-
What are the regulators for fintech companies in your jurisdiction?
FinTech products and services may be subject to overlapping jurisdiction of a number of federal regulators, including the Federal Reserve, the Office of the Comptroller of the Currency, the Financial Industry Regulatory Authority, the Federal Financial Institutions Examination Council, the Commodities Futures Trading Commission, the Securities and Exchange Commission, the Financial Crimes Enforcement Network and the Consumer Financial Protection Bureau. At the state level, fintech companies may be subject to regulation by state departments of revenue.
-
Do you foresee any imminent risks to the growth of the fintech market in your jurisdiction?
The fintech market has been subject to fragmented and multi-layered regulation in the U.S. since its inception. The new Trump administration has so far engaged in de-regulation by executive order, rolling back regulatory oversight and ordering agencies such as the SEC to drop high profile enforcement actions. Without a comprehensive legislative fix to the regulation of fintech products and services, the market appears to be subject to unilateral executive action, and that can change with a change in administrations. This uncertainty remains the biggest risk to the growth of the fintech market in the U.S.
-
Are fintechs required to be licensed or registered to operate in your jurisdiction?
There is no mandatory licensing regime applicable to fintechs generally. During the fall of 2016, in an effort to regulate fintech companies, the Office of the Comptroller of the Currency (“OCC”), announced a study to consider whether it would issue a special charter to fintech companies to become special purpose national banks. In May 2017, Comptroller Thomas J. Curry announced the OCC may issue such charters. Shortly thereafter, in April 2017, the Conference of State Bank Supervisors (“CSBS”) filed a lawsuit in federal district in the District of Columbia arguing that the OCC does not have the appropriate statutory authority to create such special purpose charter. Although a successful suit in the lower court was overturned on appeal, the OCC has suspended taking or renewing special purpose banking charter applications.
Fintechs that are money service businesses must register with the Financial Crimes Enforcement Network (FinCEN), and most states have a registration or licensing regime for money transmission businesses.
-
What is a Regulatory Sandbox and how does it benefit fintech start-ups in your jurisdiction?
There are no fintech regulatory sandboxes at the federal level in the U.S. The State of Arizona was the first to launch a fintech sandbox. Upon approval of an applicant’s registration, the participant may engage in a limited and temporary operation of a fintech business in the state for up to two years (with a one year extension).
Regulatory sandboxes, such as the Arizona FinTech Sandbox, allow products and services to be launched in a limited capacity without incurring regulatory burdens and compliance costs, while consumers test the attractiveness of the fintech product or service. Consumers are protected in the event the test fails, and individual transaction caps per customer are in effect.
-
How do existing securities laws apply to initial coin offerings (ICOs) and other crypto assets, and what steps can companies take to ensure compliance in your jurisdiction?
The SEC has indicated that tokens or coins offered pursuant to an ICO likely will be considered securities. As such, any offering of securities token or coins is subject to the Securities Act of 1933, which requires that the offering be registered with the SEC or exempt from registration
Under Section 2(a)(1) of the Securities Act and Section 3(a)(10) of the Exchange Act, the definition of security does not specify a token or coin, but does specify an “investment contract.” The term “investment contract” is the residual category in the definition that captures securities that do not fall within other categories.
In SEC v. W.J. Howey Co., the U.S. Supreme Court articulated a test for determining whether something is an “investment contract.” The test—which has become known as the “Howey test”—provides that an “investment contract” is an investment of money in a common enterprise with a reasonable expectation of profits to be derived from the entrepreneurial or managerial efforts of others. According to the SEC, this definition embodies a “flexible rather than a static principle, one that is capable of adaptation to meet the countless and variable schemes devised by those who seek the use of the money of others on the promise of profits.” In considering whether something is a security, “the emphasis should be on economic realities underlying a transaction, and not on the name appended thereto.”
The prongs of an investment contract, as articulated in Howey, are thus fourfold: (i) an investment of money (ii) in a common enterprise (ii) with a reasonable expectation of profits (iv) to be derived from the entrepreneurial or managerial efforts of others.
