Analysis
How federal and state financial regulation applies to payments, lending, banking partnerships, and financial technology products.
No single regulator "owns" financial technology in the United States. A lending app may answer to the CFPB for its disclosures, to FinCEN for its anti-money-laundering program, to fifty state regulators for its licenses, and to its partner bank's federal supervisor for everything the bank touches. The result is a compliance map that looks less like a rulebook and more like a patchwork quilt.
These guides trace that patchwork: who regulates what, when a product triggers state money-transmitter licensing, what bank partnerships really require after the interagency guidance on third-party risk, and how UDAAP enforcement reaches marketing language that engineers never thought of as "legal copy."
There is no single fintech regulator in the United States. This guide maps the federal agencies and state licensing regimes for payments, lending, deposits, and data — organized by activity.
Founders and product teams should start with the regulatory map to see which agencies could claim jurisdiction over a product, then drill into the licensing and AML primers before writing a single line of onboarding flow.
What banks and fintechs each take on when they partner: the interagency third-party risk framework, the contract terms that allocate compliance duties, and the deposit-recordkeeping lessons of recent program failures.
What the Bank Secrecy Act requires of fintechs: when a company becomes a regulated financial institution, the pillars of an AML program, how KYC works, and the reports FinCEN expects.
The Dodd-Frank Act bans unfair, deceptive, or abusive acts or practices in consumer finance. Here is how UDAAP risk reaches fintech products, marketing, and bank partnerships — and what a defensible compliance program looks like.
Moving or holding customer money can require licenses in nearly every U.S. state plus federal FinCEN registration. Learn which product features trigger money transmission rules and how the Money Transmission Modernization Act is reshaping them.
Fintechs answer to overlapping privacy and security regimes: GLBA, the FTC Safeguards Rule, NYDFS Part 500, and state privacy laws. This guide organizes them into five program pillars a compliance team can actually run.
Custody duties for digital assets depend almost entirely on what the holder is: a broker-dealer, a chartered trust company, or an unregulated platform. This guide maps the fault lines and the duties behind each.
PCI DSS is enforced through card-network contracts rather than by any regulator. This guide explains how that private standard interacts with federal and state law, and how fraud losses are allocated.
Any lender or platform that reports account data to a credit bureau becomes a furnisher, with statutory accuracy and investigation duties. This guide explains what section 1681s-2 requires and where liability attaches.
Collecting on consumer debt can require a licence in many states — sometimes even for the original creditor. This guide covers the FDCPA and Regulation F, state licensing patterns, and the practices creating most exposure.
Sending consumer money abroad triggers Regulation E subpart B: itemized prepayment disclosures, receipts, a cancellation window, and a formal error-resolution process. This guide walks through each requirement.
Regulation Crowdfunding lets private companies sell securities to the general public within strict limits, through a registered intermediary. This guide covers the caps, disclosure, and portal rules behind the exemption.
An algorithm that recommends securities is still an investment adviser. This guide covers SEC versus state registration, the narrowed internet adviser exemption, and how fiduciary duty applies to automated advice.
Selling insurance through an app still means holding state producer licences. This guide explains lines of authority, nonresident licensing, limited lines, and the conduct rules governing digital distribution.