The first time an engineer at a U.S. bank watches a FedNow credit transfer settle on a Wireshark trace, the experience is anticlimactic. A small ISO 20022 message, a couple of internal ledger writes, an acknowledgement back. The settlement is final in well under twenty seconds. Yet that single message touches more compliance code, fraud models, and reconciliation jobs than almost any other transaction the bank will process that day. This fintech infrastructure guide walks the U.S. financial market through what happens under the hood.
The American payments stack carried more than $18 trillion in interbank value through Fedwire in 2025, according to the Federal Reserve payment systems page, with ACH handling another $80 trillion in originations and FedNow doubling its monthly volume each quarter since launch. Understanding how those rails interlock with core systems, APIs, and consumer apps is now table stakes for anyone selling into U.S. financial services.
The four working layers in a U.S. bank
Inside a typical American bank, the infrastructure splits into four layers. The bottom layer is the settlement network connection: dedicated FedLine endpoints for Fedwire and FedNow, a Nacha-compliant ACH operator connection, and a SWIFT BIC for cross-border. The second layer is the core banking system, usually FIS IBS, Fiserv DNA, or Jack Henry SilverLake, which holds the demand-deposit ledger.
The third layer is the integration tier, where middleware translates core calls into modern REST or gRPC APIs. This is where most fintech sponsor banks have spent the past five years. The top layer is the channel: mobile app, web banking, third-party fintech partner, or treasury portal. When a customer in San Diego initiates a payment, the request traverses all four layers in both directions before the funds are released.
Outside the four-layer view, two cross-cutting systems matter. The first is the bank identity directory, which holds the customer record-of-truth used by every downstream module. The second is the policy engine, a set of rule services that decide whether a transaction is allowed under the bank program plan filed with examiners. In modern U.S. banks both run as independent services, called from the integration layer rather than embedded in the core.
How a single payment actually settles
Consider a same-day ACH credit of $4,200 from a Bank of America business account to a Capital One personal account. The originating bank validates the request against limits and fraud rules, batches it for the next ACH cycle, and submits the file to the Federal Reserve operator. The Fed posts a settlement entry against the originating bank’s reserve account and routes the credit to Capital One, which posts to the receiving customer’s ledger after its own risk checks.
Each of those steps is governed by a different rulebook. Nacha sets the ACH formats and timing. The Federal Reserve sets the settlement window and reserve-account mechanics. The OCC and FDIC inspect the bank’s compliance program. The CFPB watches the consumer-disclosure side. None of those rules are encoded in the rails themselves; they live in the bank’s policy code and reconciliation jobs. Reporting from Deloitte financial services insights shows that compliance and risk now consume roughly 35 percent of U.S. bank technology spend, up from 22 percent a decade ago.
For real-time rails, the timing changes but the obligations do not. FedNow settles in seconds and is irrevocable, which means the bank’s fraud model must score and decide before the message leaves the gateway. That has driven adoption of streaming-data tools like Apache Flink and feature stores from vendors such as Tecton and Feast inside U.S. bank tech stacks.
APIs, sponsor banks, and the middleware layer
Most consumer-facing fintech apps in the U.S. do not hold a bank charter. They partner with a sponsor bank, which holds the FDIC-insured deposits and provides regulatory cover. The middleware layer connects the fintech to the sponsor bank’s core. Companies like Treasury Prime, Synctera, Unit, and Modern Treasury sit in this layer, exposing endpoints for account creation, card issuance, ACH initiation, and ledger queries.
This model produced rapid product launches between 2020 and 2023, then ran into reconciliation issues when Synapse collapsed in 2024. Since then, the OCC and FDIC have published clearer expectations: sponsor banks must keep a direct, customer-level record of every account opened through a partner, with daily reconciliation back to the core ledger. The regtech compliance overview on this site has tracked how that guidance is reshaping middleware contracts.
Reporting in the state of US fintech shows that the sponsor-bank model is consolidating around a smaller number of well-capitalized partners, including Cross River Bank, Lead Bank, Column, and Pathward. Each of these now publishes a public API surface, but the contracts behind those APIs include detailed reconciliation, capital, and customer-identification clauses that did not exist in earlier versions.
Data, fraud, and observability
The U.S. financial market generates a staggering volume of telemetry. A mid-size bank processes 60 to 120 million authorization decisions a month across cards, ACH, and wire, each producing dozens of log lines, model scores, and customer-event records. Observability of that pipeline has become its own discipline. Most large U.S. banks now run a Kafka-based event bus, a separate analytical lake on Snowflake or Databricks, and a fraud-scoring system that updates features in under 50 milliseconds.
Fraud is the highest-stakes use case. Card-not-present fraud against U.S. issuers exceeded $13 billion in 2025, and synthetic-identity fraud against fintech accounts grew faster than any other category. The Cybersecurity and Infrastructure Security Agency tracks these patterns through advisories at cisa.gov financial services, and most U.S. banks subscribe to its alerts as part of their threat intelligence program.
On the model side, U.S. issuers have moved from rules-only systems to gradient-boosted decision models with rules as a guardrail. Newer architectures add graph models for synthetic-identity detection, which look at the relationships between phone numbers, devices, and account openings across the bank’s customer base. The AI in financial services piece on this site goes deeper into how those models are trained and audited.
One understated point: most U.S. fintech apps do not yet have a true ledger of record. They rely on the sponsor bank for that and keep only a cached copy. The 2024 reconciliation crisis showed how fragile that pattern is when the middleware layer fails. New entrants are now building real double-entry ledgers from the start, often borrowing patterns from the open-source TigerBeetle project and from older trading systems used at exchanges.
What this means for the U.S. market in 2026 and beyond
For chief information officers at U.S. banks, the architectural decisions of the next two years will set cost structures for the next decade. The big questions are whether to keep running a vendor core on-premise, whether to migrate to a cloud-native core from Thought Machine, Mambu, or 10x, and how much of the customer experience to delegate to fintech partners. Each path has trade-offs in unit economics, regulatory risk, and time to launch.
For fintech operators, the model is shifting from a single sponsor bank to a multi-bank stack. Companies that previously routed all ACH through one partner now split flows across two or three sponsor banks for resilience. That spreads regulatory risk, but it also increases reconciliation work and demands stronger internal ledgers. Several large U.S. fintech companies have responded by hiring former core-banking engineers and building their own internal double-entry systems on top of Postgres or CockroachDB.
For regulators, the priorities for 2026 are clear: closer oversight of bank-fintech partnerships, broader rollout of FedNow as a default rail for payroll and benefits, and tighter rules around AI-driven credit decisions under the CFPB. The agency has been signaling that adverse-action notices must explain model outputs in plain English, which is technically demanding for any deep model.
The engineer watching that anticlimactic Wireshark trace knows the truth that the rest of the market is just catching up to: U.S. fintech infrastructure is no longer a back-office concern. It is the product. The next bank that gets it right will not need to advertise speed, security, or partnerships; the receipts will arrive at the customer’s phone before the marketing email does.
