Coredo

Since 2016 I have been building COREDO as a company that removes regulatory uncertainty for entrepreneurs and financial directors. During this time the COREDO team has obtained licenses and set up operating models in the EU, the United Kingdom, the Czech Republic, Slovakia, Cyprus, Estonia, Lithuania, Singapore and Dubai. In this article I have compiled practical recommendations on CASP licensing, with a focus on capital, personnel, AML and technological resilience. I draw on the experience of numerous projects so that you can immediately see where the main value lies and how to avoid costly mistakes.

Why MiCA and global supervision now

The European MiCA regulation introduces common requirements for CASPs regarding capital, organizational structure and client protection, and also provides passporting mechanisms in the EU. COREDO’s practice confirms: the new regime raises the entry threshold, but with proper preparation accelerates scaling across regions and reduces fragmentation of requirements. We take into account that MiCA and the capital requirements for CASPs tie own funds to the set of services and fixed overhead costs.

Choosing a jurisdiction and market entry

Decisions on choosing a jurisdiction and forming a market entry model define the legal, tax and commercial framework of expansion. Below we will examine step by step how these factors manifest in the EU context: from regulatory harmonization to requirements for economic substance.

EU regulatory harmonization

MiCA creates uniform rules, but in practice each state retains particularities in supervision and expectations regarding local presence. Economic substance and local presence of a CASP are not a formality: real resident directors, an office, a full-time MLRO, and management functions within the country strengthen the position at the application stage. At COREDO we design the organizational structure of the CASP in advance for licensing and prepare a passporting strategy to later use cross-border CASP services without duplicating licenses.

Estonia, Malta, Lithuania offer different entry barriers. In Estonia the minimum share capital for a VASP depends on the services and usually ranges from €100,000 to €250,000; personnel and control requirements have been strengthened since 2022. In Malta the VFA classification raises the bar for capital and governance: for advanced classes this means hundreds of thousands of euros and enhanced internal controls. Lithuania actively welcomes crypto business: VASP registration is possible, but banks and payment providers expect confirmed substance and a mature AML framework.

Depth and supervisory models in four countries

The FCA conducts strict registration of crypto companies: there is no formal minimum capital, but a CASP’s own funds must cover risks and fixed expenses, and personnel must demonstrate competencies and independence of compliance functions. FINMA and the Swiss cantonal regulators apply a high level of scrutiny to custody solutions and directors’ responsibilities. In Singapore under MAS’ PSA for DPT providers the minimum capital and security deposit depend on the volume of operations; mature processes for cybersecurity and key management are expected. In Dubai, VARA imposes clear requirements for product documentation, outsourcing of critical functions, and SLAs with providers.

CIS: a bridge to the EU and Asia

Capital for CASP: terms and calculations

For proper capital management within CASP it is important to first build a clear understanding of key terms before moving on to practical calculations. In the first section we will go through the basic terminology and regulatory logic to lay the foundation for further capital assessment methods and concrete computations.

Terminology and regulatory logic

Capital versus liquidity: the regulator for CASP requires both. Capital is a buffer against losses; liquidity is the ability to meet obligations and withstand outflows. Some jurisdictions apply elements of ICAAP: internal capital assessment and stress-testing, and risk-weighted assets (RWA) are adapted to the nature of crypto exposures and operational risks.

Risks, stress tests and capitalization

How to calculate capital requirements for a crypto exchange? We take the minimum CASP share capital, add a buffer to FOE (fixed overheads) for 12–18 months, account for CASP reserve capital requirements for custody and cyber risk coverage. Capitalization strategies when scaling a CASP include additional issuances, subordinated debt as a source of regulatory capital within limits, and cyber insurance, which indirectly reduces net losses in stress scenarios.

Funding and corporate actions

Personnel: fit and proper and organizational design

A company’s effectiveness largely depends on its personnel, adherence to the fit and proper principles, and thoughtful organizational design. In the following points we will examine staffing requirements and leadership roles in detail to understand how to build competencies, responsibilities, and managerial interactions within the organization.

