U.S. fintech regulation is activity-based rather than governed by a single “fintech license.” The rules that apply depend on what the company does, where customers live, whether it handles funds, and whether a regulated financial institution is involved.
A fintech business may face several overlapping requirements:
- Federal regulation covering payments, lending, securities, commodities, consumer protection, financial crime, sanctions, and data use.
- State regulation covering money transmission, lending, servicing, collections, privacy, and consumer protection.
- Bank-partner oversight when services are delivered through an insured bank or credit union.
- Network and contractual rules imposed by payment networks, sponsor banks, processors, and other regulated partners.
The practical starting point is to map the product’s activities and funds flow before deciding which laws, regulators, registrations, or licenses may apply.
Important: This guide provides general information, not legal advice. Regulatory classifications and exemptions are fact-specific, and requirements change frequently.
How U.S. fintech regulation is organized
The United States does not have one national regulator responsible for every fintech company. Oversight is divided among federal agencies, state authorities, banking regulators, and—in some markets—self-regulatory organizations.
Regulation follows the activity
A company’s technology or branding rarely determines its regulatory status. The relevant question is what financial activity the company performs.
Examples include:
- Accepting or transmitting money
- Holding customer funds or stored value
- Issuing payment cards
- Extending or arranging credit
- Servicing loans or collecting debts
- Providing deposit-like products through a bank
- Offering securities or investment advice
- Facilitating derivatives or certain digital-asset transactions
- Collecting and using consumer financial data
Two apps with similar interfaces may have different obligations because their legal roles and funds flows differ.
Federal and state rules can apply at the same time
Federal law commonly establishes requirements for consumer disclosures, anti-money laundering, sanctions, fair lending, and securities markets. State law may add licensing, interest-rate, disclosure, privacy, servicing, or examination requirements.
A federal registration does not automatically replace state licensing. For example, a company treated as a money services business under federal rules may also need to evaluate state money-transmitter laws separately.
Direct regulation and partner oversight are different
Some fintech companies obtain their own licenses or registrations. Others operate through partnerships with banks, broker-dealers, payment processors, or other regulated entities.
A partnership can change the allocation of responsibilities, but it does not make compliance disappear. Regulated partners generally expect fintech vendors and program managers to maintain controls appropriate to their roles, including:
- Customer identification and verification support
- Transaction monitoring and escalation
- Consumer disclosures
- Complaint management
- Information security
- Third-party risk management
- Marketing review
- Record retention
- Regulatory reporting support
The contract should clearly assign responsibilities, but contractual allocation does not necessarily determine how a regulator will classify the underlying activity.
Key federal and state regulators
The following table maps the principal U.S. authorities that fintech businesses commonly encounter.
| Regulator or authority | Primary role | Fintech activities commonly affected |
|---|---|---|
| Consumer Financial Protection Bureau (CFPB) | Administers and enforces federal consumer financial laws; supervises certain banks and nonbanks | Consumer payments, remittances, lending, servicing, credit reporting, debt collection, disclosures, and unfair, deceptive, or abusive acts or practices |
| Financial Crimes Enforcement Network (FinCEN) | Administers the Bank Secrecy Act and related anti-money laundering requirements | Money services businesses, money transmission, certain prepaid access activities, suspicious activity reporting, and financial crime controls |
| Office of Foreign Assets Control (OFAC) | Administers U.S. economic and trade sanctions | Payments, customer and counterparty screening, blocked property, cross-border transactions, and digital assets |
| Securities and Exchange Commission (SEC) | Regulates securities markets and enforces federal securities laws | Securities offerings, broker-dealer activity, investment advice, trading platforms, investment products, and digital assets that fall within securities laws |
| Financial Industry Regulatory Authority (FINRA) | Self-regulatory organization overseeing registered broker-dealers under SEC supervision | Broker-dealer membership, sales practices, communications, supervision, and market conduct |
| Commodity Futures Trading Commission (CFTC) | Regulates U.S. derivatives markets and enforces relevant commodity laws | Futures, options, swaps, leveraged retail commodity transactions, and certain digital-asset activities |
| National Futures Association (NFA) | Self-regulatory organization for the U.S. derivatives industry | Registration and compliance for certain derivatives intermediaries |
