Funding for US fintechs dropped 50% in 2022. As the industry moves from growth to cost-savings, small fintechs will have to tap financial service providers for functionalities such as savings accounts, payments, lending, and debit cards. At the same time, more nonfinancial companies than ever wish to offer financial capabilities in their apps or platforms. Both young and mature software companies, retailers, and marketplaces are offering these same banking services for a more integrated user experience. Providers of this “embedded finance” did $20 billion in revenue in 2021, and McKinsey expects the market to double in the next few years.
Cross River Bank is both a chartered financial institution and a technology provider, meaning it can serve both customers. With a bank charter, Cross River can provide fintechs with a balance sheet to write loans and hold deposits while offering a risk and compliance framework. But there’s a more importance reason it attracted over $1.15 billion in capital from KKR, Andreesson Horowitz, and Battery Ventures. With a core processing platform that offers a suite of plug-and-play banking services, Cross River can distribute the embedded finance experience to fintechs and nonfinancial companies. Rather than seek two partners, customers can tap Cross River for both the balance sheet and the technology.
The market for this banking-as-a-service (BaaS) is expected to reach $2.3–$3.6 trillion later this decade, and Cross River has established an early lead. Many big banks rely on legacy systems and cannot quickly adapt to the new technology demanded by fintechs. Gaining a bank charter is a costly and fraught process, and fintechs don’t want to bear the burden of bank compliance. Cross River’s suite of banking services, all available through an API, offers financial products to fintechs and fintech capabilities to nonfinancial companies.
And yet, last week the FDIC sent a strong signal that this growth will be tempered by oversight:
Cross River has earned the ire of regulators before. The bank paid a $641K fine for 70 fraudulent loans1 it originated for partner Freedom Financial in 2018 (which was fined $20M). But Cross River’s loan book is unusual, for the reasons stated above. It originates loans on behalf of fintechs (mostly marketplace lenders like LendingClub, Upstart), then sells them back to the fintech. The fintech securitizes them and/or sells them to hedge funds or others.
Fintechs loved the lax rules and high margins, and Cross River became very good at originating loans for them quickly. During the pandemic, it was perhaps too quick; Cross River rapidly tied its API to SBA’s E-Tran Loan system and became a major writer of PPP loans. Rather than bank its own customers, it got PPP borrowers from its fintech partners. (Congress later reported that 75% of fraud PPP came from fintechs.) Gade said he enjoyed helping those affected by the pandemic. Cross River also made $1 billion in fees.
But Cross River keeps 10–20% of loans. CEO Gilles Gade says this shows “commitment” to its partners without taking too much risk. So, which loans would you keep on your books?
Not too long ago, 60% of its book was personal loans (a very high proportion) and in Q4 2022 Cross River earned a NIM of 6.19%. The FDIC says the average US community bank earns 3.34%, putting Cross River in the 97th percentile. Business has been pretty good—so how did it manage this?
This note puts the regulatory action into context, exploring Cross River’s wins and losses objectively, and why its business model has succeeded at gaining both traction and the scrutiny of regulators. Below, we cover:
Banking-as-a-service and its traction
The regulatory headwinds for this business model
The bull case for banks like Cross River
Across the river
CEO Gilles Gade was born in France and arrived in the US in the 1990s. After 12 years as an investment banker on Wall Street, he launched a boutique investment bank focused on technology in 2000. Then, the Global Financial Crisis hit. Most banks were shedding risk, but Gade saw an opportunity to launch a community bank with “a clean balance sheet, adequate equity, and a tremendous opportunity to buy quality assets” during the downturn. In the midst of the crisis, Gade took $700,000 of his own savings, plus another $9 million pitched in by others, and invested in Cross River Bank, a chartered bank with no assets located in New Jersey—just across the Hudson River from the center of the financial world.
The Garden State has its reputation, good and bad, but most people don’t know that it allows the sort of high interest rates forbidden in states with strict usury laws (nearby Connecticut & New York, for example).
