Fintech Compliance Requirements: 4 Essential Layers | Osto<\/title>\n<meta name=\"description\" content=\"Fintech compliance requirements in the US explained: SOC 2, PCI DSS, BSA\/AML, money transmitter licenses, GLBA, and how to know which ones apply to you.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n \/* Osto branded comparison table *\/\n .otable{overflow-x:auto;margin:26px 0;border-radius:16px;border:1px solid #e3e6f5;box-shadow:0 10px 34px rgba(28,38,122,.10)}\n table.regtable{border-collapse:separate;border-spacing:0;width:100%;min-width:520px;font-size:14.5px;background:#fff;margin:0}\n table.regtable thead tr,table.regtable tr:first-child{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n table.regtable th,table.regtable tr:first-child td{background:transparent;color:#fff;text-align:left;padding:15px 18px;font-size:13px;font-weight:800;letter-spacing:.03em;border:none}\n table.regtable td{padding:14px 18px;border-bottom:1px solid #eef0f7;vertical-align:top;color:#33384f}\n table.regtable tr:nth-child(even):not(:first-child){background:#f7f9ff}\n table.regtable tr:last-child td{border-bottom:none}\n table.regtable td:first-child{font-weight:700;color:#0e1330}\n table.regtable tr td:first-child{border-right:1px solid #eef0f7}\n table.regtable tr:first-child td:first-child,table.regtable th:first-child{border-right:1px solid rgba(255,255,255,.18)}\n table.regtable tr:first-child td{border-bottom:none}\n\n<\/style>\n<\/head>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">Fintech compliance requirements are the steepest of any software vertical, because you carry a whole regulatory layer other startups never touch. This guide breaks down exactly what a fintech needs to operate and sell in the US, and how to tell which rules apply to your product.<\/p>\n\n <div class=\"meta\"><span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>11 min read<\/span><span class=\"dot\"><\/span><span>Compliance<\/span><\/div>\n\n <div class=\"tldr\">\n <h2>The short answer<\/h2>\n <p>Fintech compliance requirements in the US stack in four layers: federal supervision (CFPB, FinCEN, SEC, FTC, with BSA\/AML rules), state licensing (money transmitter licenses in 49 states if you move or hold money), industry and buyer standards (PCI DSS for card data, SOC 2 and ISO 27001 for trust), and privacy and consumer laws (state privacy laws, GLBA, TILA, ECOA). There is no single fintech license, the exact mix is driven by what your product does with money and data. Many early fintechs use a partner-bank or Banking-as-a-Service model to defer direct licensing, but the security, AML, and data obligations still apply.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#why\">Why fintech is different<\/a><\/li>\n <li><a href=\"#layers\">The four layers<\/a><\/li>\n <li><a href=\"#frameworks\">The frameworks that apply<\/a><\/li>\n <li><a href=\"#money\">The money layer and BaaS<\/a><\/li>\n <li><a href=\"#scope\">How to scope your list<\/a><\/li>\n <li><a href=\"#osto\">How Osto helps fintechs<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec c-sky\" id=\"why\">Why fintech compliance requirements are steeper<\/h2>\n <p>Every US software startup faces some compliance, but a fintech carries an extra dimension: it moves money and holds financial data, which puts it under financial regulators as well as the usual security and privacy rules. That is why fintech compliance is broader and less forgiving than a typical SaaS startup’s, covered in our guide to <a href=\"https:\/\/www.osto.one\/resources\/blog\/saas-compliance-requirements-us\/\">SaaS compliance requirements for selling in the US<\/a>. Getting the architecture wrong early is expensive, because compliance obligations shape your data flows, your licensing, and your partnerships from day one, not after launch.<\/p>\n\n <h2 class=\"sec c-sage\" id=\"layers\">The four layers of fintech compliance requirements<\/h2>\n <p>The single most useful way to understand them is to stop looking for one checklist and see them as four stacked layers. Each layer is triggered independently, so a payments app and a lending app face different combinations.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#1C267A;margin-bottom:6px;text-align:left\">The mental model<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">Four layers, not one checklist<\/div>\n <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">The fintech compliance requirements in the US are not a single list. They stack in four layers at once, and which parts apply depends entirely on what your product does with money and data.<\/div>\n <svg viewBox=\"0 0 800 240\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"The four layers of US fintech compliance requirements\">\n<g font-family=\"Inter,Arial,sans-serif\">\n <text x=\"400\" y=\"30\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\">Fintech compliance is four layers at once<\/text>\n <text x=\"400\" y=\"52\" text-anchor=\"middle\" fill=\"#8a90a6\" font-size=\"11.5\">There is no single fintech license. The mix depends on what you do with money and data.