Fintech & Digital Payments Compliance in the United States

The United States is open to non-bank payment providers, including digital-only ones, but entry is layered. Federal law sets the anti-money laundering, sanctions and consumer-protection baseline, while licensing to move money sits with each state. There is no single national payments licence.

The principal authorities are FinCEN for anti-money laundering rules, the state financial regulators (with New York and California among the most active) for licensing, and the Consumer Financial Protection Bureau (CFPB) and Federal Trade Commission (FTC) for consumer protection and data security.

The biggest obstacle for a new entrant is the state-by-state licensing build, which is why many apps launch on a sponsor bank's charter first. That route shortens time to market but does not shift the bank's legal responsibility, so the bank will impose its own identity and monitoring standards on the app.

1. Who regulates this sector

The Conference of State Bank Supervisors (CSBS) coordinates state regulators and publishes model legislation, but it is not itself a regulator. State attorneys general and state privacy regulators also act against payment firms; their rules are summarised only where they bear on onboarding.

2. Licensing and authorisation

Federal: register with FinCEN

FinCEN treats a money services business (MSB) as a financial institution. A money transmitter is an MSB regardless of the amount of money it transmits, while currency dealers, cheque cashers and issuers or sellers of money orders, travellers' cheques or stored value are MSBs only above an activity threshold of more than $1,000 per person per day, applied separately to each activity (FinCEN, MSB definition and registration). Banks and firms registered with and regulated by the SEC or CFTC are excluded.

Each MSB must register on FinCEN Form 107 within 180 days after it is established, renew every two calendar years, and re-register after a change of control, a transfer of more than 10 percent of voting power or equity, or an increase of more than 50 percent in its agents. It must keep a list of its agents, and a foreign-located MSB doing business in the United States must appoint a US agent for service of process (31 CFR 1022.380). Registration is not a licence: FinCEN does not approve business models.

State: a licence where the customer is

Licensing to move money is state law, state by state. New York requires a licence under Article 13-B of the Banking Law and manages applications through NMLS (NY DFS, Money Transmitters). The Department's industry letter of 31 March 2011 concluded that transmitters doing business with people located in New York need a licence even with no office or agent in the state. California's Money Transmission Act defines "in this state" to include transactions with, to or from persons located in California, and the DFPI has applied it to out-of-state providers (DFPI opinion, Money transmission in this state). These two states are illustrative, not a survey.

The CSBS Money Transmission Modernization Act is a model law that sets common net worth, surety bond and permissible investment standards. It binds only where a state has enacted it, in full or in part, so firms still need to check each state's own statute.

Operating without authorisation

Failure to register carries a civil penalty for each day the violation continues, and operating an unregistered or unlicensed money transmitting business is a federal crime under 18 U.S.C. 1960, punishable by up to five years' imprisonment (FinCEN, MSB registration penalties).

3. AML, KYC and customer due diligence

MSBs are obliged entities under the Bank Secrecy Act. Each must keep a written anti-money laundering programme, commensurate with the risks of its location, size and services, that includes policies and controls for verifying customer identification, filing reports and keeping records; a designated compliance person; training; and an independent review (31 CFR 1022.210). An agent and its principal may agree who drafts the controls, but each remains solely responsible for implementing them.

Unlike banks, MSBs have no standalone customer identification programme rule, and they are not among the "covered financial institutions" whose programme rules carry the customer due diligence and beneficial ownership requirements; FinCEN's April 2026 proposal lists those as banks, broker-dealers, mutual funds, futures firms and credit card system operators (91 FR 18704). Identity obligations for MSBs come instead from the programme rule and from transaction-level rules.

SARs and any information that would reveal them are confidential and may not be disclosed to the customer. Geographic targeting orders can add temporary, local thresholds; the order covering MSBs along the southwest border requires reports and identity verification for currency transactions of $1,000 to $10,000 until 1 March 2027 [In force, not applied where a court has enjoined it] (FinCEN, 4 September 2026).

