Reading a fintech's compliance stack like a regulator would

United States: the Bank Secrecy Act (1970) is the foundational AML law, enforced through FinCEN (Financial Crimes Enforcement Network), a bureau of the Treasury. FinCEN requires Suspicious Activity Reports (SARs) for flagged transactions and Currency Transaction Reports (CTRs) for cash transactions over $10,000. OFAC enforces sanctions. Most fintechs don't hold a banking charter themselves; they operate through a "bank-sponsor" or "banking-as-a-service" arrangement with a chartered bank (examples: Cross River Bank, Column Bank), and that sponsor bank is ultimately on the hook with its regulator, whether the OCC (Office of the Comptroller of the Currency), the Fed, or the FDIC.

European Union: the anti-money-laundering framework runs through a series of directives, most recently AMLD5 and AMLD6, soon consolidated under the new AMLR (Anti-Money Laundering Regulation) and a new supervisory body, AMLA (Anti-Money Laundering Authority), which becomes operational from 2025 to 2026 and will directly supervise the highest-risk cross-border financial institutions. Payment institutions are licensed under PSD2 (the second Payment Services Directive) and supervised nationally: the FCA in the UK (post-Brexit, outside AMLA's scope), BaFin in Germany, the Banque de France/ACPR in France.

This structural fact matters: in the US, compliance risk is often outsourced up to a sponsor bank; in the EU, the licensed fintech itself typically carries direct regulatory liability. When you evaluate a fintech, always ask: who actually holds the license, and who answers to the regulator if something breaks?

What "real infrastructure" looks like in practice

Take a payments company onboarding a small e-commerce merchant. A thin compliance layer does this:

• Collects a government ID and a selfie, calls a vendor APIAPIApplication Programming Interface: a standardised interface that lets applications communicate and exchange data without knowing each other's internal workings.View full definition → (e.g. Jumio, Onfido), gets a "pass," moves on.
• Runs a one-time sanctions check at onboarding, never again.
• Has a rules engine that flags transactions over a round-number threshold, generating alerts nobody reviews within regulatory timeframes.

Real infrastructure looks different:

• KYB includes verifying the business registration, checking beneficial ownership through corporate registries, and assigning a risk rating (low/medium/high) that determines onboarding depth and ongoing review frequency.
• Sanctions screening runs at onboarding and on every transaction, because sanctions lists update in real time (Russia-related designations after February 2022 added thousands of names within weeks) and a customer clean at signup can appear on a list a month later.
• Transaction monitoring uses behavioral baselines, not just static thresholds: a merchant that suddenly processes 10x its typical volume, or a consumer account that receives funds from 40 unrelated senders in a week, triggers a case for a human analyst, not just a rule.
• SARs are actually filed. In the US in fiscal year 2023, FinCEN received over 4.6 million SARs (FinCEN estimate, publicly reported); a fintech processing meaningful volume that files zero SARs per year is a red flag, not a sign of clean customers.

A simple monitoring rule, illustrated

Here's a stripped-down version of a structuring-detection rule, the kind an analyst reviews in a compliance system:

This isn't the whole system, real ones weigh dozens of variables and use machine learning models trained on historical SAR outcomes, but it shows the core logic: look for behavior *shaped* to dodge a known reporting threshold, not just big numbers.

Due diligence checklist: what to actually ask

If you're evaluating a fintech (as an investor, partner, or new hire), don't accept "we're compliant." Ask for:

1. Who is the licensed entity and who is the sponsor bank/regulator? Get the actual name, not "a top-tier banking partner."

2. SAR/case volume trends over 12 to 24 months. Flat-zero or wildly erratic numbers both signal problems.

3. Last regulatory exam results. In the US, sponsor banks undergo BSA/AML exams; findings often surface in consent orders, which are public. (See FinCEN's enforcement actions page for real examples.)

4. Staffing ratio: how many compliance analysts per million transactions or per active customer. A two-person compliance team at a company processing millions of transactions monthly is a thin layer.

5. Vendor dependency: is screening run through a reputable, auditable vendor (Refinitiv World-Check, ComplyAdvantage, LexisNexis) with logged decisions, or through an ad hoc internal list nobody updates?

The main risks when the stack is thin

• Regulatory risk: consent orders, fines, or loss of banking-as-a-service access. Real precedent: in 2024, the US Federal Reserve and FDIC took enforcement action against banking partners in the BaaS space over BSA/AML deficiencies tied to fintech partners, and several fintech-bank partnerships (including the widely reported Synapse-related banking disruption) unwound in 2024, freezing customer funds for weeks.
• Reputational and counterparty risk: card networks (Visa, Mastercard) and correspondent banks can terminate relationships with fintechs seen as high-risk, cutting off payment rails entirely.
• Fraud losses masquerading as "manageable risk": weak monitoring lets bad actors (synthetic identities, money mules) operate longer, increasing direct loss and SAR backlog.
• Concentration risk in outsourcing: relying entirely on one KYC vendor or one sponsor bank means a single point of failure, as seen when Synapse's bankruptcy in 2024 disrupted fintechs like Yotta that relied on it for ledger and banking infrastructure.

Key Takeaways

• Compliance quality is judged by continuous, evidenced controls, not onboarding checkboxes: real programs monitor transactions and re-screen sanctions on an ongoing basis, not just at signup.
• Know the legal architecture: in the US, sponsor banks (regulated by the OCC, Fed, or FDIC, under FinCEN's BSA framework) often carry primary AML liability for fintech partners; in the EU, the licensed payment institution typically carries it directly, soon under the new AMLA.
• Zero or wildly inconsistent SAR filings, thin compliance staffing relative to transaction volume, and single-vendor dependency are concrete red flags in due diligence.
• Public enforcement actions (FinCEN, OCC, Fed, FCA) are free, verifiable evidence of how a compliance program actually performed under scrutiny, use them before trusting a company's own claims.
• The 2024 unwinding of several BaaS partnerships is a live case study: thin compliance and infrastructure dependency can freeze customer funds and end business relationships almost overnight.