Requirements and leadership roles

The roles of MLRO, CCO, CTO, CFO, CIO in a CASP allocate responsibilities: MLRO: management of AML and SARs, CCO – overall compliance framework and reporting, CTO/CIO – security, keys, infrastructure, CFO: capital, liquidity, reporting. The responsibility of CASP directors and staff is personal: the regulator assesses their decisions, the management of conflicts of interest in CASP leadership, and the independence of control.

Hiring and screening effectiveness

Recruitment and personnel screening procedures for a CASP include background checks, biography checks, criminal record and sanctions screening of the director, verification of education and actual achievements. Preparing CVs and proof of experience for CASP applicants should be substantive: projects, KPIs, implemented rollouts, certifications. The composition of the compliance and AML department in a CASP is built from an MLRO, KYC/KYB analysts, a sanctions officer, a reporting officer, and an independent internal auditor.

Ongoing operating expenses for CASP personnel should be planned for 12–18 months ahead. Performance indicators for the compliance function (KRI, KPI) include SLA for KYC, alert processing time, escalation rate, SAR quality, as well as ROI metrics from investments in compliance personnel. The assessment of the economic efficiency of hiring vs outsourcing shows: some functions are cost-effective to keep in-house, while others should be given to an external provider. Compliance function: in-house vs centralized for a CASP group: often a hybrid model with coordination at the holding level.

Succession, motivation and retention

Technologies, security and resilience

Reliable technologies, the indispensable foundation for ensuring the security and operational resilience of services. Below we will examine in detail custody, segregation and key management practices that are critically important for protecting assets and maintaining operations during incidents.

Custody and key management

Asset insurance and client loss coverage reduce operational risks; cyber insurance and capital requirements are linked: having adequate coverage can affect the assessment of residual risk in ICAAP. Agreements with liquidity and leverage providers should limit counterparty risks, and outsourcing exchange engines and SLAs for critical functions are required with transparent RTO/RPO.

Compliance and privacy

Technical requirements: SOC2, ISO27001, regular pentest, vulnerability management and access control. Business continuity and backup policies support operational resilience, while incident reporting and engagement with the regulator reduce regulatory risks during outages. Practices to prevent personal data leaks (GDPR/PDPA) and integration of HR and compliance for access control to assets close significant security gaps.

Independence of quality control

internal audit and the quality control of CASP personnel assess the effectiveness of the first and second lines of defence. Critical functions can be outsourced, but responsibility remains with the directors; we define vendor control KPIs and independent monitoring. Engagement with external auditors and capitalization reviews helps demonstrate the maturity of risk management.

License application: documents and process

Properly assembled documents and a structured submission process are the key to a successful application, and checkpoints help track readiness at each stage. We’ll start with organizational matters, then go over substance requirements and finish with the practical part – a business plan that confirms the project’s economic justification.

Substance of the organization and business plan

Product documentation details custody chains, exchange procedures, brokerage, limits on client transactions and margin risks. Segregation of client funds is codified in contracts and operating instructions, taking into account regulatory guidance on custodian vs exchange liabilities. The organizational structure of a CASP for licensing demonstrates the independence of compliance and risk functions.

Deal structure: timing and cost

Timing and cost of obtaining a CASP license depend on the jurisdiction and the readiness of the materials. In the EU, with a quality package, review takes from 3 to 9 months; in Singapore and Dubai: longer for complex models. We assess in advance the ongoing operating expenses for CASP personnel and funding sources for the CASP license to avoid cash shortfalls at the finish.

Reporting and control in the operational phase

In the operational phase, reliable reporting and continuous internal control become key to minimizing risks and ensuring compliance with standards. Regulatory reporting and AML are especially important – they require clear coordination of procedures, data transparency and prompt incident response.

AML and regulatory reporting

Internal reporting procedures and regulatory reports record compliance with capital and liquidity requirements, security incidents and governance changes. Capital and liquidity reporting rules vary, but in all cases a transparent accounting of own funds for CASP and FOE is required. AML reporting and Suspicious Activity Reports (SAR) require a qualified MLRO and precision in escalation procedures.

