Toolkit · Finance

The Fintech and Consumer Lending Toolkit

12 U.S.C. § 5552

Type
Toolkit
Jurisdiction
National
Date
2026-06-21
Topic
Finance

A resource map for consumer financial services and fintech practice, organized around the twelve places these programs actually break. It covers product classification and the four-installment line that determines whether a product is regulated credit at all, preemption and the bank partnership model with its unresolved true lender question, the licensing layer from state lender and money transmitter licensing through the agent-of-payee exemption, anti-money-laundering and sanctions obligations including strict-liability OFAC screening, the Regulation Z disclosure architecture, fair lending and the model governance expectations that now govern algorithmic underwriting, payments regulation across Regulation E and the network rules, credit reporting obligations for users and furnishers, UDAAP as the enforcement theory of first resort, marketing and consent under the TCPA and CAN-SPAM, privacy and information security under GLBA and the Safeguards Rule, and the supervision and complaint machinery that produces most examination findings. Each pillar gives the doctrine, the anchor authority, the trap, and links into the UpLaw documents that develop it. It closes with an authority shelf, a regulation ownership map, and a first-ninety-days sequence.

The Fintech and Consumer Lending Toolkit

Finance > Consumer Financial Services | Published 21 June 2026 - Updated 29 July 2026 | UpLaw - uplaw.us

Consumer financial regulation has three layers that operate independently: disclosure, telling consumers the price and terms; substantive prohibition, forbidding particular conduct; and UDAAP, reaching whatever the first two miss. A program built only on the first layer will pass a disclosure exam and lose an enforcement action, because the theory that gets used is almost always the third one.

Keywords: product classification, bank partnership, exportation, valid when made, true lender, MTL, agent of payee, BSA/AML, OFAC, Reg Z, fair lending, adverse action, Reg E, FCRA, UDAAP, TCPA, Safeguards Rule, MLA

How to read this toolkit

This is a resource map, not a treatise. It walks twelve pillars of consumer financial services practice. Under each you get the governing doctrine in plain terms, the anchor authority, the trap that catches people, and the UpLaw documents that develop it.

Four ground rules first.

One: classification decides everything. Whether a product is credit, whether it involves money transmission, and whether the customer is a consumer determine which of a dozen regimes apply. Write the classification down with reasoning; every downstream decision cites it.

Two: preemption is narrow. It covers rate and licensing. It does not cover UDAAP, fair lending, disclosure, BSA/AML, or third-party risk management. A bank partnership solves one problem and creates several.

Three: two things take a year. State money transmitter licensing across a footprint, and finding and papering a bank partner. Start both in week one.

Four: state enforcement does not follow federal enforcement. Dodd-Frank § 1042, 12 U.S.C. § 5552, lets state attorneys general enforce Title X including UDAAP. The effective compliance obligation is far more stable than the federal enforcement environment suggests.

Start here for the doctrinal treatment: Consumer Financial Services Regulation: A Comprehensive Guide to TILA, ECOA, RESPA, EFTA, and UDAAP. For the narrative introduction: Rent-a-Charter. For the launch sequence: Launching a Fintech Product: A Licensing and Compliance Checklist.

Our running matters. Tessera Lending, Inc. (fictional), an installment lender with a bank partner. Halcyon Pay, Inc. (fictional), a payments company moving funds between consumers and merchants.

Pillar 1 — Product classification

Doctrine. Whether a product is credit under Regulation Z turns on whether there is a finance charge or the obligation is payable in more than four installments by written agreement. Whether it involves money transmission turns on state law definitions and the actual flow of funds. Whether the customer is a consumer determines which statutes apply — though ECOA covers business credit too.

Anchors. 12 C.F.R. § 1026.2(a)(14), (17); state money transmission statutes; 15 U.S.C. § 1691 (ECOA reaches business credit).

Trap. Structuring around Reg Z does not escape regulation. A four-installment product with no finance charge falls outside TILA and remains fully subject to UDAAP, state lending law, and — for buy now, pay later providers with digital user accounts — the CFPB's interpretive treatment as card issuers subject to the credit card dispute and billing error provisions.

