a16z-, Unit- & Blue Ridge-Linked Startup Targets Undocumented Immigrants With Deceptive Claims
False FDIC Claims, Potential UDAAPs Show Limits of Banking-as-a-Service Models
Hey all, Jason here.
Happy (almost) 4th of July to my American readers — hopefully, you’re able to enjoy an extra-long weekend.
Thanks to the generous support of paying subscribers, Fintech Business Weekly made a donation to the Aspen Institute. The next organization we’ll be supporting is the Hispanic Federation, which includes economic empowerment as a focus area by offering financial education, resources, and training — 15% of subscription revenue earned in July and August will be donated to the organization.
Existing subscriber? Please consider supporting this newsletter by upgrading to a paid subscription. New here? Subscribe to get Fintech Business Weekly each Sunday:
Maza, Funded By Andreessen Horowitz and Partnered With Unit and Blue Ridge Bank, Targets Undocumented Immigrants With Deceptive Claims
Last week, Maza, a startup that facilitates undocumented immigrants in applying for US individual tax ID numbers (ITINs) and opening US bank accounts, announced it had raised an $8 million seed round, led by a16z and with participation from sophisticated angel investors that included the CEO of American Express National Bank and a Plaid co-founder.
The problem Maza is tackling is a sizable one: undocumented immigrants aren’t eligible for a Social Security number — the key identifier used in the US necessary for everything from paying one’s taxes to opening financial accounts and renting an apartment.
That’s where an ITIN comes in. Its intended purpose is to enable those with a tax filing obligation but who lack an SSN to file their taxes, but it can also help an undocumented immigrant to establish a financial identity in the United States, even without legal resident status.
It’s worth noting that an ITIN isn’t a cure-all for the undocumented. Many financial service providers only accept SSNs or have terms and conditions that require applicants to be citizens or legal residents in the United States.
The PATRIOT Act generally requires financial institutions to obtain a name, date of birth, physical address, and identification number, and to form a “reasonable belief” in the identity of a prospective customer.
These requirements don’t explicitly limit FIs to opening accounts for US citizens and legal residents physically located in the United States.
But most FIs do have such requirements, due to the historical difficulty of forming a “reasonable belief” in applicants physically located outside the United States or who are not citizens or legal residents with an SSN. Serving such customers is a higher-risk activity, which requires appropriate policies, procedures, and controls to be in place.
Regulators aren’t unaware that onboarding requirements may lead some banks to choose not to serve populations that lack the most common credentials. In a recent speech at the Bank On National Conference, OCC acting comptroller Michael Hsu acknowledged that (emphasis added):
“To continue to expand financial access, banks need to innovate and consider adjustments to their screening processes. These might include accepting more forms of identification, streamlining remote account opening, partnering with benefits providers and employers, and training bank frontline staff.”
Current CIP rules do provide an exception to the identification number requirement that allows a bank to open an account for a customer who has applied for but not yet obtained an tax ID number, a provision Maza appears to be taking advantage of:
The exception permits the bank to open an account for a customer who has applied for a TIN, but does not yet have a TIN. In this case, the bank’s CIP must include procedures to confirm that the application was filed before the customer opens the account and to obtain the TIN within a reasonable period of time after the account is opened.
Applying For An ITIN Online Isn’t Novel
Maza enables users to apply for an ITIN online. This isn’t novel: dozens of sites claim to offer such services. Maza itself isn’t even a certified ITIN acceptance agent; rather it partners with a third-party acceptance agent.
The company also promises users “access to the financial system,” including “credit, banking, and taxes in the United States.”
Maza leverages banking-as-a-service platform Unit and bank partner Blue Ridge — which entered into a consent order with the OCC late last year related to its oversight of fintech partners — to offer a deposit account and debit card.
But there are numerous, serious problems with claims Maza makes on its site.
Maza repeatedly describes itself as a “banking service” and “banking platform,” without always making clear such services are provided by banking partner Blue Ridge.
And in an apparent attempt to establish its legitimacy, Maza leans heavily on claims it is associated with Visa and the FDIC. Various pages of its site and app use language including:
“secured by Visa and the FDIC”
“supported by Visa and the FDIC”
“associated with Visa and the FDIC”
“powered by Visa, FDIC”
“official partners of Visa”
Based on a review of internet archive records, Maza has been making false deposit insurance claims and misusing the FDIC logo since at least late 2021.
Various areas of the site do make reference to Blue Ridge Bank, though many uses of the FDIC logo and deposit insurance claims lack proximate language making clear that Maza itself is not a bank and that deposit accounts and insurance are provided by banking partner Blue Ridge.
The FDIC issued updated rules over a year ago regarding false advertising, misrepresentations about insured status, and misuse of the FDIC’s name, and there have been no shortage of cease and desist orders, to both crypto and fintech companies, for violations.
Asked about the significance of false FDIC insurance claims in this case, Konrad Alt, of financial services advisory firm Klaros Group, said (emphasis added): “In view of the FDIC's numerous recent actions against companies that have been misusing the FDIC logo, falsely representing their insurance status, or both, this seems to show either a complete diligence failure or total indifference to legitimate FDIC concerns on the part of the bank and the investor alike.”