Prior to July, 2017, the SEC had not applied the Howey test to an ICO. However, on July 25, 2017, the SEC provided important initial guidance on its application of the Howey test to ICOs when it released a Section 21(a) Report of Investigation on its findings regarding the token sale by The DAO. The DAO functions as a decentralized autonomous organization, which essentially means a virtual organization embodied in computer code and executed on a distributed ledger or blockchain
In its analysis of whether The DAO had improperly offered and sold securities via an ICO, the SEC noted that new technologies do not remove conduct from the purview of U.S. federal securities laws. Based on the facts and circumstances regarding The DAO’s offering of tokens, the SEC found that (i) DAO tokens are securities under federal securities law, (ii) The DAO was required to register the offer and sale of DAO tokens under the Securities Act absent a valid exemption, and (iii) any exchange on which DAO tokens were traded was required to register under the Securities Act as a national securities exchange or operate pursuant to an exemption. In its report, the SEC did not say that all tokens would be securities. Rather, the SEC noted that the determination depends on the particular facts and circumstances and economic realities of the transaction.
The SEC has continued to strictly apply the Howey test to a number of ICOs through enforcement actions, finding many to have involved offers of unregistered securities. More recently, the SEC has brought enforcement actions against major cryptocurrency exchanges in connection with sales of unregistered securities.
The new Trump administration has embarked on aggressive de-regulation of federal agencies as well as announcing a more pro-crypto outlook than past administrations. On January 23, 2025, Trump issued an executive order entitled “Strengthening American Leadership in Digital Financial Technology”, signalling a more crypto-friendly framework and an end to regulation through enforcement. The SEC, under new leadership, has re-activated the Crypto Task Force to be led by Commissioner Hester Peirce, a pro-crypto SEC commissioner.
Companies looking to launch new coins in the U.S. have the option of engaging in a full registration of their coin offering with the SEC. Often this is unattractive due to the regulatory review period and high compliance costs. Alternatives include structures that do not require registration, but have limitations on numbers and qualifications of investors. Companies may be better place to wait and see the new regulatory landscape that develops in the U.S. under a more pro-crypto administration and SEC.
-
What are the key anti-money laundering (AML) and Know Your Customer (KYC) requirements for cryptocurrency exchanges in your jurisdiction, and how can companies implement effective compliance programs to meet these obligations?
At the federal level, companies that engage in money transmission are considered money services businesses (“MSBs”), which are regulated entities for anti-money laundering (“AML”) purposes under the Bank Secrecy Act of 1970 (the “BSA”). MSBs are required to register with the Financial Crime Enforcement Network (“FinCEN”) and meet other regulatory requirements, such as implementing an AML compliance program.
Under the BSA, money transmission is defined as the acceptance of currency, funds, or other value that substitutes for currency from one person and the transmission of currency, funds, or other value that substitutes for currency to another location or person by any means. This legislation typically requires cryptocurrency exchanges and other crypto-related business to register with the FinCEN and report annually for anti-money laundering compliance. They must implement a risk-based AML program, conduct customer due diligence, monitor transactions, and submit currency and suspicious activity reports
Many states have enacted money transmitter licensing requirements that may apply to cryptocurrency exchanges. Many states have expanded the definition of money transmitter to include the transmission of cryptocurrency, while others exclude cryptocurrencies from money transmitter licensing requirements. New York’s Biticense applies specifically to transmission and exchanges of cryptocurrencies, and requires an anti-money laundering program. In 2022, Robinhood Crypto LLC entered into a consent decree with the New York Department of Financial Regulation and paid a $30 Million fine resulting from inadequacies in its anti-money laundering program.
Companies operating fintech businesses that require the establishment of AML programs at the federal or state level should design and implement anti-money laundering programs consistent with the FATF (Financial Action Task Force) Recommendations, including the recommendations on internal controls necessary for an effective AML program.
-
How do government regulations requiring licensing or regulatory oversight impact the operations of cryptocurrency and blockchain companies in your jurisdiction, and what strategies can be employed to navigate these varying requirements?