Gade’s contrarian strategy showed early promise. Where an average community bank takes 3–4 years to turn a profit after accounting for compliance and startup costs, Gade made Cross River profitable in five quarters, mostly by trading government-backed and auction-rate securities. But Cross River didn’t stay a normal bank for long. In 2009, Gade learned of a small fintech company, GreenSky Credit, that partnered with Home Depot to offer its customers financing for repair and renovation projects. In order to originate the loans, GreenSky needed access to someone’s banking charter. Cross River stepped up, and Gade noticed another opportunity: consumers and business had grown skeptical of banks during the financial crisis. Meanwhile, 172 fintechs launched in 2008, and another 233 in 2009. Like GreenSky, many of them needed banking services, but there was no way they would all get banking charters. The year it opened, Cross River was one of only 90 banks that received a charter.
Cross River soon became a lender to other lenders—originating loans for fintechs who designed their own front-end applications. Rather than hold the loans on its balance sheet like a regular bank, Cross River sold them back to the fintech.
Gade didn’t stop at just loans. Cross River continued building the services demanded by its partners, soon offering fintechs quick payments via Cross River’s access to the Federal Reserve’s Automated Clearing House (ACH). Soon, Gade offered credit, debit, and prepaid cards, then automated wire services, bank accounts, subledgers, and virtual accounts. In just a few years, Gade had built an entire core processing platform that fintechs could plug into—giving them all the benefits of being a bank, without going through the hassle and expense of getting a banking charter themselves.
It didn’t take long for Gade to realize Cross River’s advantage: “somewhere between what a bank should be and what a fintech aspires to be.” Thus came the other meaning of Cross River’s name: bridging the gap between traditional banking and fintech operations.
Product
Cross River Bank is both a bank and a banking-as-a-service provider, offering a one-stop shop for companies hoping to embed financial capabilities into their products. It offers a core banking platform—the back-end systems of a bank that process transactions, including transfers, deposits and loans—which fintechs plug into via its API. With its own banking charter, Cross River can also offer FDIC-insured accounts, credit and debit cards, and payments. Thus, a company can get the banking services straight from the bank, rather than from two separate providers, allowing them to focus on customer acquisition and growth.
Traditional Banking
Cross River operates under the financial holding company CRB Group, which is regulated by the Federal Reserve, and still maintains two branches and four ATMs. At a basic level, this charter allows Cross River to make loans, take deposits, and access the Federal Reserve's payments network, among other things.
Even within traditional banking, Gade distinguished Cross River early. When the government extended PPP loans, Cross River quickly set up the infrastructure to originate the loans, which Gade said “put us on the map.” He noted that many of these borrowers were discovered by fintechs, and those fintechs returned to Cross River for its other banking products later on.
Banking-as-a-Service
Most of Cross River’s revenue comes from offering these banking services to fintechs, a model colloquially known as “rent-a-charter.” In other words, Cross River provides banking processes, such as loans, payments, or deposit accounts, as a service using Cross River’s API-driven platform. Oliver Wyman estimated the cost for acquiring a customer through a legacy bank is typically in the range of $100–$200, whereas a new BaaS technology stack such as Cross River’s can do so for between $5–$35.
Cross River’s Marketplace Lending API allows marketplace lenders such as LendingClub and Upstart to validate and originate loans. Cross River holds the loans on its books for a few days before selling them back to the fintech, or to partner investors. Throughout the process, Cross River handles the compliance process, which is important since lending often deals with multiple states’ licensing requirements and usury laws.
Cross River is allowed to sponsor a Banking Identification Number (BIN) for small and medium-sized businesses and startups, which streamlines the process of getting a corporate card, which can be issued through Visa, MasterCard, and AMEX. The value of the API is a full stack of banking products and services, which opens cross-selling opportunities. For example, the API could enable product integrations to commercial expense management software providers, such as Divvy, offering cards, loans, and bank accounts to customers of those providers. In-platform accounts, payments, and credit are more convenient for the user, and less error-prone, than connecting to external bank accounts.
Payments
Within Cross River’s API is its real-time payments functionality, a service that has been in-demand among fintechs and nonfinancial companies for the past 2–3 years. Cross River relies on the Federal Reserve’s ACH payment rails and offers its XPay services for intrabanking. Cross River’s Real-Time Payment System converts fiat to crypto, allowing users to embed fiat and crypto payments capabilities that Gade says can be rolled out in two weeks (a bit longer with compliance processes). These faster, more secure, and lower-cost transfers have been integrated by TransferWise, Coinbase, Stripe, and Google Wallet.