<\/text>\n <rect x=\"16\" y=\"70\" width=\"185\" height=\"150\" rx=\"14\" fill=\"#1c267a\"\/>\n <circle cx=\"52\" cy=\"106\" r=\"18\" fill=\"#2b3596\"\/><g transform=\"translate(43.00,97.00) scale(0.75)\" fill=\"none\" stroke=\"#aeb6ee\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M14 4l6 6-3 3-6-6z\"\/><path d=\"M11 7l-6 6M4 20h9M6.5 15.5l3 3\"\/><\/g>\n <text x=\"30\" y=\"146\" fill=\"#fff\" font-size=\"12.5\" font-weight=\"800\">Federal<\/text>\n <text x=\"30\" y=\"166\" fill=\"#c3c9ee\" font-size=\"10.5\">CFPB, FinCEN,<\/text><text x=\"30\" y=\"182\" fill=\"#c3c9ee\" font-size=\"10.5\">SEC, FTC, and<\/text><text x=\"30\" y=\"198\" fill=\"#c3c9ee\" font-size=\"10.5\">BSA \/ AML rules<\/text>\n <rect x=\"211\" y=\"70\" width=\"185\" height=\"150\" rx=\"14\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.4\"\/>\n <circle cx=\"247\" cy=\"106\" r=\"18\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.4\"\/><g transform=\"translate(238.00,97.00) scale(0.75)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M9 4L3 6v14l6-2 6 2 6-2V4l-6 2-6-2z\"\/><path d=\"M9 4v14M15 6v14\"\/><\/g>\n <text x=\"225\" y=\"146\" fill=\"#1C267A\" font-size=\"12.5\" font-weight=\"800\">State licensing<\/text>\n <text x=\"225\" y=\"166\" fill=\"#5b6178\" font-size=\"10.5\">Money transmitter<\/text><text x=\"225\" y=\"182\" fill=\"#5b6178\" font-size=\"10.5\">licenses in 49<\/text><text x=\"225\" y=\"198\" fill=\"#5b6178\" font-size=\"10.5\">states if you move money<\/text>\n <rect x=\"406\" y=\"70\" width=\"185\" height=\"150\" rx=\"14\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.4\"\/>\n <circle cx=\"442\" cy=\"106\" r=\"18\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.4\"\/><g transform=\"translate(433.00,97.00) scale(0.75)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"9\" r=\"6\"\/><path d=\"M9 13.5L8 21l4-2 4 2-1-7.5\"\/><path d=\"M9.5 9l1.8 1.8L15 7.5\"\/><\/g>\n <text x=\"420\" y=\"146\" fill=\"#1C267A\" font-size=\"12.5\" font-weight=\"800\">Standards<\/text>\n <text x=\"420\" y=\"166\" fill=\"#5b6178\" font-size=\"10.5\">PCI DSS, SOC 2,<\/text><text x=\"420\" y=\"182\" fill=\"#5b6178\" font-size=\"10.5\">and ISO 27001 for<\/text><text x=\"420\" y=\"198\" fill=\"#5b6178\" font-size=\"10.5\">trust and card data<\/text>\n <rect x=\"601\" y=\"70\" width=\"183\" height=\"150\" rx=\"14\" fill=\"#eef7f4\" stroke=\"#0a7d6c\" stroke-width=\"1.4\"\/>\n <circle cx=\"637\" cy=\"106\" r=\"18\" fill=\"#fff\" stroke=\"#0a7d6c\" stroke-width=\"1.4\"\/><g transform=\"translate(628.00,97.00) scale(0.75)\" fill=\"none\" stroke=\"#0a7d6c\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"8\" r=\"4\"\/><path d=\"M4 21a8 8 0 0 1 16 0\"\/><\/g>\n <text x=\"615\" y=\"146\" fill=\"#0a6558\" font-size=\"12.5\" font-weight=\"800\">Privacy and<\/text>\n <text x=\"615\" y=\"164\" fill=\"#0a6558\" font-size=\"12.5\" font-weight=\"800\">consumer<\/text>\n <text x=\"615\" y=\"184\" fill=\"#5b6178\" font-size=\"10.5\">State privacy laws,<\/text><text x=\"615\" y=\"200\" fill=\"#5b6178\" font-size=\"10.5\">GLBA, TILA, ECOA<\/text>\n<\/g><\/svg>\n \n<\/div>\n\n <p>The federal layer brings agency supervision and, critically, a Bank Secrecy Act anti-money-laundering program. The state layer brings money transmitter licensing, required in 49 states if you move or hold customer funds, with Montana the main exception. The standards layer brings PCI DSS for card data and SOC 2 or ISO 27001 for enterprise and bank-sponsor trust. The privacy and consumer layer brings state privacy laws, the Gramm-Leach-Bliley Act for financial data, and lending laws like TILA and ECOA. Together these are the full span of the obligations, and no single product triggers all of them.<\/p>\n\n <div class=\"bbox teal\"><div class=\"bt\">There is no single fintech license<\/div>The requirements are driven by what your product does, not a fixed checklist. Move or hold money, and licensing plus AML apply. Handle card data, and PCI DSS enters. Extend credit, and federal lending laws apply. Map your product’s activities first, then the requirements follow.<\/div>\n\n <h2 class=\"sec c-apri\" id=\"frameworks\">The frameworks that may apply<\/h2>\n <p>Translate the four layers into concrete frameworks and the picture becomes a short, product-specific list rather than an intimidating wall of acronyms.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#1C267A;margin-bottom:6px;text-align:left\">The frameworks<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">What may apply to your fintech<\/div>\n <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">Put the layers together and a recognisable set of frameworks makes up the fintech compliance requirements you could face. Few fintechs need every one, the trigger is your specific product.<\/div>\n <svg viewBox=\"0 0 800 356\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"The frameworks a US fintech startup may need\"><text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">The frameworks a US fintech may need<\/text><rect x=\"16\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><circle cx=\"136\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><g transform=\"translate(126.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"9\" r=\"6\"\/><path d=\"M9 13.5L8 21l4-2 4 2-1-7.5\"\/><path d=\"M9.5 9l1.8 1.8L15 7.5\"\/><\/g><text x=\"136\" y=\"136\" text-anchor=\"middle\" fill=\"#1C267A\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">SOC 2<\/text><text x=\"136\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Enterprise and bank-sponsor<\/text><text x=\"136\" y=\"173\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">trust<\/text><rect x=\"274\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><circle cx=\"394\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><g transform=\"translate(384.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><rect x=\"3\" y=\"6\" width=\"18\" height=\"12\" rx=\"2\"\/><path d=\"M3 10h18\"\/><\/g><text x=\"394\" y=\"136\" text-anchor=\"middle\" fill=\"#1C267A\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">PCI DSS<\/text><text x=\"394\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">If you handle card data<\/text><rect x=\"532\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><circle cx=\"652\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><g transform=\"translate(642.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"11\" cy=\"11\" r=\"7\"\/><path d=\"M21 21l-4.3-4.3\"\/><\/g><text x=\"652\" y=\"136\" text-anchor=\"middle\" fill=\"#1C267A\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">BSA \/ AML and KYC<\/text><text x=\"652\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Detect and report financial<\/text><text x=\"652\" y=\"173\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">crime<\/text><rect x=\"16\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><circle cx=\"136\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><g transform=\"translate(126.