In the US, businesses are not regulated by virtue of using blockchain technology itself. Cryptocurrency businesses are regulated by overlapping regulatory authorities at both the federal and state level. This overlapping, multi-level regulation is burdensome and costly, and adds uncertainty to a business’ compliance efforts.
There are a large number of activities that may trigger a registration or licensing requirement in the United States. In particular, unless an exemption applies:
1. Securities:
Offering securities, including certain tokens arising out of initial coin offerings (“ICOs”), triggers a requirement to register the securities with the Securities and Exchange Commission (“SEC”). With respect to ICOs, the SEC has found that certain tokens arising out of ICOs constitute securities offerings, but the SEC has also determined that bitcoin and ether are not or are no longer securities for purposes of federal securities law. Please see the response to Question 5 for a more detailed discussion of ICO regulation.
Providing a market for the trading of securities triggers a requirement to register as a national securities exchange or broker-dealer.
Brokering or dealing in securities triggers a requirement to register as a broker-dealer with the SEC. Advising persons with respect to securities transactions triggers a requirement to register as an investment adviser with the SEC. An investment adviser is an individual or a firm that is in the business of providing advice about securities to clients. For example, individuals or firms that receive compensation for providing advice with respect to investing in securities, such as stocks, bonds, mutual funds, or exchange traded funds (“ETFs”), are investment advisers
2. Commodity Interests:
Brokering transactions in futures contracts, options on futures contracts, swaps, or retail off-exchange forex contracts (collectively, “Commodity Interests”) triggers a requirement to register as an introducing broker or futures commission merchant with the Commodity Futures Trading Commission (“CFTC
Advising persons with respect to Commodity Interest transactions triggers a requirement to register as a commodity trading advisor (“CTA”) with the CFTC. A CTA is an individual or organization that, for compensation or profit, advises others, directly or indirectly, as to the value of or the advisability of trading futures in commodity interests.
Operating a commodity pool triggers a requirement to register as a commodity pool operator (“CPO”) with the CFTC. A commodity pool is an enterprise in which funds contributed by a number of persons are combined for the purpose of trading commodity interests.
3. Currency Transmission:
At the federal level, companies that engage in money transmission are considered MSBs, which are regulated entities for anti-money laundering purposes under the BSA. MSBs are required to register with the Financial Crime Enforcement Network (“FinCEN”) and meet other regulatory requirements, such as implementing an AML compliance program.
Under the BSA, money transmission is defined as the acceptance of currency, funds, or other value that substitutes for currency from one person and the transmission of currency, funds, or other value that substitutes for currency to another location or person by any means.
At the state level, money transmitters are required to have licenses for each state in which they operate. Many states have expanded the definition of money transmitter to include the transmission of cryptocurrency, while others exclude cryptocurrencies from money transmitter licensing requirements. It is a federal crime to operate as a money transmitter without a relevant state license.
4. Receiving and Holding Funds Belonging to Others:
Corporate entities that receive and hold funds from consumers and corporate clients and later make such funds available to the depositor or transfer to a recipient or beneficiary designated by the depositor is generally required to obtain the appropriate state or federal license. A wide-range of entities exercise such deposit-taking function, including commercial banks or credit unions, bill payment companies, escrow companies, and remittance companies.
Although deposit-taking services are generally a function of a bank, and constitutes a core service of the business of banking, fintech companies are offering services of receiving and holding consumer funds through methods including mobile applications, websites, and point-of-sales terminals. The deposit-taking services offered by fintech companies, in which the fintech company transmits such funds to recipients indicated by the depositor, are generally deemed money transmitters. As discussed above, money transmitters need to register with FinCEN and obtain appropriate state licensing.
5. Extending Credit:
Covering a wide range of payment products, the extension of credit in the United States has a long history of being a licensed activity, particularly with respect to extensions of credit to the public, or consumer credit. Non-bank companies seeking to offer home mortgages, credit cards, pre-paid cards, and even the so called ‘payday lending’ are generally required to obtain a special state license.
Each U.S. state has enacted laws and regulations governing the offering of loans to consumers, and generally require registration and licensing on each state in which the fintech company intends to conduct its lending business.