| Federal Trade Commission (FTC) | Enforces federal prohibitions against unfair or deceptive practices and certain privacy and data-security requirements | Marketing, privacy, data security, identity protection, and nonbank commercial practices |
| Office of the Comptroller of the Currency (OCC) | Charters and supervises national banks and federal savings associations | Bank-fintech partnerships, banking services, third-party risk, payments, lending, and custody provided through national banks |
| Federal Deposit Insurance Corporation (FDIC) | Insures deposits and supervises certain state-chartered banks | Bank partnerships, deposit products, third-party risk, and representations about deposit insurance |
| Federal Reserve Board | Supervises bank holding companies and certain state-chartered banks; administers several consumer regulations | Bank partnerships, payments, lending, bank ownership, and consumer compliance |
| National Credit Union Administration (NCUA) | Charters and supervises federal credit unions and administers the National Credit Union Share Insurance Fund | Fintech services offered through credit unions, third-party relationships, payments, and lending |
| State financial regulators | License and supervise financial activities under state law | Money transmission, consumer lending, mortgage activity, loan servicing, debt collection, and virtual-currency activities in some states |
| State attorneys general | Enforce state consumer-protection and other laws | Deceptive practices, advertising, privacy, consumer harm, and multistate enforcement |
| State privacy authorities | Administer state-specific privacy requirements | Consumer data access, deletion, sharing, targeted advertising, sensitive data, and privacy notices |
A company may interact with multiple authorities for one product. A consumer lending platform, for example, could face federal consumer-credit requirements, state lending laws, bank-partner oversight, privacy rules, and state attorney-general enforcement.
Major fintech laws and compliance areas
Fintech laws are best understood by the risk or activity they regulate.
Anti-money laundering and money transmission
The Bank Secrecy Act (BSA) and FinCEN regulations establish anti-money laundering and reporting obligations for covered financial institutions, including qualifying money services businesses.
Depending on its activities, a fintech may need to evaluate:
- Whether it is a money services business under federal rules
- Whether a federal exemption applies
- Whether it must maintain an anti-money laundering program
- Customer identification and verification responsibilities
- Suspicious activity and other reporting obligations
- Recordkeeping requirements
- Independent testing and compliance governance
FinCEN provides an official overview of money services business registration. Registration analysis is separate from state money-transmitter licensing and should not be treated as a substitute for it.
State money-transmission laws generally require a separate jurisdiction-by-jurisdiction analysis. Whether a license is required can depend on who receives customer funds, who controls them, where the customer is located, and whether an exemption is available.
Sanctions compliance
OFAC sanctions can affect domestic and cross-border fintech products, including payments, wallets, remittances, marketplaces, and digital-asset services.
A risk-based sanctions program may involve:
- Customer and counterparty screening
- Geographic restrictions
- Transaction screening
- Wallet-address or payment-data review where relevant
- Escalation and blocking procedures
- Recordkeeping
- Controls for sanctions-list updates
Sanctions obligations are distinct from anti-money laundering requirements, even though companies often operate the controls together.
Consumer payments and electronic transfers
The Electronic Fund Transfer Act and Regulation E govern many electronic transfers involving consumer accounts. Depending on the product, requirements may address:
- Initial and periodic disclosures
- Error-resolution procedures
- Unauthorized electronic transfers
- Access devices
- Preauthorized transfers
- Remittance transfers
- Certain prepaid accounts
The legal roles of the bank, program manager, processor, and consumer-facing fintech should be documented. The party handling customer support must also be able to route disputes and error notices within the required process.
Consumer lending and credit
Consumer credit products can trigger a combination of federal and state requirements.
Common federal laws include:
- Truth in Lending Act and Regulation Z: Cost-of-credit disclosures and other credit requirements.
- Equal Credit Opportunity Act and Regulation B: Prohibitions against discrimination in credit transactions and requirements for certain notices.
- Fair Credit Reporting Act: Rules for obtaining, using, furnishing, and safeguarding consumer-report information.
- Servicemembers Civil Relief Act: Protections for eligible military members in specified circumstances.
- Military Lending Act: Restrictions and disclosures for certain consumer-credit products offered to covered borrowers.
State law may regulate lender licensing, loan brokering, servicing, interest rates, fees, disclosures, and collections. The relevant analysis can change based on whether the fintech is the lender, a service provider, a lead generator, or a platform working with a bank.
