Reading a fintech's compliance stack like a regulator would
# Reading a fintech's compliance stack like a regulator would
In 2021, German payments company Wirecard collapsed after admitting €1.9 billion on its balance sheet did not exist. For years its auditors, investors, and even some regulators had accepted glossy compliance disclosures at face value. Nobody had actually opened the hood. This lesson teaches you to open the hood.
Why this matters more than a slick dashboard
Every fintech now shows you a "trust and safety" page: badges, certifications, a paragraph about "bank-grade security." That page tells you almost nothing about whether the compliance program actually works. A regulator, or a serious investor doing due diligence, ignores the marketing and asks three questions: what's the legal obligation, what's the actual control, and what's the evidence it runs continuously.
The three pillars, defined
KYC (Know Your Customer): the process of verifying a customer's identity before onboarding them, required under anti-money-laundering law. For a business customer it's called KYB (Know Your Business), which includes verifying beneficial owners, i.e. the real humans who ultimately own or control the entity (typically anyone with 25%+ ownership under US and EU rules).
AML transaction monitoring: ongoing surveillance of payment flows to detect patterns consistent with money laundering, such as structuring (breaking large transfers into smaller ones to avoid reporting thresholds) or rapid pass-through of funds.
Sanctions screening: checking customers and transactions against government-maintained lists of prohibited individuals, entities, and countries, such as OFAC's Specially Designated Nationals list in the US, or the EU's consolidated sanctions list.
The regulatory architecture, by jurisdiction
United States: the Bank Secrecy Act (1970) is the foundational AML law, enforced through FinCEN (Financial Crimes Enforcement Network), a bureau of the Treasury. FinCEN requires Suspicious Activity Reports (SARs) for flagged transactions and Currency Transaction Reports (CTRs) for cash transactions over $10,000. OFAC enforces sanctions. Most fintechs don't hold a banking charter themselves; they operate through a "bank-sponsor" or "banking-as-a-service" arrangement with a chartered bank (examples: Cross River Bank, Column Bank), and that sponsor bank is ultimately on the hook with its regulator, whether the OCC (Office of the Comptroller of the Currency), the Fed, or the FDIC.
European Union: the anti-money-laundering framework runs through a series of directives, most recently AMLD5 and AMLD6, soon consolidated under the new AMLR (Anti-Money Laundering Regulation) and a new supervisory body, AMLA (Anti-Money Laundering Authority), which becomes operational from 2025 to 2026 and will directly supervise the highest-risk cross-border financial institutions. Payment institutions are licensed under PSD2 (the second Payment Services Directive) and supervised nationally: the FCA in the UK (post-Brexit, outside AMLA's scope), BaFin in Germany, the Banque de France/ACPR in France.
This structural fact matters: in the US, compliance risk is often outsourced up to a sponsor bank; in the EU, the licensed fintech itself typically carries direct regulatory liability. When you evaluate a fintech, always ask: who actually holds the license, and who answers to the regulator if something breaks?
What "real infrastructure" looks like in practice
Take a payments company onboarding a small e-commerce merchant. A thin compliance layer does this:
Collects a government ID and a selfie, calls a vendor APIAPIApplication Programming Interface: a standardised interface that lets applications communicate and exchange data without knowing each other's internal workings.Voir la définition complète → (e.g. Jumio, Onfido), gets a "pass," moves on.
Runs a one-time sanctions check at onboarding, never again.
Has a rules engine that flags transactions over a round-number threshold, generating alerts nobody reviews within regulatory timeframes.
Real infrastructure looks different:
KYB includes verifying the business registration, checking beneficial ownership through corporate registries, and assigning a risk rating (low/medium/high) that determines onboarding depth and ongoing review frequency.
Sanctions screening runs at onboarding and on every transaction, because sanctions lists update in real time (Russia-related designations after February 2022 added thousands of names within weeks) and a customer clean at signup can appear on a list a month later.
Transaction monitoring uses behavioral baselines, not just static thresholds: a merchant that suddenly processes 10x its typical volume, or a consumer account that receives funds from 40 unrelated senders in a week, triggers a case for a human analyst, not just a rule.