Liquidity management in cases of laundering and rapid outflows relies on pre-approved limits and stress plans. Setting limits on client transactions and margin risks reduces the likelihood of sudden breaks and market cascades. Regulatory fines and license refusals typically occur due to undercapitalization, weak AML and unverified sources of capital; the COREDO team remedied such situations through recapitalization and redesign of the KYC/KYB framework.

Structure audit, modification and closure

Regulatory approvals for changes to capital structure and corporate rights: a standard practice when scaling. External auditors check capitalization, IT controls and compliance with GDPR/PDPA. Business closure procedures and protection of clients’ interests include an asset return plan, regulator notifications and an independent audit of segregation.

COREDO case studies: where details matter

In Lithuania, the COREDO team implemented a project for an exchange CASP oriented toward a MiCA passport. The key was the strategy: the minimum capital for the CASP was covered with equity, and the CASP’s own funds were strengthened with subordinated debt within the limits. We implemented an ICAAP approach and outflow stress tests, recalculated FOE for 18 months and achieved a comfortable assessment by the regulator.

In Singapore, a solution developed at COREDO helped a DPT provider obtain a status compliant with PSA requirements. We built a SOC2-compliant architecture, implemented KMS/HSM and multisig, conducted a pentest and set up incident reporting. MAS positively assessed the competencies of the MLRO and the independence of internal audit.

In Estonia, our experience at COREDO showed how critical staffing requirements are for crypto companies. We supplemented the team with a strong MLRO, separated the CCO and MLRO roles, strengthened Travel Rule integration, and updated AML policies in light of AMLD6 and FATF. The result: a successful license review, reduced risk of enforcement actions, and stable relationships with banks.

In Dubai, the COREDO team established outsourcing of exchange engines with strict SLAs, formalized agreements with custodians and custody terms, and provided for asset and cyber risk insurance. This allowed for reduced capital add-ons for operational risks and sped up VARA approval. We also implemented KPI/KRI for compliance to transparently demonstrate ROI at the board level.

Checklists for CASP license

• Capital and liquidity:
  • Own funds (own funds): minimum and FOE ≥ 25% of annual expenses.
  • Proof of sources of capital: bank statements, SPA, audit.
  • Recapitalization plan: additional share issuance, subordinated debt, cyber risk insurance.
  • Liquidity reserves and stress tests: outflows, margin calls, provider outages.
• Personnel and governance:
  • Fit and proper for CASP management; independent CCO, qualified MLRO.
  • Procedure for checking the director’s background, criminal record and sanctions clearance.
  • Management succession plan; Risk, Audit, RemCo committees; conflict of interest.
  • Compensation models and risk-oriented bonuses; compliance KPI/KRI.
• Technology and security:
  • Segregation of client funds; cold/hot wallets, KMS, HSM, multisig.
  • KYT: Chainalysis/Elliptic/TRM; Travel rule provider; sanctions lists.
  • SOC2/ISO27001; pentest; BCP/DR; incident reporting and contact with the regulator.
  • SLA with outsourcers; agreements with custodians and liquidity providers.
• Documentation and process:
  • Organizational chart and job/function descriptions; local substance.
  • Business plan: products, revenue models, stress scenarios, financial forecasts.
  • AML/CTF policies, sanctions, KYC/KYB, SAR reports; internal reporting.
  • Passporting plan to the EU; assessment of tax and licensing consequences.

Cost planning and return on investment

Assessing the economic efficiency of hiring vs outsourcing requires comparing TCO: salaries, training and certification of AML/CTF staff, software licenses, external auditors. Metrics for return on investment in compliance and security are measured by reductions in losses from incidents, refusals in banking relationships, fines and licensing timelines. Techniques for optimizing personnel and compliance costs include a centralized center of expertise for the group, policy harmonization and shared services.

Staff planning when entering new markets builds in increased workloads for the MLRO and IT security, as well as stronger Travel Rule compliance and reporting. Economic efficiency assessment that takes into account capital threshold requirements by jurisdiction (EU/Asia/CIS) helps choose the optimal scaling route. comparison of jurisdictions by entry barrier and personnel cost we record in the financial model to support the board of directors’ decision.

