Summary. A payments, deposit, or credit product is regulated financial services from the first transaction, and the obligations attach whether or not anyone has read them. The framework is fragmented across federal prudential regulators, the CFPB, FinCEN, OFAC, and fifty state banking departments, and the same product can be lawful in one structure and unlicensed money transmission in another. This toolkit runs the sequence: mapping the flow of funds and identifying the licensing question, choosing among direct licensing, a bank partnership, and a restructured model, building the AML and sanctions programs that apply regardless, meeting the consumer protection obligations, satisfying the sponsor bank's third-party risk expectations, and running the compliance function.

What this toolkit is for, and who should use it

Financial regulation does not ask what a company calls itself. It asks what functions the product performs, and the answers follow the flow of funds and the obligations between parties. A payroll product that holds a restaurant's money for two days and disburses it to employees is money transmission in most states, a money services business federally, a prepaid program under Regulation E, and — if it also advances earned wages — possibly a credit product. None of that is visible in the product spec, and all of it attaches from the first transaction.

This toolkit is for founders, product leaders, and counsel building a payments, deposit-like, lending, or embedded finance product. It assumes a company that has not yet launched, or one that has launched and is now discovering what it built.

Roadmap at a glance

  1. Map the flow of funds — the analysis that must precede engineering.
  2. The licensing question — money transmission, the exemptions, and the criminal statute behind it.
  3. Structure — direct licensing, bank partnership, or restructure.
  4. The bank partnership — what it provides and where it fails.
  5. AML and sanctions — the layer with no thresholds.
  6. Consumer protection — Regulation E, Regulation Z, ECOA, and FCRA.
  7. Privacy and security — the Safeguards Rule program.
  8. UDAAP — where enforcement actually lands.
  9. Lending-specific issues — true lender, valid-when-made, and rate exportation.
  10. The compliance management system the bank's examiner expects.
  11. Ongoing operations — reconciliation, complaints, and change control.
  12. The questions founders actually ask.

Stage 1 — Map the flow of funds

Do this on one page, before anything is built.

Diagram every movement of money: from whom, to whom, through which accounts, held for how long. For each account, identify whose name it is in and who owns the funds. At each point ask the operative question: does the company have possession or control of funds it owes to another person? Identify whether the company discharges an obligation between two other parties, whether there is float, and whether the company issues or redeems stored value.

Have the diagram reviewed by counsel and by the engineer who built the system, because the product description and the implementation frequently differ.

If the company ever controls money it owes to someone else, money transmission is presumed and an exemption must be identified. If funds move directly from payer to an account in the payee's name and the company transmits only instructions, they generally do not.

Resources

Stage 2 — The licensing question

Federally, a money services business — including a money transmitter — must register with FinCEN within 180 days and renew biennially. Registration is not a license and confers no authority. Operating unlicensed and unregistered is a felony under 18 U.S.C. § 1960.

The state layer carries the burden. Nearly every state requires a money transmitter license, with surety bonds scaled to volume, minimum net worth, permissible investments equal to outstanding obligations, background checks on control persons, audited financials, AML program documentation, annual reports, and examination. Multi-state licensure through NMLS and the Money Transmission Modernization Act have improved coordination without collapsing the twelve-to-thirty-month timeline.

The exemptions that matter:

  • Agent of payee — a genuine written agency agreement with the payee, where receipt by the agent discharges the payer's obligation. This is what most marketplace and platform models depend on, and it is unavailable if the company is the payer's agent.
  • Payment processor, narrowly.
  • Bank agent, where the bank is the transmitter of record and bears the obligation.
  • Closed loop and limited purpose stored value.

Confirm the exemption state by state, and document the analysis in writing, dated.

Stage 3 — Structure

Price the three options in time, capital, and control.

Direct licensing — roughly 45 licenses, substantial bonds and net worth, twelve to thirty months, and a compliance staff. Correct for a company building a durable payments franchise; wrong for one with eleven months of runway.

Bank partnership — four to seven months, most of it sponsor bank diligence, at the cost of dependence on one institution and its examiner's expectations.

Restructure to avoid transmission — funds move directly between payer and payee, the company transmits instructions only. Eliminates the licensing question and the float revenue together.

