Summary. Whether a payments or lending product requires licensing is determined by the flow of funds and by who owes an obligation to whom, not by what the product is called — and the analysis must be run before anything is built. A company that discovers the answer after launching has customer balances in states where it is not licensed, a problem with no cheap solution. This checklist runs the analysis in order: map the flow of funds, identify whether the company ever holds or controls funds it owes to someone else, test the exemptions, choose among direct licensing, a bank partnership, and a restructured model, then work through the registrations, program requirements, and consumer obligations that attach regardless.

What this checklist is for. A pre-launch regulatory analysis for a payments, deposit-like, or credit product. For the framework, see Banking and Payments Regulation for Fintech Companies.

Phase 1 — Map the flow of funds

Do this first, on one page, before anything else.

  • Diagram every movement of money: from whom, to whom, through which accounts, held for how long.
  • For each account in the diagram, identify whose name it is in and who owns the funds.
  • At each point, answer: does the company have possession or control of funds it owes to another person?
  • Identify whether the company discharges an obligation between two other parties.
  • Identify the float — any period during which funds sit before disbursement — and who earns on it.
  • Identify whether the company issues, sells, or redeems stored value.
  • Identify every third party in the chain: processors, sponsor banks, ledger providers, card issuers, and program managers.
  • Have the diagram reviewed by counsel and by the engineer who built the system, because the product description and the implementation frequently differ.

Why this matters. Money transmission analysis follows the funds and the obligations. If the company ever controls money it owes to someone else, transmission is presumed and an exemption must be identified. If funds move directly from payer to an account in the payee's name and the company only transmits instructions, they generally do not.

Phase 2 — Test the exemptions

  • Agent of payee. Is there a genuine written agency agreement with the payee, and does receipt by the company discharge the payer's obligation to the payee? This is the exemption most marketplace and platform models depend on, it is recognized in many states and codified in the Money Transmission Modernization Act, and it is unavailable if the company is the agent of the payer.
  • Payment processor. Narrow, generally limited to processing through clearing and settlement systems on behalf of a merchant.
  • Bank agent. Is a chartered bank the transmitter of record, holding the funds and bearing the obligation, with the company acting as its agent? This depends on the flow-of-funds architecture, not on the contract's labels.
  • Closed loop or limited purpose stored value usable only with the issuer or a defined merchant group.
  • Confirm the exemption state by state, because scope varies and the Money Transmission Modernization Act has been adopted unevenly.
  • Document the analysis in writing, dated, with the exemption cited for each state.

Phase 3 — Choose the structure

  • Direct licensing. Model the cost: applications in up to 50 jurisdictions, surety bonds, minimum net worth, permissible investments equal to outstanding obligations, background checks and fingerprinting for officers, directors, and 10-percent owners, audited financials, business plans, AML program documentation, and 12 to 30 months to national coverage through NMLS.
  • Bank partnership. Model the diligence timeline (typically three to six months), the sponsor bank's contractual requirements, the economics, and the concentration risk of depending on one institution.
  • Restructure to avoid transmission, moving funds directly between payer and payee with the company transmitting only instructions — which eliminates the licensing question and eliminates float revenue with it.
  • Price each option in time, capital, and control, and decide with the runway in mind.

Phase 4 — Federal registrations and programs

  • Register with FinCEN as a money services business within 180 days of establishing the business, and renew every two years. Registration is a reporting obligation, not a license, and operating unlicensed and unregistered is a felony under 18 U.S.C. § 1960.
  • Maintain a list of agents as required.
  • Build the AML program with the five pillars: written policies and controls approved by senior management; a designated compliance officer with authority and resources; ongoing training; independent testing on a risk-based schedule; and customer due diligence with beneficial ownership identification for legal entity customers.
  • Implement a customer identification program — collect and verify name, date of birth, address, and identification number, retain records, and check government lists.
  • Implement transaction monitoring and suspicious activity reporting within 30 days of initial detection, with absolute confidentiality — disclosing a SAR's existence to the subject is a federal crime, and contractual notice obligations must carry a legal carve-out.
  • Implement currency transaction reporting where cash is handled, funds transfer recordkeeping, and the Travel Rule at the applicable threshold.
  • Retain records for five years.
  • Implement OFAC screening — customers and counterparties, at onboarding, on an ongoing basis, and against list updates — with documented fuzzy-matching thresholds, handling of transliterations, and application of the 50 percent rule. Sanctions compliance is strict liability with no size threshold.
  • Establish blocking and rejecting procedures, 10-business-day blocking reports, and the annual report.