SARs are actually filed. In the US in fiscal year 2023, FinCEN received over 4.6 million SARs (FinCEN estimate, publicly reported); a fintech processing meaningful volume that files zero SARs per year is a red flag, not a sign of clean customers.
A simple monitoring rule, illustrated
Here's a stripped-down version of a structuring-detection rule, the kind an analyst reviews in a compliance system:
IF sum(transactions, customer_id, rolling_24h) > $9,000
AND count(transactions, customer_id, rolling_24h) >= 3
AND each_transaction < $10,000
THEN flag_case("possible structuring", risk_score += 25)
This isn't the whole system, real ones weigh dozens of variables and use machine learning models trained on historical SAR outcomes, but it shows the core logic: look for behavior *shaped* to dodge a known reporting threshold, not just big numbers.
Due diligence checklist: what to actually ask
If you're evaluating a fintech (as an investor, partner, or new hire), don't accept "we're compliant." Ask for:
1. Who is the licensed entity and who is the sponsor bank/regulator? Get the actual name, not "a top-tier banking partner."
2. SAR/case volume trends over 12 to 24 months. Flat-zero or wildly erratic numbers both signal problems.
3. Last regulatory exam results. In the US, sponsor banks undergo BSA/AML exams; findings often surface in consent orders, which are public. (See FinCEN's enforcement actions page for real examples.)
4. Staffing ratio: how many compliance analysts per million transactions or per active customer. A two-person compliance team at a company processing millions of transactions monthly is a thin layer.
5. Vendor dependency: is screening run through a reputable, auditable vendor (Refinitiv World-Check, ComplyAdvantage, LexisNexis) with logged decisions, or through an ad hoc internal list nobody updates?
Vérification des acquis
1. What is the core lesson of the Wirecard collapse for someone evaluating a fintech's compliance program?
2. A fintech onboards a corporate client. Under standard KYB requirements, which individuals must specifically be identified as beneficial owners?
3. Why does a regulator ask 'what's the evidence it runs continuously' rather than just confirming a control exists on paper?
CHOIX MULTIPLES
4. Select ALL correct answers about AML transaction monitoring and sanctions screening as distinct compliance functions.
Sélectionnez toutes les réponses correctes.
CHOIX MULTIPLES
5. Select ALL correct answers about the three questions a regulator or serious investor asks when evaluating a fintech's compliance stack.
Sélectionnez toutes les réponses correctes.
The main risks when the stack is thin
Regulatory risk: consent orders, fines, or loss of banking-as-a-service access. Real precedent: in 2024, the US Federal Reserve and FDIC took enforcement action against banking partners in the BaaS space over BSA/AML deficiencies tied to fintech partners, and several fintech-bank partnerships (including the widely reported Synapse-related banking disruption) unwound in 2024, freezing customer funds for weeks.
Reputational and counterparty risk: card networks (Visa, Mastercard) and correspondent banks can terminate relationships with fintechs seen as high-risk, cutting off payment rails entirely.
Fraud losses masquerading as "manageable risk": weak monitoring lets bad actors (synthetic identities, money mules) operate longer, increasing direct loss and SAR backlog.
Concentration risk in outsourcing: relying entirely on one KYC vendor or one sponsor bank means a single point of failure, as seen when Synapse's bankruptcy in 2024 disrupted fintechs like Yotta that relied on it for ledger and banking infrastructure.
Key Takeaways
Compliance quality is judged by continuous, evidenced controls, not onboarding checkboxes: real programs monitor transactions and re-screen sanctions on an ongoing basis, not just at signup.
Know the legal architecture: in the US, sponsor banks (regulated by the OCC, Fed, or FDIC, under FinCEN's BSA framework) often carry primary AML liability for fintech partners; in the EU, the licensed payment institution typically carries it directly, soon under the new AMLA.
Zero or wildly inconsistent SAR filings, thin compliance staffing relative to transaction volume, and single-vendor dependency are concrete red flags in due diligence.
Public enforcement actions (FinCEN, OCC, Fed, FCA) are free, verifiable evidence of how a compliance program actually performed under scrutiny, use them before trusting a company's own claims.
The 2024 unwinding of several BaaS partnerships is a live case study: thin compliance and infrastructure dependency can freeze customer funds and end business relationships almost overnight.