How to Verify a Payments License or Regulated Company

The regulated-company market has a credibility problem. A seller says the company is “fully licensed.” A formation agent offers a “Montana MSB license.” A website displays a regulator logo. A broker circulates a screenshot from a public registry. A startup claims it can operate in fifty states because it is registered with FinCEN. Another claims an old European authorization can be moved to a new owner and used for an entirely different product.

Some of these claims are fraudulent. Many are more subtle: the company exists, the registry entry is real, and the document is genuine—but the permission is misunderstood, inactive, limited, non-transferable, or irrelevant to the buyer’s intended business.

The direct answer is that legitimacy has three levels:

1. Authenticity: does the entity and regulatory record genuinely exist?

2. Authority: does the permission legally cover the proposed activity, customers, and geography?

3. Usability: can the company survive ownership change, obtain banking and providers, meet capital and compliance obligations, and actually execute the transaction?

A company can pass the first test and fail the other two. Serious due diligence must test all three.

Begin with the Exact Legal Identity

A legitimate review starts with the legal entity, not the trading name. Obtain the full registered name, company number, jurisdiction of incorporation, registered office, ownership, directors, and group structure. Then match those details to the regulator’s record.

Small discrepancies can be meaningful. A seller may present a similarly named affiliate rather than the licensed entity. A website may belong to one company while customer contracts name another. A license may cover a subsidiary but the bank account and sales activity sit in the parent. A registration may have been copied from an unrelated entity.

Verify the entity through the official corporate registry and the regulator’s official database. Do not rely on a certificate image, broker spreadsheet, or link controlled by the seller.

Identify What Type of Regulatory Status it is

The word “license” is often used to describe very different statuses:

• A license or authorization to conduct specified activity;

• A federal AML registration

• A state or local registration;;

• An exemption from licensing;

• An agent or authorized-delegate appointment;

• A pending application;

• Membership in a trade body;

• A company incorporation; or

• An expired, surrendered, suspended, or revoked permission

Each status has a different legal effect.

In the United States, FinCEN MSB registration is a federal Bank Secrecy Act requirement for covered businesses. It is not, by itself, a nationwide state money-transmitter license. State licensing analysis remains necessary where the activity and nexus require it.

A Montana entity is a recurring example. Montana historically has not operated the same money-transmitter licensing regime as states that issue MTLs. Describing a Montana company, a state filing, or an exemption as a transferable “Montana money transmitter license” can mislead buyers into believing they have acquired an authorization that does not exist in that form. The correct analysis depends on the current law and the actual transaction, but the central point is stable: an exemption is not a license.

In Canada, a FINTRAC MSB registration addresses federal AML obligations, while the Bank of Canada’s Retail Payment Activities Act framework separately applies to covered payment service providers. One registration should not be presented as the other.

Test the Scope of Authority

Once the status is identified, read the scope. The regulator may authorize only certain services, customers, countries, branches, agents, currencies, or assets. Conditions may limit business volume, require prior approval for changes, or prohibit specific activity.

The review should answer:

• Which activities are permitted?

• In which jurisdictions does the permission apply?

• Does it cover consumers, businesses, or both?

• Does it cover custody, stored value, e-money, payment initiation, acquiring, FX, crypto exchange, Crypto transfer, or wallet services?

• Are there restrictions or conditions?

• Is the company required to maintain local substance, staff, capital, safeguarding, insurance, or Auditors?

• Are branches, agents, or delegates separately listed?

• Has the company materially changed its business without approval?

A money-transmitter license does not automatically authorize lending, deposit-taking, securities, investment services, or every form of crypto activity. An EMI authorization does not automatically solve acquiring, credit, or unregulated-country activity. A crypto authorization does not automatically permit the company to receive and transmit fiat.

Verify Current Status and Compliance History

A registry entry may show that a license was granted. The buyer must determine whether it remains active and in good standing.

Request evidence of renewals, fees, regulatory filings, audited financial statements, compliance reports, capital calculations, safeguarding reports, insurance, examinations, and correspondence. Ask about conditions, remediation plans, late filings, complaints, investigations, enforcement, and regulator meetings.

Public records may not show informal supervisory concerns. The seller may be restricted from sharing confidential examination material, but that issue should be managed by counsel and appropriate permissions —not used as a reason to provide no evidence.

The company should also be searched for enforcement actions, litigation, insolvency, tax liens, adverse media, customer complaints, sanctions, and director disqualifications. Review the owners and managers, not only the entity.

The Legitimacy and Usability Matrix

Examine Ownership and Change of Control

A buyer is not purchasing a static object. Ownership change can itself alter the regulatory status.

Determine the thresholds for direct and indirect control, voting rights, board appointment, significant influence, or other control concepts. Identify every proposed owner and source of funds. Assess whether the buyer’s management has the required experience and reputation.