4. Identity verification and onboarding

Federal rules for MSBs do not list accepted documents for account opening or prescribe biometric or liveness checks. The programme rule requires reasonably designed procedures to verify customer identification, so the method is a risk-based choice that examiners and partner banks will test. The concrete federal identity elements appear at transaction level:

In-person transmittals

For a $3,000 order from someone who is not an established customer, verify identity before accepting it by examining a document, preferably with name, address and photograph, and record the document type and number plus a taxpayer identification number (TIN) or, if none, an alien or passport number (1010.410(e)(2)(i), (e)(5)).

Remote transmittals

For the same order not made in person, record the name, address and TIN (or alien or passport number) and a copy or record of the method of payment, such as the card or cheque used (1010.410(e)(2)(ii)).

Synthetic identities, built by combining a real Social Security number (SSN) with invented details, are a known weakness of non-documentary checks. The Social Security Administration's electronic Consent Based SSN Verification service lets permitted financial institutions and their service providers confirm whether a name, date of birth and SSN match its records. It needs the person's written consent, which may be an electronic signature, and returns only "yes" or "no"; it does not verify identity on its own (SSA, eCBSV).

Reliance is limited. A sponsor bank remains responsible for compliance with financial crimes laws for activities performed through a fintech partner, and an MSB's agent agreement does not transfer the principal's obligations.

5. Digital channels: what's different

Bottom line: the federal anti-money laundering rules are largely channel-neutral, but going online widens the state licensing footprint to every state where customers are located, and replaces the federal document check for larger transfers with a data-and-payment-trail record.

Licensing follows the customer

New York's 2011 position and California's definition of "in this state" both turn on where the customer is located, not where the server or office sits. An app available nationwide therefore faces the full multistate licensing build from day one unless it operates under a bank's charter or as a bank's agent.

No federal remote-verification standard

Federal MSB rules neither require nor prohibit document-and-selfie checks, database verification or biometrics. For larger remote transmittals the rule instead requires a TIN and a record of how the transfer was funded (31 CFR 1010.410(e)(2)(ii)). Sponsor banks and state examiners typically expect more, so the practical standard is set by the risk assessment and the partner contract.

Remote onboarding as a named risk factor

FinCEN's proposed programme rule would require every MSB to run risk assessment processes covering its "distribution channels", which FinCEN defines to include remote or other non-face-to-face account opening, and it lists IP addresses, device logins and geolocation as information firms may use [Proposed, comments closed 9 Jun 2026] (91 FR 18704).

6. Data protection and biometrics

There is no single federal data protection statute or authority in the United States. For non-bank payment providers the main federal rule is the FTC's Safeguards Rule under the Gramm-Leach-Bliley Act, which requires an information security programme for customer information. Since 13 May 2024 it also requires notice to the FTC, through a form on its website, of any unauthorised acquisition of unencrypted customer information involving at least 500 consumers, as soon as possible and no later than 30 days after discovery (88 FR 77499). Unauthorised access is presumed to be acquisition unless the firm has reliable evidence to the contrary, and the FTC may publish the reports.

Selfie, face-match and liveness data collected at onboarding is not addressed by federal MSB rules, but several states regulate biometric identifiers directly, and state consumer privacy laws add notice, retention and deletion duties. Identity records that Bank Secrecy Act rules require must still be kept for five years, so retention schedules need to separate mandatory records from optional biometric data.

7. Sector-specific obligations

Bank partnerships and banking-as-a-service

The OCC, Federal Reserve and FDIC's 2023 interagency guidance states that a bank's use of third parties, including fintech companies, does not diminish its responsibility to comply with laws addressing financial crimes and consumer protection as if it performed the activity itself (88 FR 37920). The guidance expects due diligence on the fintech's licences, ownership and OFAC exposure, contract rights to audit and require remediation, and regulator access to the fintech's records. It is supervisory guidance without the force of law, but sponsor banks write it into their programme agreements.