Cryptocurrency businesses intending to operate in the U.S. should engage in compliance by design. Seeking legal and compliance advice to structure operations to comply with the regulatory landscape is important in a market with many untrustworthy participants.
-
What measures should cryptocurrency companies take to comply with the governmental guidelines on tax reporting and obligations related to digital assets in your jurisdiction?
The Internal Revenue Service recognized cryptocurrency as personal property in Notice 2014-21 issued in March 2014. For purposes of computing gross income, the fair market value of the cryptocurrency in US dollars on the date it was received is the basis, and gains or losses on the sale of that cryptocurrency must be reported by the taxpayer. Subsequent IRS guidance addresses hard forks and airdrops as taxable income.
Investors, traders and broker-dealers have specific IRS guidelines applicable to gains and losses (ordinary and capital) and potential exemption from wash sale rules. Recently, the IRS and Treasury issued regulations on reporting requirements on brokers of decentralized financing (DeFi).
Issuers, investors, broker-dealers, traders, miners and stakers should obtain professional tax advice for reporting gains and losses associated with cryptocurrency transactions. The IRS indicated it would increase enforcement activity in 2025. However, with a new administration and cutting of IRS workers, its unclear whether increased IRS enforcement will be a priority.
-
How can blockchain companies address data privacy and protection regulations in your jurisdiction, while ensuring transparency and security on decentralized networks?
Unpermissioned public blockchains often clash with data privacy regulations where transaction records and pseudonymously identified participants are open to inspection. Data privacy laws, such as the California Consumer Privacy Act, protect the rights of individuals by prohibiting businesses from processing their personal data without consent. Data subjects may also have a right to require their personal information be deleted. Confirmations of blockchain transactions typically require third party miners or stakers to process blockchain transactions without the express consent of the transaction participants. Any “right to be forgotten” under data privacy laws cannot be effected with respect to data confirmed on an immutable peer-to-peer blockchain.
Some blockchain technologies are employing technologies, such as zero knowledge proofs, to keep personal data off chain and allow transaction verification without exposing participant identities. Other privacy based solutions include privacy coins and tumblers that mix transaction data to obscure individual identities; however, some of these mixing services have been charged with violations of anti-money laundering regulations.
-
How do immigration policies, such as the U.S.’s H-1B and L-1 visas, impact the ability of fintech companies to hire international talent in your jurisdiction?
The U.S. H-1B and L-1 visa programs allow skilled workers to obtain temporary permission to work in the U.S., and have contributed significantly to the development of the tech sector. H-1B visas are currently capped at 85,000 per year, and have been issued predominantly to skilled tech workers from India. The L-1 and L-2 visa programs allow managerial and specially skilled employees to work in the US for related companies.
The tech sector has grown with major tech companies obtaining the bulk of the H-1B visas, including in their fintech divisions. With strict immigration enforcement a key platform of the Trump administration, some are expecting executive orders that tighten the eligibility requirements for these temporary workers.
-
What are the key regulatory and compliance requirements that a fintech must address when entering the market in your jurisdiction, and how can the company ensure adherence to all applicable laws and regulations?
There is no omnibus regulation of fintech companies in the U.S. For those businesses engaged in money transmission activities, registration with FinCEN as a money services business and establishment of an anti-money laundering program is required. At the state level, state money transmitter laws mandate licensure in order to offer money transmission services in 49 of the 50 states. These state licensing requirements, including New York’s BitLicense, can be a significant compliance undertaking.
In addition to MSB registration and money transmitter licensing, cryptocurrency issuers, exchanges, brokers, and custodians need to comply with Securities and Exchange Commission regulations where the underlying token is deemed to be a security. See the response to Question 7 for additional discussion of compliance requirements.
Due to the lack of a single regulatory framework for fintech companies, fintech products and services may be subject to overlapping jurisdiction of a number of additional regulators, including the Federal Reserve, the Office of the Comptroller of the Currency, the Financial Industry Regulatory Authority, the Federal Financial Institutions Examination Council, the Commodities Futures Trading Commission, the Financial Crimes Enforcement Network and the Consumer Financial Protection Bureau.