Trap, second order. Earned wage access. Whether it is credit has been answered differently by different regulators and at different times, and several states have enacted product-specific statutes with fee caps and registration. Structure for the possibility that it is credit.

Go deeper: Consumer Financial Services Regulation: A Comprehensive Guide · Launching a Fintech Product: A Licensing and Compliance Checklist

Pillar 2 — Preemption and the bank partnership

Doctrine. A national bank may charge the rate allowed by its home state anywhere; state banks have parity subject to a state opt-out. Interest permissible when a loan is made is unaffected by assignment. Who counts as the lender is unresolved.

Anchors. 12 U.S.C. § 85; Marquette National Bank v. First of Omaha Service Corp., 439 U.S. 299 (1978); Smiley v. Citibank (South Dakota), N.A., 517 U.S. 735 (1996); DIDMCA § 521, 12 U.S.C. § 1831d; Madden v. Midland Funding, LLC, 786 F.3d 246 (2d Cir. 2015); valid-when-made rules at 12 C.F.R. § 7.4001(e) and 12 C.F.R. § 331.4(e); Dodd-Frank § 1044, 12 U.S.C. § 25b.

Trap. True lender is genuinely open. The OCC's 2020 rule was repealed by Congressional Review Act resolution, which also bars a substantially similar rule without new legislation. Courts apply predominant-economic-interest or totality tests state by state. The documents that decide the question are the credit committee minutes and the rejection log, not the partnership agreement.

Trap, second order. DIDMCA opt-outs. Several states have opted out of state-bank parity, and litigation over what it means for a loan to be "made in" the opting-out state is active and unresolved. This is currently the most consequential open question in consumer lending.

Trap, third order. Preemption is about rate and licensing only. UDAAP, fair lending, disclosure, BSA/AML, and third-party risk expectations all apply, and the Bank Service Company Act, 12 U.S.C. § 1867(c), makes the fintech directly examinable.

Go deeper: Rent-a-Charter: The Bank Partnership Model and the Law That Keeps Testing It · Secured Transactions Under UCC Article 9: A Comprehensive Guide

Pillar 3 — Licensing

Doctrine. State lender licensing for direct lending; state money transmitter licensing for moving funds; federal MSB registration with FinCEN as a separate and additional obligation.

Anchors. State lender and money transmission statutes; the Money Transmission Modernization Act as adopted; 31 C.F.R. § 1022.380 (FinCEN registration within 180 days, renewed biennially); NMLS for licensing administration.

Trap. The agent-of-payee exemption is the structural question that determines whether a company needs money transmitter licenses at all. Availability turns on exact statutory language and the exact flow of funds — including whether receipt by the agent discharges the payor's obligation. Get a written analysis state by state before assuming it applies.

Trap, second order. Timeline. Twelve to twenty-four months for a national money transmitter footprint, with surety bond underwriting, permissible investment requirements, control person background checks, and audited financials. Companies that treat licensing as a launch-month task launch a year late.

Trap, third order. Permissible investment requirements constrain how customer funds may be held — which is a treasury and product design constraint, not merely a filing.

Go deeper: Launching a Fintech Product: A Licensing and Compliance Checklist · How Cryptocurrency Is Regulated Around the World: A Comparative Overview

Pillar 4 — BSA/AML and sanctions

Doctrine. A written AML program with five pillars — internal controls, independent testing, a designated officer, training, and customer due diligence — plus customer identification, beneficial ownership collection, transaction monitoring, and suspicious activity reporting. Sanctions screening is a separate regime.

Anchors. 31 U.S.C. §§ 5311–5336; 31 C.F.R. § 1010.230 (beneficial ownership); FinCEN MSB rules at 31 C.F.R. Part 1022; OFAC sanctions programs.

Trap. OFAC is strict liability. Knowledge is not an element. A transaction with a blocked person is a violation regardless of screening quality, though a documented sanctions compliance program is a substantial mitigating factor in any enforcement response.

Trap, second order. SAR confidentiality. Disclosing the existence of a suspicious activity report — including to the customer, and including in litigation — is itself a violation. Train customer-facing staff and litigation counsel on it.

Trap, third order. Transaction monitoring tuning. An untuned system generating thousands of unreviewed alerts is worse than a modest one that is actually worked, because the alerts document knowledge without action.