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M9 4L3 6v14l6-2 6 2 6-2V4l-6 2-6-2z\"\/><path d=\"M9 4v14M15 6v14\"\/><\/g><text x=\"136\" y=\"286\" text-anchor=\"middle\" fill=\"#1C267A\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Money transmitter<\/text><text x=\"136\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">A license if you move or hold<\/text><text x=\"136\" y=\"323\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">money<\/text><rect x=\"274\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><circle cx=\"394\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><g transform=\"translate(384.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M4 10h16M5 10l7-5 7 5M6 10v7M10 10v7M14 10v7M18 10v7M4 20h16\"\/><\/g><text x=\"394\" y=\"286\" text-anchor=\"middle\" fill=\"#1C267A\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">GLBA<\/text><text x=\"394\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Safeguards for financial data<\/text><rect x=\"532\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><circle cx=\"652\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><g transform=\"translate(642.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M14 4l6 6-3 3-6-6z\"\/><path d=\"M11 7l-6 6M4 20h9M6.5 15.5l3 3\"\/><\/g><text x=\"652\" y=\"286\" text-anchor=\"middle\" fill=\"#1C267A\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Lending laws<\/text><text x=\"652\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">TILA and ECOA if you extend<\/text><text x=\"652\" y=\"323\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">credit<\/text><\/svg>\n \n<\/div>\n\n <p>SOC 2 earns enterprise and bank-sponsor trust and is what US procurement expects, with Type II the real standard and Type I a stepping stone. PCI DSS applies if you touch card data. A BSA\/AML program with KYC is mandatory if you handle money movement. Money transmitter licensing applies if you move or hold funds. GLBA governs financial data, and TILA and ECOA apply if you lend. Which of these you actually need depends on your product, and the same control work often satisfies several at once, since these frameworks overlap heavily. For the choice between the two trust standards, see our <a href=\"https:\/\/www.osto.one\/resources\/blog\/soc-2-vs-iso-27001-us\/\">SOC 2 vs ISO 27001<\/a> comparison.<\/p>\n\n <h2 class=\"sec c-plum\" id=\"money\">The money layer and the BaaS shortcut<\/h2>\n <p>The heaviest part is the money-movement layer, and how you handle it is one of the biggest early decisions a fintech makes.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#1C267A;margin-bottom:6px;text-align:left\">The money layer<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">License directly, or lean on a sponsor<\/div>\n <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">The heaviest of the fintech compliance requirements is the money layer. There are two ways to handle it, and the choice shapes how much you build yourself.<\/div>\n <svg viewBox=\"0 0 800 236\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"Partner-bank BaaS versus direct money transmitter licensing\">\n<g font-family=\"Inter,Arial,sans-serif\">\n <text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\">Two ways to handle the money layer<\/text>\n <rect x=\"30\" y=\"66\" width=\"350\" height=\"150\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.6\"\/>\n <text x=\"60\" y=\"100\" fill=\"#1C267A\" font-size=\"14\" font-weight=\"800\">Partner-bank \/ BaaS<\/text>\n <line x1=\"60\" y1=\"112\" x2=\"356\" y2=\"112\" stroke=\"#d3d9f2\" stroke-width=\"1\"\/>\n <text x=\"60\" y=\"138\" fill=\"#4a5170\" font-size=\"12\">Operate under a sponsor bank’s<\/text>\n <text x=\"60\" y=\"158\" fill=\"#4a5170\" font-size=\"12\">charter to defer direct licensing.<\/text>\n <text x=\"60\" y=\"182\" fill=\"#2b3596\" font-size=\"12\" font-weight=\"700\">Security and AML duties still apply.<\/text>\n <rect x=\"420\" y=\"66\" width=\"350\" height=\"150\" rx=\"16\" fill=\"#eef7f4\" stroke=\"#0a7d6c\" stroke-width=\"1.6\"\/>\n <text x=\"450\" y=\"100\" fill=\"#0a6558\" font-size=\"14\" font-weight=\"800\">Direct licensing<\/text>\n <line x1=\"450\" y1=\"112\" x2=\"746\" y2=\"112\" stroke=\"#c7e3dc\" stroke-width=\"1\"\/>\n <text x=\"450\" y=\"138\" fill=\"#4a5170\" font-size=\"12\">Obtain money transmitter licenses<\/text>\n <text x=\"450\" y=\"158\" fill=\"#4a5170\" font-size=\"12\">state by state and register with<\/text>\n <text x=\"450\" y=\"182\" fill=\"#0a6558\" font-size=\"12\" font-weight=\"700\">FinCEN. Heavier, but fully your own.<\/text>\n<\/g><\/svg>\n \n<\/div>\n\n <p>Obtaining money transmitter licenses directly means a separate application in each of the 49 states that require one, plus FinCEN registration, a heavy, ongoing lift. That is why many seed-stage fintechs operate under a partner bank’s charter through a Banking-as-a-Service model, which defers direct licensing while they grow.<\/p>\n<p>The important caveat: the partner model does not erase your obligations. You still own transaction monitoring, data protection, consumer disclosures, and the security controls your sponsor bank and enterprise buyers will demand. Operating unlicensed money transmission where a license is required carries serious federal exposure, so this is a decision to make with regulatory counsel, not alone.<\/p>\n\n <h2 class=\"sec c-sky\" id=\"scope\">How to scope your own list<\/h2>\n <p>You do not chase every framework. The fintech compliance requirements that apply to you fall out of a few product questions. Do you move or hold customer money? Then licensing and AML apply. Do you touch card data? Then PCI DSS applies. Do you extend credit? Then TILA and ECOA apply. Do you sell to enterprises or partner with a bank? Then SOC 2 is expected, our guide to <a href=\"https:\/\/www.osto.one\/resources\/blog\/compliance-to-sell-to-enterprises-us\/\">compliance to sell to enterprises<\/a> covers that side. Do you hold personal or financial data? Then state privacy laws and GLBA apply.