Checklist · Finance

Launching a Fintech Product: A Licensing and Compliance Checklist

12 U.S.C. § 1867(c)

Type: Checklist
Jurisdiction: National
Date: 2025-03-17
Topic: Finance

A pre-launch checklist for a consumer financial product, sequenced so the decisions that take twelve months start in month one. Phases one through five establish the regulatory perimeter: classifying the product to determine which regimes apply, deciding between direct licensing and a bank partnership, diligencing and papering the bank relationship with the provisions that are simultaneously risk management and the true lender defense, mapping state licensing across the intended footprint, and completing federal registrations. Phases six through eleven build the compliance infrastructure: the anti-money-laundering program and its five pillars, OFAC screening, the Regulation Z disclosure build, fair lending model governance and disparate impact testing, adverse action notices that state actual reasons, and Regulation E error resolution for products that move money. Phases twelve through eighteen cover the consumer-facing layer: credit reporting obligations, a UDAAP review of the entire experience rather than the disclosures alone, marketing and consent, privacy and information security, servicemember protections including the check whose omission voids the loan, servicing and collections, and complaint management as a compliance control. Phases nineteen and twenty cover testing and the launch gate.

Launching a Fintech Product: A Licensing and Compliance Checklist

Finance > Consumer Financial Services | Published 17 March 2025 - Updated 8 July 2026 | UpLaw - uplaw.us

Two things on this list take a year: state money transmitter licensing across a national footprint, and finding and papering a bank partner. Everything else can be built in a quarter. Teams that sequence the fast work first and discover the slow work in month eight launch a year late — or launch unlicensed, which is worse.

Keywords: product classification, MTL, agent of payee, FinCEN registration, BSA/AML, OFAC, bank partnership, true lender, Reg Z, fair lending testing, adverse action, Reg E, UDAAP, TCPA, Safeguards Rule, MLA

Work this in order, and start Phases 4 and 3 in week one regardless of where the rest of the plan is. The doctrinal treatment is in Consumer Financial Services Regulation: A Comprehensive Guide to TILA, ECOA, RESPA, EFTA, and UDAAP. The narrative overview is Rent-a-Charter: The Bank Partnership Model and the Law That Keeps Testing It.

Our running example. Tessera Lending, Inc. (fictional) is launching an installment loan product at rates up to 34% APR, with an in-app account, ACH repayment, and a partner bank originating.

Phase 1 — Classify the product

[ ] Is it credit? Apply Reg Z: is there a finance charge, or is it payable in more than four installments by written agreement? 12 C.F.R. § 1026.2(a)(14), (17).
[ ] Is it open-end or closed-end credit, and does it constitute a credit card account under Reg Z?
[ ] Does it involve money transmission — receiving money for transmission to a third party?
[ ] Does it involve holding funds, and if so, whose funds and in what capacity?
[ ] Does it involve a deposit, requiring a charter or a bank relationship?
[ ] Does it implicate securities or commodities regulation?
[ ] Does it involve payments — ACH, cards, wires, or real-time payments — and which network rules apply?
[ ] Is the customer a consumer (personal, family, or household purposes) or a business? Note ECOA covers business credit too.
[ ] Write the classification down with reasoning. Every downstream decision cites it.

Why it matters, and the traps. The four-installment line determines TILA coverage for many products, and providers structure to it. Note that structuring around Reg Z does not escape UDAAP, state lending law, or — for buy now, pay later providers with digital user accounts — the CFPB's interpretive treatment as card issuers subject to the credit card dispute and billing error provisions.

Earned wage access classification is genuinely contested and has moved. Structure for the possibility that it is credit.

