3.2 Licensing, Registration, Charters, and Regulatory Sandboxes
Key Takeaways
FinTech regulation is activity-based: the services performed, not the brand or technology, determine the licence and the AML duties.
In the United States, money transmitters register with FinCEN as MSBs and also need state licences, while banks hold federal or state charters.
EU and UK e-money and payment institutions are licensed separately from banks and must safeguard customer funds instead of lending them.
The UK FCA and MAS launched regulatory sandboxes in 2016; a sandbox relaxes some rules under conditions but does not suspend AML/CFT obligations.
CAFCA sub-topic 1.3 asks you to explain the regulatory principles that apply to different FinTech business models: registration, licensing and banking charters. It also asks how AML requirements differ between models and why sandboxes exist. Exam questions usually describe a product and ask which permission or obligation applies, or whether a proposed shortcut is lawful.
Principle 1: regulation follows the activity
Regulators look at what the firm actually does. Holding deposits, moving money for others, issuing stored value, safekeeping or exchanging crypto-assets, lending, and arranging investments are each regulated activities. A firm can perform several activities at once. Marketing labels such as "we are just software", "decentralised" or "a platform" do not change the analysis.
Main routes to market
| Model | United States | EU / UK | AML/CFT obligations come from |
|---|---|---|---|
| Own banking licence | National charter (OCC) or state charter, with FDIC insurance and a Federal Reserve or state supervisor | Credit institution authorisation (in the UK, PRA and FCA) | Full bank AML programme: CIP, CDD and beneficial ownership, SARs, sanctions |
| Partner-bank (BaaS) model | No licence for the FinTech's banking products; the partner bank holds the charter | Agent or distributor arrangements with a licensed institution | Mostly the partner's programme, delegated by contract (Chapters 2 and 17) |
| Money transmission / payments | FinCEN MSB registration plus state money transmitter licences | Payment institution (EU PSD2; UK Payment Services Regulations 2017) | Firm's own AML programme as an MSB or obliged entity |
| E-money | Usually money transmission or prepaid access under state law | E-money institution (EU EMD2; UK Electronic Money Regulations 2011) | Firm's own programme, plus safeguarding of customer funds |
| Crypto-assets | MSB registration, state licences (for example the New York BitLicense or a limited purpose trust charter) | MiCA CASP authorisation (EU); FCA AML registration for cryptoasset firms (UK) | Firm's own programme, including the Travel Rule |
| Lending / BNPL | State lending licences or partner-bank origination | Consumer credit authorisation | Varies; partner banks often impose their programme |
Three exam points follow from this table:
- Registration is not licensing. FinCEN MSB registration is a federal registration. It is not a licence and it does not replace state licences. In the US, nearly every state licenses money transmitters, and the CSBS Money Transmission Modernization Act model law (2021) is gradually standardising those rules.
- E-money and payment institutions are not banks. They cannot take deposits or lend out customer balances. They must safeguard customer funds, usually in segregated accounts or with an insurance or guarantee arrangement. That is why "your money is FDIC/FSCS protected" claims from non-banks are a classic misrepresentation risk.
- AML requirements differ by model. In the US, the CDD Rule's beneficial ownership requirements apply to banks, broker-dealers, mutual funds and futures firms. MSBs instead have their own AML programme rule (31 CFR 1022.210). Payment processors that meet FinCEN's exemption are not money transmitters at all. In the EU and UK, almost every licensed FinTech is an obliged entity under the same AML rules.
Passporting and cross-border reach
Within the EU, an authorised payment institution, e-money institution or CASP can passport its licence to other member states. A UK firm lost EU passporting rights after Brexit and needs local authorisation. Supervisors still expect AML controls that reflect each host country's risks, so passporting a licence does not passport a risk assessment.
Regulatory sandboxes and innovation hubs
A regulatory sandbox lets a firm test an innovative product with real customers, under close supervisory oversight, within agreed limits. The UK FCA launched the first widely copied sandbox in 2016, and the Monetary Authority of Singapore launched its FinTech Regulatory Sandbox the same year. The Global Financial Innovation Network (GFIN), set up in 2019, coordinates cross-border testing between regulators.
What a sandbox does and does not do:
| A sandbox can | A sandbox cannot |
|---|---|
| Provide restricted or tailored authorisation for a limited test | Waive anti-money laundering, sanctions or counter-terrorist financing laws |
| Cap customer numbers, transaction values or duration | Permit anonymous accounts or skipping customer identification |
| Give informal steers and regulatory feedback | Guarantee a full licence after the test |
| Require consumer disclosures, redress and an exit plan | Protect the firm from enforcement for breaches during the test |
Regulators set eligibility criteria such as genuine innovation, consumer benefit, a real need to test, and readiness to test. They require a test plan with safeguards and a transition or exit strategy. An innovation hub gives informal guidance without live testing. For CAFCA, the key message is that financial crime rules continue to apply inside a sandbox. Supervisors often look more closely at onboarding and monitoring during a test because the product is new.
Realistic exam scenario
A UK start-up plans an e-money wallet with instant international payouts. The founders propose applying to the sandbox so that they can "launch without KYC for the first 5,000 users and add checks later." The compliance lead should explain that a sandbox could restrict scale or provide tailored authorisation, but cannot remove customer due diligence, sanctions screening or reporting duties. The test plan must include CDD, monitoring and a suspicious activity reporting process from day one.
Common exam traps
- "FinCEN registration is enough to operate nationwide." State licensing is separate.
- "Sandbox participants are exempt from AML." They are not.
- "An EMI can lend customer balances like a bank." It must safeguard them.
- "The partner bank model means the FinTech has no AML role." The FinTech performs delegated controls under contract, and the bank remains accountable.
A FinTech registered with FinCEN as a money services business plans to offer domestic money transfers to customers in 30 US states. What else is generally required?
A national bank charter from the OCC before any transfers can be offered
State money transmitter licences where required, on top of FinCEN registration
An exemption letter from the CFPB for each state
Nothing further; FinCEN registration alone authorises money transmission nationwide
Which statement about regulatory sandboxes is accurate?
It can tailor or limit authorisation for a supervised test, but AML/CFT duties still apply
Sandboxes are only available to licensed banks
Sandbox firms may skip customer identification checks for the duration of the test period
Joining a sandbox guarantees a permanent licence at the end of the test
An EU e-money institution receives customer funds in exchange for issuing e-money. What must it do with those funds?
Lend them out to fund growth, in the same way a bank uses deposits
Transfer them to the European Central Bank each night for safekeeping
Safeguard them, for example in segregated accounts or with insurance
Convert them into crypto-assets to improve liquidity and yield for customers
Sections you finish are checked off in the contents.