What regulatory and compliance requirements apply to online-first fintech, payments, and digital-asset businesses in the United States?
This guide provides a comprehensive, lifecycle-based overview of U.S. financial regulatory and compliance requirements for online-first fintech, payments, and digital-asset businesses. The United States regulatory landscape features multiple layers, including federal Bank Secrecy Act and anti-money laundering laws, state money transmission licensing regimes, and overlapping agency jurisdictions such as FinCEN, SEC, CFTC, CFPB, IRS, DOJ, and banking regulators. To navigate this complexity, the guide follows key business stages from pre-launch planning through licensing, launch, ongoing operations, growth, and partnering, explaining the compliance obligations and expectations at each phase.
By understanding where you are in the lifecycle and what rules apply, you can proactively address requirements.
How do you scope your regulatory obligations before launching a fintech or crypto product?
1. Pre-Launch and Regulatory Scoping
Before launching any digital money services or crypto venture, it is crucial to map out the regulatory scope of your planned activities. Early regulatory scoping identifies which laws, licenses, and oversight agencies will apply to your business model.
Are you a Money Services Business under FinCEN rules, and does that include crypto?
Federal MSB Status (FinCEN and BSA): Determine if your business will be classified as a Money Services Business under FinCEN regulations. In practice, most online payment and digital-asset platforms fall under the money transmitter category of MSB if they accept and transmit funds or equivalents, including cryptocurrency, from one person to another.
FinCEN defines money transmission to include the transfer of currency, funds, or other value that substitutes for currency. This captures many crypto and stablecoin business models that transmit value on behalf of others.
Could an MSB exemption apply to your business model, and why are exemptions risky?
MSB Exemptions: Evaluate whether any narrow regulatory exemptions might apply that could exclude your activity from MSB status. FinCEN’s rules carve out certain activities. For example, a company that only provides the software or connection services to support money transmission without itself controlling funds is not an MSB, and payment processors for bona fide goods or services acting by agreement with merchants to process payments may fall outside the money transmitter definition.
However, these exemptions are limited in scope. If your platform holds customer value or can transmit money between users, especially for purposes other than payment for goods or services, you will likely still be treated as an MSB. In the crypto context, true non-custodial wallet providers or software-only blockchain infrastructure might avoid MSB status, but any custodial or intermediary role with user funds or crypto triggers MSB regulation in most cases. Treat exemptions cautiously and consult legal counsel, since misclassification can lead to operating unlawfully.
Do you need state money transmitter licenses, and how do you determine your state licensing footprint?
State Money Transmission Laws: Identify the states in which you will do business, such as where you have customers or operations, and assess if those states regulate your activity under money transmitter licensing laws. There is no single U.S. money transmitter license. Instead, each state and territory may require a license to engage in money transmission with its residents. States define money transmission with variations, and many states include virtual currency or monetary value concepts in their definitions.
As a result, an online fintech or crypto business often needs dozens of state licenses to operate nationwide. However, because statutes vary, the exact licensing footprint depends on your business model and each state’s law. Some states may exempt specific business arrangements.
Montana is a unique example. Montana does not regulate money transmitters, although a company may still need other licenses depending on its activities.
Carefully analyze each target jurisdiction’s requirements before launch, typically with the help of experienced counsel or compliance advisors. At this pre-launch stage, companies may leverage our MTL readiness assessment tool to evaluate where they are in the journey to require a license based on planned services.
What crypto-specific regulatory categories might apply beyond MSB and MTL?
Crypto-Specific Regulatory Considerations: Digital asset businesses must consider additional layers of classification. Simply being a money transmitter under FinCEN does not preclude other regulatory designations. In pre-launch planning, examine whether any aspect of your crypto product could make it a security invoking SEC regulation or a derivative or commodity instrument invoking CFTC oversight.
For example, issuing a token that purchasers buy with an expectation of profit can raise securities law issues under the Howey framework, and offering leveraged crypto trading can implicate derivatives and commodities regulation.
Stablecoin platforms warrant special attention because the U.S. now has a federal stablecoin framework. A federal stablecoin law was signed in July 2025, establishing a regulatory framework for payment stablecoins and affecting how stablecoin issuance and related activities are supervised and examined.
Additionally, the Travel Rule for fund transfers applies to crypto. If your business will transmit crypto externally, you will need a solution to share required sender and recipient information for covered transactions.
What is the Travel Rule threshold in the U.S., and what should you plan for?
The Travel Rule and related recordkeeping requirements apply to transmittals of funds of 3,000 dollars or more, and covered institutions must retain required records for up to five years.
FinCEN has considered lowering the threshold for certain cross-border activity, such as proposals referencing a 250 dollar threshold, but this has not been finalized.