<\/p>\n<p>Answer those honestly and you have your real, product-specific list, and the sequence: build the security foundation first, then let SOC 2 and the legal obligations document it. A grounding in <a href=\"https:\/\/www.osto.one\/resources\/blog\/soc-2-for-startups\/\">SOC 2 for startups<\/a> is usually where that foundation begins.<\/p>\n\n <h2 class=\"sec c-sage\" id=\"osto\">How Osto helps fintechs get ready<\/h2>\n <p>The security and standards layer, PCI-supporting controls, SOC 2, ISO 27001, vendor risk, and the evidence behind them, is exactly the part a lean fintech struggles to stand up while building product and navigating licensing. Piecing it together from separate tools and consultants is slow and fragile, which is the gap Osto is built to close.<\/p>\n <p>Osto is a one-stop cybersecurity and compliance platform. It automates SOC 2 and ISO 27001 controls and evidence, provides the encryption, access-control, logging, and security-testing controls that underpin PCI DSS and financial-data safeguards, runs VAPT across your apps, APIs, and infrastructure, and pre-fills security questionnaires, all across 200+ frameworks in one place. It gets a fintech genuinely ready for the security side of its compliance requirements and keeps the evidence audit-ready. Osto is the security and readiness layer, it does not issue money transmitter licenses, act as your CPA auditor, or replace regulatory counsel on licensing and AML.<\/p>\n\n <div class=\"callout\">\n <h3>Get the security layer of fintech compliance handled.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving teams. Automate SOC 2 and ISO 27001, cover the controls behind PCI DSS, run VAPT, and answer security questionnaires, on one platform. No security team required.<\/p>\n <a href=\"https:\/\/osto.one\/book-demo\/\" style=\"display:inline-block;background:#1c267a;color:#ffffff;font-weight:700;font-size:15px;padding:14px 26px;border-radius:12px;text-decoration:none;margin-top:6px\" target=\"_blank\" rel=\"noopener\">Book a Demo →<\/a>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>What are the fintech compliance requirements to operate in the US?<\/summary><p>They stack in four layers: federal supervision with BSA\/AML rules, state money transmitter licensing if you move or hold money, industry and buyer standards like PCI DSS and SOC 2, and privacy and consumer laws such as state privacy laws, GLBA, TILA, and ECOA. The exact set depends on what your product does.<\/p><\/details>\n <details><summary>Is there a single federal fintech license?<\/summary><p>No. There is no single fintech license in the US. What you need is driven by your product: move money and licensing plus AML apply, handle card data and PCI DSS applies, extend credit and lending laws apply. The requirements are activity-specific.<\/p><\/details>\n <details><summary>Do fintechs need a money transmitter license?<\/summary><p>If your product holds customer funds, moves money, or issues stored value, very likely yes. As of 2026, 49 states require a money transmitter license, with Montana the main exception, each a separate application. Many early fintechs use a partner-bank model to defer this.<\/p><\/details>\n <details><summary>Does a Banking-as-a-Service model remove compliance obligations?<\/summary><p>No. Operating under a sponsor bank defers direct licensing, but you still own transaction monitoring, AML, data protection, consumer disclosures, and the security controls your sponsor and enterprise buyers require. The obligations move, they do not disappear.<\/p><\/details>\n <details><summary>Do fintechs need SOC 2 and PCI DSS?<\/summary><p>Usually. SOC 2 is expected by US enterprise buyers and bank sponsors, with Type II the real standard. PCI DSS applies whenever you store, process, or transmit card data. Both often run in parallel, and their controls overlap with each other and with ISO 27001.<\/p><\/details>\n <details><summary>Which compliance should a fintech do first?<\/summary><p>Map your product’s activities, then start with what your market demands and your data triggers, usually SOC 2 readiness if you sell in the US, PCI DSS in parallel if you touch card data, and an AML program if you move money. Build the security foundation first and let the rest document it.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>Fintech Compliance Requirements: 4 Essential Layers | Osto Fintech compliance requirements are the steepest of any software vertical, because you\u2026<\/p>\n","protected":false},"author":8,"featured_media":1348,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[727,728,729],"class_list":["post-1347","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-fintech-compliance-requirements","tag-fintech-compliance-us","tag-fintech-regulations-us"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1347","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=1347"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1347\/revisions"}],"predecessor-version":[{"id":1349,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1347\/revisions\/1349"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/1348"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=1347"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=1347"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=1347"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":1347,"date":"2026-09-21T05:00:22","date_gmt":"2026-09-21T05:00:22","guid":{"rendered":"https:\/\/www.osto.one\/resources\/?p=1347"},"modified":"2026-09-21T05:00:22","modified_gmt":"2026-09-21T05:00:22","slug":"fintech-compliance-requirements-us","status":"publish","type":"post","link":"https:\/\/www.osto.one\/resources\/blog\/fintech-compliance-requirements-us\/","title":{"rendered":"Fintech Compliance Requirements to Sell in the US"},"content":{"rendered":"\n\n\n\n\n\nFintech Compliance Requirements: 4 Essential Layers | Osto<\/title>\n<meta name=\"description\" content=\"Fintech compliance requirements in the US explained: SOC 2, PCI DSS, BSA\/AML, money transmitter licenses, GLBA, and how to know which ones apply to you.