Phase 2 — Charter, partnership, or direct licensing

[ ] Model the three paths: direct state licensing (rate-capped, 50-state licensing burden), a bank partnership (rate exportation, partner dependency), or a charter (rare, slow, capital-intensive).
[ ] If the product's economics require rates above state caps, the partnership is not optional — say so early.
[ ] Identify every state where the intended rate exceeds the usury cap for the product type and size.
[ ] Identify states that have opted out of DIDMCA under § 525 and assess the exposure, noting the active litigation over what it means for a loan to be "made in" the opting-out state.
[ ] Model the licensing cost and timeline for the direct path — expect twelve to twenty-four months for a full footprint.
[ ] Model the partnership economics: origination fee, purchase price, risk retention, and the reserve the bank will require.
[ ] Assess partner concentration risk — what happens if the bank exits, is acquired, or receives a supervisory directive?

Phase 3 — Diligence and paper the bank partnership

Diligence the bank

[ ] Confirm the charter type and primary federal regulator.
[ ] Review public enforcement history and any published supervisory actions.
[ ] Assess capital, concentration in fintech partnerships, and total program exposure.
[ ] Assess the bank's own compliance management system and staffing.
[ ] Confirm the bank has done this before and understands third-party risk expectations.

The agreement — provisions that are simultaneously risk management and the true lender defense

[ ] Bank sets and approves the credit policy.
[ ] Bank makes the credit decision on each loan, with a real ability to reject.
[ ] Bank retains meaningful economic interest over time — not a two-day formality.
[ ] Bank holds approval rights over pricing, product changes, and marketing materials.
[ ] Bank oversees servicing, complaint handling, and collections, with reporting.
[ ] Compliance management system requirements imposed on the fintech.
[ ] Audit and examination rights, including access to models and validation records.
[ ] Acknowledgment of the banking agencies' examination authority under the Bank Service Company Act, 12 U.S.C. § 1867(c).
[ ] Incident and breach notification obligations and timelines.
[ ] Data ownership, use limitations, and return on termination.
[ ] Termination rights and a wind-down plan that protects borrowers.
[ ] Indemnity and its limits — total indemnification of the bank is a true lender factor against the program.
[ ] Reserve, holdback, or collateral requirements.

Then actually exercise the rights

[ ] Establish a credit committee at the bank that meets and documents decisions.
[ ] Document the bank's review and rejection of specific loans and specific marketing materials.
[ ] Retain the minutes.

Why it matters, and the traps. A bank that has these rights and never exercises them has neither risk management nor a true lender defense. The documents that decide a true lender challenge are the credit committee minutes and the rejection log, not the agreement.

Phase 4 — Map state licensing (start in week one)

[ ] Build a state-by-state matrix: intended activity, license required, rate cap, fee restrictions, permissible terms, net worth, bond, and timeline.
[ ] For lending: consumer lender, installment lender, sales finance, or small dollar licenses as applicable.
[ ] For money transmission: identify whether the flow of funds constitutes transmission in each state.
[ ] Analyze the agent-of-payee exemption state by state — availability turns on exact statutory language and the exact flow of funds.
[ ] Confirm whether the state has adopted the Money Transmission Modernization Act, which harmonizes definitions and exemptions.
[ ] Confirm control person background check and fingerprinting requirements, and identify who qualifies as a control person.
[ ] Confirm surety bond amounts and arrange the surety early — underwriting takes weeks.
[ ] Confirm permissible investment requirements for money transmitters, which constrain how customer funds are held.
[ ] Register on NMLS where the state uses it.
[ ] Build the launch sequence by state so revenue can begin in licensed states while others are pending.
[ ] Calendar renewal and reporting obligations from day one.

Phase 5 — Federal registrations

[ ] Register as a money services business with FinCEN within 180 days of establishing the business if applicable. 31 C.F.R. § 1022.380. Renew every two years.
[ ] Determine whether the entity is a covered person under Dodd-Frank Title X and whether it falls within a CFPB larger participant rule.
[ ] Determine any SEC or FINRA registration obligation if securities are involved.
[ ] Determine any CFTC registration if commodities or derivatives are involved.
[ ] Confirm Corporate Transparency Act beneficial ownership reporting status, verifying the current scope of the regime.