What other regulators and legal risks should you consider before launch?
Overlapping Regulators and Laws: Beyond money movement laws, a fintech or crypto business must comply with a host of other laws once it handles customers and money. Consumer protection is a key area. If you will offer services to individuals, laws enforced by the CFPB and FTC come into play. These include prohibitions on unfair, deceptive, or abusive acts or practices, as well as specific requirements like Regulation E for wallets or prepaid products and the CFPB’s Remittance Rule if you will send consumer transfers abroad regularly.
A key practical trigger in the Remittance Rule is the safe harbor threshold tied to whether a person provides remittance transfers in the normal course of business, which uses a 500 transfers threshold in the CFPB’s rules.
Tax compliance cannot be ignored. The IRS treats cryptocurrency as property for tax purposes. Treasury and the IRS finalized broker reporting rules for dispositions of digital assets, with reporting on Form 1099-DA beginning with transactions on or after January 1, 2025.
Finally, consider DOJ enforcement risk. Operating without required licenses or engaging in willful AML violations can lead to criminal charges. 18 U.S.C. § 1960 is a key statute used to prosecute unlicensed money transmitting activity. If you transmit money in states where you lack a license or fail to register with FinCEN, the DOJ can prosecute.
In summary, the pre-launch phase is about understanding your regulatory identity. This includes confirming whether your business will be treated as a FinCEN-regulated MSB, determining which state licenses you need, and spotting any special regulatory regimes such as crypto securities, commodity laws, and consumer finance laws that apply to your model. By using tools and expert guidance to scope these obligations, you set a strong foundation for the next phase, pursuing the required licenses and registrations.
What licenses and registrations do you need to operate legally after scoping is complete?
2. Licensing and Registration
Once you have scoped out the likely regulatory requirements, the next lifecycle stage is obtaining the formal licenses, registrations, and approvals needed to operate legally.
How do you register as an MSB with FinCEN, and what does registration actually do?
FinCEN MSB Registration: At the federal level, if your business meets the MSB definition, you must register with FinCEN as an MSB. This is done by filing FinCEN Form 107 electronically through the BSA E-filing system. Initial registration must occur within 180 days of starting operations, and FinCEN registration must be renewed every two years to remain active.
Registration is a notice filing that places your company on FinCEN’s MSB registry. It does not replace state licensing. Registration triggers the obligation to comply with applicable BSA and AML rules for MSBs.
What does state money transmitter licensing require, and why is it often the biggest barrier?
State Money Transmitter Licenses: For any U.S. state that deems your activities to be money transmission, you must apply for and obtain a Money Transmitter License prior to doing business with residents of that state. Each state licensing process is unique and typically requires a detailed application including business plans, flow-of-funds diagrams, financial statements, minimum net worth or liquidity proof, surety bond, background checks for key officers and owners, AML compliance policies, and other documentation.
The state licensing regime is often the most significant operational barrier for fintech and crypto startups entering the U.S. market. Approval timelines vary by state, and requirements differ, especially for digital assets.
What other regulatory filings might apply beyond FinCEN and state licensing?
Other Registrations and Regulatory Filings: Depending on your expanded scope, consider these possibilities.
SEC: If your platform will deal in securities, such as offering tokenized securities, security token trading, or investment contracts, you may need to register as a broker-dealer or alternative trading system, or seek an exemption.
CFTC: If you plan to offer derivatives or facilitate margin trading on commodities, you may trigger requirements to register as a futures commission merchant, commodity exchange, or other CFTC-regulated entity.
CFPB: There is no licensing by CFPB, but certain activities require compliance with CFPB rules, and the CFPB can supervise certain markets.
FinCEN-specific filings: If your business involves foreign entities, foreign-located MSBs doing business in the U.S. must have a U.S. agent for service of process and comply with U.S. MSB rules. If you plan to have a network of authorized agents, FinCEN requires you to prepare and maintain an agent list and update it regularly.
IRS: FinCEN has delegated BSA examination authority for MSBs to the IRS in most cases. That means BSA and AML compliance may be examined by the IRS.
OFAC and bank regulators: OFAC administers sanctions laws you must comply with from day one. If partnering with banks, federal banking regulators may indirectly review your activities via the bank.
How should you treat beneficial ownership information in onboarding and compliance programs in 2025 and beyond?
If you onboard business customers, beneficial ownership and control information remains an important risk-based due diligence element in many MSB compliance programs. Separately, beneficial ownership information reporting rules changed significantly in 2025. FinCEN issued an interim rule that removes beneficial ownership reporting requirements for U.S. companies and U.S. persons, while certain foreign companies may still have reporting obligations. As a result, onboarding should be framed as risk-based due diligence, not as a blanket requirement that all business customers must file beneficial ownership reports.