Trends and Recommendations

Regulatory trends: tightening capital requirements after incidents and clarifying regulatory guidance on custodian vs exchange liabilities. Benchmarking of capital requirements between the EU and Asia shows an increased emphasis on FOE and operational risk. The impact of crypto insurance on capital requirements is becoming noticeable: regulators view real coverage with minimal exclusions positively.

Managing liquidity and sudden increases in outflows is becoming a key competency. Management of conflicts of interest, the role of the board of directors and committees, measures to reduce operational and reputational risk: all of this affects the assessment of an organisation’s “fit and proper” status. Taxation and reporting requirements for CASP require constant calibration as product lines and geography change.

Lessons from COREDO’s practice

In one project, the regulator initiated license revocation due to a capital shortfall after market fluctuations and an increase in FOE. The COREDO team quickly prepared a recapitalization plan, arranged subordinated debt, and updated the ICAAP and stress scenarios. The regulator accepted the adjustments, and the client avoided a business shutdown and strengthened liquidity reserves.

Another case concerned the travel rule: the provider was failing to meet SLAs and AML alerts were piling up. The solution developed at COREDO included replacing the provider, rebuilding the alert logic, setting KPIs for the team, and improving the MLRO’s competencies. Within two months processing time decreased threefold, and SARs became more accurate in structure and content.

I also highlight a project on the transition from a subsidiary to a branch in the EU. We assessed licensing implications in advance, adjusted capital and internal reporting, and agreed on governance changes. As a result the client retained passporting and optimized their tax position without regulatory delays.

How to gain time and reduce risks

The sooner you turn regulatory requirements into a concrete plan, the easier it is to scale the business and protect clients’ interests. Regulators in the EU, the UK, Switzerland, Singapore and Dubai expect from CASPs the same as from mature financial participants: sufficient capital, responsible management, transparency and operational resilience. COREDO’s experience confirms: it is these principles that make crypto business sustainable and predictable over the long term.

I have led COREDO since 2016 and every day I see the same thing: companies lack structured, pragmatic compliance that works as a business asset rather than a bureaucratic overlay. Over years of working in the EU, the Czech Republic, Slovakia, Cyprus, Estonia, the United Kingdom, Singapore and Dubai, the COREDO team has delivered hundreds of projects – from company incorporations and obtaining financial licenses to building AML/CFT systems and regulatory reporting. This text is not a review of ‘best practices’, but a distillation from real cases, mistakes and solutions that turn a compliance strategy into a real driver of business growth and investor confidence.

Compliance as a competitive advantage

Compliance for international business

Compliance program: stages and KPIs

Registration and licenses – Europe/Asia/CIS

COREDO cases: from idea to operations

Third parties in international supply chains

RegTech and compliance automation

Compliance in investments and M&A

Budget and ROI for the Board of Directors

Culture of learning and continuous improvement

Frequently Asked Questions from Clients

What leaders should remember

Conclusions

Since 2016 I have been leading COREDO through a shifting regulatory landscape, helping entrepreneurs from Europe, Asia and the CIS launch and scale fintech businesses. Over that time regulators have learned to speak the language of technology, and technology — the language of regulators. I see how the fintech director has evolved from a visionary product specialist into an architect of corporate governance for fintech, a proponent of the risk-based approach and a leader of change. And every time the COREDO team takes on a project, I start with a simple question: how to turn regulatory expectations of fintech directors into a competitive advantage?

In this article I have gathered practical approaches, hands-on tools and proven frameworks that at COREDO consistently lead to licenses, a sustainable operating model and flawless inspections. I deliberately use plain language but employ precise terminology — this way our clients build a shared vocabulary with regulators and increase trust at every stage.

Company registration and jurisdiction selection

jurisdiction selection – not about the speed of opening an account and not about “where it’s cheaper to register an LTD”. This decision is about regulatory risk appetite, market access, compliance costs and reporting requirements. COREDO’s practice confirms: early calibration of objectives (payments, e‑money, crypto, brokerage, lending, neobank) saves months and tens of thousands on restructuring.

