The middleware orchestration thesis. Where BaaS is heading by 2028.

Banking-as-a-service is in the middle of a decomposition that most of its current vendors have not priced in. The model that built the market, the all-in-one platform that gives a client a licence, the banking rails, the compliance, and the technology in a single package, is being pulled apart into distinct layers by forces that are structural rather than cyclical. By 2028 the shape of the market will be different, and the vendors that dominate it will not be the same ones that dominate it now.

The thesis is straightforward: BaaS is unbundling into three layers, the licence layer, the provider layer, and the orchestration layer, and the economics of the all-in-one model break under the weight of doing all three at once in a tightening regulatory environment. The orchestration layer is where the durable position is, and the vendors that understand this early will build the businesses that survive the decomposition. The vendors that keep selling the bundled model will find the bundle coming apart in their hands.

The demand for what BaaS does, letting a licensed institution or an ambitious fintech launch a banking product quickly, is growing. It is a prediction about which shape of vendor captures that demand, and the argument is that the shape is changing from the bundle to the layered stack, with orchestration as the layer that holds the value.

The three-layer model

The decomposition separates BaaS into three layers that are being pulled apart because they have different economics, different risk profiles, and different natural owners.

The licence layer.

The regulatory permission to hold funds, issue accounts, process payments, or issue cards. This layer is owned by licensed institutions: banks, electronic money institutions, payment institutions. It is capital-intensive, regulated, and slow to build, which is exactly why it is a distinct layer. The licence is a scarce, defensible asset, and the institutions that hold it are increasingly aware that it is the scarce thing in the stack. They are less willing to let a technology vendor intermediate their licence invisibly, and more inclined to own the client relationship that the licence makes possible.

The provider layer.

The specialised rails and services: the card issuer-processors, the banking-partner connections, the KYC and AML providers, the payment networks, the FX and settlement providers. This layer is a market of specialists, each excellent at one function, competing on price and capability within their specialism. It is fragmenting further as each function deepens, because a specialist card processor beats a generalist at card processing and a specialist compliance provider beats a generalist at compliance, and the client increasingly wants the specialist.

The orchestration layer.

The layer that sits between the client and the other two, connecting the licence to the right providers, translating between the client’s product and the underlying rails, managing the integrations, and giving the client a single coherent surface to build on. This is the layer that makes the decomposition usable, because a client who had to integrate a licence, five providers, and their own compliance stack directly would face exactly the complexity that BaaS was invented to remove. The orchestration layer removes it without owning the licence or being the provider, and that position is the thesis.

The three layers stabilise as a structure because they have genuinely different economics and natural owners. The licence layer is owned by the regulated, the provider layer by the specialists, and the orchestration layer by the technology companies that are best at integration and product. The all-in-one model tried to own all three, and the argument is that owning all three is getting harder, not easier.

When all-in-one economics break under regulatory weight

The all-in-one BaaS model made sense in a lighter regulatory era. A single vendor could hold or intermediate the licence, run the provider relationships, and offer the technology, and the bundle was efficient because the regulatory cost of doing all three was manageable. That era is ending, and the regulatory weight is what breaks the bundle.

Regulators across Europe and beyond have spent the last several years tightening the expectations on anyone touching the licence layer. The scrutiny of banking-as-a-service arrangements has increased, the expectations on safeguarding, on AML, on operational resilience, on outsourcing governance have risen, and the regulatory cost of intermediating a licence has gone up accordingly. A vendor that intermediates licences across many clients now carries a regulatory burden that scales with the client base and consumes margin that the bundled model did not budget for.

The all-in-one vendor is caught in a squeeze. To keep intermediating the licence, it has to invest heavily in the compliance and governance the regulators now expect, which raises its cost base. To compete on the technology, it has to keep investing in the product. To match the provider specialists, it has to keep pace across every function it bundles, which no single vendor does well. The bundle that was efficient in the light-regulation era becomes three expensive obligations in the heavy-regulation era, and the vendor cannot fund all three at the level each now requires.

The clients feel the consequence. The all-in-one vendor, stretched across three layers, is excellent at none, and the client who wants a best-in-class card programme, a best-in-class compliance stack, and a well-governed licence finds the bundle offering an adequate version of each rather than a strong version of any. As the client base matures and the requirements sharpen, adequate stops being enough, and the client starts looking at the layered alternative.

The orchestration vendor’s structural advantage

The orchestration vendor is positioned where the all-in-one vendor is squeezed, and the advantage is structural rather than a matter of execution.

The orchestration vendor does not intermediate the licence, so it does not carry the regulatory burden that is crushing the all-in-one margin. It connects the client to a licensed institution that owns its own regulatory obligations, and the orchestration vendor’s role is technology and integration, which is a lighter regulatory position. It carries the obligations of a technology provider and an outsourcing partner, which are real but far lighter than the obligations of a licence intermediary.

