Launching a fintech product in a new jurisdiction
To launch a fintech product in another market among the United States, European Union, United Kingdom, and Canada, map each differing rule and partner bank requirement, retest local payment rails, authentication, disclosures, currency rounding, accessibility, and data location, and rerun home-market regression. The output is a requirement-to-test traceability matrix and a test evidence pack.
A live product entering a second regulated market
The trigger is a date that someone else sets: a licence or registration decision, a partner bank's go-live window, or a passport notification inside the European Union, where the home authority shall communicate its decision within 3 months of receiving the notification (Article 28(3) of Directive (EU) 2015/2366, PSD2). Typical cases: a UK e-money app opening EU accounts, or a US money transmitter serving Canada.
Legal owns the fintech compliance checklist for licences and filings. The CTO and the head of compliance own its testing half: which flows change, and which evidence shows they were tested. The flows that change are payment rails and file formats, authentication and disclosure rules, currency and rounding, language and accessibility, and where customer and account data is stored.
What goes wrong when the new market gets the old test plan
- Customers onboarded before the permission exists. A release flag opens sign-up before the licence or registration is in place. Under 18 U.S.C. 1960(a), whoever knowingly conducts, controls, manages, supervises, directs, or owns all or part of an unlicensed money transmitting business faces a fine, up to 5 years of imprisonment, or both. Section 1960(b)(1)(A) covers a money transmitting business that affects interstate or foreign commerce and operates without an appropriate licence in a state that punishes this as a misdemeanor or felony (state licence rules). In Canada, a payment service provider must be registered with the Bank of Canada before it performs any retail payment activities (Retail Payment Activities Act, section 23), including a provider abroad that directs such activities at end users in Canada (section 5). Retail Payment Activities Regulations section 48(1) sets penalties of up to $10,000,000 for a very serious violation.
- Authentication copied from a market without SCA. A US flow ships to the EU with a password and a device check. PSD2 Article 74(2) states that where the payer's provider does not require strong customer authentication, the payer does not bear any financial loss unless the payer acted fraudulently, and a payee or payee's provider that fails to accept strong customer authentication refunds the financial damage caused to the payer's provider. Fraud losses move to the new entrant (PSD2 SCA requirements).
- Disclosures formatted the home-market way. For remittance transfers from US consumers to recipients abroad, 12 CFR 1005.31(b)(1)(iv) sets how the disclosed exchange rate is rounded (Regulation E). A receipt template carried over from the EU repeats a wrong rate format on every US transfer from launch day, so the fix ships as a release after go-live.
- A new rail without its checks. In euro area Member States, payment service providers have had to offer payers verification of the payee before a credit transfer since 9 October 2025, and in non-euro Member States from 9 July 2027 (ECB, Instant Payments Regulation). A product that carries only its US ACH logic into euro credit transfers has no name check.
- Onboarding and payment screens that fail accessibility. Directive (EU) 2019/882 covers consumer banking services and e-commerce services provided to EU consumers after 28 June 2025 (Article 2(2)(d) and (f)), and Member States lay down the penalties (Article 30). Microenterprises providing services are exempt (Article 4(5)). The EAA requirements page lists what is tested.
- Personal data copied back to the home region. GDPR Article 44 allows a transfer of personal data outside the European Economic Area only under the conditions of Chapter V. A production copy loaded into a home-market test environment, or EU logs shipped to a US monitoring tool, is such a transfer.
The launch testing sequence
- Build the difference register. For each flow, list what changes: licence conditions, partner bank requirements, rails, authentication, disclosures, limits, currencies, languages, and data location. Output: Requirement-to-test traceability matrix.
- Test jurisdiction gating. Sign-up and transfers open only where the permission exists, and address changes move a customer into or out of scope. Output: gating test results per jurisdiction.
- Test the local rails and file formats. Cover messages, cut-offs, returns, and recalls in the partner bank's test environment. Output: Payment file format validation suite (NACHA, ISO 20022 pain and camt, SWIFT MT and MX); Cut-off time and settlement timing scenarios across time zones; Return, reject, and recall test cases.
- Test authentication for the new rules. Cover authentication elements, exemptions, and dynamic linking for EU and UK flows, and step-up rules elsewhere. Output: authentication test results per flow.
- Recalculate currency, fees, and rounding. Recompute each disclosed rate, fee, and total per currency pair. Output: Boundary and rounding test suite per formula.
- Rerun onboarding and screening with local data. Use local identity documents, addresses, and sanctions lists. For Canada, include the FINTRAC identity verification thresholds. Output: Onboarding and verification scenario suite; Sanctions and PEP screening test data set and results.
- Test language and accessibility. Check translated disclosures, number formats, and screen reader use of onboarding and payment flows. Output: WCAG 2.2 AA audit report; Screen reader test results for payment and onboarding flows.
