Real Substance Requirements for FinTech Companies: What Regulators Actually Look For

1. What regulators mean by substance

Substance is not one statutory checklist. It is a connected assessment of governance, management, staff, premises, systems, decision-making and resources. The exact expectations vary by permission and jurisdiction, but the regulator normally needs comfort that the applicant is not a shell delegating all meaningful functions to an unrelated group company or vendor.

For an EMI or PI, the analysis is especially practical. Who approves onboarding? Who owns the risk appetite? Who reviews suspicious activity? Who reconciles safeguarded funds? Who handles a material incident? Who reports to the board? The answer must identify real people with authority, time and evidence of competence.

2. The fit-and-proper test is more than a clean criminal record

Fit and proper assessments generally cover honesty, integrity, reputation, competence, experience, financial soundness and the person's ability to devote adequate time to the role. A founder may be commercially successful and still be unsuitable for a controlled function if the application cannot show relevant regulated-sector experience or a credible support structure.

3. Physical office: what is “real”?

A physical office should be proportionate to the entity's activity. A regulated start-up may not need a large headquarters, but it should be able to show where local staff work, where governance meetings occur, how confidential records are handled and how the regulator can contact responsible persons.

A registered address alone is usually weak evidence. So is an office that exists on paper while every director, employee and decision sits abroad. A flexible workspace can be acceptable if the arrangement provides genuine access, privacy, continuity and the ability to host staff and supervisory meetings. The answer depends on the regulator and business model; it should be documented, not assumed.

4. Outsourcing is permitted; abdication is not

Most FinTech companies outsource some technology, cloud hosting, customer support, compliance tooling or back-office work. The licensed entity remains responsible for its regulatory obligations. It must understand the service, approve the vendor, monitor performance, retain access to records and maintain a credible exit plan.

The application should explain the boundary between group support and regulated decision-making. A vendor may provide screening results; the firm must own the risk decision. A cloud provider may host data; the firm must control access, resilience and incident escalation. A parent company may provide staff; the local entity must still demonstrate authority, oversight and availability.

5. Substance checklist for founders

1. Map decisions: list every material decision and identify where it is made, by whom and under which approval threshold.
2. Appoint accountable people: prepare fit-and-proper evidence, time commitments, deputies and reporting lines for directors and key function holders.
3. Secure the premises: document office access, privacy, equipment, records, meeting capability and business continuity.
4. Evidence operations: produce sample onboarding, reconciliation, monitoring, complaint and incident records — even if based on controlled testing before launch.
5. Control outsourcing: complete vendor due diligence, contracts, service levels, audit rights, information security and exit planning.
6. Re-test after approval: substance must continue when volumes grow, staff leave, products change or a group company restructures.

6. How substance connects to AML and banking

Substance is not an isolated corporate requirement. It affects AML/KYC credibility and banking. A bank will ask who controls the account and who can explain the transaction flows. An AML supervisor will ask who owns the risk assessment, sanctions decisions and suspicious-activity escalation. A regulator will ask whether the local entity can supervise its outsourced functions.

Founders should build the operating model with AML/KYC compliance, banking onboarding and the licensing application in parallel. Read the Lithuania EMI route and Malta FinTech route as examples of the wider principle: an authorisation requires a business that can be operated, not merely incorporated.

“Substance is the evidence trail between a permission and a functioning institution.”

Licensium governance observation

Conclusion: build a company that can answer the phone

Real FinTech substance is visible in decisions, people, offices, controls and records. Regulators do not require every startup to look like a bank, but they do require the licensed entity to be capable, accountable and proportionate to the risks it creates.

Licensium can assess local-director and office requirements, prepare fit-and-proper files, map key functions and build an evidence-led EMI or PI licensing strategy. Start a confidential review before committing to a jurisdiction.