No, The SaaS company should strive to be a Data Processor for the web agency, and the web agency will likely want to be a Data Processor for its customers in turn. A Data Processor processes the personal data only as instructed by the Controller. The SaaS company should not be a Data Controller itself.
Being a Data Processor requires a contract that fulfils the condition in Art 28 GDPR.
It is the Data Controller's responsibility to provide transparent information to Data Subjects. However, some of the involved tasks can be outsourced to a Data Processor.
If the SaaS company deals with customers directly, the company might be a Controller for some and a Processor for others, or possibly both but for different processing activities. This depends on whether the customer is a Data Controller, Data Subject, or both in this context. If the SaaS company receives data from third parties in its capacity as a Controller, then yes, it must inform the data subjects as required per Art 14. But the mere creation of an account would likely not mean that personal data was obtained from a third party. This ultimately depends on the details of the account creation process, though.