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n \/* Osto branded comparison table *\/\n .otable{overflow-x:auto;margin:26px 0;border-radius:16px;border:1px solid #e3e6f5;box-shadow:0 10px 34px rgba(28,38,122,.10)}\n table.regtable{border-collapse:separate;border-spacing:0;width:100%;min-width:520px;font-size:14.5px;background:#fff;margin:0}\n table.regtable thead tr,table.regtable tr:first-child{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n table.regtable th,table.regtable tr:first-child td{background:transparent;color:#fff;text-align:left;padding:15px 18px;font-size:13px;font-weight:800;letter-spacing:.03em;border:none}\n table.regtable td{padding:14px 18px;border-bottom:1px solid #eef0f7;vertical-align:top;color:#33384f}\n table.regtable tr:nth-child(even):not(:first-child){background:#f7f9ff}\n table.regtable tr:last-child td{border-bottom:none}\n table.regtable td:first-child{font-weight:700;color:#0e1330}\n table.regtable tr td:first-child{border-right:1px solid #eef0f7}\n table.regtable tr:first-child td:first-child,table.regtable th:first-child{border-right:1px solid rgba(255,255,255,.18)}\n table.regtable tr:first-child td{border-bottom:none}\n\n<\/style>\n<\/head>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">Fintech compliance requirements are the steepest of any software vertical, because you carry a whole regulatory layer other startups never touch. This guide breaks down exactly what a fintech needs to operate and sell in the US, and how to tell which rules apply to your product.<\/p>\n\n <div class=\"meta\"><span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>11 min read<\/span><span class=\"dot\"><\/span><span>Compliance<\/span><\/div>\n\n <div class=\"tldr\">\n <h2>The short answer<\/h2>\n <p>Fintech compliance requirements in the US stack in four layers: federal supervision (CFPB, FinCEN, SEC, FTC, with BSA\/AML rules), state licensing (money transmitter licenses in 49 states if you move or hold money), industry and buyer standards (PCI DSS for card data, SOC 2 and ISO 27001 for trust), and privacy and consumer laws (state privacy laws, GLBA, TILA, ECOA). There is no single fintech license, the exact mix is driven by what your product does with money and data. Many early fintechs use a partner-bank or Banking-as-a-Service model to defer direct licensing, but the security, AML, and data obligations still apply.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#why\">Why fintech is different<\/a><\/li>\n <li><a href=\"#layers\">The four layers<\/a><\/li>\n <li><a href=\"#frameworks\">The frameworks that apply<\/a><\/li>\n <li><a href=\"#money\">The money layer and BaaS<\/a><\/li>\n <li><a href=\"#scope\">How to scope your list<\/a><\/li>\n <li><a href=\"#osto\">How Osto helps fintechs<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec c-sky\" id=\"why\">Why fintech compliance requirements are steeper<\/h2>\n <p>Every US software startup faces some compliance, but a fintech carries an extra dimension: it moves money and holds financial data, which puts it under financial regulators as well as the usual security and privacy rules. That is why fintech compliance is broader and less forgiving than a typical SaaS startup’s, covered in our guide to <a href=\"https:\/\/www.osto.one\/resources\/blog\/saas-compliance-requirements-us\/\">SaaS compliance requirements for selling in the US<\/a>. Getting the architecture wrong early is expensive, because compliance obligations shape your data flows, your licensing, and your partnerships from day one, not after launch.<\/p>\n\n <h2 class=\"sec c-sage\" id=\"layers\">The four layers of fintech compliance requirements<\/h2>\n <p>The single most useful way to understand them is to stop looking for one checklist and see them as four stacked layers. Each layer is triggered independently, so a payments app and a lending app face different combinations.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#1C267A;margin-bottom:6px;text-align:left\">The mental model<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">Four layers, not one checklist<\/div>\n <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">The fintech compliance requirements in the US are not a single list. They stack in four layers at once, and which parts apply depends entirely on what your product does with money and data.<\/div>\n <svg viewBox=\"0 0 800 240\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"The four layers of US fintech compliance requirements\">\n<g font-family=\"Inter,Arial,sans-serif\">\n <text x=\"400\" y=\"30\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\">Fintech compliance is four layers at once<\/text>\n <text x=\"400\" y=\"52\" text-anchor=\"middle\" fill=\"#8a90a6\" font-size=\"11.5\">There is no single fintech license. The mix depends on what you do with money and data.