Go deeper: Export Controls and Economic Sanctions: A Comprehensive Guide to the EAR, ITAR, and OFAC · Export Control and Sanctions Compliance: A Practical Checklist · White Collar Crime and Corporate Criminal Liability: A Comprehensive Guide

Pillar 5 — Disclosure under Regulation Z

Doctrine. Disclose the cost of credit as a finance charge and an APR, with the required content, at the required time, in the required form — differently for open-end and closed-end credit, with additional rules for credit cards and mortgages.

Anchors. 15 U.S.C. §§ 1601–1667f; 12 C.F.R. Part 1026, especially §§ 1026.4 (finance charge), 1026.18 (closed-end), 1026.22 (APR accuracy), 1026.23 (rescission), 1026.43 (ability to repay), 1026.51–1026.61 (credit cards).

Trap. The three-year rescission. Where required disclosures or the notice of the right to rescind were not delivered in a transaction secured by the consumer's principal dwelling, the rescission period extends from three days to three years. It is the most severe remedy in the statute.

Trap, second order. Rendering. A technically compliant disclosure that renders badly on a phone — truncated, requiring scrolling past the key terms, or presented after the commitment moment — is a UDAAP problem even if it satisfies Reg Z. Test on real devices.

Trap, third order. Advertising trigger terms. Stating a payment amount, a rate, or a down payment in an advertisement triggers additional required disclosures under §§ 1026.16 and 1026.24. Marketing teams generate these violations constantly.

Go deeper: Consumer Financial Services Regulation: A Comprehensive Guide · Advertising Law: A Comprehensive Guide to the FTC Act and Lanham Act

Pillar 6 — Fair lending and model governance

Doctrine. No discrimination on prohibited bases, reached through overt discrimination, disparate treatment, and disparate impact — a facially neutral practice with disproportionate adverse effect, unless justified by business necessity with no less discriminatory alternative.

Anchors. ECOA, 15 U.S.C. §§ 1691–1691f; Reg B, 12 C.F.R. Part 1002; Fair Housing Act, 42 U.S.C. §§ 3601–3619; Texas Department of Housing & Community Affairs v. Inclusive Communities Project, Inc., 576 U.S. 519 (2015).

Trap. Proxy variables. A model can encode historical discrimination without any input naming a protected characteristic — through geography, education, device type, or purchase patterns. Testing must occur at the deployed-decision level, not only at the model level.

Trap, second order. The documented search for less discriminatory alternatives is now a supervisory expectation in its own right. Its absence is a finding regardless of whether disparity exists. Test alternative specifications, record the predictive-performance tradeoff, and keep the file.

Trap, third order. Adverse action reasons. Reg B requires the specific principal reasons, and a model's complexity is not an excuse. A model that cannot generate the actual reasons is not deployable — the compliance problem precedes the fairness problem.

Go deeper: AI Governance and Compliance: A Comprehensive Guide · Deploying an AI System: An AI Governance and Risk Checklist · Fair Housing and Public Accommodations: A Comprehensive Guide to the FHA and ADA Title III

Pillar 7 — Payments

Doctrine. Regulation E governs consumer electronic fund transfers — error resolution, unauthorized transfer liability, preauthorized transfers, prepaid accounts, and remittances. Network rules govern the rest.

Anchors. 15 U.S.C. §§ 1693–1693r; 12 C.F.R. Part 1005, especially §§ 1005.6 (liability tiers), 1005.10 (preauthorized), 1005.11 (error resolution), 1005.18–1005.19 (prepaid); NACHA Operating Rules; card network rules; UCC Article 4A for wholesale wires.

Trap. Article 4A is not consumer-protective. Wholesale wire transfers governed by UCC Article 4A allocate loss very differently from Reg E, frequently to the sender. A product that moves money by wire rather than ACH has a materially different loss allocation, and consumers do not know it.

Trap, second order. Error resolution timelines are short. Ten business days to investigate, or forty-five with provisional credit. Systems that route disputes through a general support queue miss them.

Trap, third order. Compulsory use. Conditioning credit on repayment by preauthorized electronic transfer violates § 1005.10(e). Products that require autopay for the advertised rate need careful structuring.