How to comply with these requirements isn’t some hidden issue; it should be tablestakes for a competently run fintech/bank partnership program.
(After receiving inquiries for this article, Maza removed some of the false and misleading claims from its site, though several remain as of writing, including the app store description of being “powered by” FDIC.)
Bait & Switch: Maza Markets A Bank Account To The Undocumented, But Terms Require Users To Be Legal Residents
The false FDIC claims are far from the only problems.
The site also makes repeated use of Department of Treasury and IRS logo and language, even claiming an “IRS guarantee.”
But such use of Department of Treasury names and marks for advertisements, business activities, and products is expressly prohibited, with civil penalties up to $5,000 per “each use” and potential criminal penalties up to $10,000 or one year in prison per each “knowing” violation.
Presumably each page view could constitute a “use” and thus a violation, potentially amounting to significant financial penalties.
Maza’s site provides scant detail on the purpose, requirements, and limitations of having an ITIN.
An initial application for an ITIN must attach a completed tax return (or the applicant must qualify under an exception to the Federal tax filing requirement.)
From its site, it isn’t clear if Maza or its acceptance agent is completing a tax return on users’ behalf, claiming an exception, or doing something else altogether. Further, Maza’s site does not make clear that users’ ITINs will expire if they do not use them to file tax returns.
Maza also makes dubious claims about the potential benefits of an ITIN, telling prospective customers it “will” allow them to “prove [their] residency” and “buy a house or property” —
While an ITIN enables undocumented immigrants to file tax returns, it does not, on its own, qualify a holder to buy a house or property. An ITIN may help document a holder’s residency (where they live — not legal resident status) and income, but how Maza describes this may be confusing.
Maza seems to be offering two distinct products/services: assistance in obtaining an ITIN and opening a bank account. While it is possible to apply for an ITIN from outside of the United States, it isn’t possible to open a bank account through Maza without a valid residential address in the US, per its terms and conditions.
Further, the deposit terms and conditions specify users must be US citizens or legal permanent residents — yet Maza specifically is targeting its services to undocumented immigrants that would not meet this criterion:
The Account is available to United States citizens or legal permanent residents of the fifty (50) United States, the District of Columbia, and all US territories, who are at least 18 years of age, have a US physical address or with military addresses (APO or FPO), and have a valid Social Security Number or Tax Identification Number.
In response to questions about its target market, Maza CEO Luciano Arango said:
“Maza serves US residents even if they lack SSN. Lacking SSN is sometimes interpreted to mean ‘undocumented,’ but the term is often a misnomer. While the Techcrunch article used the term undocumented - that is not how we market our product.”
But the pool of people who are legal US residents and are ineligible for an SSN is quite small, and Arango himself said in an interview that Maza “[c]ustomers go from undocumented to partially documented.”
(After receiving inquiries for this article, Maza removed many of the Department of Treasury and IRS logos/claims from its site, though at least one remained as of the time of publication.)
No Hidden Fees*
There are a handful of other potentially false and misleading claims, including that Maza has “no hidden fees*” and that users can “open an account in minutes.”
The asterisk on Maza’s “no hidden fees” claims does not correspond to any additional disclaimer in the footer. Maza’s deposit account agreement, accessible on its site, does include fees: a 1% foreign transaction fee and out-of-network ATM fees.
While it doesn’t appear in the deposit agreement available on its site, additional documentation accessible during account opening indicates users will be charged an $8 per month fee if they don’t fulfill one of several requirements:
The claim of being able to open an account “in minutes” is dubious at best.
While some users who are able to be automatically verified may be able to do so, it is extremely unlikely this claim would true for many users, if they don’t already have an SSN or ITIN, are using a foreign passport, or don’t have a readily verifiable residential address in the US.
Maza’s Problems Demonstrate Inherent Risks in BaaS Models
Taking Maza and its founders at face value, the intentions here seem to be good.
But ignorance isn’t an excuse for failing to comply with laws and regulations designed to protect consumers — particularly when the intended audience is a vulnerable one that may not speak English or have knowledge of the US immigration or banking systems.
Maza’s BaaS platform Unit and bank partner Blue Ridge hold responsibility for conducting due diligence and meeting third-party risk management obligations.
In response to questions for this article, a representative for Blue Ridge Bank said:
“We are in constant collaboration with our partners to ensure our products and services are properly and adequately advertised and disclosed. We are deeply committed to compliance with all applicable laws and regulations and routinely monitor and review the marketing content of companies with which we partner.”
And a representative for banking-as-a-service platform Unit said:
“Unit, our bank partners and our clients take compliance very seriously. We coordinate closely with our bank partners to implement controls over marketing materials created by our shared clients. The banking-related disclosure issues you raised in this case had already been identified independently and were in the process of being remediated.”
And yet that such obvious and egregious problems existed live in production — apparently for more than a year — call into question Unit and Blue Ridge’s ability to operate partner programs in a safe, sound, and compliant manner.
Further, Maza highlights a fundamental problem with BaaS models: the company appears to have no on-staff personnel with legal or compliance experience.