Stage 4 — The bank partnership

What it provides: rate exportation under 12 U.S.C. § 1831d, permitting national lending on uniform terms; licensing relief where the company genuinely acts as the bank's agent; and access to payment rails otherwise available only to financial institutions.

What the bank will require, driven by the 2023 Interagency Guidance on Third-Party Relationships: audit rights, compliance management system requirements, complaint reporting, marketing approval, change control, business continuity, and termination rights — with the agencies able to examine service providers directly under the Bank Service Company Act.

Where it fails: ledger and reconciliation breakdowns. The banking-as-a-service failures of recent years arose not from credit losses but from an inability to reconcile customer-level records to the bank's ledger, leaving end users unable to access funds. Any product holding customer funds at a partner bank must be able to prove, on any given day, exactly whose money is where — and the custodial account titling must support FDIC pass-through if the company intends to describe the product as insured.

Negotiate the wind-down. A 90-day termination for convenience with no transition obligation is a business-ending term. And maintain a second bank relationship; sponsor concentration is an existential risk.

Stage 5 — AML and sanctions

This layer applies regardless of how the licensing question comes out.

Build the five-pillar AML program: written policies and controls approved by senior management; a designated compliance officer with authority and resources; ongoing training; independent testing; and customer due diligence including beneficial ownership for legal entity customers. Add a customer identification program, transaction monitoring, suspicious activity reporting within 30 days with absolute confidentiality, currency transaction reporting where cash is handled, the Travel Rule, and five-year recordkeeping.

OFAC has no size threshold and is strict liability. Screen customers and counterparties at onboarding, on an ongoing basis, and against list updates. Screening logic — fuzzy matching thresholds, transliterations, and the 50 percent rule — is an engineering problem rather than a checkbox. Block or reject as required, report blockings within 10 business days, and file the annual report.

Stage 6 — Consumer protection

Regulation E applies to electronic fund transfers to or from a consumer asset account, including most stored value and many fintech "accounts." Build error resolution to the clocks: investigate and determine within 10 business days or provisionally credit and take up to 45 days (90 for new accounts, POS, and foreign-initiated transfers), then notify within three business days. Liability caps are $50, $500, or unlimited depending on timing, and the consumer's negligence is irrelevant. Prepaid accounts carry additional short-form and long-form fee disclosure, a credit-feature waiting period, and agreement submission requirements.

Regulation Z attaches where there is a finance charge or more than four installments. A pay-in-four product with no fee is generally outside it; add a mandatory fee or a fifth payment and it is inside. Earned wage access is the live example, with several states now regulating it specifically.

ECOA and Regulation B require adverse action notices stating specific principal reasons — and the Bureau has said plainly that model complexity is not an excuse. Run fair lending testing on any model before and after deployment, because a facially neutral variable correlating with a protected characteristic and lacking business necessity is actionable.

FCRA governs use of consumer reports, furnishing to consumer reporting agencies with dispute investigation within 30 days, and — critically — whether the company has itself become a consumer reporting agency by assembling information for the purpose of furnishing reports to third parties.

Also check by product: the Military Lending Act's 36 percent MAPR cap with voidness consequences; the FDCPA and Regulation F if collecting others' debts; Regulation II for debit interchange and routing; Regulation CC for funds availability; Regulation DD for deposit disclosures; NACHA rules; and card network rules, which are private but carry fines and termination rights more immediate than most regulatory processes.

Stage 7 — Privacy and security

Gramm-Leach-Bliley requires initial and annual privacy notices and an opt-out from sharing with nonaffiliated third parties.

The Safeguards Rule requires a written information security program with a qualified individual in charge, a written risk assessment, access controls, encryption of customer information in transit and at rest, multifactor authentication, secure development practices, service provider oversight, an incident response plan, penetration testing and vulnerability assessments, an annual board report, and notification to the FTC of security events affecting 500 or more consumers.

Section 1033 open banking requires covered institutions to make consumer financial data available through developer interfaces, with restrictions on secondary use and standards for authorization and revocation. The rule has been litigated and revised; any product relying on data aggregation should track it closely.