Phase 6 — Build the AML program

[ ] Appoint a BSA/AML compliance officer with authority and reporting lines.
[ ] Write the AML program with all five pillars: internal controls, independent testing, designated officer, training, and customer due diligence.
[ ] Implement a customer identification program with documentary and non-documentary verification.
[ ] Implement beneficial ownership collection for legal entity customers. 31 C.F.R. § 1010.230.
[ ] Implement risk-based customer due diligence and enhanced due diligence for higher-risk customers.
[ ] Implement transaction monitoring with tuned rules and documented thresholds.
[ ] Implement suspicious activity report procedures, including the confidentiality prohibition on disclosure.
[ ] Implement currency transaction reporting if applicable.
[ ] Implement recordkeeping including the funds transfer and travel rules.
[ ] Schedule independent testing at least annually by a qualified party.
[ ] Deliver training by role and document completion.

Phase 7 — OFAC screening

[ ] Screen all customers against the SDN list and relevant sectoral and program lists at onboarding and on an ongoing basis.
[ ] Screen counterparties and, where relevant, transaction parties.
[ ] Tune the matching algorithm and document the false positive resolution procedure.
[ ] Establish blocking and rejecting procedures and the reporting obligations that follow.
[ ] Confirm geographic restrictions for comprehensively sanctioned jurisdictions, including IP-based controls.
[ ] Document the sanctions compliance program against the published framework elements.
[ ] Remember that OFAC liability is strict — knowledge is not required.

See Export Control and Sanctions Compliance: A Practical Checklist.

Phase 8 — Build the Reg Z disclosures

[ ] Determine open-end or closed-end and build the corresponding disclosure set.
[ ] Compute the finance charge under 12 C.F.R. § 1026.4, including all charges incident to the extension of credit.
[ ] Compute the APR and confirm it falls within tolerance.
[ ] Build the account-opening disclosures and periodic statements for open-end products.
[ ] Build the closed-end disclosures under § 1026.18 with the payment schedule and total of payments.
[ ] Confirm timing — disclosures before consummation, and before the first transaction for open-end.
[ ] Build the change-in-terms notice process, including the 45-day advance notice for credit card rate increases.
[ ] Review advertising against the trigger-term rules in §§ 1026.16 and 1026.24.
[ ] Confirm electronic delivery satisfies the E-SIGN consent requirements.
[ ] Test the disclosures on actual screens at actual sizes — a compliant document rendered badly on a phone is a UDAAP problem.

Phase 9 — Fair lending and model governance

[ ] Document the credit policy and every variable used in underwriting and pricing.
[ ] Screen for proxy variables that correlate with protected characteristics — geography, education, device, purchase patterns.
[ ] Test the model for disparate impact across protected classes at the model level and at the deployed-decision level.
[ ] Conduct and document a search for less discriminatory alternatives with comparable predictive performance. The absence of this search is itself a finding.
[ ] Establish model governance: development documentation, independent validation, ongoing monitoring, and change control.
[ ] For vendor models, obtain sufficient access to test — the lender remains responsible.
[ ] Establish exception tracking for underwriting and pricing overrides, and analyze them for disparate treatment.
[ ] Confirm no prohibited information is requested. 12 C.F.R. § 1002.5.
[ ] Confirm compliance with the spousal signature rules in § 1002.7(d) for any business or joint credit.
[ ] Determine whether § 1071 small business lending data collection applies and on what schedule.
[ ] Establish record retention — 25 months consumer, 12 months business.

See Deploying an AI System: An AI Governance and Risk Checklist and AI Governance and Compliance: A Comprehensive Guide.

Phase 10 — Adverse action notices

[ ] Build notices stating the specific principal reasons for the decision, not generic categories. § 1002.9.
[ ] Confirm the model can generate the actual reasons — if it cannot, the model is not deployable.
[ ] Deliver within 30 days of a completed application, adverse action on an existing account, or a counteroffer not accepted.
[ ] Combine with the FCRA adverse action notice under 15 U.S.C. § 1681m(a): the consumer reporting agency's identity, a statement that it did not make the decision, and the right to a free report and to dispute.
[ ] Include the ECOA notice of the prohibition on discrimination and the enforcement agency.
[ ] Build risk-based pricing notices where applicable, or use the credit score disclosure exception.
[ ] Retain copies and the underlying decision data.

