To build a payment system, you first decide how you will be licensed, then register with the Financial Crimes Enforcement Network (FinCEN) within 180 days of starting operations, obtain state money transmitter licenses where your users live, stand up anti-money laundering and data security programs that meet federal rules, open a merchant account with an acquiring bank, and finally integrate with a payment gateway and test before going live. The full path from first filing to first live transaction typically runs six months to over a year. The order matters, because the licensing model you pick shapes the cost, timeline, and technical architecture of everything that follows.
Pick Your Licensing Model First
Three models are available, and the wrong choice can cost hundreds of thousands of dollars in unnecessary compliance spending or expose you to criminal liability for unlicensed money transmission.
Full licensing means you register as a Money Services Business with FinCEN and obtain a money transmitter license in every state where your users live. Maximum control, maximum capital, maximum legal fees. It fits companies operating at scale with direct custody of customer funds.
Bank partnership, sometimes called Banking-as-a-Service, means you build the technology and user experience while a licensed sponsor bank’s charter covers the regulatory requirements. This can exempt your company from state-by-state money transmitter licensing, though the bank will impose its own compliance and oversight requirements.
Payment facilitator (PayFac) means you operate under a sponsoring acquiring bank or processor and submit sub-merchants’ transactions through your own master merchant account. Many states offer an “agent of the payee” exemption that can shield payment facilitators from money transmitter licensing. The exemption does not exist in every state, and the qualifying criteria vary. If you rely on an exemption that turns out not to apply, the consequences include federal criminal charges, so careful legal analysis is essential.
The rest of the steps below apply directly to the full-licensing path. Companies operating through a bank partnership or as a PayFac still need to understand AML rules, data security standards, and consumer protection obligations, because those responsibilities cannot be fully outsourced.
Register With FinCEN as an MSB
Any company that qualifies as a Money Services Business must register with FinCEN by filing Form 107 within 180 days of beginning operations.1eCFR. 31 CFR Part 1022 – Rules for Money Services Businesses The MSB category covers money transmitters, currency exchangers, check cashers, and issuers or sellers of money orders and traveler’s checks. Banks and entities regulated by the SEC or CFTC are exempt from MSB registration even if they engage in money transmission.
Form 107 asks for your legal business name, EIN, physical address, the states where you or your agents operate, the specific MSB activities you conduct, every owner or controlling person, and the number of authorized agents. Registration must be renewed every two years by filing an updated Form 107 before December 31 of the calendar year preceding the renewal period.2FinCEN.gov. Money Services Business (MSB) Registration
Missing the deadline carries a civil penalty of $5,000 per violation, with each day of noncompliance counting as a separate violation.1eCFR. 31 CFR Part 1022 – Rules for Money Services Businesses Operating an unlicensed money transmitting business is also a federal crime punishable by up to five years in prison.3Office of the Law Revision Counsel. 18 USC 1960 – Prohibition of Unlicensed Money Transmitting Businesses
Get State Money Transmitter Licenses
Federal registration alone is not enough. Every state except Montana requires a separate money transmitter license for businesses that receive funds from residents for the purpose of sending them to another party. A payment system serving customers nationwide therefore needs to obtain and maintain licenses in up to 49 states plus the District of Columbia.
Most states accept applications through the Nationwide Multistate Licensing System (NMLS), which lets you file a single Company Form (MU1) and request licenses in multiple jurisdictions. The application requires disclosure of your corporate structure, direct and indirect owners, executive officers, financial statements, and answers to background disclosure questions. Fingerprinting and criminal background checks for all controlling persons are submitted separately.
Financial requirements vary by state but generally include a minimum net worth (often between $500,000 and $1,000,000) and a surety bond. Bond amounts typically run from $250,000 to over $2,000,000, scaled to your projected transaction volume. Initial application fees range roughly from $100 to $10,000 per state, with most around $1,000. Once licensed, you face annual reporting, periodic examinations by state financial regulators, and renewal fees.
