What is the difference between PaaS and BaaS?

Payments as a Service (PaaS) and Banking as a Service (BaaS) are related but structurally different models. PaaS provides the infrastructure to make and receive payments, issue cards and manage compliance – all underpinned by an Electronic Money Institution (EMI) licence. BaaS provides a broader set of banking capabilities, including deposit accounts, lending and credit, and is typically underpinned by a banking licence. A business that needs to issue cards, process payments or disburse funds needs PaaS. A business that needs to offer deposit accounts or credit products needs BaaS.

On this page:

• What does PaaS cover that BaaS does not, and vice versa?
• What is the regulatory difference between PaaS and BaaS?
• Which licence does a PaaS provider hold, and why does it matter?
• Can a BaaS provider also offer PaaS, and what are the risks?
• How does the European market consolidation relate to the PaaS and BaaS distinction?
• How do I know which model I actually need?
• Where does BIN sponsorship fit in relation to PaaS and BaaS?

Answer

PaaS covers payment infrastructure: card issuing, transaction processing, scheme connectivity, settlement and payment compliance. BaaS covers banking infrastructure: everything PaaS covers, plus deposit accounts, lending, credit facilities and a banking licence. PaaS is the correct and sufficient model for most businesses that need to embed payment capability.

What PaaS covers

A PaaS provider holds an EMI licence, principal membership of Visa and Mastercard, and the processing infrastructure to handle real-time authorisation, clearing and settlement. Clients access card issuance, funds disbursement, multi-currency settlement, fraud monitoring and AML controls without building or licencing any of it themselves.

What BaaS adds to PaaS

BaaS extends the payment model to include banking-grade products: deposit accounts, lending and credit facilities, and supervision by a prudential regulator as well as a conduct regulator. BaaS is the appropriate model for businesses that need to offer deposit accounts to end users, provide credit products, or require banking-grade deposit protection rather than EMI-level e-money safeguarding.

What to watch for

• Many providers describe themselves as BaaS providers while operating under an EMI licence rather than a banking licence. The label matters less than the actual licence the provider holds and what it permits them to do on your behalf.
• A business that only needs card issuing and payment processing does not need BaaS. Confirm what licence underpins the service and whether it matches your actual product requirements.

Answer

PaaS operates under an EMI licence, which authorises the issuance of electronic money and the provision of payment services. BaaS operates under a banking licence, which additionally authorises the acceptance of deposits and the provision of credit. These are separate regulatory regimes with different supervisory authorities, capital requirements and compliance obligations. The distinction determines what the provider can legally offer, and therefore what you can build on top of their infrastructure.

The EMI licence and what it permits

An EMI licence is issued by a financial regulator – the FCA in the UK or the Bank of Lithuania in the EU, for example – and authorises the holder to issue electronic money, process transactions, hold funds as e-money, and manage payment flows across multiple currencies and geographies. It does not permit the provider to accept deposits, lend money or offer credit products.

The banking licence and what it adds

A banking licence permits all of the above, plus the acceptance of deposits, the provision of credit, and participation in national deposit guarantee schemes. Banking licence holders are supervised by both a conduct regulator and a prudential regulator, which adds capital adequacy obligations and balance sheet requirements that an EMI does not carry

What to watch for

• Ask your prospective PaaS provider exactly which licence they hold and in which jurisdiction it was granted. An EMI licence granted in one EU member state can be passported across the EEA, but the home regulator’s standards and the provider’s compliance history both matter.
• If a provider describes themselves as BaaS but cannot confirm they hold a banking licence, they are offering EMI-based PaaS under a different label. Understand what you are actually buying.

Answer

A PaaS provider holds an EMI licence. This matters because it determines what the provider can legally do on your behalf, what protections apply to the funds held in the arrangement, and how the provider is supervised. For most businesses using PaaS to issue cards or manage payment flows, an EMI licence is the correct and sufficient regulatory basis.

How funds are protected under an EMI licence

Under an EMI licence, customer funds must be safeguarded in segregated accounts with a qualifying institution, held separately from the provider’s own funds. This is distinct from deposit protection under a banking licence, which in many jurisdictions includes a government-backed guarantee scheme. For most PaaS use cases – card programmes, disbursements, payment flows – this distinction is not commercially material. For products that require deposit-level protection, a banking licence is needed.

Why the issuing regulator matters

Not all EMI licences are equivalent. The supervisory standards applied by different European regulators vary, and a provider licenced in a jurisdiction known for lighter-touch supervision may not meet the same standards as one supervised by the FCA or the Bank of Lithuania. A provider that has held a clean licence for a decade across two jurisdictions has demonstrated regulatory standing in a way that a recently licenced provider has not.