Cross River claims that, in 2014, it was the first in the industry to pioneer push-to-debit payments. Partnering with Stripe, this allowed clients such as Lyft, Instacart, and TaskRabbit to send funds to employees’ and sellers’ debit cards, which is simpler and less error-prone than sending to external bank accounts.
Cross River Digital Ventures
In 2021, Gade launched a venture arm, Cross River Digital Ventures, to back companies in lending, payments, investing, and fintech. To date, the bank has made 18 deals with a median check size of $13.5 million, including CRE financing platform Lev, payments company Sardine, and solar credit company Sunstone.
Market
Customer
During the Global Financial Crisis, banks pulled back on lending and risk-taking generally, and marketplace lenders filled that void, expanding the credit spectrum in the process. These lenders include proper fintechs—Prosper, LendingClub, Affirm, among them—as well as legacy finance companies, such as Quicken Loans’ RocketLoans and Loan Depot. Out of the dozens of marketplace lenders now operating, 16 partner with Cross River using its Marketplace Lending API. Cross River originates these loans, then sells them back to the marketplace lenders, while handling compliance and payments in real time.
Besides marketplace lenders, Cross River partners with money service businesses, foreign remitters, and third party payment processors. Demand for embedded finance capabilities, which would draw on Cross River’s BaaS API, is highest among vertical SaaS companies in retail, restaurants, healthcare, trucking, construction, and food and agriculture, according to McKinsey.
Market Size
With a balance sheet small than $10 billion, Cross River Bank is just a drop in the bucket of the $2 trillion US banking market cap, but it has attracted venture capital attention because of a more valuable proposition: offering its banking services to other companies in the form of banking-as-a-service. The market for embedded finance experiences rises as more companies (from DoorDash to Amazon) and ecommerce platforms (like Shopify) partner with new payment and lending platforms (like Affirm or Plaid). Juniper Research projects revenues of embedded finance providers to reach $17.3 billion by 2026, with a market for banking-as-a-service as big as $2.3–$3.6 trillion by later in the decade.
According to McKinsey research, the majority of revenues from embedded-finance lending products accrued to the balance sheet provider—that is, the firm bearing the credit risk. In 2021, this was 55% of the $14 billion embedded finance lending. Meanwhile, for payments and deposit products, those who owned the end-customer relationship benefited most, earning $4 billion from lending, or 30% of total embedded finance lending revenues.
Competition
Many neobanks, such as Monzo or N26, are fintechs that improve upon traditional banking services. Cross River twists this model in the other direction: it’s a traditional bank that provides technology infrastructure. Although many companies compete in the individual services Cross River provides, its biggest competitors are chartered banks that offer similar technology stacks and also service fintechs—namely, Celtic (launched in 2001) and WebBank (1997). WebBank, for example, services Klarna, Petal, and LendingClub (along with Cross River).
Importantly, Cross River, WebBank, and Celtic are all banks run by bankers. Recently, former engineers at Facebook, Plaid, and Affirm launched Column to “build the bank we wish we had.” Column already provides BaaS to Plaid, Brex, and mobile banks such as Oxygen and Nearside. Although the company is pre-seed, if the engineers can service fintechs better than the bankers, then Column may become a competitive player in the BaaS arena.
Importantly, Gade does not see Cross River competing with European fintechs, who are subject to far different regulatory standards and who are not competitive in the US market. But as Cross River moves overseas, it will have to compete with those incumbents according to their own rules.
Banks becoming fintechs
Cross River has a two-sided moat: both a banking charter and a large technology stack. Established banks are challenged to compete with Cross River because they rely on legacy systems, and few are capable of a quick digital transformation to offer BaaS, though McKinsey cites a study that two-thirds have already started. They also don’t benefit from the higher interchange fees that small US banks are allowed to charge their customers due to the Durbin Amendment, thereby making these large banks less attractive partners for fintechs. On the other hand, legacy institutions have scale and still dominate payment flows, so they may attack specific niches currently targeted by Cross River.
