New technology in the financial industry is changing how people manage their finances.  This merger of financial services with technology, referred to as “fintech,” is a booming industry.  In 2014 alone, technology-focused venture capital firms invested $12.2 billion in fintech startups, a threefold increase over the previous year.  Startups are not the only companies racing to join the industry.  Heavyweights in the financial services industry, such as JPMorgan Chase and Goldman Sachs, are also adopting fintech services such as peer-to-peer payments and same-day approval of small business loans.

But if Silicon Valley is coming, so is the government.  A major challenge to the growing fintech industry comes from government scrutiny and enforcement actions – particularly as they relate to money laundering and the financing of terrorist activity.

How Does Fintech Work?

Most fintech transactions occur through an application on a smartphone or company website and are completed on an accelerated timetable.  Fintech companies’ offerings vary, but include the following categories of services:

• Mobile Payment Systems and Digital Wallets:  Mobile payment and digital wallet apps, such as Venmo, allow users to store, send and receive funds from their account on the app.
• Peer-to-Peer Money Transfer:  Peer-to-peer money transfer companies, such as TransferWise, use peer-to-peer technology to avoid bank fees charged for sending money overseas.
• Online Marketplace Lending: Companies that offer online marketplace lending use online platforms to lend either directly or indirectly to small businesses and consumers.  Companies operating in this industry tend to fall into three categories:
• Balance sheet lenders that originate loans for borrowers (for example, OnDeck);
• Bank-affiliated online lenders that originate loans for borrowers; and
• Peer-to-peer lenders that sell securities to obtain the financing to enable third parties to fund borrowers (for example, Lending Club).

Scrutiny of and Potential Action Against Fintech Companies

The anonymity and speed of fintech services raise the risk that terrorists and criminals will exploit fintech to support their illicit activity.  As a result, fintech companies should expect and be prepared for government scrutiny of their compliance with AML laws. Furthermore, regulation requires that financial institutions have customer identification programs in place and maintain related customer due diligence standards, referred to as “know your customer” (“KYC”).

These regulations are robust.  An AML compliance program must be in writing and must provide: (1) a system of internal controls to ensure ongoing compliance (which includes verifying customer identification); (2) independent testing for compliance;  (3) an individual designated as responsible for coordinating and monitoring day-to-day compliance; and (4) training for appropriate personnel.

AML Challenges for the Fintech Industry

To comply with the law – and to ensure that their services are not exploited by bad actors – companies offering fintech services must know how to comply with AML regulations, as well as how to avoid common pitfalls in fintech compliance programs.  Detailed below are just a few of the challenges that fintech companies face in complying with AML regulations:

• Fintech companies need to have operational AML programs as soon as their business opens.  Fintech companies are required to have robust AML programs that are fully operational when they begin offering financial services.  However, because many fintech companies start small and grow over time, there may be a gap between when a company first offers financial services and when its compliance program is fully running.  As a result, financial transactions may go unmonitored, and companies may unwittingly operate without complying with all regulations, and thus may be vulnerable to prosecution or enforcement action.
• Rapidly growing fintech companies need to ensure that their compliance program grows in scale with their business.  Once a fintech company has established an AML compliance program, the AML compliance program may not keep pace with the company’s business.  For example, an effective AML program requires conducting KYC due diligence.  A fintech startup may conduct adequate KYCs on the company’s initial customer base; however, the KYC process may be overwhelmed as the company grows and attracts larger volumes of customers from diverse backgrounds and locations.  Similar problems may arise in generating SARs and satisfying other reporting requirements as transactions taking place across an app increase rapidly over a year.
• Anonymous payments should not be permitted for any transaction, regardless of amount. Financial institutions are required to verify a customer’s identity.
• Peer-to-peer lending companies need to implement fully operational AML programs whether they are subject to the BSA regulations or not.  Although a peer-to-peer lender may not be liable for failing to comply with the BSA, it can still suffer reputational damage if a loan made to a customer is implicated in a terrorist or criminal scheme.

Conclusion

As the fintech industry transforms traditional banking practices, it falls under enhanced government scrutiny.  Without a thorough AML compliance program in place, fintech companies risk damage to their reputation and the loss of investor and customer confidence in their business.  In order to continue growing without the risk of not complying with AML laws, fintech companies – and the financial institutions that partner with them – must know the AML requirements that apply to their business, identify potential weaknesses within their AML compliance programs, and implement gold standard AML compliance programs.