What to watch for

• Confirm the specific licence number and issuing regulator for any provider you are evaluating. Cross-reference against the regulator’s public register to verify the licence is current and unrestricted.
• Ask how long the provider has held its licence and whether it has ever been subject to supervisory restrictions, special measures or sanctions.
• For multi-market programmes, confirm the provider holds authorisation in the jurisdictions your programme will operate in, not just the ability to passport from a single home state.

Answer

Yes. A BaaS provider with a banking licence can offer PaaS-equivalent payment services alongside deposit and credit products. The risk is not in the model itself but in scope: a banking-licenced provider is managing credit risk, liquidity risk and capital adequacy alongside payment compliance. If the banking side of the business encounters regulatory difficulty, the payment infrastructure a client depends on may be affected even if their programme has nothing to do with the problem.

What a banking licence means for compliance scope

Banking licences require the management of obligations that an EMI does not carry. A provider that has built its business around banking-grade products is managing a more complex compliance environment than one focused specifically on payment infrastructure. When compliance failures have occurred in the European market, they have often arisen from the difficulty of managing banking-grade obligations at embedded finance scale and pace.

What to ask if your provider holds a banking licence

If your programme only requires payment capability, ask whether the payment infrastructure and compliance oversight are operationally separated from the banking side of the business, and whether a regulatory restriction on the banking operations would affect your payment programme.

What to watch for

• A banking licence does not automatically signal greater safety for a payment programme client. It signals a broader and more complex regulatory scope that may or may not be relevant to your needs.
• If your programme only needs PaaS capability, evaluate whether the additional compliance scope of a banking-licenced provider adds risk rather than value to your specific situation.

Answer

The regulatory difficulties that several European providers faced between 2022 and 2025 occurred predominantly in the BaaS segment: providers offering banking-grade infrastructure at embedded finance scale without adequate compliance controls. The consolidation is a reminder that the model a provider operates under, and their compliance track record within it, are material risk factors for clients.

Why the BaaS model has faced more scrutiny

Banking-licenced providers carry obligations across credit risk, liquidity management, capital adequacy and payment compliance simultaneously. Providers that expanded rapidly in the low-interest-rate environment of 2020 to 2022 took on compliance obligations at a scale their infrastructure had not kept pace with. When regulators audited those obligations, the deficiencies were significant.

What this means when choosing a provider

The consolidation does not mean BaaS is wrong for all buyers. It means the compliance track record, financial standing and regulatory history of any provider should be examined before committing. The questions are the same regardless of label: how long have they held their licence, have they been subject to supervisory restrictions, and what is their financial position?

What to watch for

• Do not assume a provider describing itself as PaaS is automatically lower risk than one describing itself as BaaS. The licence, the regulatory track record and the financial standing matter more than the label.
• Ask any prospective provider whether they have ever been subject to regulatory sanctions, restrictions on new business or special supervisory measures, and ask for the answer in writing.

Answer

If you need to issue cards, process payments, disburse funds or manage payment flows, you need PaaS. If you need to offer deposit accounts, provide credit or lending products, or require deposit guarantee scheme protection for your end users, you need BaaS or a banking licence. Most businesses evaluating payment infrastructure find that PaaS is the correct and sufficient model.

A simple decision framework

Answer

BIN sponsorship is the card scheme participation arrangement within a PaaS model that enables a client to issue Visa or Mastercard cards. When a PaaS provider holds principal membership of Visa and Mastercard and extends that membership to a client, enabling them to issue cards as an affiliate member of the scheme, that is BIN sponsorship. It is a component of PaaS where card issuance is required, not a separate model.

A client using a PaaS provider only for funds disbursement or open banking may not need BIN sponsorship at all. BIN sponsorship is specific to card issuance within the EMI-based PaaS model and does not apply in the same way to BaaS arrangements underpinned by a banking licence.

For a full explanation of how BIN sponsorship works, who uses it and what to look for in a provider, see: BIN sponsorship explained: the complete guide for fintechs and PSPs.

Related pages

• Payments as a Service: the complete guide for businesses outsourcing payment infrastructure in Europe – the full buyer’s guide to PaaS including who uses it, what a provider covers, and how to evaluate provider stability
• What is the difference between PaaS and embedded finance? – the broader category that PaaS and BaaS both sit within
• What does a PaaS provider cover, and what stays with the client? – a detailed breakdown of the responsibility division
• BIN sponsorship explained: the complete guide for fintechs and PSPs – how BIN sponsorship works as the card scheme participation piece within a PaaS model

Evaluating a PaaS provider for your programme?

DiPocket is a dual-regulated EMI and principal member of both Visa and Mastercard, authorised by the FCA (Reference No. 900439) and the Bank of Lithuania (Licence No. 75), operating payment programmes across 15 European markets. Explore DiPocket’s PaaS and BIN sponsorship services.