Fintech Guide to Building a Compliance Program | Lithic

Fintech Guide to Building a Compliance Program

June 10, 2022

Matt Janiga
General Counsel and Compliance Officer

Compliance can feel like a black box to many fintech operators, so the idea of building a compliance program from scratch can seem daunting. But it doesn’t have to be so hard.

In this guide, we explain how to approach building a compliance program.

For a deeper dive on compliance, check out these resources:

If you need access to quality legal templates, visit our Legal Library.

Founder TL;DR

Why are compliance programs important for fintech?

Fintech companies build applications and services on top of regulated financial institutions, mainly banks. To access key infrastructure — ACH rails, payment card BINs from Visa and Mastercard, correspondent accounts for cross-border payments — a fintech will need to pass its key partner’s diligence processes and demonstrate it has sufficient controls.

Compliance programs, along with finance and technical controls (often demonstrated via the SOC process), help assuage partner concerns and open the door for fintechs to access key banking services and payment functions.

Compliance program basics

The topic of compliance can be daunting to founders, but experienced business professionals and engineers shouldn’t be discouraged. That’s because compliance on any topic — whether money laundering, sanctions, or consumer compliance — can be reduced to a few key tasks:

When broken down into these functional areas, compliance looks similar to launching products with a sound QA and testing function, what security professionals might regularly do to protect your customer data, or even akin to the types of financial controls your CFO or Controller might implement.

Identifying and Documenting Compliance Risks

The first step in building your compliance program is to document the key risks you need to control. If you are working with a BaaS provider or banking partner, you should ask if they have a compliance policy or guidance for program managers.

For example, many bank partners (including Lithic’s) have a guide detailing the requirements they expect fintech partners to comply with. You can often use these documents to cover the need to identify compliance risks and also do the next step (design compliance controls).

Third parties, whether law firms, consultants, or founder communities on Slack and Discord, can also be helpful and may have guides or precedents for you to leverage. If you are larger and have some budget, we generally recommend you hire compliance consultants.

Designing Compliance Controls

Your controls should be commensurate with your risks and resources. Smaller companies with nascent products should focus on the basics. See below for a few types of controls.

Diligence at or before account opening

Depending on your product type, this control could be done manually (e.g., employees reviewing applicants’ corporate documents for B2B payments products, verifying photo IDs, running negative news checks). Or if you have some engineering resources or are expecting to scale, you can integrate with a vendor and conduct diligence programmatically.

Verification of customer information

It’s one thing to collect information, but it’s another to verify it. There is a lot of PII available for sale on the dark web, and there are an increasing number of synthetic identities that have been constructed and seasoned just for fraud purposes. Verifying customer information is often a key control, including verifying the customer is age 18 or older and also not deceased (fraudsters love to steal dead people’s social security numbers).

For guidance on how to build an AML customer verification function, check out our KYC/KYB Operations Guide.

Monitoring of customer activity

Reviewing transactions and product activity for fraudulent and unusual activity can help you identify bad actors, and help your financial partners satisfy their financial crimes intelligence obligations.

Re-screening of customers

Customers can periodically turn into bad actors, whether for fraudulent or other purposes like sanctions. Periodically re-screening your customers lets you review for bad actors who have otherwise slipped by your other controls or have turned bad after onboarding.

Monitoring for complaints and negative news

If you are in the B2C space, sometimes one of the best compliance controls is to monitor for what your customers are saying about your company/product (or your customers for B2B contexts) online. As fintech veterans know, customers are quick to reach you on social and email channels when something is wrong with your product.

Documenting Compliance Risks and Controls

Once you have identified your risks and corresponding controls, start documenting your program. Most compliance programs rely on a set of key documents, which can be adapted to the underlying law (e.g., AML compliance, consumer lending compliance, etc.).

Here are a few things we recommend documenting.

Risk assessment

A risk assessment is a document that memorializes the risks posed by your products, markets, and customers. It also likely documents a high-level overview of your controls. One example is an AML risk assessment, but more mature companies may have an enterprise-wide risk assessment that covers more topics. Risk assessments identify the risks your company should consider, while the below documents lay out how you’ll deal with them.

Policies

Policies are documents that explain a key subject matter area, which internal employees are responsible for maintaining controls, and how the company plans to address risks and requirements on the topic. You can access sample policies and templates in our Lithic Legal Library.

Procedures

Procedures are where you document repeatable steps and expectations for operational staff to use when combating the various risks identified in your risk assessment. For example, your KYC procedure might speak to how staff are supposed to review mismatching vendor information or verify a photo ID.

Playbooks and Macros

Sometimes operational staff will need further guidance. You might develop short playbooks to document decision trees or create macros and canned responses that staff can quickly copy and paste to respond to routine inquiries and tasks.

Operating Compliance Controls

You’ll eventually need staff to operate your compliance program. But if you’re small and pre-product-market-fit, most companies your size start by tasking a business person to manage compliance operations. This will often entail setting up your initial policies and procedures, working with vendors, and annually updating policy and procedure documents to keep up with your operations.

Testing of Compliance Controls

Compliance professionals could make great teachers because they love testing! More seriously, every good program will need to be periodically tested to ensure it's working. Some key aspects of testing may include: