New SaaS Security Framework Boosts Embedded Payments

New SaaS Security Framework Boosts Embedded Payments

Highlights

SaaS is evolving from enabling payments to becoming payments platforms, opening new revenue, stickiness and use cases.

Moves by FIS and others show how legacy incumbents are pushing core financial functions into cloud-native SaaS models.

The CSA’s new SaaS Security Capability Framework (SSCF) offers a practical, product-level security baseline that can build trust and accelerate adoption of financial SaaS.

The power of software as a service (SaaS) in finance lies in turning software into a composable, live payments engine that lives inside other systems, enabling finance less as a module and more as an embedded, dynamic utility.

    Get the Full Story

    Complete the form to unlock this article and enjoy unlimited free access to all PYMNTS content — no additional logins required.

    yesSubscribe to our daily newsletter, PYMNTS Today.

    By completing this form, you agree to receive marketing communications from PYMNTS and to the sharing of your information with our sponsor, if applicable, in accordance with our Privacy Policy and Terms and Conditions.

    At its core, SaaS is about delivering software over the cloud in modular, continuously updated form. In financial services, that means no longer installing a payments engine. Instead, firms call one via API, combine it with application logic, and monetize around it.

    Payments Embedded Into the Mix

    SaaS firms and financial incumbents are pushing payments deeper into software flows, for example, via embedded payments. SaaS providers, particularly vertical ones, are realizing that embedding payments not only streamlines checkout for users but turns the payment plumbing into a revenue stream and loyalty lever.

    In 2025, that evolution is accelerating. FIS, for instance, announced this month that it “reengineered” its Private Capital Suite as a cloud-native SaaS solution. According to the company, the tool has been “upgraded into a fully front-to-back solution” with “a flexible and scalable ecosystem” to support complex fund processing and compliance.

    That shift is about more than moving infrastructure; it signals a new revenue model. By turning core capabilities into API-based services, companies like FIS can monetize usage, tier functionality and embed payments elements to clients.

    Likewise, in the vertical SaaS space, partnerships are multiplying to embed payments directly into workflows. Mastercard’s April partnership with Unipaas aims to help vertical SaaS platforms adopt modern card processing capabilities. In the small- to medium-sized business (SMB) space, SaaS firm Wix unveiled in August a financial services suite called Wix Checking and Wix Capital that embeds banking, payments and reconciliation directly into its platform. According to the company, Wix Checking “removes the need for external banking tools and manual reconciliations, saving time and reducing errors.”

    Advertisement: Scroll to Continue

    On the go-to-market side, vertical SaaS platforms are wrestling with the build versus buy versus partner decision.

    “Most businesses today are asking themselves: ‘Do you partner, do you build, or do you buy?’” Stax CEO Paulette Rowe told PYMNTS in June. “Those decisions set your path on profitability and efficiency for years to come.”

    Stax Connect Plus users reportedly are doubling payment revenue through white-label sales support and subscription tools.

    Together, these trends show how SaaS in finance is morphing from enabling payments to embedding them, to becoming a platform that others build on, enabling new revenue models and tighter customer lock-in.

    Security and Trust

    For SaaS models to scale in financial services, trust is critical, especially because financial SaaS often processes sensitive data, handles settlement flows and integrates with banking rails. Last week, the Cloud Security Alliance (CSA) launched the SaaS Security Capability Framework (SSCF).

    The SSCF defines 41 customer-facing, configurable security controls across six domains, including change control and configuration management; data security and privacy lifecycle management; identity and access management; interoperability and portability; logging and monitoring; and security incident management.

    By bringing standardization to how SaaS security is evaluated, the SSCF may help accelerate SaaS adoption in regulated sectors like financial services. Customers and third-party risk teams have a consistent baseline to compare offerings. Security teams get a clearer implementation roadmap.

    In the coming years, we may see financial SaaS platforms that look more like banking engines with a UI rather than software that connects to a bank. As that happens, business model innovation, performance and trust will become the key differentiators, not just features.