Phase 11 — Reg E and payments

[ ] Determine whether the product involves electronic fund transfers to or from a consumer account.
[ ] Build initial disclosures and periodic statements under 12 C.F.R. Part 1005.
[ ] Build error resolution: investigate within 10 business days (45 with provisional credit), resolve within 45 days (90 for specified transactions). § 1005.11.
[ ] Build unauthorized transfer liability determination consistent with the § 1005.6 tiers.
[ ] For preauthorized transfers, obtain written authorization, honor stop-payment requests up to three business days before, and notice varying amounts. § 1005.10.
[ ] Confirm no compulsory use of preauthorized transfers as a condition of credit. § 1005.10(e).
[ ] If offering a prepaid account, build the short-form and long-form disclosures under §§ 1005.18–1005.19.
[ ] If offering remittances, build the subpart B disclosures, 30-minute cancellation, and error resolution.
[ ] Confirm compliance with NACHA Operating Rules for ACH, including authorization, return, and WEB entry account validation requirements.
[ ] Confirm compliance with card network rules if cards are involved.

Phase 12 — FCRA

[ ] Confirm a permissible purpose exists for every consumer report pulled. 15 U.S.C. § 1681b.
[ ] Distinguish prescreened offers and comply with the firm offer of credit and opt-out notice requirements.
[ ] If furnishing data to consumer reporting agencies, build accuracy procedures and a dispute investigation process under § 1681s-2(b).
[ ] Build the direct dispute process for the categories § 1681s-2(a)(8) covers.
[ ] Confirm identity theft procedures including blocking under § 1681c-2.
[ ] Confirm red flags program obligations under the Identity Theft Rules where applicable.
[ ] Confirm disposal of consumer report information complies with the Disposal Rule.

Phase 13 — The UDAAP review

[ ] Review the entire customer experience, not just the disclosures: acquisition, application, approval, funding, servicing, and exit.
[ ] Test the net impression of every marketing claim, not just its literal accuracy.
[ ] Review fee structure independent of disclosure — is any fee likely to cause substantial injury that is not reasonably avoidable?
[ ] Screen for dark patterns: friction asymmetry between signing up and cancelling, pre-checked boxes, misleading defaults, and countdown pressure.
[ ] Confirm cancellation is as easy as enrollment.
[ ] Review representment practices for returned payments.
[ ] Review any practice that takes unreasonable advantage of a consumer's lack of understanding or reliance — the abusiveness prong.
[ ] Substantiate every savings, approval odds, or credit improvement claim before it is made.
[ ] Review the complaint themes from any pilot as a UDAAP signal.
[ ] Document the review and the decisions.

Phase 14 — Marketing and consent

[ ] Obtain prior express written consent for autodialed or prerecorded telemarketing calls and texts, with the required disclosures. 47 U.S.C. § 227.
[ ] Note that Facebook, Inc. v. Duguid, 592 U.S. 395 (2021), narrowed the ATDS definition but did not affect the prerecorded voice or do-not-call rules.
[ ] Build revocation handling by any reasonable means.
[ ] Maintain an internal do-not-call list and scrub against the national registry.
[ ] Comply with CAN-SPAM for commercial email: accurate headers, a functioning opt-out honored within ten business days, and a physical postal address. 15 U.S.C. §§ 7701–7713.
[ ] Check state telemarketing and texting statutes, several of which are broader than the TCPA.
[ ] Review influencer and affiliate arrangements for disclosure compliance and for liability for their claims.
[ ] Confirm Reg Z advertising trigger-term compliance and Reg B compliance in any preapproval messaging.

See CAN-SPAM Compliance for Commercial Email: A Practical Checklist and Influencer and Endorsement Disclosure: A Practical Checklist.