Consumer protection for transfers

Regulation E caps a consumer's liability for unauthorised electronic fund transfers at the lesser of $50 or the amount taken if a lost or stolen access device is reported within two business days, and at $500 if later, with further exposure if a statement error is not reported within 60 days (12 CFR 1005.6). Weak onboarding and account-takeover controls therefore become direct losses. The CFPB rule that would have placed the largest non-bank payment apps under its supervision was disapproved by Congress [Disapproved, no force or effect] (Pub. L. 119-11, 9 May 2025); the CFPB's enforcement authority over non-banks is unaffected.

Payment stablecoins

Under the GENIUS Act, only permitted issuers may issue payment stablecoins in the United States once the Act takes effect on 18 January 2027, and from 18 July 2028 digital asset service providers may not offer or sell to US persons a payment stablecoin from an unpermitted issuer [Adopted, effective 18 Jan 2027] (91 FR 61688). FinCEN has proposed carving permitted issuers out of the MSB definition and giving them their own programme rules [Proposed] (FinCEN, 10 April 2026). Wallet and payment apps that distribute stablecoins should map which issuers they support before the 2028 date.

8. Risk indicators and red flags

FinCEN's January 2024 analysis of identity-related suspicious activity groups identity abuse into impersonation, compromise of credentials and circumvention of verification (FinCEN Financial Trend Analysis). Indicators relevant to payment apps include:

Payment and remittance typologies

• Synthetic identity: an SSN that does not match the name and date of birth, or a thin file with no history.
• Impersonation at onboarding: document images, selfies or device data reused across several accounts.
• Account takeover: login from a new device followed quickly by changed contact details and a large transfer out.
• Threshold avoidance: repeated transfers just under $3,000, or cash just under local order thresholds.
• Funnel accounts: many unrelated senders paying one recipient who moves funds abroad.
• Agent anomalies: an agent whose volume jumps or whose customers share identifiers.
• Sanctioned networks: payments touching entities named in FinCEN special measures or OFAC designations.

9. Enforcement and penalties

FinCEN's civil penalties are set per violation and, for continuing violations, per day. Amounts below apply to penalties assessed on or after 17 January 2025 (31 CFR 1010.821):

In December 2025 FinCEN assessed $3.5 million against Paxful, an online peer-to-peer platform, which admitted failing to register as an MSB, to maintain an effective programme and to file SARs (FinCEN, 9 December 2025). In February 2025 it imposed $37 million on Brink's Global Services USA for operating as an unregistered money transmitter without an adequate programme (FinCEN, Brink's). State regulators add their own licensing penalties.

10. Recent changes and what to watch

• 6 October 2026 [Proposal withdrawn] FinCEN withdrew its 2020 proposal on unhosted crypto wallet reporting for banks and MSBs; no new wallet reporting duty applies.
• 5 October 2026 [Proposed] FinCEN proposed prohibiting transmittals of funds involving the A7 network's sub-agents; remittance providers should prepare screening.
• 30 September 2026 [Adopted, effective 18 Jan 2027] Treasury's interim rule on state stablecoin certifications confirms the GENIUS Act start date.
• 4 September 2026 [In force, partly enjoined] Southwest border geographic targeting order for MSBs runs to 1 March 2027.
• 10 April 2026 [Proposed, comments closed 9 Jun 2026] FinCEN's programme rule rewrite would require documented risk assessments, including of remote channels, and a US-based compliance officer.
• 9 May 2025 [Disapproved] CFPB larger-participant supervision of payment apps nullified by Pub. L. 119-11.

11. What this means for identity verification

Collect SSN or another TIN at onboarding rather than at the first large transfer: remote transmittals of $3,000 or more need it, and collecting it once avoids friction later. Because federal rules set no remote method, document the chosen method (document and selfie, database or both) in the risk assessment and align it with the sponsor bank's standard. Consent-based SSN verification is a useful synthetic-identity control and needs a consent step in the flow. Keep the payment-method record for remote transfers, store required identity records for five years, and keep biometric data on a separate, state-law-driven retention schedule. Re-verify on account recovery, device change and payout-detail changes, the moments account takeover exploits. Build licensing logic by customer location, since the state of residence determines the licence and the state's examiner.