<\/text>\n <rect x=\"16\" y=\"70\" width=\"185\" height=\"150\" rx=\"14\" fill=\"#1c267a\"\/>\n <circle cx=\"52\" cy=\"106\" r=\"18\" fill=\"#2b3596\"\/><g transform=\"translate(43.00,97.00) scale(0.75)\" fill=\"none\" stroke=\"#aeb6ee\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M14 4l6 6-3 3-6-6z\"\/><path d=\"M11 7l-6 6M4 20h9M6.5 15.5l3 3\"\/><\/g>\n <text x=\"30\" y=\"146\" fill=\"#fff\" font-size=\"12.5\" font-weight=\"800\">Federal<\/text>\n <text x=\"30\" y=\"166\" fill=\"#c3c9ee\" font-size=\"10.5\">CFPB, FinCEN,<\/text><text x=\"30\" y=\"182\" fill=\"#c3c9ee\" font-size=\"10.5\">SEC, FTC, and<\/text><text x=\"30\" y=\"198\" fill=\"#c3c9ee\" font-size=\"10.5\">BSA \/ AML rules<\/text>\n <rect x=\"211\" y=\"70\" width=\"185\" height=\"150\" rx=\"14\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.4\"\/>\n <circle cx=\"247\" cy=\"106\" r=\"18\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.4\"\/><g transform=\"translate(238.00,97.00) scale(0.75)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M9 4L3 6v14l6-2 6 2 6-2V4l-6 2-6-2z\"\/><path d=\"M9 4v14M15 6v14\"\/><\/g>\n <text x=\"225\" y=\"146\" fill=\"#1C267A\" font-size=\"12.5\" font-weight=\"800\">State licensing<\/text>\n <text x=\"225\" y=\"166\" fill=\"#5b6178\" font-size=\"10.5\">Money transmitter<\/text><text x=\"225\" y=\"182\" fill=\"#5b6178\" font-size=\"10.5\">licenses in 49<\/text><text x=\"225\" y=\"198\" fill=\"#5b6178\" font-size=\"10.5\">states if you move money<\/text>\n <rect x=\"406\" y=\"70\" width=\"185\" height=\"150\" rx=\"14\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.4\"\/>\n <circle cx=\"442\" cy=\"106\" r=\"18\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.4\"\/><g transform=\"translate(433.00,97.00) scale(0.75)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"9\" r=\"6\"\/><path d=\"M9 13.5L8 21l4-2 4 2-1-7.5\"\/><path d=\"M9.5 9l1.8 1.8L15 7.5\"\/><\/g>\n <text x=\"420\" y=\"146\" fill=\"#1C267A\" font-size=\"12.5\" font-weight=\"800\">Standards<\/text>\n <text x=\"420\" y=\"166\" fill=\"#5b6178\" font-size=\"10.5\">PCI DSS, SOC 2,<\/text><text x=\"420\" y=\"182\" fill=\"#5b6178\" font-size=\"10.5\">and ISO 27001 for<\/text><text x=\"420\" y=\"198\" fill=\"#5b6178\" font-size=\"10.5\">trust and card data<\/text>\n <rect x=\"601\" y=\"70\" width=\"183\" height=\"150\" rx=\"14\" fill=\"#eef7f4\" stroke=\"#0a7d6c\" stroke-width=\"1.4\"\/>\n <circle cx=\"637\" cy=\"106\" r=\"18\" fill=\"#fff\" stroke=\"#0a7d6c\" stroke-width=\"1.4\"\/><g transform=\"translate(628.00,97.00) scale(0.75)\" fill=\"none\" stroke=\"#0a7d6c\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"8\" r=\"4\"\/><path d=\"M4 21a8 8 0 0 1 16 0\"\/><\/g>\n <text x=\"615\" y=\"146\" fill=\"#0a6558\" font-size=\"12.5\" font-weight=\"800\">Privacy and<\/text>\n <text x=\"615\" y=\"164\" fill=\"#0a6558\" font-size=\"12.5\" font-weight=\"800\">consumer<\/text>\n <text x=\"615\" y=\"184\" fill=\"#5b6178\" font-size=\"10.5\">State privacy laws,<\/text><text x=\"615\" y=\"200\" fill=\"#5b6178\" font-size=\"10.5\">GLBA, TILA, ECOA<\/text>\n<\/g><\/svg>\n \n<\/div>\n\n <p>The federal layer brings agency supervision and, critically, a Bank Secrecy Act anti-money-laundering program. The state layer brings money transmitter licensing, required in 49 states if you move or hold customer funds, with Montana the main exception. The standards layer brings PCI DSS for card data and SOC 2 or ISO 27001 for enterprise and bank-sponsor trust. The privacy and consumer layer brings state privacy laws, the Gramm-Leach-Bliley Act for financial data, and lending laws like TILA and ECOA. Together these are the full span of the obligations, and no single product triggers all of them.<\/p>\n\n <div class=\"bbox teal\"><div class=\"bt\">There is no single fintech license<\/div>The requirements are driven by what your product does, not a fixed checklist. Move or hold money, and licensing plus AML apply. Handle card data, and PCI DSS enters. Extend credit, and federal lending laws apply. Map your product’s activities first, then the requirements follow.<\/div>\n\n <h2 class=\"sec c-apri\" id=\"frameworks\">The frameworks that may apply<\/h2>\n <p>Translate the four layers into concrete frameworks and the picture becomes a short, product-specific list rather than an intimidating wall of acronyms.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#1C267A;margin-bottom:6px;text-align:left\">The frameworks<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">What may apply to your fintech<\/div>\n <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">Put the layers together and a recognisable set of frameworks makes up the fintech compliance requirements you could face. Few fintechs need every one, the trigger is your specific product.<\/div>\n <svg viewBox=\"0 0 800 356\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"The frameworks a US fintech startup may need\"><text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">The frameworks a US fintech may need<\/text><rect x=\"16\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><circle cx=\"136\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><g transform=\"translate(126.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"12\" cy=\"9\" r=\"6\"\/><path d=\"M9 13.5L8 21l4-2 4 2-1-7.5\"\/><path d=\"M9.5 9l1.8 1.8L15 7.5\"\/><\/g><text x=\"136\" y=\"136\" text-anchor=\"middle\" fill=\"#1C267A\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">SOC 2<\/text><text x=\"136\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Enterprise and bank-sponsor<\/text><text x=\"136\" y=\"173\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">trust<\/text><rect x=\"274\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><circle cx=\"394\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><g transform=\"translate(384.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><rect x=\"3\" y=\"6\" width=\"18\" height=\"12\" rx=\"2\"\/><path d=\"M3 10h18\"\/><\/g><text x=\"394\" y=\"136\" text-anchor=\"middle\" fill=\"#1C267A\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">PCI DSS<\/text><text x=\"394\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">If you handle card data<\/text><rect x=\"532\" y=\"58\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><circle cx=\"652\" cy=\"92\" r=\"20\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><g transform=\"translate(642.16,82.16) scale(0.82)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><circle cx=\"11\" cy=\"11\" r=\"7\"\/><path d=\"M21 21l-4.3-4.3\"\/><\/g><text x=\"652\" y=\"136\" text-anchor=\"middle\" fill=\"#1C267A\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">BSA \/ AML and KYC<\/text><text x=\"652\" y=\"158\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Detect and report financial<\/text><text x=\"652\" y=\"173\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">crime<\/text><rect x=\"16\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><circle cx=\"136\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><g transform=\"translate(126.