers and two parties' controls aligned

The partner-bank model changes who does what, so its contract and ledger design deserve the closest scrutiny (interpretation). For the channel layer, see the buyer guides on digital banking platforms for retail banks and open banking API platforms.

How the work is organized

For the core, the Finantrix Core Banking Software Features checklist frames assessment by areas such as product factory, customer and account, deposits, lending, payments and general ledger. For the front of the channel, the Digital Account Opening Platform Features checklist works through application flow, identity verification, decisioning, funding and abandonment recovery.

Questions to ask

Which system is the record of each customer's balance, and who can prove it on any given day?
If a fintech or platform keeps the customer ledger, how often is it reconciled to the bank's FBO accounts, and who owns a break?
Does the contract name an owner for each duty in it, and does a system that owner controls perform it?
Where in the app does the customer learn that the fintech is not a bank, and that insurance covers the failure of the insured bank?
Who reviews the program if the September 2026 third-party guidance proposal is finalized?

How we sourced this article: every quotation comes from the documents listed below, and we keep saved copies. The working definition of digital banking, the layer model and everything marked (interpretation) are our own. Rules and guidance are described as they stood on the date at the top; this is not legal advice. If you want to question a point, get in touch through our contact page.

Sources

Frequently Asked Questions

What is the difference between digital banking and a digital bank?

Digital banking is a way of delivering banking products, through websites, apps and other electronic channels, and any bank can offer it. A digital bank, in the sense used here, is a chartered bank whose primary delivery channels are digital. A fintech that offers accounts held by a partner bank is a third model, which the federal banking agencies have described as a bank-fintech arrangement.

Can a fintech take deposits without a bank charter?

Not in its own name. 12 U.S.C. 378(a)(2) makes it unlawful to engage in the business of receiving deposits unless the firm meets the statute's conditions, such as being incorporated and authorized under federal or state law and subject to examination. Fintechs without a charter offer accounts that a chartered partner bank holds.

Who is responsible when a fintech partner makes a mistake?

The partner bank remains responsible to its supervisors. The 2023 Interagency Guidance on Third-Party Relationships says a bank's use of third parties does not diminish its responsibility to meet those requirements (safe and sound operation and compliance with law) to the same extent as if it did the work in-house. That guidance is under proposed revision as of September 2026 but remains the current interagency text.

What is an FBO account in banking-as-a-service?

It is an account at the partner bank held for the benefit of the fintech's end users. In the arrangements the federal banking agencies described in 2024, the bank's core may record only these pooled accounts, while the fintech or a platform keeps the record of each customer's share, so the two ledgers must be reconciled.