- Check where data goes. Trace storage, backups, logs, analytics, and support tools per region. Output: Data residency checks for US, EU, and Canada.
- Rerun home-market regression. Confirm that new-market code leaves home-market fees, limits, and disclosures unchanged. Output: home-market regression results.
- Assemble the evidence. Output: Test evidence pack per audit scope; Gap report before the assessment.
Timeline and scope
Durations are typical engineering estimates for one product entering one market, not company statistics. Licence and partner bank reviews run on their own timelines.
| Phase | Duration (estimate) | Roles | Output |
|---|---|---|---|
| Difference register | 1-2 weeks | QA lead, compliance lead, product owner | Requirement-to-test traceability matrix |
| Gating and onboarding | 2-3 weeks | QA engineer, KYC operations lead | Gating test results; Onboarding and verification scenario suite; Sanctions and PEP screening test data set and results |
| Rails and formats | 2-4 weeks, in parallel | QA engineer, payments engineer, partner bank test contact | Payment file format validation suite (NACHA, ISO 20022 pain and camt, SWIFT MT and MX); Cut-off time and settlement timing scenarios across time zones; Return, reject, and recall test cases |
| Authentication, disclosures, rounding | 2-3 weeks, in parallel | QA engineer, automation engineer | Authentication test results; Boundary and rounding test suite per formula |
| Language and accessibility | 1-2 weeks | Accessibility tester, QA engineer | WCAG 2.2 AA audit report; Screen reader test results for payment and onboarding flows |
| Data location | 1-2 weeks | QA engineer, infrastructure engineer | Data residency checks for US, EU, and Canada |
| Regression and evidence | 1-2 weeks | QA lead | Home-market regression results; Test evidence pack per audit scope; Gap report before the assessment |
Scope grows with each money flow and rail opened at launch, such as Nacha ACH files or SEPA credit transfers. A US launch multiplies gating tests by the states in the licence plan, and each added language adds disclosure and accessibility checks per screen.
How we help with a new market launch
We test against the new market's rules and produce the evidence; the regulator decides on the licence and the partner bank on go-live. Our engineers use synthetic or masked data.
- Audit and certification test evidence covers steps 1 and 10: Requirement-to-test traceability matrix, Test evidence pack per audit scope, and Gap report before the assessment.
- Bank transfers and payment rails testing covers step 3: Payment file format validation suite (NACHA, ISO 20022 pain and camt, SWIFT MT and MX); Cut-off time and settlement timing scenarios across time zones; Return, reject, and recall test cases.
- Financial calculation testing covers step 5 with the Boundary and rounding test suite per formula.
- KYC, AML and fraud testing covers step 6: Onboarding and verification scenario suite; Sanctions and PEP screening test data set and results.
- Accessibility testing covers step 7: WCAG 2.2 AA audit report; Screen reader test results for payment and onboarding flows.
- Data privacy and test data management covers step 8: Data residency checks for US, EU, and Canada.
From steps 2, 4, and 9 you also receive gating test results per jurisdiction, authentication test results per flow, and home-market regression results.
Related
Services
Standards
- PSD2 and Strong Customer Authentication
- European Accessibility Act, with WCAG 2.2 and EN 301 549
- GDPR for financial data
- ISO 20022
- GLBA and US state money transmitter requirements
- Electronic Fund Transfer Act and Regulation E, including the remittance transfer rule
- Nacha Operating Rules for ACH
- Retail Payment Activities Act
- PCMLTFA and FINTRAC obligations
Guides
- How to test FX markup: rate application and markup disclosure
- How to test banker's rounding in payment and ledger code
- How to test Same Day ACH cutoff times and settlement timing across time zones
- How to test SCA exemptions: low value, TRA, and trusted beneficiaries
- How to reconcile camt.053 statements: format, batch entries, reversals, and MT940 mapping
- How to reduce false positives in sanctions screening: testing for false alerts and missed matches
Questions
What is passporting?
Under the Payment Services Directive (PSD2, Directive (EU) 2015/2366), passporting lets a payment institution authorised in one European Economic Area (EEA) Member State provide services in another after notifying its home authority. The home authority decides within 3 months, and an agent or branch starts only once entered in the Article 14 register (Article 28(3)). UK-EEA passporting ended when the Brexit transition period ended on 31 December 2020.
What is data residency?
Data residency is the country or region where data is stored and processed, including backups, logs, and disaster recovery copies. In the European Union, the General Data Protection Regulation (GDPR) sets no general in-country storage rule, but Article 44 allows transfers of personal data outside the European Economic Area only under the conditions of GDPR Chapter V.
Scope testing for your next market
Tell us the home market, the target market, the licence or partner bank route, and the flows you plan to open first. We reply with a first difference register and the test phases, each with the evidence it produces.