Consumer protection and marketing
Fintech advertising and product design are subject to consumer-protection standards. The CFPB can address unfair, deceptive, or abusive acts or practices within its jurisdiction, while the FTC and state authorities may act against unfair or deceptive conduct under their respective laws.
Compliance review should cover:
- Product names and benefit claims
- Fee descriptions
- Approval or eligibility representations
- Interest and repayment terms
- Deposit-insurance statements
- Testimonials and endorsements
- “No fee,” “instant,” or “guaranteed” claims
- User-interface designs that may obscure material terms
- Consistency between advertising, disclosures, and actual product operation
A technically accurate disclosure may not cure a misleading overall presentation.
Privacy, cybersecurity, and financial data
The Gramm-Leach-Bliley Act establishes privacy and safeguarding obligations for covered financial institutions. Other federal and state rules may apply based on the entity, data, product, and customer location.
A fintech’s data-compliance map should identify:
- What personal and financial information is collected
- Why each data element is needed
- Which parties receive or access the data
- How long data is retained
- Which privacy notices and consumer rights apply
- How consent and authorization are recorded
- How security incidents are detected and escalated
- Whether vendors can meet contractual and regulatory requirements
State privacy laws may add rights and obligations beyond federal financial-privacy requirements. Coverage and exemptions vary, including for data or entities already regulated under financial-services laws.
Securities, investments, and digital assets
A fintech offering investments, trading, portfolio management, fundraising, or yield-related products must determine whether federal or state securities laws apply.
Potential classifications include:
- Securities issuer
- Broker-dealer
- Investment adviser
- Alternative trading system
- Transfer agent
- Investment company
- Service provider to a regulated securities firm
Digital-asset terminology does not decide the legal classification. The structure, rights, marketing, distribution, and economic substance of the product matter.
Digital-asset businesses may also face FinCEN, OFAC, CFTC, state licensing, tax, consumer-protection, and cybersecurity requirements. The applicable framework depends on the asset and activity rather than the use of blockchain technology alone.
Regulatory matrix by fintech business model
This matrix is a scoping tool, not a final legal classification.
| Business model | Core regulatory questions | Potential federal oversight | Potential state requirements |
|---|---|---|---|
| Digital wallet or peer-to-peer payments | Who receives and controls funds? Are balances stored? Who processes transfers and resolves errors? | FinCEN, CFPB, OFAC, FTC; banking regulators if a bank partner is involved | Money-transmitter licensing, consumer protection, privacy, unclaimed-property rules |
| Domestic or international remittances | Is the company accepting and transmitting customer funds? Are consumer remittance rules triggered? | FinCEN, CFPB, OFAC | Money-transmitter licensing and state consumer-protection laws |
| Prepaid or stored-value product | Who issues the account or card? Are funds held by a bank? Which prepaid-account rules apply? | CFPB, FinCEN, OFAC, applicable banking regulators | Money transmission, unclaimed property, privacy, consumer protection |
| Consumer lending platform | Who is the lender? Who sets terms? Is the fintech arranging, underwriting, servicing, or collecting? | CFPB, FTC, applicable banking regulators | Lender, broker, servicing, and collection licensing; rate and fee limits; state disclosures |
| Buy now, pay later product | Is the arrangement consumer credit? How are disputes, returns, fees, and adverse decisions handled? | CFPB, FTC, applicable banking regulators | Lending, brokering, servicing, consumer protection, and credit-reporting restrictions where applicable |
| Earned wage access or cash-advance product | Is the product credit under applicable law? Are tips, subscriptions, or expedited-transfer fees charged? | CFPB, FTC, applicable banking regulators | Wage, lending, money-transmission, and consumer-protection laws depending on structure |
| Business lending platform | Is the company lending, brokering, or servicing? Are state commercial-financing disclosures required? | FTC and applicable banking regulators; other federal rules depending on the product | Commercial-financing disclosures, lender or broker licensing in applicable states, collections laws |
| Deposit account or neobank interface | Which bank holds deposits? Are deposit-insurance statements accurate? Who owns customer service and compliance tasks? | FDIC, OCC, Federal Reserve, CFPB, FinCEN, OFAC | Privacy, consumer protection, money transmission depending on the funds flow |
| Investment app or robo-adviser | Does the company provide investment advice, execute trades, or hold assets? | SEC, FINRA, potentially FinCEN and OFAC | State securities or investment-adviser requirements where federal preemption does not apply |
| Crowdfunding or capital-raising platform | Are securities offered? Which offering exemption and intermediary rules apply? | SEC, FINRA where relevant | State securities laws and notice requirements, subject to applicable federal rules |
| Cryptocurrency exchange or hosted wallet | Does the business exchange, transmit, custody, or facilitate trading in digital assets? How are assets classified? | FinCEN, OFAC, SEC or CFTC depending on activity and asset classification | Money transmission, virtual-currency licensing in certain states, cybersecurity and consumer protection |
| Payments infrastructure or embedded-finance provider | Does the company only provide technology, or does it control transactions, accounts, underwriting, or customer relationships? | Depends on function; may include FinCEN, CFPB, FTC, OFAC, and banking regulators | Licensing depends on activities, agency relationships, funds flow, and state definitions |
| Personal financial management or data-aggregation app | What data is accessed, under what authorization, and for what purpose? Can users revoke access? | CFPB, FTC, and banking regulators where regulated partners are involved | State privacy, data-security, breach-notification, and consumer-protection laws |
Technology providers should not assume that describing themselves as “software only” settles the analysis. Regulators and partners may examine actual operational control, customer communications, transaction authority, compensation, and risk allocation.