Fintechs becoming banks
On the flip side, more fintechs may apply for banking charters or buy banks and rent those charters to other fintechs. Although this may sound reasonable, it is impractical for most fintechs to get a banking charter. The banking charter is necessary to offer an account with FDIC insurance (the only way to offer an account) and access to the Federal Reserve’s payments system. But the process is complex, fraught, and expensive. It took Varo Money three years and $100 million to get a charter.
Moreover, most banks spend significant time and expense complying with banking regulations designed to protect consumers and maintain the safety and soundness of the industry, and fintechs probably don’t have the funding (or interest) in this. Growth has always been very risky for banks, so the US deposit insurer, the FDIC, caps growth in the first seven years of a new bank (known as a “de novo”) and will have to approve any high-growth business plan changes after that seven-year probationary period.
That said, competitors may expedite the process by purchasing a nationally chartered bank, then implementing a broad, fintech-friendly BaaS model. LendingClub, for example, purchased Radius Bank in 2021. Even so, many fintechs will opt not to build their own financial products. Launching financial services on a nonfinancial platform (such as DoorDash or Instacart) can take a large team 6–12 months. Tapping into a BaaS API can quickly open new revenue channels at attractive margins, deepen customer engagement, and open cross-selling opportunities among its customers.
Business Model
Cross River’s primary business model is “renting” its banking charter to fintechs, a form of regulatory arbitrage that relies on extracting economic rents. Fintechs and nonfinancial companies normally begin by integrating deposit and payments products into their applications, which promotes customer stickiness. This is usually a gateway to higher-margin credit products. The data collected on deposit and payment activity makes the underwriting of these loans easier.
Typically, the fintech finds a borrower and Cross River originates the loan through the Marketplace Lending API. After a few days of compliance processes, Cross River sells the loan back to the fintech, taking a small fee on every loan. “We’re in the moving business,” Gade says, “not the storage business. We originate [loans], we package them, and we sell them.” The fintech also normally sells the debt, often to hedge funds or other bond investors, or securitizes it into bundles of many loans.
That said, Cross River keeps a portion of these loans on its books—roughly 10%–20%—which Gade says shows commitment to Cross River’s clients without taking on too much risk. In 2022, this “commitment” amounted to $7.3 billion. According to its FDIC filings, 60% of these loans are personal loans, a relatively high proportion for a community bank, and almost entirely from its fintech lending partners.
Many of these loans carry high interest rates, which is forbidden in states with strict usury laws like nearby Connecticut and New York. That has contributed to outsized performance for Cross River’s loan book. Banking is historically a low-margin business, with community banks averaging a net interest margin (or NIM, i.e., gross margin) of 3.34%. Cross River managed a 6.19% NIM in Q4 2022, putting it the 97th percentile of community banks.
Of course, as a bank, Cross River faces high compliance costs. A bank of Cross River’s size can expect to pay about 3–5% of their noninterest expense on compliance, such as know-your-customer rules (KYC) and anti-money laundering laws (AML).
Cross River’s BaaS model is a modular, pay-as-you-go arrangement, with many cross-selling opportunities. By offering a full suite of banking services, Cross River locks fintechs into its ecosystem. This can be a constraint since banking with Cross River limits a company to only those products and services it offers. Other BaaS companies, such as Unit, maintain partnerships with multiple banks, offering an array of potential additional financial products and features.
Cross River’s success is partly why we cannot ignore the FDIC’s action; regulators clearly signaled that they intend to clamp down on this business model.
Valuation
In March 2022, Cross River raised a $620 million Series D from Eldridge, Andreessen Horowitz, T. Rowe Price, Whale Rock Capital Management, and Hanaco Venture Capital, as well as its existing investors. The $3 billion post-money valuation represented a 3x increase from its Series C valuation. Moreover, revenue growth has averaged 50% per year and it has been profitable since 2010. Cross River had considered an IPO in 2021, but these plans were tabled.
Since opening its doors, Cross River has originated more than $85 billion in loans to businesses and consumers, collecting fees between 0.2% and 0.5% from loans across its entire portfolio. In 2022, it earned interest income (effectively, revenue) of $586 million on borrowing costs (equivalent to cost of goods sold) of $73 million. By 2018, Cross River was extending credit to 2.2 million people annually and processing 3–5 million transactions per week.
