Compliance is the function that keeps a regulated firm within the laws, regulations, licence conditions and internal policies that apply to it, and keeps the evidence that it does so. In a licensed fintech it covers AML and counter-terrorist financing, KYC, sanctions, data protection, consumer protection, safeguarding of client money and regulatory reporting. As the second line of defence, compliance writes policies, monitors whether controls work and reports to the board, while named roles such as the MLRO answer personally to the regulator. Failures escalate from findings to onboarding restrictions, fines and licence loss, and partner banks can act first. A change of ownership is itself a compliance event requiring prior regulatory approval.
What does a compliance function do
Most regulated firms organise risk control in three lines of defence. The business owns its risks and runs day-to-day controls. Compliance, as the second line, writes policies, advises, monitors whether controls work and reports to the board. Internal audit, the third line, tests both independently. Named roles sit inside this structure: the MLRO decides on suspicious activity reports and answers personally to the regulator for AML, and a data protection officer covers GDPR where required.
Regulators judge compliance by evidence, not documents. A policy that says every high-risk customer is reviewed annually, next to a file showing reviews two years overdue, proves the firm knew the rule and did not follow it.
What are the compliance requirements for payment and e-money firms
The rules are specific and time-bound. In the UK, FCA rule DISP 1.6.2AR requires a payment or e-money firm to send a final response to a complaint within 15 business days; in exceptional circumstances it may send a holding response and reply within 35 business days. Other complaints have eight weeks. The FCA's Consumer Duty adds four outcomes the firm must evidence with data: products and services, price and value, consumer understanding and consumer support.
Under GDPR, a personal data breach must be reported to the supervisory authority within 72 hours of the firm becoming aware of it, where feasible. In AML, the EU Anti-Money Laundering Authority (AMLA), established on 26 June 2024 and based in Frankfurt, is scheduled to start directly supervising around 40 selected obliged entities in 2028, with selection during 2027.
Illustrative example: an EMI with 120,000 customers receives 300 complaints a month. At two hours of handling each, that is 600 hours a month, roughly four full-time staff, just to meet the 15-day deadline without breaching it.
What happens when compliance fails
Consequences scale from findings in a regulatory visit, through restrictions on onboarding new customers or launching products, to fines, removal of approved individuals and loss of the licence. Failures also spread to partners: banks providing safeguarding accounts and card schemes run their own reviews and can end the relationship before any regulator acts.
Compliance in buying or selling a licensed fintech
A change of ownership is itself a compliance event. In the UK, anyone acquiring or increasing control of an FCA-regulated firm must notify the FCA and get approval first; the FCA has up to 60 working days from a complete notification to assess, excluding pauses for information requests, and acquiring control without approval is a criminal offence under section 191F of FSMA. Buyers review compliance audit findings, open regulator correspondence, breach logs, complaint data and suspicious activity report volumes, and price any remediation backlog into the deal.