Financial Technology

It depends on whether you take control of customer funds, and it is the first question to answer. Businesses that receive money from one party and transmit it to another generally require licensing, state by state, in each state where they serve customers.

Many fintech products avoid the obligation by structuring so that funds are held by a partner bank or a licensed processor rather than by the company. That structural decision is far easier to make during design than after launch.

It depends on economic substance, not on what it is called. Where purchasers invest money in a common enterprise expecting profits from the efforts of others, the instrument is likely to be treated as a security regardless of the label applied to it.

If it is one, the offering must be registered or fit within an exemption, with the disclosure and resale restrictions that follow. Getting this analysis wrong carries consequences including rescission and enforcement, so it should be resolved before any offering, not after.

Broadly: a designated compliance officer, written policies and procedures, customer identification and verification, sanctions screening, ongoing transaction monitoring, required reporting, recordkeeping, training, and independent testing.

The point regulators emphasize is that the program must be operating in practice. A well-drafted policy that nobody follows provides no protection, and examinations focus on evidence that the controls actually run.

Before, and specifically before the flow of funds is finalized. The decisions that create or avoid regulatory obligations are architectural: where money sits, who holds it, how custody works, what is collected at onboarding.

Retrofitting compliance onto a launched product usually means re-engineering the payment flow, delaying while licenses are obtained, or limiting the states you can serve. All three are more expensive than the analysis would have been.

Potentially, if you are transmitting money and serving customers nationally. There is no single federal money transmitter license; each state licenses separately with its own application, bond, and net worth requirements.

This is why many companies either partner with a licensed institution or phase their launch state by state. It is the longest-lead compliance item in most fintech businesses, and planning around it is part of the launch schedule rather than a parallel task.

More than to most categories of data, and they vary by where users are located. Financial institutions have longstanding federal obligations around safeguarding customer information and explaining information-sharing practices.

State privacy laws add requirements that depend on user residence rather than company location, so a Michigan company with national users faces multiple regimes. The most common failure is a privacy policy that does not accurately describe what the product actually does with data.

It moves quickly, particularly for digital assets. Regulatory positions, enforcement priorities, and state licensing requirements have all shifted materially in recent years and continue to.

That is a practical reason to treat any compliance analysis as tied to a point in time and to revisit it when the product changes or when guidance does, rather than treating a launch-time opinion as permanent.