To be fair so does most of the traditional banking system.
Because of the relatively low-friction signup process, fintech banks are extremely trigger happy with account locks, and at that point you have to go through their permanently-overloaded customer service to get your money transferred to another bank, a process that might take months if you’re unlucky.
The FDIC insured bank which actually has money when using these apps is somewhere in the backend and you get stuff like the synapse bankruptcy[1]
[1] https://apnews.com/article/synapse-evolve-bank-fintech-accou...
It’s not that they “steal” your money, but unlike your local bank, their customer service is much less tactile which means that if you’re up shit’s creek getting out if it gets much harder.
This is why everyone is always asking everyone to demonstrate the sources of funds in finance.
Obviously it is not 100% effective, but it is somewhat effective. You cannot just jog in from Iran and enroll as a JP Morgan client
A whitelist/allowlist is a system that defaults to rejecting everything, but allow someone to override that rejection.
A blacklist/denylist is a system that defaults to allowing everything, but can on-demand block/deny something.
Banking system for individuals today mostly have a blacklist/denylist for the common use case. Walk into a bank and ask to open an account, and they'll most likely allow you.
If you manage to trip up any alerts (big deposits for example), they'll ask you for more info, citing KYC/AML for the reason why.
> This is why everyone is always asking everyone to demonstrate the sources of funds in finance.
This usually happen after the funds have touched some account you own, hence it's a blacklist system. A whitelist system wouldn't allow you to deposit those funds until after you got verified somehow.