Phase 5 — State licensing mechanics

  • Build a state matrix: license required, exemption available, application status, bond amount, net worth requirement, permissible investment rules, reporting frequency, and examination cycle.
  • Prepare through NMLS where the state participates.
  • Assemble the application package: organizational documents, financial statements (frequently audited), business plan, flow-of-funds description, AML program, information security program, policies, and organizational chart.
  • Identify every control person — officers, directors, and owners above the threshold — and prepare fingerprints, background checks, and personal financial disclosures for each.
  • Obtain surety bonds in each state's amount, scaled to volume.
  • Confirm minimum net worth and maintain permissible investments equal to outstanding transmission obligations.
  • Identify states with additional regimes — New York's BitLicense under 23 NYCRR Part 200, and state virtual currency business acts — where digital assets are involved.
  • Confirm lender licensing separately where credit is extended, and analyze true lender and valid-when-made exposure for a bank partnership lending model.
  • Calendar annual reports, renewals, change-of-control approvals (which must be obtained before closing a transaction), and examinations.

Phase 6 — Consumer protection and the sponsor bank

  • Determine whether Regulation E applies, and if so build error resolution to its clocks: investigate and determine within 10 business days or provisionally credit and take up to 45 days (90 for new accounts, point-of-sale, and foreign-initiated transfers), then notify within three business days. Code the liability caps so that consumer negligence never enters the calculation.
  • Determine whether Regulation Z applies — a finance charge, or more than four installments, brings a credit product inside it.
  • Confirm ECOA and Regulation B compliance, including adverse action notices stating specific principal reasons, and run fair lending testing on any model before and after deployment.
  • Confirm FCRA obligations if consumer reports are used or information is furnished, and assess whether the company has become a consumer reporting agency.
  • Build the GLBA Safeguards Rule program: a qualified individual, a written risk assessment, access controls, encryption in transit and at rest, multifactor authentication, secure development, service provider oversight, incident response, testing, and an annual board report.
  • Review every consumer-facing screen for UDAAP — fee disclosure matching actual charges, no implied FDIC insurance (which is also a rule violation under 12 C.F.R. Part 328), no dark patterns, and a cancellation flow as easy as enrollment.
  • For a bank partnership, prepare for third-party risk management diligence: compliance management system, complaint process, marketing approval, change control, business continuity, and — critically — daily reconciliation to the bank ledger at the customer level, with clear custodial account titling supporting FDIC pass-through.
  • Negotiate the sponsor bank agreement's termination and wind-down provisions; a 90-day termination with no transition obligation is a business-ending term.

Common mistakes

  • Launching before the flow-of-funds analysis, which is the only error on this list with no cheap remediation.
  • Relying on the agent-of-payee exemption without a written agency agreement with the payee, or where the company is the payer's agent.
  • Assuming a bank partnership eliminates licensing without confirming the bank is genuinely the transmitter of record.
  • Registering with FinCEN and believing that is a license.
  • Building AML and OFAC after launch rather than before the first customer.
  • Claiming FDIC insurance without pass-through account titling and customer-level recordkeeping.
  • Missing change-of-control approval before closing a financing or an acquisition.
  • Treating Regulation E error resolution as a customer service process rather than as a regulated workflow with hard deadlines.
  • Ignoring the sponsor bank's audit findings, which predict what a regulator will later ask about.
  • No second bank relationship, leaving the business dependent on a single institution's risk appetite.

Primary authority

Related

This checklist is educational and not legal advice. State money transmission and lending laws vary substantially and several federal rules discussed here are subject to pending litigation or revision. Consult qualified financial services counsel before launching a payments, deposit, or credit product.