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M9 4L3 6v14l6-2 6 2 6-2V4l-6 2-6-2z\"\/><path d=\"M9 4v14M15 6v14\"\/><\/g><text x=\"136\" y=\"286\" text-anchor=\"middle\" fill=\"#1C267A\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Money transmitter<\/text><text x=\"136\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">A license if you move or hold<\/text><text x=\"136\" y=\"323\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">money<\/text><rect x=\"274\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><circle cx=\"394\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><g transform=\"translate(384.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M4 10h16M5 10l7-5 7 5M6 10v7M10 10v7M14 10v7M18 10v7M4 20h16\"\/><\/g><text x=\"394\" y=\"286\" text-anchor=\"middle\" fill=\"#1C267A\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">GLBA<\/text><text x=\"394\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">Safeguards for financial data<\/text><rect x=\"532\" y=\"208\" width=\"240\" height=\"132\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><circle cx=\"652\" cy=\"242\" r=\"20\" fill=\"#fff\" stroke=\"#1C267A\" stroke-width=\"1.5\"\/><g transform=\"translate(642.16,232.16) scale(0.82)\" fill=\"none\" stroke=\"#1C267A\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"><path d=\"M14 4l6 6-3 3-6-6z\"\/><path d=\"M11 7l-6 6M4 20h9M6.5 15.5l3 3\"\/><\/g><text x=\"652\" y=\"286\" text-anchor=\"middle\" fill=\"#1C267A\" font-size=\"13\" font-weight=\"800\" font-family=\"Inter,Arial,sans-serif\">Lending laws<\/text><text x=\"652\" y=\"308\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">TILA and ECOA if you extend<\/text><text x=\"652\" y=\"323\" text-anchor=\"middle\" fill=\"#5b6178\" font-size=\"11\" font-family=\"Inter,Arial,sans-serif\">credit<\/text><\/svg>\n \n<\/div>\n\n <p>SOC 2 earns enterprise and bank-sponsor trust and is what US procurement expects, with Type II the real standard and Type I a stepping stone. PCI DSS applies if you touch card data. A BSA\/AML program with KYC is mandatory if you handle money movement. Money transmitter licensing applies if you move or hold funds. GLBA governs financial data, and TILA and ECOA apply if you lend. Which of these you actually need depends on your product, and the same control work often satisfies several at once, since these frameworks overlap heavily. For the choice between the two trust standards, see our <a href=\"https:\/\/www.osto.one\/resources\/blog\/soc-2-vs-iso-27001-us\/\">SOC 2 vs ISO 27001<\/a> comparison.<\/p>\n\n <h2 class=\"sec c-plum\" id=\"money\">The money layer and the BaaS shortcut<\/h2>\n <p>The heaviest part is the money-movement layer, and how you handle it is one of the biggest early decisions a fintech makes.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:30px 32px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#1C267A;margin-bottom:6px;text-align:left\">The money layer<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:8px;text-align:left\">License directly, or lean on a sponsor<\/div>\n <div style=\"font-size:14px;line-height:1.7;color:#5b6178;margin-bottom:24px;text-align:left\">The heaviest of the fintech compliance requirements is the money layer. There are two ways to handle it, and the choice shapes how much you build yourself.<\/div>\n <svg viewBox=\"0 0 800 236\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"Partner-bank BaaS versus direct money transmitter licensing\">\n<g font-family=\"Inter,Arial,sans-serif\">\n <text x=\"400\" y=\"34\" text-anchor=\"middle\" fill=\"#0e1330\" font-size=\"16\" font-weight=\"800\">Two ways to handle the money layer<\/text>\n <rect x=\"30\" y=\"66\" width=\"350\" height=\"150\" rx=\"16\" fill=\"#eef1fb\" stroke=\"#1C267A\" stroke-width=\"1.6\"\/>\n <text x=\"60\" y=\"100\" fill=\"#1C267A\" font-size=\"14\" font-weight=\"800\">Partner-bank \/ BaaS<\/text>\n <line x1=\"60\" y1=\"112\" x2=\"356\" y2=\"112\" stroke=\"#d3d9f2\" stroke-width=\"1\"\/>\n <text x=\"60\" y=\"138\" fill=\"#4a5170\" font-size=\"12\">Operate under a sponsor bank’s<\/text>\n <text x=\"60\" y=\"158\" fill=\"#4a5170\" font-size=\"12\">charter to defer direct licensing.<\/text>\n <text x=\"60\" y=\"182\" fill=\"#2b3596\" font-size=\"12\" font-weight=\"700\">Security and AML duties still apply.<\/text>\n <rect x=\"420\" y=\"66\" width=\"350\" height=\"150\" rx=\"16\" fill=\"#eef7f4\" stroke=\"#0a7d6c\" stroke-width=\"1.6\"\/>\n <text x=\"450\" y=\"100\" fill=\"#0a6558\" font-size=\"14\" font-weight=\"800\">Direct licensing<\/text>\n <line x1=\"450\" y1=\"112\" x2=\"746\" y2=\"112\" stroke=\"#c7e3dc\" stroke-width=\"1\"\/>\n <text x=\"450\" y=\"138\" fill=\"#4a5170\" font-size=\"12\">Obtain money transmitter licenses<\/text>\n <text x=\"450\" y=\"158\" fill=\"#4a5170\" font-size=\"12\">state by state and register with<\/text>\n <text x=\"450\" y=\"182\" fill=\"#0a6558\" font-size=\"12\" font-weight=\"700\">FinCEN. Heavier, but fully your own.<\/text>\n<\/g><\/svg>\n \n<\/div>\n\n <p>Obtaining money transmitter licenses directly means a separate application in each of the 49 states that require one, plus FinCEN registration, a heavy, ongoing lift. That is why many seed-stage fintechs operate under a partner bank’s charter through a Banking-as-a-Service model, which defers direct licensing while they grow.<\/p>\n<p>The important caveat: the partner model does not erase your obligations. You still own transaction monitoring, data protection, consumer disclosures, and the security controls your sponsor bank and enterprise buyers will demand. Operating unlicensed money transmission where a license is required carries serious federal exposure, so this is a decision to make with regulatory counsel, not alone.