This is where most companies underestimate both cost and time. Budget for legal and compliance consulting fees on top of the application fees themselves, and expect several months per state. The multi-state burden is the primary reason many startups choose a bank partnership model instead.
Build the AML and Sanctions Program
Every MSB must implement a written anti-money laundering compliance program with four components:4eCFR. 31 CFR 1022.210 – Anti-Money Laundering Programs for Money Services Businesses internal controls covering customer identity verification, recordkeeping, report filing, and responses to law enforcement requests; a designated compliance officer responsible for day-to-day oversight; regular employee training on detecting suspicious transactions; and periodic independent review of the program’s effectiveness by someone other than the compliance officer.
Money transmitters must file a Suspicious Activity Report for any transaction of $2,000 or more that the business knows, suspects, or has reason to suspect involves illegal activity or is designed to evade reporting requirements.5eCFR. 31 CFR 1022.320 – Reports by Money Services Businesses of Suspicious Transactions
All U.S. persons and businesses must also comply with sanctions administered by the Treasury Department’s Office of Foreign Assets Control. In practice, that means screening every transaction party against the Specially Designated Nationals list before processing a payment. Property or funds belonging to individuals or entities on the SDN list must be blocked, and U.S. persons are broadly prohibited from dealing with them.6Treasury. Frequently Asked Questions – Recently Updated Violations carry substantial civil and criminal penalties. Building automated SDN screening into the transaction flow from day one is far cheaper than retrofitting it after a compliance failure.
Meet the Security Standards
PCI DSS
Any entity that stores, processes, or transmits cardholder data must comply with the Payment Card Industry Data Security Standard. PCI DSS v4.0 is now fully in effect, with the last future-dated requirements becoming mandatory on March 31, 2025.7PCI Security Standards Council. PCI Data Security Standard (PCI DSS) The standard covers network segmentation, access controls, encryption, and vulnerability management. Validation obligations scale with annual transaction volume, but the underlying security requirements are the same at every level.
Cardholder data must be encrypted in transit (TLS) and at rest (typically AES-256). Tokenization replaces card numbers with non-sensitive placeholders in your databases, so a breach of your systems yields useless data. Firewalls, intrusion detection, and regular vulnerability scans round out the baseline. Acquirers and card networks can impose monthly non-compliance fees, often between $5,000 and $20,000, on merchants that fail to validate their PCI status.
GLBA Safeguards Rule
Payment systems that qualify as financial institutions under the Gramm-Leach-Bliley Act face additional obligations beyond PCI DSS. The FTC’s Safeguards Rule requires a written information security program covering all customer information, not just cardholder data.8eCFR. Standards for Safeguarding Customer Information You must designate a qualified individual to oversee the program, conduct written risk assessments, require multi-factor authentication for anyone accessing information systems, and encrypt customer information in transit and at rest.
Customer data must be securely disposed of no later than two years after the last date it was used to serve the customer, and you need a written incident response plan. If a breach exposes unencrypted data belonging to 500 or more consumers, you must notify the FTC within 30 days of discovering it.8eCFR. Standards for Safeguarding Customer Information Vulnerability assessments must be conducted at least every six months unless you have continuous monitoring in place.
SOC 2
A SOC 2 Type II report evaluates controls across security, availability, processing integrity, confidentiality, and privacy. It is not legally mandated, but enterprise clients and partner banks frequently require a current SOC 2 report before they will integrate with your platform.
Handle Disputes and Consumer Liability Under Regulation E
If your payment system handles electronic fund transfers, including debit transactions, prepaid accounts, peer-to-peer transfers, and direct deposits, Regulation E imposes mandatory error resolution and liability rules that must be built into your operations.9Consumer Financial Protection Bureau. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E)
When a consumer reports an error, you generally have 10 business days to investigate. You can extend the investigation to 45 days only if you provisionally credit the disputed amount within the initial 10 business days and give the consumer full access to the funds during the investigation. Results must be reported within three business days after the investigation completes.10eCFR. 12 CFR 1005.11 – Procedures for Resolving Errors
Consumer liability for unauthorized transfers is tiered by how quickly the consumer reports. Reports within two business days of discovering the loss cap liability at $50. Reports after two business days but within 60 days of receiving the statement cap liability at $500. After 60 days from the statement date, the consumer bears full liability for unauthorized transfers that the institution can show would not have occurred with timely notice.