Phase 15 — Privacy and information security

[ ] Deliver GLBA privacy notices — initial and annual — with opt-out where required. Reg P, 12 C.F.R. Part 1016.
[ ] Build the information security program under the Safeguards Rule, 16 C.F.R. Part 314: a designated qualified individual, a written risk assessment, access controls, encryption in transit and at rest, multi-factor authentication, secure development, penetration testing and vulnerability assessment, service provider oversight, an incident response plan, and periodic board reporting.
[ ] Build breach notification procedures covering state statutes and, for bank partners, the 36-hour computer-security incident notification rule.
[ ] Map state comprehensive privacy law applicability — GLBA exemptions differ, some entity-level and some data-level, and a fintech may be fully covered.
[ ] Build consumer data access capability for Dodd-Frank § 1033, verifying the rule's current status and compliance dates.
[ ] Paper data aggregator relationships with use limitations and security obligations.
[ ] Complete a data map and retention schedule.

See Standing Up a Privacy Compliance Program: A Practical Checklist and Responding to a Data Breach: A Notification and Incident Response Checklist.

Phase 16 — Servicemember protections

[ ] Build the Military Lending Act covered borrower check using the Department of Defense database or a nationwide consumer report, performed and recorded at the right time to obtain the safe harbor. 32 C.F.R. § 232.5.
[ ] Compute the Military Annual Percentage Rate, which includes fees and credit insurance premiums TILA's APR excludes, and confirm it does not exceed 36%.
[ ] Remove prohibited terms for covered borrowers: mandatory arbitration, SCRA waivers, mandatory allotment, prepayment penalties, and specified vehicle title security.
[ ] Deliver the required oral and written disclosures.
[ ] Build SCRA processes: the 6% cap on pre-service obligations on written notice, military status affidavits before default judgments, and protections against repossession and foreclosure. 50 U.S.C. §§ 3901–4043.
[ ] Train servicing and collections staff on identifying servicemember status.

Why it matters, and the traps. An MLA violation renders the credit agreement void from inception. There is no cure. The covered borrower check is the single highest-consequence control in a consumer lending launch and it is the one most often missed.

See USERRA and SCRA Compliance for Employers and Creditors: A Practical Checklist.

Phase 17 — Servicing, collections, and complaints

[ ] Build payment processing, application, and posting rules and disclose them.
[ ] Build error resolution and information request procedures.
[ ] Build loss mitigation and hardship procedures.
[ ] For collections, comply with Reg F: the call frequency presumption in § 1006.14(b), electronic communication opt-out, the validation notice under § 1006.34, and the prohibition on suing or threatening suit on time-barred debt.
[ ] Confirm whether the entity is a debt collector under the FDCPA, and remember that creditors collecting their own debts are still subject to UDAAP and state law.
[ ] Build complaint intake across every channel, with acknowledgment, triage, ownership, resolution, and root-cause analysis.
[ ] Monitor the CFPB complaint database and meet response timelines.
[ ] Report complaint metrics to management and to the bank partner.

Why it matters, and the traps. Complaints are a supervisory input, a UDAAP early warning system, and the most common source of examination findings. Treat complaint handling as a compliance function, not a customer service function.

See FDCPA Debt Collection Compliance: A Practical Checklist.

Phase 18 — Vendor management and the compliance management system

[ ] Inventory every third party touching the product: the bank, the core processor, the aggregator, the collections agency, the model vendor, and the marketing partners.
[ ] Risk-tier each and diligence proportionately.
[ ] Contract for compliance obligations, audit rights, security requirements, breach notification, and termination.
[ ] Monitor performance and compliance on a defined cycle.
[ ] Build the compliance management system the examiners will assess: board and management oversight; written policies and procedures; training; monitoring and testing; complaint response; and independent audit.
[ ] Assign named ownership for each regulation.
[ ] Establish a change management process so product changes route through compliance before launch.
[ ] Establish a regulatory change management process to track amendments and new guidance.