-
How should a fintech approach market entry strategy in your jurisdiction, considering factors such as target customer demographics, competitive landscape, and potential partnerships with banking and other financial institutions?
The US market for fintechs continues to be robust, with both well-established and new entrants providing an array of competing products and services. Fintechs also face competition from traditional banks and other financial institutions. Fintechs would be well advised to avoid competing with traditional banks on fintech services that banks and financial institutions can easily provide, especially in a regulatory environment that does not mandate open banking. Unique services that can be provided more efficiently by non-bank fintechs are best placed for partnerships with banks and other financial institutions.
-
What are the primary financial and operational risks associated with entering the market in your jurisdiction, and how can the fintech effectively mitigate these risks to ensure a smooth transition and sustainable growth?
One primary financial and operational risk to market entry in the US for fintechs is the erosion of trust in this market sector. High profile fraud and enforcement actions have tarnished the image of fintechs, especially in the cryptocurrency market. In the absence of a comprehensive legislative or regulatory framework for fintechs operating in the U.S., companies should focus on designing and implementing robust and effective compliance measures in designing around anti-money laundering and know your customer programs, fairness, transparency, and anti-bias mechanisms for the use of artificial intelligence, as well as availing themselves of opportunities to interact with regulators rather than avoiding them. Prioritizing the establishment of a reputation for trust by fully investing in compliance activities is an effective means of mitigating these risks and position the new entrant in the U.S., fintech market for sustainable growth.
-
Does your jurisdiction allow certain business functions to be outsourced to an offshore location?
For fintechs regulated as financial institutions, the Federal Reserve Bank (FED), the Office of the Comptroller of the Currency (OCC) and the FFIEC have all issued guidance on outsourcing by financial institutions. The guidance generally requires due diligence on third party outsourcing providers and contractual standards to address legal, financial and operational risk in outsourcing.
The position of U.S. financial regulators has been to treat cloud computing as a form of outsourcing, so that its outsourcing guidance will apply to cloud computing services. The FFIEC’s “Outsourced Cloud Computing” guidance distinguishes among private clouds, public clouds and hybrids, and the appropriate use of each as it relates to management of risk.
-
What strategies can fintech companies use to effectively protect their proprietary algorithms and software in your jurisdiction, and how does patent eligibility apply to fintech innovations?
Software and algorithms are protected by U.S. copyright laws and international treaties. Registration of copyright is available (and required for enforcement proceedings), but copyright protection attaches from the moment the work is fixed. The source code to software and algorithms, if properly maintained in confidence, may be treated as a trade secret. Software and algorithms may also be eligible for patent protection; however, the patent-eligibility of software and algorithms have been narrowed significantly by the courts in recent years.
The U.S. Supreme Court recognized software implemented business processes as patentable in its 1998 State Street Bank decision. After a decade of overly broad software patents issued by the patent office, the Supreme Court once again ruled on the patentability of software-implemented business processes in Bilski v. Kappos and substantially narrowed their eligibility for patent protection. Subsequently, in Alice Corp v. CLS Bank, the Supreme Court emphasized that embodying otherwise common aspects of business operations in software would not be eligible for patent protection.
The Federal Circuit’s 2018 decision in Berkeimer v. HP Inc. limited patent rejections and invalidations based upon well-understood or common activities. In January 2019, the US Patent and Trademark Office issued its Revised Patent Subject Matter Eligibility Guidance memo setting out the procedures for applying subject matter eligibility criteria. Recent Federal Circuit court rulings have also narrowed patentability exclusions, making room for greater patentability of software. However, in 2022, the U.S. Supreme Court turned away two cases that offered the opportunity the further clarify the patentability of software inventions.
Software is also protected by contract under the terms of the licensor’s license agreement. In Pro CD v. Zeidenberg, the court upheld the use of a shrinkwrap license agreement to extend the protection afforded by federal copyright laws’ exclusive rights.
-
How can a fintech company safeguard its trademarks and service marks to protect its brand identity in your jurisdiction?