For broader context on infrastructure-led models, see the overview of Fintech-as-a-Service market trends.
Licensing, registration, and partnership: what is the difference?
These terms are often used interchangeably, but they describe different arrangements.
| Regulatory path | What it generally means | Key limitation |
|---|---|---|
| License | An authority grants permission to conduct a regulated activity, often subject to financial, reporting, examination, and governance requirements | One license may not cover every activity or state |
| Registration | A business files with an authority or regulatory system because it falls within a defined category | Registration may not authorize activities that separately require a license |
| Charter | A government authority authorizes and supervises a bank, credit union, or similar institution | Obtaining a charter creates substantial ongoing prudential obligations |
| Bank or licensed-partner model | A fintech provides technology or program services while a regulated institution performs specified financial functions | The fintech may still have direct legal obligations and will face partner oversight |
| Agent relationship | A company performs authorized functions on behalf of a licensed or regulated principal | Agent exemptions and permitted activities vary by law and jurisdiction |
| Exemption | A statute or rule excludes qualifying entities or activities from a requirement | Exemptions are usually narrow and depend on documented facts |
The correct path should be determined after mapping the product, legal roles, funds flow, customer locations, and planned expansion.
Initial fintech compliance scoping checklist
Use this legal compliance checklist before launching a product, entering a new state, or changing the movement of funds.
1. Define the product and legal roles
- [ ] Describe every financial function in plain language.
- [ ] Identify the customer-facing company.
- [ ] Identify the entity that sets pricing and terms.
- [ ] Identify the entity that approves or declines transactions.
- [ ] Determine who holds customer funds or assets.
- [ ] Document the role of each bank, processor, lender, custodian, and program manager.
- [ ] Separate regulated financial activity from supporting technology services.
2. Map the complete funds flow
- [ ] Record where customer money originates.
- [ ] Identify every account through which funds pass.
- [ ] Determine who has possession or control at each stage.
- [ ] Identify settlement timing and reconciliation responsibilities.
- [ ] Document refunds, reversals, chargebacks, and failed transactions.
- [ ] Determine what happens to funds if a partner or fintech becomes insolvent.
A funds-flow diagram should match contracts, product disclosures, accounting treatment, and actual system behavior.
3. Classify the activities
Evaluate whether the company may be engaged in:
- [ ] Money transmission
- [ ] Currency exchange
- [ ] Prepaid access or stored value
- [ ] Consumer or commercial lending
- [ ] Loan brokering, servicing, or debt collection
- [ ] Deposit-related program management
- [ ] Securities brokerage or investment advice
- [ ] Digital-asset exchange, transmission, custody, or trading
- [ ] Consumer-report use or furnishing
- [ ] Regulated financial-data access
4. Build a jurisdiction map
- [ ] Identify every state where customers reside.
- [ ] Distinguish customer location from company location.
- [ ] Review state licensing and exemption questions by activity.
- [ ] Identify state disclosure, rate, fee, servicing, and privacy rules.
- [ ] Track renewal, reporting, examination, and change-of-control obligations for applicable licenses.