We most often compare the EU (Lithuania, Cyprus, Estonia), the United Kingdom, Singapore and Dubai. In Europe the PSD2 linkage and open banking matter, in the United Kingdom: FCA expectations for senior managers (SM&CR) and mature financial crime practice, in Singapore – MAS sandbox and an approach to risk‑based licensing, in Dubai: a focus on virtual assets and structuring client funds. The COREDO team carefully assesses local specifics: regulatory supervision for neobanks, requirements for e‑money providers, safeguarding and escrow options.

License vs local registration

In conversations with clients I rarely recommend a “one‑size‑fits‑all license” without a clear go‑to‑market model. An international license opens doors, but only where it is recognized. Local registration for a pilot market sometimes provides a faster product‑market fit and manageable compliance. The solution developed at COREDO typically includes a map of passporting opportunities, post‑Brexit constraints, requirements for agents/distributors and a plan for subsequent harmonization in the EU or Asia.

EU passporting after Brexit

Service passporting is a real advantage for payment institutions and EMIs, but only with a robust model of three lines of defense (three lines of defense) and readiness for cross‑border supervision. After Brexit a UK license does not provide automatic access to the EU, and “reverse” passporting is impossible. Our experience at COREDO has shown: a hybrid architecture with EU‑EMI and UK‑AEMI can cover both zones with a reasonable compliance TCO.

Beneficial owner (BO) checks

In the EU and in several Asian jurisdictions the beneficial owners register (BO) is part of basic hygiene. We build in advance the evidentiary base of source of funds, the ownership structure and the chain of control to withstand enhanced Due Diligence. This sharply reduces friction when opening accounts and speeds up onboarding with partner banks.

PSD2, crypto and brokerage licenses

When it comes to licensing, the main thing is not the list of documents but the alignment of the operating model with the regulator’s intent. I think in terms of governance, risk, compliance and reporting. This helps design processes so the regulator sees risk control embedded in the fabric of the business, not in detached policies.

Licensing of payment institutions

A payment institution in the EU requires evidence of control over operational and financial risks. We rely on EBA guidance on managing payment risks: risk segmentation, incident management, outsourcing, IT and security. For PSD2 compliance we prepare:

• a map of products and data flows, including eIDAS and electronic signing schemes;
• regulatory reporting for fintech: formats, deadlines, SLAs, process owner roles;
• GDPR and fintech requirements: privacy by design, DPIA and data pseudonymization;
• procedures for client money rules, safeguarding and reconciliation.

Requirements for e-money providers

For EMI we always model capital adequacy requirements taking into account growth rate, seasonality and stress scenarios. Safeguarding client funds is the core of trust: segregated accounts, escrow structures and daily reconciliations. At COREDO we implement checkpoints for custody vs safeguarding so that no custodial storage function is disguised as protection of client money.

Regulation: AMLD5/AMLD6 and the Travel Rule

We divide crypto regulation for companies into three layers: Licensing of VASPs, AML/CFT and data requirements. Directives AMLD5 and AMLD6 and VASP requirements demand a risk‑based approach, EDD for PEPs, and KYC/KYB processes adapted to on‑chain risks. The Travel Rule sets standards for data transfer in inter-exchange transfers of crypto assets; here we design secure channels and data-sharing agreements. At the same time we take into account sanctions compliance for fintech (OFAC/UN/EU) and restriction registers.

Neobank and regulatory sandboxes

Regulatory sandboxes: a tool, not a goal. I design a sandbox procedure for fintech as a managed experiment with clear hypotheses, metrics and a sandbox exit strategy. In the UK we focus on FCA SM&CR and the role of senior managers; in Singapore – MAS sandbox and Singapore’s requirements on risk disclosure; in Hong Kong, regulatory practice of the HKMA and SFC. We agree in advance on regulatory forbearance, checkpoint mechanisms and a commercialization plan after exit.

Corporate governance of fintech

The right architecture of governance determines the “health” of a license for years to come. The fintech director today: an integrator of product, risk and compliance, owner of culture and performance benchmarks.