Trademark protection may be obtained by federal registration with the US patent and trademark office, or may arise at common law. Unlike many other jurisdictions, trademark protection in the US requires use in commerce, and not mere registration alone.
The Lanham Act prohibits unfair competition through the infringement of another’s trademark, trademark dilution and false advertising. Both civil damages and injunctive relief is available for violation of the Lanham Act. In rare circumstances, civil seizures and treble damages are available.
-
What are the legal implications of using open-source software in fintech products in your jurisdiction, and how can companies ensure compliance with open-source licensing agreements?
Open source is a designation that covers a variety of licensing terms. In general, open source licenses permit users to use, modify, and distribute the source code to the licensed software. Some open source licenses are permissive, and require only that the distribution of modified source code identify the original licensor as well as the changes made to the licensed source code. Other open source licenses require programs linked or combined with the licensed source code to be subject to the same original open source license agreement (including its source code disclosure obligations) with no additional license restrictions.
Companies should adopt open source licensing and usage policies that provide oversight for a company’s use of open source software and the required steps to comply with the terms of the approved open source license.
-
How can fintech startups navigate the complexities of intellectual property ownership when collaborating with third-party developers or entering into partnerships?
When collaborating with third party developers or entering into development partnerships, fintech startups should be clear in their agreements about the ownership and exploitation rights with respect to technology collaborations. The developments may be covered by multiple intellectual property regimes that have different rights associated with them. For example, developed software may be subject to patent, copyright and trade secret protections.
In the absence of an agreement providing otherwise, the developer that creates the material will typically own the rights in that material. Being clear on the owner of the developments, and the party that has the right to bring enforcement proceedings and obtain recoveries is essential to well managed development relationships.
Joint ownership of developments can be complicated, because the rights of joint owners differs depending upon the intellectual property right. Because intellectual property rights are strictly territorial, the joint ownership rights are determined by the intellectual property laws of the jurisdiction where they were created. In most cases, these rights can be varied by contract. Therefore, fintechs need to carefully consider these issues in negotiating development agreements with third party developers and joint venture partners.
-
What steps should fintech companies take to prevent and address potential IP infringements, such as unauthorized use of their technology or brand by competitors?
Implementing policies and programs to protect and maintain intellectual property rights, including training of employees, are some of the measures that companies can take to prevent leakage of intellectual property and reduce the likelihood of unauthorized use.
A patentee is entitled to damages in the event of infringement, which may include reasonable royalties or lost profits. A copyright owner is entitled to actual damages, or alternatively statutory damages (if the copyright has been registered prior to the infringement). Both a patentee and copyright owner may obtain injunctive relief to restrain continued infringement of the intellectual property. The Digital Millennium Copyright Act has a notice and take down procedure where copyright owners can send a take-down notice to an Internet Service Provider that is hosting unauthorized copies of the copyright owner’s work.
Trade secrets protect information that derives value from not being known by competitors or readily ascertainable, provided that reasonable measures have been used to keep it confidential. Misappropriation of a trade secret is a tort at common law, and is actionable under the Uniform Trade Secrets Act (enacted in 48 states) and under the federal Defend Trade Secrets Act. Civil remedies for trade secret misappropriation include recovery of damages and injunctive relief to restrain further use or disclosure. In some circumstances, theft of trade secrets may constitute a criminal violation.
Trademark and service mark owners can bring claims under the Lanham Act for infringement, dilution or false advertising (confusion of source or sponsorship). Claims may include civil damages and injunctive relief.
-
What are the legal obligations of fintechs regarding the transparency and fairness of AI algorithms, especially in credit scoring and lending decisions? How can companies demonstrate that their AI systems do not result in biased or discriminatory outcomes?