No matter how robust Unit and Blue Ridge’s compliance management system, if their consumer-facing client doesn’t know or understand the compliance processes they’re supposed to be following, it seems borderline impossible to have adequate controls in place.
Reached via Twitter DM, a Maza cofounder responded to the FDIC claims issue by saying, “Other than tightening up our process for reviewing marketing collateral, there isn’t much else to this issue.”
Maza’s CEO, Luciano Arango, added in part via email:
“Regarding the disclosures on our website, we updated our website on May 26th, 2023. However, when we launched the new version of our website, important disclosures previously in place were not properly transferred over.
The bank notified us of these banking disclosure-related issues prior to your observations this week. Unfortunately, the changes were not immediately implemented due to an internal communication issue on my team, which I am ultimately responsible for. They have since been corrected.”
Yet, as of the time of publication, the company’s site and app store listing still make false and misleading claims, including that it is “powered by” and “backed by” the FDIC.
The teams’s response demonstrates a serious lack of understanding of the potential problems and risks on the company’s site and of its legal/regulatory compliance obligations.
Clients like Maza don’t know what they don’t know — but, ultimately, legal liability for compliance obligations lie with the bank charter holder.
For Blue Ridge, this could be a serious problem.
The bank is already operating under a consent order related to its failures to adequately oversee fintech partner programs compliance with BSA/AML requirements.
Asked about the potential repercussions for Blue Ridge, Konrad Alt, of Klaros, said:
“Almost as a definitional matter, a bank that is under an enforcement order has lost its regulator's confidence in at least some important respect. So, fundamentally, the challenge of getting out from under an enforcement order is entirely about regaining that confidence. In that light, actions that further undermine regulatory confidence — even if they have nothing to do with the substance of the order — are clearly unhelpful.”
While many of the problems with Maza aren’t necessarily BSA/AML-related, they demonstrate continuing failures to diligence and monitor the bank’s partners.
What Was a16z Thinking?
Ultimately, this isn’t really a story about Maza and its compliance failures — it’s a story about those that enabled it, those that should be conducting meaningful due diligence and appropriate third-party risk management: Blue Ridge, Unit, and Maza’s investors, including a16z.
Investors and founders often talk about “democratizing” access to financial services and “expanding access and inclusion.” Fair and equitable access to financial services, especially for disadvantaged and vulnerable groups, like undocumented immigrants, is a real problem.
But it’s not clear that attempting to address it, as Maza is, is a venture-scale business.
Maza’s ITIN facilitation service, for which it charges $149, is something users can do for free themselves; numerous other firms, including tax giant H&R Block, offer similar services. Maza only accepts passports as documentation, continuing to exclude those who only hold alternate forms of documentation, like a consular ID or birth certificate.
The ITIN offering functions as a customer acquisition vector for what is, essentially, a niche neobank offering — a segment of fintech that has not proven to have a viable business model.
Even this offering isn’t any kind of innovation. Some major banks, including Wells Fargo, offer what actually may be a more inclusive account that enables users to open it with an ITIN and a matricula card (consular ID) — a form of ID Maza doesn’t accept.
The customers Maza is seeking to serve are likely to have lower balances and be more difficult to extend credit to than mainstream offerings, like Varo, MoneyLion, or Dave — none of which have shown a viable path to profitability. Maza banking users are also more likely to spend in cash, more likely to churn, and more likely to require high-touch customer service, all of which means lower average revenue per user and higher costs.
Seema Amble, a partner at a16z, which led Maza’s $8 million seed round, told Techcrunch:
“There is a massive gap between mainstream financial access and the Latino population in the US (which is 19% of the U.S.). And the product needs don’t mean just translating existing products into Spanish — it’s offering them a set of products that fits their life and work.
They’re blocked from even accessing these products in the first place. Maza has identified the true pain point, lack of SSN, and they have built a product that unblocks everything from payments, to credit and mortgages without leaving the app.”
But Amble’s analysis is grossly reductive: while there are some 62 million who identify as Hispanic/Latino living in the US, estimates put the number of undocumented living in the US at around 11.5 million. And, it should be noted, not all undocumented are Latino.
Further, Maza doesn’t actually seem to solve the problem Amble thinks it does, as Maza only serves those with passports, and its banking terms and conditions still require users to be US citizens or legal permanent residents — getting an ITIN doesn’t “unblock everything” for the undocumented.
There’s nothing wrong with trying to make a profit, but a16z may find itself disappointed with its returns on this investment.
Representatives for Andreessen Horowitz (a16z) and Visa did not return requests for comment for this story.
Other Good Reads
On Banking FinTechs — Part I (Walt Cox)
Apple Needs To Clean Out Its Wallet (Fintech Takes)
Robinhood Acquires X1 (Fintech Ledger)
Don’t Ask ChatGPT For Financial Product Recommendations (Ron Shevlin/Forbes)
About Fintech Business Weekly
Looking to work with me in any of the following areas? Email me.
Fintech advising & consulting
Sponsoring this newsletter
News tip or story suggestion — reach me on Signal at +1-316-512-1571
Early stage startup looking to raise equity or debt capital