Fintech Regulation: Licensing, Crypto Compliance, and Enforcement

Regulatory sandbox programs offered by state financial regulators and the Consumer Financial Protection Bureau allow fintech companies to test innovative financial services under modified regulatory requirements for a defined period, and fintech counsel advising a company seeking sandbox participation must evaluate whether the company's proposed service falls within the sandbox's eligibility criteria, what regulatory relief the sandbox provides relative to the standard licensing requirements, and what data collection and reporting obligations the company must fulfill during the sandbox period to support a subsequent application for full licensure.

A company that transmits money, stores funds, or facilitates payment transactions must obtain money transmitter licenses in each state where it operates, and digital asset compliance counsel must evaluate which activities trigger licensing requirements, whether any exclusions apply, and whether a bank partnership could eliminate the need for state-by-state licenses.

Virtual asset service providers that exchange, transfer, or safeguard cryptocurrency on behalf of customers are money services businesses under the Bank Secrecy Act and must register with FinCEN and implement a written AML program. AML compliance counsel advising a VASP must evaluate whether the company's transaction monitoring system detects the patterns that characterize cryptocurrency-based money laundering.

A token offering that involves the sale of a digital asset that investors purchase primarily to profit from the efforts of a third party satisfies the Howey test for a security, and cryptocurrency regulation counsel must evaluate whether the token's characteristics bring it within the definition of a security and whether a Regulation D private placement exemption is available.

The CFPB's Section 1033 rulemaking requires financial institutions to make consumer financial data available to authorized third parties upon consumer request, and digital assets and web3 counsel advising a fintech that accesses bank data through open banking APIs must evaluate whether the company's data use practices comply with the consumer's authorization, whether the company has adequate data security measures to protect the information it receives, and whether its use of the data is limited to the purposes for which the consumer provided authorization.

Financial institutions and fintech companies using AI to make credit or underwriting decisions must ensure the models do not produce discriminatory outcomes under ECOA or the Fair Housing Act, and blockchain and AI governance counsel must evaluate whether model outputs can be explained to regulators and whether the model has been tested for disparate impact across protected classes.

A fintech company's AML program must include a written compliance policy, a designated compliance officer, an ongoing employee training program, and independent testing of the program's effectiveness, and stablecoin regulation and digital payments counsel advising on AML program design must evaluate whether the company's transaction monitoring system is calibrated to detect the specific money laundering typologies most common in the company's product and customer base.

A fintech company that receives a civil investigative demand, a subpoena, an examination notice, or an informal inquiry from a financial regulator should engage cryptocurrency and digital asset law counsel before responding, since the company's initial response frequently determines the scope and direction of the investigation.