Unlike the European Union, the U.S. has not enacted comprehensive legislation to address the use of artificial intelligence. Rather, regulation has arisen at the sectoral level. The Consumer Finance Protection Bureau (“CFPB”), the agency responsible for protecting consumers in the financial sector, has issued rules and guidance on the use of AI in consumer credit decisions. On June 24, 2024, the CFPB approved a new rule entitled “Quality Control Standards for Automated Valuation Models (2024),” promulgated by the CFPB, the Federal Reserve, the Federal Deposit Insurance Corporation, the National Credit Union Administration, the Office of the Comptroller of the Currency, and the Federal Housing Finance Agency. The rule requires the implementation of quality control policies by mortgage originators and secondary market issuers designed to, among other things, protect against data manipulation and conflicts of interest, and comply with nondiscrimination laws.
In 2023, the CFPB issued guidance mandating that creditors list the actual reason for the credit denial, or change of credit conditions, when taking adverse actions against borrowers, so customers are protected from both potentially arbitrary or discriminatory denials, lessening the impact on future credit determinations.
Finally, the CFPB has also emphasized through guidance the need for creditors using AI to find less discriminatory alternatives in their automated processes generally, and to continuously test their models so that the risk of discriminatory lending practices remains low.
Artificial intelligence is also in active use as part of so called “robo-advisories” that harness artificial intelligence to provide wealth management advice and structure investment portfolios. These AIs have attracted some regulatory scrutiny, with the Massachusetts Securities Division ruling that a registered investment company cannot fulfill its fiduciary duties in reliance on AI robo-advisors alone; rather, some human intervention is required.
-
What are the IP considerations for fintech companies developing proprietary AI models? How can they protect their AI technologies and data sets from infringement, and what are the implications of using third-party AI tools?
The intellectual property protections for algorithms in artificial intelligence models is addressed in the response to Question 15. The data sets used to train AI models can raise intellectual property issues. Misuse of data sets can raise infringement concerns if the underlying data set is protected, such as by copyright law. Third party tools used by fintechs can result in intellectual property problems where the outputs of the model are based on unlicensed inputs. This can result not only in claims of infringement by the data set owner, but claims of ownership over the outputs derived from the processing of the unlicensed data.
In Getty Images (US), Inc. v. Stability AI, Inc., D. Del., No. 1:23-cv-00135, filed Feb. 3, 2023, Getty alleges that without authorization, Stability AI copied over 12 million of Getty Images’ photographs and associated captions and metadata without authorization and removed or altered Getty Images’ copyright management information. Getty asserts that Stability AI is using Getty’s photographs without authorization to train its Stable Diffusion machine learning-driven image-generation model. Fintechs using third-party AI tools, or third-party data sets to train their own tools, should conduct the proper diligence to determine that acquired data sets have been used properly for AI model training.
-
What specific financial regulations must fintechs adhere to when deploying AI solutions, and how can they ensure their AI applications comply with existing financial laws and regulations? Are there specific frameworks or guidelines provided by financial regulatory bodies regarding AI?
The U.S. has not enacted comprehensive legislation to address the use of artificial intelligence. The CFPB has issued guidelines and regulations regarding the use of AI in consumer credit decisions. Please see the response to question 20 above.
Various state laws, particularly in connection with consumer data privacy, grant individuals the right to opt out of processing of their personal data for profiling in furtherance of decisions that include financial and lending services. The State of Colorado enacted a landmark law requiring developers and deployers of high-risk artificial intelligence systems to use reasonable efforts to avoid algorithmic discrimination.
-
What risk management strategies should fintech companies adopt to mitigate potential legal liabilities associated with AI technologies?
At the federal level, the Trump administration is using executive orders to roll back initiatives aimed at reducing bias in the use of AI which it sees as hindering innovation in artificial intelligence. The guardrails for use of artificial intelligence are being spearheaded by state legislatures. Fintechs should monitor developments at the state level and adjust their business plans to comply with state AI regulation when providing their products and services to customers in that state.
-
Are there any strong examples of disruption through fintech in your jurisdiction?
There are a number of examples of strong fintech disruption in the areas of payments and money transfers, lending, wealth management, and insuretech. Stripe and Block (f/k/a Square) are two examples of fintech disruptors in the payments space. Chime is a US based online bank that offers loan services.
-
Which areas of fintech are attracting investment in your jurisdiction, and at what level (Series A, Series B, etc.)?