<\/p>\n\n <h2 class=\"sec c-sky\" id=\"scope\">How to scope your own list<\/h2>\n <p>You do not chase every framework. The fintech compliance requirements that apply to you fall out of a few product questions. Do you move or hold customer money? Then licensing and AML apply. Do you touch card data? Then PCI DSS applies. Do you extend credit? Then TILA and ECOA apply. Do you sell to enterprises or partner with a bank? Then SOC 2 is expected, our guide to <a href=\"https:\/\/www.osto.one\/resources\/blog\/compliance-to-sell-to-enterprises-us\/\">compliance to sell to enterprises<\/a> covers that side. Do you hold personal or financial data? Then state privacy laws and GLBA apply.<\/p>\n<p>Answer those honestly and you have your real, product-specific list, and the sequence: build the security foundation first, then let SOC 2 and the legal obligations document it. A grounding in <a href=\"https:\/\/www.osto.one\/resources\/blog\/soc-2-for-startups\/\">SOC 2 for startups<\/a> is usually where that foundation begins.<\/p>\n\n <h2 class=\"sec c-sage\" id=\"osto\">How Osto helps fintechs get ready<\/h2>\n <p>The security and standards layer, PCI-supporting controls, SOC 2, ISO 27001, vendor risk, and the evidence behind them, is exactly the part a lean fintech struggles to stand up while building product and navigating licensing. Piecing it together from separate tools and consultants is slow and fragile, which is the gap Osto is built to close.<\/p>\n <p>Osto is a one-stop cybersecurity and compliance platform. It automates SOC 2 and ISO 27001 controls and evidence, provides the encryption, access-control, logging, and security-testing controls that underpin PCI DSS and financial-data safeguards, runs VAPT across your apps, APIs, and infrastructure, and pre-fills security questionnaires, all across 200+ frameworks in one place. It gets a fintech genuinely ready for the security side of its compliance requirements and keeps the evidence audit-ready. Osto is the security and readiness layer, it does not issue money transmitter licenses, act as your CPA auditor, or replace regulatory counsel on licensing and AML.<\/p>\n\n <div class=\"callout\">\n <h3>Get the security layer of fintech compliance handled.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving teams. Automate SOC 2 and ISO 27001, cover the controls behind PCI DSS, run VAPT, and answer security questionnaires, on one platform. No security team required.<\/p>\n <a href=\"https:\/\/osto.one\/book-demo\/\" style=\"display:inline-block;background:#1c267a;color:#ffffff;font-weight:700;font-size:15px;padding:14px 26px;border-radius:12px;text-decoration:none;margin-top:6px\" target=\"_blank\" rel=\"noopener\">Book a Demo →<\/a>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>What are the fintech compliance requirements to operate in the US?<\/summary><p>They stack in four layers: federal supervision with BSA\/AML rules, state money transmitter licensing if you move or hold money, industry and buyer standards like PCI DSS and SOC 2, and privacy and consumer laws such as state privacy laws, GLBA, TILA, and ECOA. The exact set depends on what your product does.<\/p><\/details>\n <details><summary>Is there a single federal fintech license?<\/summary><p>No. There is no single fintech license in the US. What you need is driven by your product: move money and licensing plus AML apply, handle card data and PCI DSS applies, extend credit and lending laws apply. The requirements are activity-specific.<\/p><\/details>\n <details><summary>Do fintechs need a money transmitter license?<\/summary><p>If your product holds customer funds, moves money, or issues stored value, very likely yes. As of 2026, 49 states require a money transmitter license, with Montana the main exception, each a separate application. Many early fintechs use a partner-bank model to defer this.<\/p><\/details>\n <details><summary>Does a Banking-as-a-Service model remove compliance obligations?<\/summary><p>No. Operating under a sponsor bank defers direct licensing, but you still own transaction monitoring, AML, data protection, consumer disclosures, and the security controls your sponsor and enterprise buyers require. The obligations move, they do not disappear.<\/p><\/details>\n <details><summary>Do fintechs need SOC 2 and PCI DSS?<\/summary><p>Usually. SOC 2 is expected by US enterprise buyers and bank sponsors, with Type II the real standard. PCI DSS applies whenever you store, process, or transmit card data. Both often run in parallel, and their controls overlap with each other and with ISO 27001.<\/p><\/details>\n <details><summary>Which compliance should a fintech do first?<\/summary><p>Map your product’s activities, then start with what your market demands and your data triggers, usually SOC 2 readiness if you sell in the US, PCI DSS in parallel if you touch card data, and an AML program if you move money. Build the security foundation first and let the rest document it.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>Fintech Compliance Requirements: 4 Essential Layers | Osto Fintech compliance requirements are the steepest of any software vertical, because you\u2026<\/p>\n","protected":false},"author":8,"featured_media":1348,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[727,728,729],"class_list":["post-1347","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-fintech-compliance-requirements","tag-fintech-compliance-us","tag-fintech-regulations-us"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1347","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=1347"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1347\/revisions"}],"predecessor-version":[{"id":1349,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/1347\/revisions\/1349"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/1348"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=1347"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=1347"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=1347"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}