Cross River Bank, which was started in a financial crisis, has benefited from later crises. After the collapse of Silicon Valley Bank and Signature Bank—two banks focused on banking tech and crypto clients, respectively—Cross River Bank attracted major refugee customers. After Signature Bank failed, and with it, its SigNet real-time payments infrastructure, Circle moved to Cross River. Again, Gade took a contrarian position:
And although the FDIC had been looking into Cross River for some time, it could very well have been this decision to bank crypto that led to the action’s announcement, i.e., post-Signature.
The COVID-19 pandemic benefitted Cross River Bank in two ways. First, the increase in e-commerce—and with it, the use of partner services like Affirm, Upgrade, and Upstart—saw revenue grow 67% in 2020 and 115% in 2021. Second, when the government guaranteed Payment Protection Program (PPP) lending during the pandemic, Cross River doubled its asset size as it extended $4.7 billion in PPP loans, averaging $44,062 each. It did so not by lending to its own customers (as JPMorgan Chase, Bank of America, and other giant banks did) but rather to new customers, whom it sourced through roughly 15 fintechs, and ended up as the fourth largest originator of PPP loans, just behind Wells Fargo, Bank of America and JPMorgan Chase.
The bull case
International Expansion
Despite a 13-year profit streak and a $106 million debt issuance in 2020, CEO Gade said the $620 million Series D was necessary for global expansion. The bank teamed up with UK-based Railsbank in January 2019 to launch a Banking-as-a-Service (BaaS) on both sides of the Atlantic through a single API. The bank also plans to get a digital banking license in Malaysia, among other countries. Of course, as Cross Bank enters foreign markets, it will be competing with large incumbents such as Railsbank, solarisBank, and GPS under their own regulatory rules, while still being subject to US regulatory constraints.
Scaling with its customers
Cross River’s business model extracts rents from growing fintechs, meaning its business with them will increase as their volumes increase across the payments (Stripe), buy now-pay later (Affirm), and crypto (Coinbase and Circle) sectors. When Scott Tobin, a partner at Battery Ventures, contributed to the $30 million Series C, he noted that Cross River had a lot of synergies with Battery’s fintech portfolio, noting that “they already hold the keys to our clientele.” Gade has underscored this shared-growth with the launch of Cross River Digital Ventures, which makes equity investments in promising partners. Cross River is therefore well positioned to benefit from the growth of the fintech ecosystem, and the financialization of nonfinancial apps and platforms.
The next generation of fintech
As Adam Goller, Cross River’s head of fintech banking, put it, Cross River’s advantage is adaptability. Beyond the products and services offered, banking with Cross River is about “the flexibility of knowing that if you have a specific need that is not accommodated by the current technology, we can build it.” This flexibility is what enabled Cross River to quickly tweak their API to be compatible with the Small Business Administration’s E-Tran system, allowing the bank to become a major writer of PPP loans.
For example, Gade has positioned Cross River as a go-to banking partner for the crypto industry. In an interview with McKinsey, Gade noted that Cross River made its name by taking a contrarian approach at a time most major banks were derisking. When Coinbase was just getting started and looking for a partner bank, many traditional financial institutions had blanket policies preventing them from engaging with crypto. “They were not interested in venturing into those domains,” he said, “and we just took the risk.” Today, Gade is looking for Cross River solutions for custodying and lending against crypto.
As Cross River Bank moves abroad, it’s helping foreign fintechs enter the US market, such as its recent partnership with UK-based Pay.com and Revolut. Cross River is well-positioned to adapt its core processing stack for the demands of new industries and markets, and well-capitalized to acquire others: it has already made three acquisitions across SMB and P2P lending.
The obvious risks
Credit Risk
As a bank, Cross River holds a loan book that is exposed to the credit and duration risk of any loan portfolio. More importantly, many of Cross River’s fintech partners are high risk, and this is an acute concern for Cross River since it’s subject to banking regulations. Cross River normally holds new loans on its books for a few days before it’s able to sell them back to the fintech. In the event of an acute credit crunch, the fintech may not be able to purchase them. If it could not find another buyer, Cross River would have to hold these loans as “held-for-sale,” which means it would need to mark them to fair market value. As credit conditions tightened, it would have to write down those loans significantly, impairing the bank’s equity and raising flags for bank regulators.