Regulatory expectations for fintech directors

Regulatory expectations for fintech directors include transparency of decisions, a managed risk appetite, demonstrable competencies and process resilience. The fintech leader’s responsibility extends to strategy, product economics, fintech compliance and supplier‑chain resilience. The role of the fintech director in the corporate governance system is to ensure a balance between growth and control, to define tolerance statements and to monitor their operationalization.

Compliance director KPIs

What do regulators expect from the compliance director? Clear board reporting, independence of the second line of defense and measurability of controls. We implement KPIs and KRIs: false positive rate and triage speed, SAR rate, detection rate for key scenarios, the closure rate of audit findings and the maturity of continuous monitoring. We complement this with reverse stress testing and scenario analysis so the board can see the boundaries of resilience.

Product cybersecurity: the leader’s role

How does the fintech director ensure product cybersecurity? Through the cloud shared responsibility model, contractual guarantees and regular checks. I build in penetration testing and red team exercises, API vulnerability controls, SIEM/SOAR processes and incident response with pre‑defined communication to the regulator. This reduces operational risk and readies the evidentiary base for inspection.

AML for fintech: detections

Compliance does not live in documents but in data and case‑level decisions. We configure processes so they are fast for the customer and persuasive for the regulator.

How to build an AML program in a neobank

The roadmap always starts with RBA: segmentation of customers, products, channels and geographies. Next — KYC/KYB, identity verification (IDV) and biometric verification with KYC orchestration to reduce friction and increase conversion. We incorporate PEP screening, Enhanced Due Diligence for high‑risk profiles, counter‑terrorism financing controls (CFT) and anti‑money laundering reporting requirements for payment services.

Transaction monitoring and algorithmic risk

Transaction monitoring systems require careful tuning of scenarios. We combine expert rules and machine learning for fraud detection with explainable AI to ensure algorithmic transparency. Model risk management is a mandatory layer: model governance, model backtesting, drift monitoring, model risk management in scoring and anti‑fraud systems. For complex schemes we use graph analytics and network analysis to improve signal quality.

Sanctions compliance

The sanctions program begins with a risk taxonomy and covers sanctions screening, OFAC/UN/EU lists and local registries. I recommend taking into account the impact of sanctions on supply chains and payments, supplementing vendor due diligence and continuous vendor monitoring. For complex jurisdictions we build a “dual‑track” counterparty screening and near‑real‑time monitoring of sanctions updates.

Regulatory reporting/SAR/audit trail

Suspicious Activity Report (SAR) and interaction with the FIU or FinCEN: an area where speed, completeness and security matter. We prepare regulatory reporting with clear SLAs, requirements for log retention and auditing (audit trail) and continuous monitoring procedures. This ensures reliability and readiness for sudden supervisory requests.

GDPR and data governance

Data is the lifeblood of fintech, and GDPR is the anatomy. I always start with a map of data flows, legal bases, and transfer boundaries.

Schrems II: SCC/BCR and privacy by design

GDPR: the legal aspects of transferring customer data require consideration of Schrems II and international data transfer mechanisms — SCC and BCR. At the same time, we implement privacy by design, DPIA and requirements for pseudonymization and protection of customer data. eIDAS facilitates cross-border payments and identification, but does not eliminate the need for thoughtful cryptography and access controls.

Outsourcing and third-party risks

Outsourcing is not a way to “shift responsibility”, but an area of increased regulatory scrutiny. I design controlled boundaries with clear metrics and accountable parties.

Outsourcing governance: evidence

Shared responsibility and cyber risks

Approaches to risk management when outsourcing cloud providers include the shared responsibility model, encryption, segmentation, least privilege and monitoring. Contractual guarantees are complemented by technical measures: logging, anomaly detection, periodic red team exercises and independent audit.

Cross-border supervision and coordination

Interagency coordination and cross-border supervision mean that queries may come from several regulators at once. I proactively arrange communication channels, mapping of regulatory requirements and allocation of roles within the team to ensure a coordinated position.

Regulatory transformations, automation

Regtech today is not a fashionable option, but a way to keep pace with change. I evaluate not only functionality, but also TCO (total cost of ownership) and ROI from investments in AML and regulatory automation.