Go deeper: Consumer Financial Services Regulation: A Comprehensive Guide · Launching a Fintech Product: A Licensing and Compliance Checklist

Pillar 8 — Credit reporting

Doctrine. A consumer report may be obtained only for a permissible purpose. Users must give adverse action and risk-based pricing notices. Furnishers must furnish accurately and investigate disputes.

Anchors. 15 U.S.C. §§ 1681–1681x, especially §§ 1681b (permissible purpose), 1681m (user notices), 1681s-2 (furnisher duties), 1681i (reinvestigation); Reg V, 12 C.F.R. Part 1022.

Trap. Furnisher dispute investigation under § 1681s-2(b) requires a reasonable investigation — not merely confirming that the furnished data matches internal records. Courts have repeatedly held that a parroting response is not an investigation, and it is the most common furnisher claim.

Trap, second order. Permissible purpose for prescreening. A prescreened offer must be a firm offer of credit and carry the required opt-out notice. Marketing teams that pull lists for general outreach without a firm offer have obtained reports without permissible purpose — which is both a civil violation and, if under false pretenses, criminal.

Go deeper: Running Background Checks Under the FCRA: A Practical Checklist · Consumer Protection Law: A Comprehensive Guide

Pillar 9 — UDAAP

Doctrine. Unfair (substantial injury, not reasonably avoidable, not outweighed by benefits), deceptive (likely to mislead a reasonable consumer, and material), or abusive (materially interferes with understanding, or takes unreasonable advantage of a lack of understanding, an inability to protect one's interests, or reasonable reliance).

Anchors. Dodd-Frank §§ 1031, 1036, 12 U.S.C. §§ 5531, 5536; FTC Act § 5, 15 U.S.C. § 45; state UDAP statutes.

Trap. Disclosure is not a defense. A fully disclosed fee can be unfair. A literally accurate advertisement can be deceptive in net impression. The UDAAP review must cover the entire experience — acquisition, application, approval, funding, servicing, and exit — not the disclosures.

Trap, second order. Dark patterns. Friction asymmetry between signing up and cancelling, pre-checked boxes, misleading defaults, and countdown pressure are all reached. Cancellation should be as easy as enrollment; where it is not, that fact alone is the enforcement theory.

Trap, third order. The abusiveness prong has no FTC Act analogue and its boundaries are still being drawn. Reliance on a covered person to act in the consumer's interests — created by marketing that positions the product as advice — is the most underappreciated exposure in the definition.

Go deeper: Advertising Law: A Comprehensive Guide to the FTC Act and Lanham Act · Substantiating Advertising Claims: A Practical Checklist · The Advertising and Marketing Law Toolkit

Pillar 10 — Marketing and consent

Doctrine. Prior express written consent is required for autodialed or prerecorded telemarketing calls and texts to wireless numbers. Commercial email requires accurate headers, a working opt-out, and a physical address.

Anchors. TCPA, 47 U.S.C. § 227; 47 C.F.R. § 64.1200; Facebook, Inc. v. Duguid, 592 U.S. 395 (2021); CAN-SPAM, 15 U.S.C. §§ 7701–7713; Telemarketing Sales Rule, 16 C.F.R. Part 310.

Trap. Duguid narrowed the ATDS definition and nothing else. The prohibitions on prerecorded and artificial voice calls, the do-not-call rules, and state analogues are fully enforced. Companies that read Duguid as ending TCPA exposure are wrong in an expensive way — $500 per violation, trebled for willful violations, with no cap.

Trap, second order. Revocation by any reasonable means. A consumer may revoke consent orally, by text reply, or through any reasonable channel. A system that honors only a specific keyword is non-compliant.

Trap, third order. State statutes. Several are broader than the TCPA — some prohibiting conduct Duguid placed outside federal reach — and several carry private rights of action.

Go deeper: CAN-SPAM Compliance for Commercial Email: A Practical Checklist · Influencer and Endorsement Disclosure: A Practical Checklist

Pillar 11 — Privacy and information security

Doctrine. GLBA requires privacy notices and opt-out rights for sharing with nonaffiliated third parties, and a written information security program. State comprehensive privacy laws exempt GLBA-covered data — but the exemptions differ.