Investment in fintechs has been depressed since the high profile implosions of FTX and Silicon Valley Bank, and have yet to rebound to the high levels seen in 2021. Despite this, demand for digital banking and embedded finance, often accompanied by AI driven solutions, continues to attract fintech investment in the U.S. A recent report by Fintech Global notes that overall US fintech funding in 2024 dropped 37% year-on-year compared to 2023, but that average deal value has increased, with investors demonstrating a preference for established players with clear growth potential rather than spreading capital across a high volume of smaller startups.
So far in 2025, fintechs have seen steady investments of in excess of $300M, including Series A, Series B and Series C funding rounds, according to Fintech Global.
United States: Fintech
This country-specific Q&A provides an overview of Fintech laws and regulations applicable in United States.
-
What are the regulators for fintech companies in your jurisdiction?
-
Do you foresee any imminent risks to the growth of the fintech market in your jurisdiction?
-
Are fintechs required to be licensed or registered to operate in your jurisdiction?
-
What is a Regulatory Sandbox and how does it benefit fintech start-ups in your jurisdiction?
-
How do existing securities laws apply to initial coin offerings (ICOs) and other crypto assets, and what steps can companies take to ensure compliance in your jurisdiction?
-
What are the key anti-money laundering (AML) and Know Your Customer (KYC) requirements for cryptocurrency exchanges in your jurisdiction, and how can companies implement effective compliance programs to meet these obligations?
-
How do government regulations requiring licensing or regulatory oversight impact the operations of cryptocurrency and blockchain companies in your jurisdiction, and what strategies can be employed to navigate these varying requirements?
-
What measures should cryptocurrency companies take to comply with the governmental guidelines on tax reporting and obligations related to digital assets in your jurisdiction?
-
How can blockchain companies address data privacy and protection regulations in your jurisdiction, while ensuring transparency and security on decentralized networks?
-
How do immigration policies, such as the U.S.’s H-1B and L-1 visas, impact the ability of fintech companies to hire international talent in your jurisdiction?
-
What are the key regulatory and compliance requirements that a fintech must address when entering the market in your jurisdiction, and how can the company ensure adherence to all applicable laws and regulations?
-
How should a fintech approach market entry strategy in your jurisdiction, considering factors such as target customer demographics, competitive landscape, and potential partnerships with banking and other financial institutions?
-
What are the primary financial and operational risks associated with entering the market in your jurisdiction, and how can the fintech effectively mitigate these risks to ensure a smooth transition and sustainable growth?
-
Does your jurisdiction allow certain business functions to be outsourced to an offshore location?
-
What strategies can fintech companies use to effectively protect their proprietary algorithms and software in your jurisdiction, and how does patent eligibility apply to fintech innovations?
-
How can a fintech company safeguard its trademarks and service marks to protect its brand identity in your jurisdiction?
-
What are the legal implications of using open-source software in fintech products in your jurisdiction, and how can companies ensure compliance with open-source licensing agreements?
-
How can fintech startups navigate the complexities of intellectual property ownership when collaborating with third-party developers or entering into partnerships?
-
What steps should fintech companies take to prevent and address potential IP infringements, such as unauthorized use of their technology or brand by competitors?
-
What are the legal obligations of fintechs regarding the transparency and fairness of AI algorithms, especially in credit scoring and lending decisions? How can companies demonstrate that their AI systems do not result in biased or discriminatory outcomes?
-
What are the IP considerations for fintech companies developing proprietary AI models? How can they protect their AI technologies and data sets from infringement, and what are the implications of using third-party AI tools?
-
What specific financial regulations must fintechs adhere to when deploying AI solutions, and how can they ensure their AI applications comply with existing financial laws and regulations? Are there specific frameworks or guidelines provided by financial regulatory bodies regarding AI?
-
What risk management strategies should fintech companies adopt to mitigate potential legal liabilities associated with AI technologies?
-
Are there any strong examples of disruption through fintech in your jurisdiction?
-
Which areas of fintech are attracting investment in your jurisdiction, and at what level (Series A, Series B, etc.)?