AML roadmap and change management

The roadmap for implementing an AML project at COREDO consists of discovery, design, build, validate, run. We create regulatory intelligence and mapping of regulatory requirements, configure continuous controls monitoring and prepare the team through targeted training. Change management mitigates the risks of service disruption and loss of knowledge.

Regtech platforms: performance metrics

Regulatory inspections: preparation

Inspections are part of a license’s lifecycle. The more transparent the processes, the smoother the inspection.

Checklist for AML inspection readiness

The regulatory checklist for launching a payment product includes confirmation of capitalization, governance, IT and security, AML/CFT and data protection. How to prepare a company for an AML regulator inspection? We build an audit trail, pre-assign communication owners and compile an “evidence package”: policies, triage procedure, logs, case examples and SAR. internal audit helps to capture an objective picture before the inspectors arrive.

Reputational risk and dealing with findings

After an inspection, a constructive follow-up is important. I use a matrix of findings’ severity, owners and deadlines, and regular reports to the board. This strengthens regulator trust and reduces reputational risk during inspections.

COREDO case studies: what worked

Examples are the best way to show how approaches come to life in real projects. Below: several case studies where the COREDO team delivered on complex objectives on time.

EMI in Cyprus: capital, safeguarding

For a B2B‑fintech we launched an e‑money license in Cyprus. We developed a capital adequacy model with reverse stress testing, set up safeguarding and an escrow model, and established client money rules. For PSD2 compliance we connected open banking modules with eIDAS certificates and carried out a DPIA. The regulator accepted the operating model without additional rounds of questions, a sign of maturity in the documentation and processes.

VASP in Estonia: Travel Rule

A crypto service in Estonia required a VASP license and a full AML/CFT framework. We implemented KYC/KYB with biometrics, configured the Travel Rule, integrated sanctions screening against OFAC/UN/EU lists and network analysis to identify high‑risk wallets. The regulator noted strong explainability in the detection models and transparency of case management.

Neobank in the UK: SM&CR and sandbox exit

For a European startup we designed participation in the UK sandbox and built an SM&CR matrix for senior managers. We defined sandbox metrics, continuous monitoring and a commercialization plan. The sandbox exit strategy included scaling compliance and an international data architecture taking Schrems II and SCC into account.

EU institute: cross-border outsourcing

In a payment institution project in the EU we established outsourcing governance with the cloud provider, defined SLAs and control points, conducted vendor due diligence and continuous vendor monitoring. The regulator requested evidence of supplier risk management, and the prepared package demonstrated process maturity, including contractual guarantees and resilience tests.

Roadmap for the fintech leader

To translate regulatory requirements into growth, I propose a simple framework. It helps the fintech director maintain a balance between product and supervision across different regions.

Steps for scaling compliance

1. Formulate the regulatory risk appetite and tolerance statements, align them with the board, and operationalize them into metrics.
2. Build the three lines of defense, define critical KPIs for the fintech director on risk and compliance, and integrate them into the OKR cycle.
3. Deploy regulatory intelligence, account for fintech regulation in Europe, MAS and HKMA/SFC in Asia, and evolving expectations in Africa.
4. Plan compliance scaling when entering international markets: passporting where possible and localization where required.
5. Prepare incident response and communication with the regulator, including inter-agency coordination and cross-border supervision.

Resilience – discipline, not an accident

Over the years I have learned: a reliable fintech company grows from discipline in the details, from choosing a jurisdiction to configuring transaction monitoring systems and board reporting. Yes, regulation changes and becomes more complex. But with a sound governance architecture, a clear RBA and thoughtful automation, regulatory requirements become an ecosystem where it is easier for a business to grow and earn trust.

The COREDO team has delivered dozens of projects in the EU, the UK, Singapore, Estonia, Cyprus and Dubai: and each time our approach has remained the same: transparency, measurability, risk manageability and respect for the logic of supervision. If you are building a payment service, an e-money provider, a crypto service or a neobank, I have a simple recommendation. Start with a requirements map and an honest assessment of operational maturity, then step by step build processes that will withstand inspection in any jurisdiction. This is how a business that is trusted by customers, banks and regulators is created, and how it scales steadily without unexpected regulatory “brakes”.