Anchors. 15 U.S.C. §§ 6801–6809; Reg P, 12 C.F.R. Part 1016; Safeguards Rule, 16 C.F.R. Part 314; Dodd-Frank § 1033 open banking, 12 U.S.C. § 5533.

Trap. The GLBA exemption in state privacy laws is not uniform. Some are entity-level (the whole institution is exempt); some are data-level (only GLBA-regulated data is exempt). A fintech that is not itself a financial institution, or that holds data outside the GLBA perimeter, may be fully covered by state law.

Trap, second order. The Safeguards Rule is prescriptive, not principles-based — a designated qualified individual, a written risk assessment, encryption in transit and at rest, multi-factor authentication, penetration testing, service provider oversight, an incident response plan, and periodic board reporting. Programs written to a general security framework frequently miss specific required elements.

Trap, third order. Data aggregator relationships. Screen-scraping and API access arrangements need contractual use limitations, security obligations, and — as § 1033 implementation proceeds — authorization and secondary-use compliance.

Go deeper: Building a Privacy Compliance Program: Governance, Data Mapping, and the Legal Patchwork · Standing Up a Privacy Compliance Program: A Practical Checklist · The Privacy and Data Protection Toolkit

Pillar 12 — Supervision, complaints, and exam readiness

Doctrine. Examiners assess a compliance management system: board and management oversight, policies and procedures, training, monitoring and testing, complaint response, and independent audit. Complaints are a supervisory input.

Anchors. CFPB supervision and examination manuals; 12 U.S.C. § 5565 (three-tier civil money penalties); § 5481(25) (related person liability for directors, officers, employees, and controlling shareholders); interagency third-party risk management guidance; Bank Service Company Act examination authority.

Trap. Complaints are a compliance function, not customer service. They are the earliest UDAAP signal, they feed the public database, and they drive examination scoping. A program without complaint root-cause analysis has no early warning system.

Trap, second order. Individual liability. Related persons who knowingly or recklessly participate in a violation can be named. That reality should shape how compliance objections are documented and escalated.

Trap, third order. Regulatory change management. After Loper Bright Enterprises v. Raimondo, 603 U.S. 369 (2024), agency interpretations are more contestable and less durable. Programs that relied on a guidance document without re-verification are exposed in both directions — the guidance may be invalidated, or a practice built on its safe harbor may lose the safe harbor.

Go deeper: Administrative Law: A Comprehensive Guide to Agency Action and Judicial Review · Responding to a Government Subpoena or Investigation: A Practical Checklist · The Corporate Compliance Toolkit

The authority shelf

Framework

  • Dodd-Frank Title X, 12 U.S.C. §§ 5481–5603 (especially §§ 5531, 5536, 5552, 5565)
  • Seila Law LLC v. CFPB, 591 U.S. 197 (2020)
  • CFPB v. Community Financial Services Ass'n of America, 601 U.S. 416 (2024)
  • Loper Bright Enterprises v. Raimondo, 603 U.S. 369 (2024)

Preemption

  • 12 U.S.C. §§ 25b, 85, 1831d
  • Marquette Nat'l Bank v. First of Omaha Serv. Corp., 439 U.S. 299 (1978)
  • Smiley v. Citibank (South Dakota), N.A., 517 U.S. 735 (1996)
  • Barnett Bank of Marion County, N.A. v. Nelson, 517 U.S. 25 (1996)
  • Madden v. Midland Funding, LLC, 786 F.3d 246 (2d Cir. 2015)
  • 12 C.F.R. §§ 7.4001(e), 160.110(d), 331.4(e)

Core statutes and regulations

  • TILA, 15 U.S.C. §§ 1601–1667f; 12 C.F.R. Part 1026
  • ECOA, 15 U.S.C. §§ 1691–1691f; 12 C.F.R. Part 1002
  • FCRA, 15 U.S.C. §§ 1681–1681x; 12 C.F.R. Part 1022
  • RESPA, 12 U.S.C. §§ 2601–2617; 12 C.F.R. Part 1024
  • EFTA, 15 U.S.C. §§ 1693–1693r; 12 C.F.R. Part 1005
  • FDCPA, 15 U.S.C. §§ 1692–1692p; 12 C.F.R. Part 1006
  • TCPA, 47 U.S.C. § 227; 47 C.F.R. § 64.1200
  • GLBA, 15 U.S.C. §§ 6801–6809; 12 C.F.R. Part 1016; 16 C.F.R. Part 314
  • MLA, 10 U.S.C. § 987; 32 C.F.R. Part 232
  • SCRA, 50 U.S.C. §§ 3901–4043
  • BSA, 31 U.S.C. §§ 5311–5336; 31 C.F.R. Chapter X