The orchestration vendor does not compete with the provider specialists, it connects to them, which means it benefits from the fragmentation of the provider layer rather than being threatened by it. Every new specialist provider is a new option the orchestration vendor can offer its clients, and the orchestration vendor’s value grows as the provider layer deepens, because the harder the provider landscape is to navigate, the more valuable the layer that navigates it. The all-in-one vendor experiences provider fragmentation as a competitive threat; the orchestration vendor experiences it as a widening menu.

The orchestration vendor owns the layer that is hardest to replace once it is embedded, because it owns the integration and the client’s product surface. A client that has built its product on an orchestration layer, with the licence and providers connected through it, would face a painful migration to change orchestration vendors, which gives the orchestration position durability. The licence can be swapped, the providers can be swapped, but the orchestration layer is where the client’s own product lives, and that is the layer with the switching cost.

The combination is a vendor that carries a lighter regulatory load than the all-in-one, benefits from the trend the all-in-one is threatened by, and holds the layer with the highest switching cost. That is a stronger structural position than the bundle, and it is available specifically to the vendors that resist the temptation to reach back into the licence layer to capture more of the stack.

The risk to the orchestration thesis

The thesis has a real risk worth naming, because a forward-looking argument that ignores its own weakness is marketing rather than analysis. The risk is that the orchestration layer gets squeezed from both sides.

From above, the licensed institutions could decide to build their own orchestration and offer it directly, capturing the layer for themselves. A bank that builds a good developer platform on top of its own licence removes the need for an independent orchestration vendor, at least for clients willing to be tied to that bank. From below, the provider specialists could integrate upward, offering enough orchestration around their own specialism to reduce the need for an independent layer. And a well-capitalised technology company could build orchestration as a feature rather than a business, bundling it into a broader offering.

The orchestration vendor’s defence against the squeeze is neutrality and breadth. An orchestration layer tied to one licence is not orchestration, it is that bank’s platform, and it loses the multi-licence, multi-provider optionality that is the point. An orchestration layer built by a provider around its own specialism is not neutral, and clients feel the bias. The independent orchestration vendor’s defensible position is precisely that it is not any single licence and not any single provider, and it holds that position only by staying independent of both, which is why the temptation to reach into the licence layer for more margin is also the temptation that would destroy the structural advantage.

What buyers should anticipate in the 2026 to 2028 procurement cycle

For the licensed institutions and fintechs buying BaaS in the next procurement cycles, the decomposition changes what a good decision looks like.

The buyer should anticipate that the all-in-one vendor they are evaluating is under a margin pressure that will show up in the relationship over the contract term. A vendor stretched across three layers in a tightening regulatory environment is a vendor whose economics may force it to cut investment in the layers the buyer depends on, or to raise prices, or in the worst case to run into the regulatory trouble that intermediating licences at scale increasingly invites. The buyer evaluating an all-in-one vendor should ask hard questions about how the vendor funds its regulatory obligations and its product investment simultaneously.

The buyer should evaluate the layered alternative even if it looks more complex on the surface. A stack of a chosen licence, chosen providers, and an independent orchestration layer looks like more moving parts than a bundle, but it gives the buyer best-in-class components, the ability to swap any layer that underperforms, and a vendor in the orchestration seat whose economics are sound. The apparent simplicity of the bundle is worth less than it looks once the bundle’s economics are under pressure.

The buyer should weigh the orchestration vendor’s independence heavily. An orchestration vendor that is quietly tied to one licence or one set of providers offers less of the optionality that makes the layered model attractive. The buyer wants an orchestration layer that is genuinely neutral, that can connect the buyer to the licence and providers that suit the buyer rather than the ones that suit the vendor, and that independence is the thing to test in diligence.

And the buyer should build for the decomposition rather than against it. A product architected to sit on a flexible orchestration layer, with the licence and providers swappable underneath, is a product built for the market that is arriving. A product hard-wired into a single all-in-one bundle is built for the market that is leaving, and re-architecting later, after the bundle has come apart, is more expensive than architecting for the layered model now.

The shape of 2028

By 2028 the BaaS market looks less like a field of competing all-in-one platforms and more like a layered stack: licensed institutions owning their licences and the client relationships those licences enable, a deep and fragmented market of provider specialists competing on capability, and a smaller number of orchestration vendors sitting between them, holding the integration and the client’s product surface. The all-in-one vendors that survive will be the ones that chose a layer and committed to it, most likely the orchestration layer, and the ones that do not survive will be the ones that kept trying to own all three as the regulatory weight made that untenable.

The demand for what BaaS does will be larger in 2028 than it is now, because more institutions and more fintechs will be launching banking products, not fewer. The question the decomposition answers is not whether the demand exists but which shape of vendor captures it, and the thesis is that the orchestration layer captures the durable centre of it. The vendors building for that future now, resisting the pull to bundle and committing to the neutral orchestration position, are building the businesses that the decomposition rewards. The vendors defending the bundle are defending a structure that the regulatory environment is quietly dismantling underneath them.