- [ ] Establish a process for approving entry into new states.
State licensing analysis should be completed before accepting customers in a jurisdiction, not after the product has scaled.
5. Identify federal obligations
- [ ] Assess Bank Secrecy Act and FinCEN status.
- [ ] Determine applicable OFAC sanctions controls.
- [ ] Identify consumer-payment and error-resolution requirements.
- [ ] Map consumer-credit, fair-lending, and credit-reporting rules.
- [ ] Review privacy, safeguarding, and cybersecurity obligations.
- [ ] Determine whether securities or commodities laws apply.
- [ ] Review advertising and product claims for deceptive or misleading representations.
6. Allocate partner responsibilities
- [ ] Assign each compliance function to a named party.
- [ ] Document data-sharing and reporting expectations.
- [ ] Establish complaint and regulatory-inquiry escalation.
- [ ] Define audit, monitoring, and remediation rights.
- [ ] Confirm responsibility for customer notices and disclosures.
- [ ] Test whether operational systems follow the contractual allocation.
- [ ] Create an exit or transition plan for critical partners.
7. Prepare the operating compliance program
- [ ] Appoint accountable compliance leadership.
- [ ] Adopt policies proportionate to the product’s risk.
- [ ] Train employees and relevant contractors.
- [ ] Maintain complaint-management and issue-escalation processes.
- [ ] Monitor transactions and product outcomes where required.
- [ ] Conduct independent testing where appropriate.
- [ ] Retain evidence of decisions, approvals, and corrective actions.
- [ ] Establish regulatory-change monitoring.
8. Review every material product change
Repeat the analysis when the company:
- Adds a new payment rail
- Begins holding customer funds
- Introduces credit or installment payments
- Changes its bank, lender, custodian, or processor
- Enters additional states
- Adds digital assets or investment features
- Changes fees, rewards, or customer disclosures
- Uses customer data for a new purpose
- Expands from business customers to consumers
A small product change can alter the regulatory classification of the entire service.
Common fintech regulatory mistakes
Treating a partner’s license as blanket coverage
A bank or licensed provider may perform a regulated function, but the fintech must confirm which activities are actually covered and whether an agency or service-provider exemption applies.
Reviewing licensing without reviewing funds flow
Marketing descriptions are not enough. The path of customer money—and each party’s control over it—often drives money-transmission and custody analysis.
Assuming federal registration replaces state authorization
Federal and state regimes serve different purposes. FinCEN registration, where required, does not by itself authorize money transmission under state law.
Launching nationally based on one-state analysis
State lending, money transmission, collections, privacy, and virtual-currency laws vary. A national digital product can create obligations in every state where it serves customers.
Focusing on disclosures but ignoring product operation
Compliance depends on what the product actually does. Disclosures must match pricing, transaction timing, error handling, data use, and customer support.
Making inaccurate deposit-insurance claims
Fintech companies working with insured institutions must describe the bank relationship and the conditions of deposit insurance accurately. A fintech company itself is not FDIC-insured merely because customer funds may be held at an insured bank.
Maintaining an up-to-date regulatory map
Fintech regulation changes through legislation, rulemaking, court decisions, agency guidance, examinations, and enforcement actions. A useful regulatory inventory should record:
| Inventory field | Information to maintain |
|---|---|
| Product or feature | The service being offered |
| Legal entity | The company performing each activity |
| Customer type | Consumer, business, institutional, or mixed |
| Customer location | States and countries served |
| Regulated activity | Payments, lending, investing, custody, data access, or another activity |
| Authority | Federal agency, state regulator, or self-regulatory organization |
| Legal requirement | License, registration, disclosure, program, reporting, or conduct rule |
| Responsible owner | Internal team and external partner |
| Evidence | Policy, filing, contract, test result, or approval |
| Review trigger | Scheduled date or specified product change |
Companies evaluating new sectors can also use a structured fintech startup watchlist to monitor emerging business models before adding them to a product roadmap.
The central rule for U.S. fintech compliance
The central rule is simple: classify the activity before choosing the regulatory path.
Start with the product’s legal roles, funds flow, customer locations, and use of regulated partners. Then map the relevant federal laws, state requirements, registrations, licenses, and operational controls. This approach produces a more reliable compliance plan than beginning with a preferred label such as “platform,” “marketplace,” “software provider,” or “neobank.”
