Corporate and regulatory counsel for the companies moving money, covering licensing, bank partnerships, and payment-rail compliance, structured so the product can launch and scale without outrunning the rules that govern it.
Fintech is a software business sitting on top of a regulated financial system, and the gap between those two worlds is where the legal risk lives. A payments product can be elegant in code and still untenable in law if the flow of funds, the licensing, and the bank relationship were not designed together from the start.
We advise financial-technology and payments companies on the architecture of the product itself: how money moves, who holds it, which licenses or partners that requires, and what the card networks, payment rails, and consumer-protection regimes demand of the flow. Getting that structure right early is what lets a product ship. The alternative surfaces later as a stop-work letter, a stranded license application, or a partner that walks away during diligence.
Payments are also rarely confined to one jurisdiction. A product built for the United States meets a different licensing and e-money regime the moment it crosses a border, and digital-asset rails add a layer of securities and commodities questions on top. We build the corporate and compliance framework with that trajectory in view. Where a matter touches a regulator, we have represented clients in matters before the SEC and the CFTC, always on the company's side of the table.
State money-transmitter licensing and federal money-services-business registration analysis, mapping the flow of funds to determine where a license is required, where an exemption or agent model applies, and how to sequence the applications.
Sponsor-bank, program-manager, and banking-as-a-service agreements that allocate compliance, liability, reserves, and oversight, papered so each party's responsibilities are clear and the program survives partner and regulator diligence.
Card-brand rules, NACHA ACH operating rules, real-time-rail requirements, and PCI obligations, analyzed for a given flow and written into the contractual and compliance framework the product runs on.
Entity selection, product architecture, and flow-of-funds design for wallets, lending, neobanking, embedded finance, and payment platforms, so the corporate form fits the regulatory model the product needs.
Consumer-financial-protection, anti-money-laundering and KYC, and data-privacy requirements that attach to a payments product, including the disclosures, program policies, and diligence that sponsors and regulators expect to see.
Stablecoin, token, and digital-asset payment rails where money-transmission, securities, and commodities questions overlap, handled with the firm's digital-assets team as the regulatory treatment continues to develop.
Receiving funds as the agent of the payee, under a written agreement that makes payment to you payment to the merchant, takes a company outside money transmission in many states, and FinCEN's payment-processor exemption does similar work federally under four conditions. Hold a balance in your own name, or lose the agency agreement, and the exemption goes with it.
Money-transmission licensing in the US is granted one state at a time, each with its own bond, net-worth, and timing requirements. Working through that patchwork is a sequencing project rather than a single filing.
The sponsor bank's examiners read your program as the bank's own, and a consent order against the bank freezes new onboarding with it. The program agreement therefore carries the bank's audit rights, its approval over your marketing and its right to terminate on a compliance finding. Negotiate the cure periods; they keep a finding from becoming a shutdown.
Nacha puts an originator into a review process when unauthorized returns exceed 0.5 percent of its debits or total returns exceed 15 percent, and the card networks run comparable monitoring programs with fines and, at the top tier, loss of the right to accept the brand. Those numbers belong in the product's dashboards from day one.
A money services business registers with FinCEN within 180 days of opening and renews every two years; a state licensee files quarterly call reports through the NMLS and annual audited statements; the AML program needs periodic independent testing. None of it is a one-time filing, and each lapse surfaces in the next partner's diligence.
The GENIUS Act of 2025 created a federal license for payment-stablecoin issuers, with reserves held one-for-one in cash and short-dated Treasuries and a monthly reserve report, and it takes effect no later than January 2027. Issuing is now a licensed business; moving money on a stablecoin rail still runs through state money-transmission law, with the securities and commodities questions on top.
Before a line of product copy is written, we diagram every hop the money makes: who holds it, when, and in whose name. That map determines your classification as a money transmitter, an agent of a payee, or a company outside the perimeter entirely, and it becomes the reference document for every regulator, bank, and network that follows.
License state by state, ride a bank partner's charter, or restructure the product so custody never lands on you. We model all three against your launch timeline and capital, then build the entity stack and agent-of-payee or BaaS architecture to match.
We negotiate the program agreement with your sponsor bank, the card-network registrations, and the NACHA and processor terms as one interlocking set, because the bank's oversight covenants and the networks' rulebooks will govern your product long after signing.
The AML program, consumer disclosures, privacy architecture, and the audit trail your bank partner's examiners will walk through are all in place before launch, then maintained through the continuous diligence a live payments program demands.
In payments, the flow of funds is the law. Draw it correctly once and every regulator reads the same map.
Hart David Carson LLP's fintech and payments practice covers the corporate and regulatory questions a financial-technology company faces as it builds, licenses, and scales a product. The work spans entity and product structuring, money-transmission and licensing analysis, bank and program-manager partnerships, card-network and payment-rail compliance, consumer-financial-protection and privacy requirements, and the financing and commercial agreements that hold a payments business together.
It depends on how money moves through the product. Holding, transmitting, or controlling customer funds can trigger state money-transmission licensing and federal registration as a money services business, while a pure software or agent-of-the-payee model may not. We map the flow of funds early, analyze the licensing exposure state by state, and structure the product so the regulatory burden fits the model.
Many fintech products are delivered through a sponsor bank or a banking-as-a-service program rather than a license the company holds itself. That arrangement lives in a program agreement that allocates compliance, liability, reserves, and oversight between the parties. We negotiate and paper those relationships with the bank, the program manager, and the processor so the responsibilities are clear and the company can meet the diligence its partners and their regulators expect.
Yes. Card-brand rules, NACHA's ACH operating rules, real-time-rail requirements, and PCI obligations all attach to a payments product, and they sit alongside the licensing and bank-partnership layer. We advise on the network and rail rules that apply to a given flow and build the contractual and compliance framework needed to operate within them.
Yes. Where a payments product touches stablecoins, tokens, or other digital assets, the money-transmission, securities, and commodities questions overlap, and the regulatory treatment is still developing. We work with the firm's digital-assets team, and we have represented clients in matters before the SEC and the CFTC. Our role in those matters is to represent the company before the agency.
Yes. A product built for the United States meets a different perimeter at the border. In the EU and the UK, payment and e-money institutions are licensed under the payment-services regimes and must safeguard customer funds in segregated accounts; a license from one EU member state passports across the others, and since 2020 the UK's no longer does. The firm's offices in London and Dubai operate through partner firms, and locally admitted counsel in the partner network handle the local license while we keep the group structure and the flow of funds consistent across markets.
Buy-side and sell-side transactions for technology and financial-services companies, with diligence, deal structuring, and negotiation when a fintech is acquiring, being acquired, or consolidating.
Explore →Board structure, fiduciary duty, and federal and state securities compliance for companies whose products and financings sit inside an evolving regulatory perimeter.
Explore →SPAC, direct-listing, and alternative-route counsel for high-growth companies, covering structuring, disclosure, and governance on the path to public markets.
Explore →Reviewed by Jonathan D. Herpy, Sr., Senior Partner · Last updated October 2026 · Educational overview · Not legal advice
One partner is accountable for the whole matter, and you have that partner's direct line. Chicago, London, and Dubai work to the same standard.