The licensing and registration stage clears the legal runway for launch. This includes FinCEN MSB registration, obtaining required state money transmitter licenses, and addressing any additional regulatory regimes implicated by your product. Do not commence money transmission activity in any jurisdiction before you are authorized.
What must be in place before you launch so regulators see a real compliance program?
3. Launch Readiness
With licenses obtained or in process under a controlled plan and FinCEN registration in place, the focus shifts to operational readiness. Regulators expect a functioning compliance program at launch.
What does an MSB AML program need to include before launch?
BSA and AML Compliance Program Development: Every MSB must develop and implement a written AML program that is effective and tailored to the business’s risks. FinCEN regulations require that the program include:
- Internal policies, procedures, and controls
- A designated compliance officer
- Ongoing employee training
- Independent review and audit
What KYC and customer due diligence capabilities need to exist at launch?
Customer Identification and Due Diligence Systems: You should have a customer identification approach in practice, collecting onboarding information and verifying identity using documentary or non-documentary methods. Higher-risk customers may require enhanced due diligence. Sanctions screening at onboarding is essential, using up-to-date sanctions lists.
What does OFAC compliance look like for fintech and crypto at launch?
OFAC Compliance Program: Sanctions compliance is a legal requirement. By launch, implement screening for customers and transactions against OFAC sanctions lists. For crypto use cases, address sanctioned wallet exposure and geolocation controls as applicable.
How should transaction monitoring and reporting be set up before day one?
Transaction Monitoring and Reporting Setup: Prior to launch, deploy monitoring systems that flag unusual or suspicious activity. Establish escalation procedures and be ready to file SARs through FinCEN’s systems when required. If applicable, implement CTR procedures for cash activity.
What is the Travel Rule and what must you do to comply for crypto transfers?
Funds Travel Rule Compliance: The Travel Rule applies to transmittals of funds of 3,000 dollars or more and requires collecting, transmitting, and retaining specified originator and beneficiary information. For crypto, have a solution or at least a documented process to exchange required information with counterparties.
Launch readiness should include a full test of compliance operations, staff escalation paths, access to reporting portals, required consumer disclosures, marketing review for accuracy, privacy and cybersecurity controls, and proper safeguarding of customer funds.
What does ongoing compliance look like after you go live?
4. Operating and Ongoing Compliance
Once your business is live and serving customers, compliance enters the ongoing operations phase. This is where you must consistently execute on policies and controls and continuously adapt to new risks or regulatory changes.
How do you handle day-to-day monitoring, SARs, CTRs, and recordkeeping?
Transaction Monitoring and Reporting: Alerts must be investigated promptly. SAR confidentiality must be maintained. Recordkeeping requirements include retention of required records for up to five years for covered activities, including Travel Rule recordkeeping for covered transmittals.
What recurring filings and renewals must you manage?
Regulatory Reporting and Communication: Renew FinCEN MSB registration every two years. File required state reports and renew state licenses on schedule.
What should you expect in state exams and federal BSA exams?
Examination Interactions: Expect state examinations and federal BSA examinations, often conducted by the IRS on behalf of FinCEN for MSBs.
What changes when the business grows, expands, or introduces new products?
5. Growth, Change, and Scaling
As your business matures, you will encounter growth opportunities and changes that have regulatory implications, including expansion, new products, scaling volume, and corporate transactions.
When should a company consider a bank or trust charter?
Transition to a Charter: Pursuing a charter can consolidate licensing but introduces prudential regulation and intensive supervision. With the federal stablecoin framework now in place, stablecoin issuance pathways and supervisory expectations are evolving, so charter strategy and bank-partner strategy should be assessed in that context.
How do embedded finance and partner models work, and what compliance burden remains?
6. Embedded Finance and Partner Models
Not every fintech or crypto startup goes it alone in compliance and licensing. Many leverage partnerships to operate under another entity’s regulatory umbrella. These models can accelerate time to market but come with compliance obligations and oversight.
Partner models can be a smart strategy, but they are not a shortcut. The end goal remains the same: a robust, compliant financial service regulators trust and customers feel safe using.
What is the bottom line for founders and finance leaders using this lifecycle framework?
The regulatory landscape for online money services and digital assets is continually evolving. By following a lifecycle approach, scoping requirements early, securing necessary licenses and registrations, implementing strong controls at launch, diligently managing ongoing compliance, planning for regulatory implications of growth, and leveraging partnerships wisely, a fintech or crypto business can navigate the U.S. regulatory system more effectively.
Reviewed by YR, CPA
Senior Financial Advisor