How to Launch a Digital Banking Business

Start with the regulated activity, not the app

Launching a digital banking business means building a financial institution or a service that depends on one. The app is the distribution channel; the underlying business receives money, executes payments, extends credit or provides access to products supplied by regulated partners.

Your first decision is therefore not which technology to buy. It is which activities your business will perform, which legal entity will perform them, and who will owe customers their money.

This guide provides a planning framework rather than legal or investment advice. Requirements depend on the product, customer type and jurisdiction. Confirm the applicable rules and supervisory expectations before committing to a launch model.

1. Define the customer proposition and money flows

Choose a specific initial customer group and problem. A freelancer account for receiving invoices has different requirements from a savings product, a lending business or a cross-border payment service.

Write down the proposed features:

• Receiving salaries or business payments.
• Holding balances and issuing payment cards.
• Sending domestic or international transfers.
• Paying interest or offering savings products.
• Providing overdrafts, loans or investments.

Then draw the money flow for each feature. Identify where funds arrive, which entity holds them, how balances are recorded, and how customers withdraw or transfer them.

For a card transaction, for example, distinguish the customer-facing app, card issuer, processor, payment network and settlement institution. These may be separate businesses with separate responsibilities.

This exercise exposes licensing requirements and dependencies before they become expensive design mistakes.

2. Choose the operating model

Become a licensed bank

A bank licence generally enables deposit-taking and lending, subject to its permissions and applicable restrictions. It also brings prudential requirements covering capital, liquidity, governance, risk management and recovery planning.

Banks can use deposits to fund lending within those constraints. They must nevertheless maintain sufficient liquidity to meet withdrawals and absorb losses through capital.

This model offers substantial control but requires a credible management team, funding and operational infrastructure. A banking licence is not simply a broader version of a payments licence.

Become a payment or electronic money institution

Where available, payment institution and electronic money institution permissions support specified payment services and, for electronic money institutions, issuing e-money.

An e-money balance is not a bank deposit. Relevant customer funds generally require safeguarding through prescribed arrangements, such as segregation or eligible insurance or guarantees. They are not a pool of funding for unrestricted lending.

This model can suit transaction accounts, wallets and payment products. It does not automatically permit deposit-taking, investment services or general lending.

Partner with a regulated institution

A fintech can provide the interface and parts of the service while a bank or another regulated institution provides the underlying account, payment service or card issuance.

Often called banking-as-a-service or embedded finance, this structure can reduce the activities the fintech performs directly. It does not remove the need to assess its own regulatory status, including whether it is an agent, distributor, outsourced provider or separately licensed firm.

Contracts and customer disclosures must identify the actual provider. The regulated partner remains accountable for its obligations and will require oversight of the fintech.

3. Map the jurisdiction and permissions

Digital distribution does not create a global licence. Assess where customers reside, where services are marketed, where activities occur and whether cross-border provision is permitted.

European Union

Bank authorisation operates through national authorities and, within the Banking Union, the European Central Bank’s supervisory framework. Payment and electronic money models have established foundations in PSD2 and EMD2, implemented through national law.

Eligible authorised firms may use passporting procedures within the European Economic Area for covered activities. Passporting is not permission to offer every financial product or operate worldwide.

EU digital operational resilience requirements under DORA are also relevant to many regulated firms. Check legislative changes, implementation dates and national requirements with the relevant authority.

United Kingdom

Banks are authorised by the Prudential Regulation Authority with the Financial Conduct Authority’s consent and are subject to both prudential and conduct supervision. Payment and electronic money institutions generally fall under FCA authorisation or registration regimes, depending on their activities and eligibility.

UK permissions do not provide an EEA passport. Eligible bank deposits may receive Financial Services Compensation Scheme protection; payment and e-money balances are not protected on the same basis merely because the provider is FCA-authorised.

United States

Bank formation involves federal or state chartering authorities and, where applicable, Federal Deposit Insurance Corporation deposit insurance approval and Federal Reserve requirements.

Non-bank payment businesses may face state money transmission licensing alongside federal Bank Secrecy Act obligations. Registration with the Financial Crimes Enforcement Network is not a bank charter or a substitute for state permissions.

In a partner-bank structure, deposit insurance depends on the actual deposit arrangement and satisfaction of applicable conditions. It does not insure the fintech itself against failure or guarantee uninterrupted access to its app.

Switzerland

FINMA supervises banks and other regulated financial institutions. Switzerland also has a FinTech licence category permitting limited acceptance of public deposits under specified conditions, including restrictions on investing those deposits and paying interest.

It is not a full banking licence, and deposits accepted under that category do not receive ordinary Swiss deposit protection. Payment and wallet models also need assessment under anti-money laundering and other applicable rules.