Cases

  • Facebook, Inc. v. Duguid, 592 U.S. 395 (2021)
  • Safeco Ins. Co. of America v. Burr, 551 U.S. 47 (2007)
  • Heintz v. Jenkins, 514 U.S. 291 (1995)
  • Texas Dep't of Housing & Cmty. Affairs v. Inclusive Communities Project, Inc., 576 U.S. 519 (2015)

Secondary sources

  • CFPB Supervision and Examination Manual
  • Interagency Guidance on Third-Party Relationships: Risk Management (2023)
  • FFIEC BSA/AML Examination Manual
  • Conference of State Bank Supervisors, Money Transmission Modernization Act
  • NACHA Operating Rules and Guidelines

Appendix A — The regulation ownership map

Assign a named owner to each. A program without named ownership has no program.

Regulation Owner function Key deliverable
Reg Z (TILA) Product and legal Disclosure templates, APR computation, advertising review
Reg B (ECOA) Credit risk and legal Adverse action reasons, fair lending testing, exception tracking
FCRA / Reg V Credit risk and operations Permissible purpose controls, dispute investigation, notices
Reg E (EFTA) Payments operations Error resolution SLAs, liability determination, disclosures
Reg F (FDCPA) Collections Contact frequency controls, validation notices, time-barred debt screen
UDAAP Compliance (all functions contribute) Full-experience review, marketing substantiation, dark pattern screen
TCPA / CAN-SPAM Marketing Consent capture and revocation, DNC scrub, opt-out honoring
GLBA / Safeguards Security and legal Privacy notices, written InfoSec program, board reporting
MLA / SCRA Underwriting and servicing Covered borrower check with safe harbor documentation
BSA/AML BSA officer Five-pillar program, CIP/CDD, monitoring, SAR decisioning
OFAC BSA officer Screening, match resolution, blocking and reporting
Licensing Legal and finance State matrix, renewals, reporting, bond maintenance
Bank partnership Legal and credit Credit committee operation, rejection log, exercise of approval rights
Third-party risk Vendor management Inventory, tiering, diligence, monitoring, contract terms
Complaints Compliance Intake, triage, resolution, root-cause analysis, metrics

Appendix B — First ninety days

Days 1–10. Classify the product in writing with reasoning. Determine whether it is credit under the four-installment and finance charge tests, whether it involves money transmission, and whether the customer is a consumer. Every subsequent decision cites this memo.

Days 1–90 (parallel track, start immediately). Two long-lead items. Begin the bank partner search and diligence — expect six months. Begin the state licensing analysis and applications — expect twelve to twenty-four months for a national footprint. Everything else can wait; these cannot.

Days 11–25. Build the state matrix: activity, license required, rate cap, fee restrictions, permissible terms, net worth, bond, and timeline. Identify DIDMCA opt-out states. Write the agent-of-payee analysis state by state if money movement is involved.

Days 26–45. Stand up the AML program with a designated officer and the five pillars, plus OFAC screening. These are gating for any money movement and they take longer to build than teams expect.

Days 46–65. Build the disclosure set and test rendering on real devices. Build adverse action notices and confirm the model can generate specific reasons — if it cannot, escalate now, because the model is not deployable.

Days 66–80. Run fair lending testing at the model and deployed-decision levels, with a documented search for less discriminatory alternatives. Build Reg E error resolution if the product moves money. Complete the Safeguards Rule program.

Days 81–90. Run the UDAAP review of the entire experience, not the disclosures. Stand up complaint intake with named ownership. Complete the regulation ownership map. Commission an independent pre-launch review by someone who did not build the program, and remediate before launching in any state.

Related Documents

Guides

Articles

Checklists

Toolkits