This is most relevant if Cross River’s partnership revenue proves to be too highly concentrated (this data is not publicly reported). For example, Cross River’s publicly listed competitor, WebBank, saw its two highest grossing contractual lending programs contribute 40% and 29% to total revenue in 2017 and 2018, respectively. This partnership risk is not a remote possibility: GreenSky Credit, Cross River’s first client, took a turn for the worse in 2018 and Gade pulled back its lending (GreenSky was purchased by Goldman Sachs in 2022). Importantly, not all of this credit risk and interest rate risk may appear on Cross River’s balance sheet; Cross River has lending agreements with its fintech partners that may include contractual commitments to extend credit to qualifying borrowers who meet lending criteria.
Economic Risk
Banks and fintechs that rely on banking products are particularly exposed to interest rate risk. For a company like Cross River, that appears on its own balance sheet, in the form of the duration risk in its loan portfolio. More important are the economic risks to its clients. Cross River touches millions of consumers and businesses via its partnerships with Stripe, Coinbase, Affirm, and Rocket Loans. An economic downturn will tighten credit and likely reduce payments velocity, possibly reducing Cross River’s fee income and other revenue. Underscoring this risk, T. Rowe Price, who participated in Cross Rivers’ $620 million Series D, wrote down its investment in the bank by 25% following the Federal Reserve’s interest rate hikes and the March 2023 banking panic, both of which contributed to tighter credit conditions in the US.
Regulatory Risk
Because Cross River is first and foremost a bank, it faces different compliance requirements than most tech companies, as well as increased regulatory risk. A bank like Cross River is particularly exposed to compliance risk because it uses third parties to originate its loans and payments that are considered very risky by regulators.
Because of the attention Cross River receives from bank regulators, Gade identified compliance risk as the biggest risk Cross River faces. For example, in 2018, the FDIC fined Cross River $641,750 for unfair and deceptive practices for failing to oversee the 24,000 loans extended by a partner fintech, Freedom Financial; 70 originated by Cross River were found to be fraudulent. The FDIC required Cross River to implement a “Compliance Management System that effectively identifies, addresses, monitors, and controls consumer protection risks associated with third-party activities,” while Freedom Financial settled with the FDIC for $20 million.
There is also increased attention among regulators at business models like Cross River’s, as Congress noted that fintechs originated three-quarters of fraudulent PPP loans. Cross River allows its partners to bypass state licensing requirements and interest rate restrictions, and some critics warn that embedded finance enables predatory lending as fintechs avoid consumer protection laws such as state usury caps.
This raises the question of potential regulatory changes that could affect Cross River’s business model. Most importantly, Cross River benefits from the Durbin amendment, which allows small US banks (< $10 billion in assets) to charge higher card interchange fees. The ability to charge high fees means high margins for fintech partners, a major advantage of banking with Cross River over, say, Bank of America. However, the influence of the small bank lobby in the US means the Durbin Amendment likely will not change in the near future anyway.
Talent Acquisition
Operationally, Cross River may face a shortage of talent. In a 2018 interview, Gade expressed concern about attracting talent from Square, PayPal, and other Silicon Valley fintech giants, and toward an East Coast bank like Cross River. In 2021, Cross River had about 125 employees in Israel, focused on software development. Although Cross River’s revenue is driven by its BaaS solutions, bank compliance requires a large headcount.
Bottom line
Cross River Bank aspires to be “a one-stop shop for the payment ecosystem,” in Gade’s words. Since its humble beginnings as a community bank in the midst of a financial crisis, Cross River has built a nearly complete banking technology stack that fintechs can plug into, allowing them to hasten their go-to-market strategy and improve the customer experience. As a traditional bank, Cross River faces risks and constraints many tech companies don’t. On the other hand, as a chartered bank and BaaS provider, it offers both fintechs and nonfinancial companies a convenience that’s difficult to find elsewhere, and it currently faces few challenges from companies with similar business models.
Further reading
How Banking-as-a-Platform Propels Cross River Bank
Inside The Secret Bank Behind The Fintech Boom
At the intersection of banking and technology: A conversation with Cross River Bank
Embedded finance: Who will lead the next payments revolution?
To be fair, Cross River originated a total of 24K loans, but it only takes a few really bad loans to raise flags.