Phase 19 — Test before launch

[ ] Run transaction testing on a pilot population: disclosures generated, APR computed, adverse action reasons produced, and Reg E timelines met.
[ ] Run fair lending testing on pilot decisions.
[ ] Run AML scenario testing and SAR decisioning on synthetic cases.
[ ] Run OFAC screening tests including near-match handling.
[ ] Test disclosures on real devices at real sizes.
[ ] Test the cancellation and complaint paths end to end.
[ ] Conduct an independent compliance review before launch, by someone who did not build the program.
[ ] Remediate findings and document the remediation.

Phase 20 — The launch gate

Do not launch in any state until all of these are true for that state:

[ ] Licenses obtained or a valid exemption documented in writing.
[ ] Bank partnership agreement executed, with the bank's credit committee operating.
[ ] Rate and fee structure confirmed lawful under the applicable regime, including DIDMCA opt-out analysis.
[ ] Disclosures built, tested, and reviewed by counsel.
[ ] Fair lending testing complete with documented results.
[ ] Adverse action notices generating specific reasons.
[ ] AML program operational with the officer appointed and training delivered.
[ ] OFAC screening live.
[ ] MLA covered borrower check operating with the safe harbor documented.
[ ] Privacy notices and the Safeguards Rule program in place.
[ ] Complaint intake operating with named ownership.
[ ] Compliance management system documented, with the regulatory ownership map complete.
[ ] Independent pre-launch review complete and findings remediated.

Worked example — Tessera's twelve months

Month 1. Product classified as closed-end consumer credit under Reg Z, with ACH repayment triggering Reg E. State matrix built: the 34% rate exceeds the cap in 19 states, so a bank partnership is required rather than optional. Money transmitter analysis concludes no MTL is needed because funds flow only between the bank, the borrower, and Tessera as servicer — documented with an agent-of-payee analysis in the three states where the flow is ambiguous.

Months 1–6. Bank partner search and diligence. Two candidates decline over fintech concentration limits. The third, Fairmount State Bank, negotiates for six months. Tessera's initial proposal — 95% purchase at two days, full indemnity, Tessera setting pricing — is restructured: the bank retains 15% of each loan for the life of the loan, approves the credit policy quarterly, holds rejection rights exercised through an automated policy the bank owns, and reviews all marketing.

Months 2–5. Lender licenses obtained in the eight states where direct lending is viable, so revenue can begin before the partnership closes.

Months 3–8. Compliance build: Reg Z disclosures, adverse action notices with model-generated reasons, Reg E error resolution, AML program with an appointed officer, OFAC screening, Safeguards Rule program, and the MLA check.

Month 7. Fair lending testing on the pilot model finds a disparity in approval rates correlated with a device-type variable. The variable is removed; predictive performance drops 40 basis points; the documented less-discriminatory-alternative analysis is retained. This is the file that matters in an examination.

Months 9–11. Pilot in three states. Transaction testing, complaint monitoring, independent review, and remediation.

Month 12. Launch by state as licenses and the partnership permit — not all at once.

Launching a Fintech Product: A Licensing and Compliance Checklist

Phase 1 — Classify the product

Phase 2 — Charter, partnership, or direct licensing

Phase 3 — Diligence and paper the bank partnership

Phase 4 — Map state licensing (start in week one)

Phase 5 — Federal registrations

Phase 6 — Build the AML program

Phase 7 — OFAC screening

Phase 8 — Build the Reg Z disclosures

Phase 9 — Fair lending and model governance

Phase 10 — Adverse action notices

Phase 11 — Reg E and payments

Phase 12 — FCRA

Phase 13 — The UDAAP review

Phase 14 — Marketing and consent

Phase 15 — Privacy and information security

Phase 16 — Servicemember protections

Phase 17 — Servicing, collections, and complaints

Phase 18 — Vendor management and the compliance management system

Phase 19 — Test before launch

Phase 20 — The launch gate

Worked example — Tessera's twelve months

Related Documents