Resources

Stage 8 — UDAAP

This is where enforcement actually lands, because it requires no rule violation. Unfair means substantial injury not reasonably avoidable and not outweighed by benefits; deceptive means a material representation likely to mislead a reasonable consumer; abusive reaches material interference with understanding and unreasonable advantage-taking of a consumer's lack of understanding or reasonable reliance.

Recurring theories: fee disclosure buried or mismatched to actual charges; "free" claims with conditions; marketing implying FDIC insurance the product does not have — which is now also a rule violation under 12 C.F.R. Part 328; dark patterns in cancellation flows; and automatic renewal practices.

Review every consumer-facing screen, with a record of approval. Most UDAAP findings come from screens nobody in compliance ever saw.

Stage 9 — Lending-specific issues

Where the product extends credit through a bank partner, three doctrines interact.

Rate exportation permits a state-chartered insured bank to charge its home state's permitted interest to borrowers anywhere, 12 U.S.C. § 1831d, the state-bank analogue to Marquette National Bank v. First of Omaha Service Corp., 439 U.S. 299 (1978).

Valid-when-made — the OCC and FDIC rules providing that interest permissible when a loan is made remains permissible after transfer, adopted in response to Madden v. Midland Funding, LLC, 786 F.3d 246 (2d Cir. 2015).

True lender — analytically distinct and still live. Where the bank originates and immediately sells the entire receivable to a fintech that set the credit policy, marketed the product, funded the loans, and bears all the risk, states have argued the fintech is the true lender and the borrower's state usury cap applies. Structures with meaningful bank participation — retained interest, genuine underwriting authority, real risk retention, and bank control over credit policy — fare far better.

Confirm separately whether state lender licensing applies to the fintech itself.

Stage 10 — The compliance management system

The sponsor bank's examiner expects, and will look for: board and management oversight with documented reporting; policies and procedures covering each applicable regulation; training by role; monitoring and testing with documented results; complaint management with root-cause analysis, including CFPB complaint database entries; audit, internal or independent; and change management requiring legal review before a new state, product feature, fee, or data use goes live.

Build it before launch. Retrofitting a compliance management system during a bank's diligence adds months.

Stage 11 — Ongoing operations

  • Daily reconciliation to the bank ledger at the customer level, with exception reporting and an owner.
  • Complaint management — collect, categorize, resolve, and analyze. Examiners read complaints first.
  • Marketing review for every claim, disclosure, and screen.
  • Fair lending testing, documented, on a schedule.
  • Vendor management, because obligations flow down and the bank holds the fintech responsible for subcontractors.
  • License and registration calendar — renewals, annual reports, change-of-control approvals obtained before closing a transaction, and examinations.
  • Records — five years for BSA, longer for many consumer statutes.

Stage 12 — The questions founders actually ask

"Do we need a license if a bank holds the funds?" Often no, if the bank is genuinely the transmitter and the company acts as its agent, with funds in accounts titled to the bank and the bank bearing the obligation. The analysis follows the flow of funds, not the contract's labels.

"Is our product FDIC insured?" The bank is insured. Whether a customer's balance is covered depends on account titling and recordkeeping sufficient to identify each owner. Saying otherwise is both a UDAAP theory and a rule violation.

"How long does licensing take?" Twelve to thirty months for national coverage, with the slowest states measured in years.

"Can we launch in one state first?" Yes, and it is usually right — but OFAC, the Bank Secrecy Act, UDAAP, and the Safeguards Rule apply from the first customer regardless of where they live.

"Who examines us?" State banking departments, the CFPB (by supervision for larger participants and by civil investigative demand for anyone), and — continuously — the sponsor bank, whose audit findings are the best predictor of what a regulator will later ask about.

"What is the single most expensive mistake?" Launching without a written flow-of-funds analysis. Every other error here is a remediation project; that one can require unwinding live customer balances across states that each have their own view of what happened.

Master resource index

Articles

Guides

Checklists

Related toolkits

External and primary sources

This toolkit is educational and not legal advice. Financial services regulation changes frequently, state money transmission and lending laws vary substantially, and several rules discussed here are subject to pending litigation or revision. Consult qualified financial services counsel before launching a payments, deposit, or credit product.