United Arab Emirates

For activities within its remit, the Central Bank of the UAE regulates banks and relevant payment businesses, including retail payment services and stored-value facilities.

The Dubai International Financial Centre and Abu Dhabi Global Market have separate regulatory frameworks overseen by the DFSA and FSRA respectively. A financial free-zone permission should not be treated as blanket authority to serve the UAE retail market.

Singapore

The Monetary Authority of Singapore supervises banks and payment service providers. Payment services are regulated under the Payment Services Act, with licensing requirements depending on the services and applicable thresholds or exemptions.

A payment institution licence is not a banking licence. Digital banking categories also have different permitted customer segments and operating conditions. Confirm the relevant authorisation route with MAS.

4. Build the governance and funding case

Regulators and institutional partners assess the people controlling the business as well as its products.

Prepare a coherent package covering:

• Ownership, controllers and sources of funding.
• Board responsibilities and senior management suitability.
• Financial forecasts, stress scenarios and funding needs.
• Risk appetite, compliance arrangements and independent assurance.
• Recovery, orderly wind-down and customer exit arrangements.

Regulatory capital is not the same as operating cash. A business needs resources to satisfy capital requirements while paying staff, suppliers and launch costs. Safeguarded customer money is not available for payroll or marketing.

Forecast delays, slower customer adoption, fraud losses and partner replacement costs. A plan that works only under its best-case assumptions is not a resilient launch plan.

5. Design customer protection and financial crime controls

Explain what happens to customer money

For every balance, establish whether it is a bank deposit, e-money, payment funds or another claim.

Document who owes the money, where it is held, how records are reconciled and what happens if the fintech or a partner fails. Explain deposit protection and safeguarding accurately: they are different mechanisms, and neither should be presented as an unconditional guarantee of immediate repayment.

Make compliance operational

Customer identification is only one part of financial crime prevention. Build processes for beneficial ownership checks, sanctions screening, risk assessment, transaction monitoring, investigation and suspicious activity reporting.

Controls should reflect the customer base. Cross-border business accounts may require more detailed ownership and payment-purpose checks than a narrowly scoped domestic product.

Give staff clear escalation routes and decision rights. Purchased screening software does not decide the firm’s legal obligations or replace accountable compliance management.

6. Build a reliable ledger and operating platform

The ledger records what the business owes customers and how transactions change those obligations. It must handle pending payments, reversals, fees, disputes and settlement without losing the audit trail.

Separate the customer interface from accounting and settlement logic. Reconcile internal records against banks, processors and payment networks, and investigate differences promptly.

Core capabilities normally include:

• Identity verification and account lifecycle management.
• A controlled, auditable ledger.
• Payment processing and reconciliation.
• Fraud detection, access controls and security monitoring.
• Customer support and complaints handling.
• Regulatory reporting and management information.
• Backups, incident response and disaster recovery.

Test interrupted connections, duplicate messages and delayed settlement. A successful demonstration of a payment is not proof that the platform handles failure safely.

7. Select partners and control outsourcing risk

Assess partners for regulatory permissions, financial resilience, operational performance and compatibility with your intended customers.

Contracts should allocate responsibility for onboarding, monitoring, safeguarding, disputes, reporting and incident notification. They should also address audit access, subcontracting, data use and termination.

Avoid dependence on a partner you cannot realistically replace. Establish how records and balances could be transferred, what customer consent might be needed and how service would continue during a transition.

Outsourcing technology or compliance tasks does not outsource the regulated institution’s accountability.

8. Validate the economics

Calculate contribution margins by customer segment and product, rather than relying only on projected account growth.

Potential revenues include subscriptions, payment fees, permitted interchange income and lending income. Costs include processing, partner charges, customer support, fraud, credit losses, compliance and technology.

Do not assume that customer balances generate freely available income. Their treatment depends on the legal model, safeguarding rules and contractual arrangements. Lending also consumes funding and capital and creates collection and impairment costs.

Stress-test low activity, high support demand and adverse fraud outcomes. Growth can increase losses when each additional customer is expensive to serve.

9. Launch in controlled stages

Begin with a limited product scope, defined customer eligibility and transaction limits aligned with your permissions and risk controls.

Before accepting customers, verify that:

• Required authorisations, registrations and partner approvals are effective.
• Customer terms match the actual legal structure.
• Reconciliation and customer-money controls work end to end.
• Staff can handle complaints, fraud and vulnerable customers.
• Incident response and recovery procedures have been tested.
• Management receives useful risk and operational reporting.

Expand only when evidence supports it. Adding lending, investments, cryptoassets or stablecoins can introduce new permissions and risks; for example, EU cryptoasset activities may engage MiCA rather than existing payment permissions alone.

A sustainable digital banking business combines a clear legal model, reliable money movement, honest customer protection disclosures and workable economics. Those foundations matter more than the number of features available on launch day.