These timelines are not optional. Automated dispute tracking, provisional credit workflows, and notification mechanisms all need to be in the build. Failing to comply exposes you to enforcement actions by the Consumer Financial Protection Bureau and private lawsuits from affected customers.
Set Up 1099-K Tax Reporting
If your platform settles transactions on behalf of third-party sellers, you are a third-party settlement organization under the tax code. A TPSO must file Form 1099-K with the IRS for any payee whose gross payments exceed $20,000 and whose total transactions exceed 200 during the calendar year.11Internal Revenue Service. IRS Issues FAQs on Form 1099-K Threshold Under the One, Big, Beautiful Bill – Dollar Limit Reverts to $20,000 The One, Big, Beautiful Bill Act reinstated this threshold after the American Rescue Plan had temporarily lowered it to $600.
Collect a valid Taxpayer Identification Number from every payee. If a payee fails to provide a TIN or provides an incorrect one, you may be required to apply backup withholding on their payments. Build TIN validation and 1099-K generation into the platform from the start to avoid a painful retrofit once transaction volume grows.
Open a Merchant Account
To actually receive and settle funds, you need a merchant account with an acquiring bank. The account temporarily holds transaction proceeds, typically for one to two business days, before depositing them into your operating bank account. The acquiring bank underwrites your business based on risk, so the application is more involved than opening a standard checking account.
Expect to provide articles of incorporation, your federal EIN, and a voided check from your corporate bank account;12Internal Revenue Service. Employer Identification Number a detailed description of the products or services being sold with your website URL and marketing materials; three to six months of prior processing statements if you have them, or detailed projections of monthly volume and average transaction size if you don’t; and your anticipated chargeback ratio and fraud prevention measures. High chargeback ratios are the fastest way to get declined or flagged for additional reserves.
Certain business categories are restricted or prohibited by most acquirers, including gambling, adult content, debt settlement, peer-to-peer money transmission, and any business involving illegal products. High-risk categories can still get approved, but expect higher fees, rolling reserves where the acquirer holds back a percentage of settlements, and a longer underwriting timeline. Approval runs from a few days for low-risk businesses to several weeks for complex applications.
Integrate, Test, and Launch
Once your merchant account is approved and you have chosen a payment gateway, the gateway issues API credentials for a sandbox environment. Wire up the connection between your front end and the gateway’s processing servers using simulated transactions, and test every scenario: successful charges, declined cards, partial refunds, timeouts, and duplicate submissions. Sandbox is the cheapest place to find bugs. Problems that slip through to production cost real money and real customer trust.
Network failures between your servers and the gateway are inevitable. Without safeguards, a dropped connection during a charge request can lead to a customer being billed twice. The standard solution is an idempotency key: a unique identifier (a UUID works well) attached to each payment request, so that if you retry a failed call, the gateway recognizes the duplicate and returns the original result instead of processing the charge again. Most major gateways store idempotency results for at least 24 hours.
Going live means swapping sandbox credentials for live API keys. Turn on monitoring and alerting before the first real transaction. Track authorization rates, error codes, and response times so you catch issues before customers complain. Confirm the settlement cycle by verifying that funds from your first live transactions land in your bank account within the expected window, typically one to three business days depending on the acquirer.
Keep Compliance Running After Launch
Your obligations do not stop at launch. PCI DSS requires quarterly vulnerability scans, and Level 1 merchants face annual onsite assessments. Your AML program needs ongoing transaction monitoring and periodic independent reviews. State regulators will conduct examinations of your books and records. Your FinCEN registration renews every two years. Build these recurring obligations into your operational calendar from the start; catching up after a regulator flags a deficiency is far more expensive than staying current.