The regulator may require prior approval, notice, re-registration, or a new application. Banks and providers may also require consent and full re-underwriting. A seller cannot guarantee approval.

Beware of structures designed to transfer practical control before approval: nominee shareholders, irrevocable voting proxies, bank mandates, management agreements, broad powers of attorney, or side letters giving the buyer control over compliance and operations. These can create unauthorized control and expose both parties.

Verify Customer Funds and Financial Condition

A regulated company can appear legitimate while hiding a balance-sheet problem. The review should reconcile customer liabilities to safeguarded or protected assets, bank balances, wallets, provider balances, and the internal ledger.

Request recent bank statements, safeguarding or trust confirmations, reconciliations, capital calculations, accounts payable, tax records, debt, reserves, chargebacks, customer claims, and off-balance-sheet obligations. For crypto businesses, reconcile on-chain assets, exchange balances, custody accounts, and customer liabilities.

Unexplained differences are a critical red flag. A license has little value if the company has a customer-funds shortfall or insufficient capital.

The buyer should also assess runway. Some regulated entities require ongoing staff, audit, insurance, local office, compliance, reporting, and capital even when they have no revenue. A dormant company can consume significant cash before the buyer launches.

Test the Compliance Program in Operation

Legitimacy is not proven by a policy manual. Sample the evidence.

Review KYC and KYB files, beneficial ownership, sanctions results, customer risk ratings, transaction alerts, suspicious-activity decisions, complaints, refunds, fraud cases, agent or merchant oversight, training, audit findings, and remediation. Confirm that policies reflect the actual products and systems.

A company may have purchased templates that mention products it never offered or omit the activity it actually performed. Dates may be inconsistent. Employees named in policies may have left years ago. The transaction-monitoring vendor may be inactive. No one may have reviewed alerts.

These signs do not always mean fraud. They do mean the company may be non-operational or non- compliant, which is highly relevant to value and approval risk.

Banking is Evidence, Not Proof

An active bank relationship can support legitimacy but must be understood precisely. Ask:

• Which legal entity owns the account?

• Is it an operating, customer-funds, safeguarding, trust, FBO, settlement, reserve, or exchange account?

• What activity did the bank approve?

• What are the limits and countries?

• Is the account active and unrestricted?

• Does the agreement require notice of ownership or business changes?

• Will the bank re-underwrite the buyer?

A shell company may have an ordinary account that cannot receive third-party money. A licensed business may have an account only because it has processed no transactions. A bank account should never be marketed as proof that a future business model is approved.

Validate Providers, Contracts, and Technology

If the seller claims the company is turnkey, verify every component.

Banks, sponsors, card programs, exchanges, custodians, processors, liquidity providers, payout partners, KYC vendors, and technology platforms should be confirmed through executed contracts and, where appropriate, direct consented contact. Review termination and change-of-control clauses, reserves, minimums, territories, products, and subcontractors.

Technology should be tested. Confirm ownership of source code and domains, access to cloud environments, security controls, ledger accuracy, reconciliation, API integrations, wallet keys, data rights, backup, and business continuity. A branded front end without a reliable ledger is not a payment platform.

Red Flags that Justify Stopping

Certain signs should pause or end the transaction:

• Pressure to pay before registry verification;

• Refusal to identify the legal entity or regulator;

• A certificate that cannot be matched to official records;

• A “license” that is actually incorporation, registration, or exemption;

• Guaranteed change-of-control approval;

• Requests to use nominees or conceal the buyer;

• Unexplained customer funds or bank balances;

• Missing regulator correspondence or financial statements;

• An active bank account that cannot be verified;

• Unusual urgency tied to license expiry;

• Large volume claims with no audited evidence;

• No compliance staff, files, or monitoring records;

• Providers that have not consented to ownership change;

• Use of personal wallets or accounts; and

A seller who discourages independent legal or regulatory advice.

A sophisticated fraud can provide documents. The test is whether the facts reconcile across independent

Genuine but Unusable: The Most Common Outcome

The most dangerous opportunities are not obvious fakes. They are genuine entities that cannot do what the buyer expects.

A real federal registration may not solve state licensing. A real license may cover only one jurisdiction. A real EMI may need significant local substance and safeguarding. A real crypto registration may not permit fiat transmission. A real bank account may close after ownership change. A real dormant company may require extensive remediation. A real exemption may apply only to narrow facts.

The diligence conclusion should therefore be expressed in operational terms:

• Authentic and suitable;

• Authentic but requires conditions or remediation;

• Authentic but unsuitable for the intended model;

• Status unclear and requires regulator confirmation; or

• False, misleading, expired, or otherwise unacceptable.

A Proper Verification Report

The final report should include:

1. Legal-entity and ownership verification;

2. Official regulatory status and evidence;

3. Scope, conditions, and geographic analysis;

4. Good-standing and compliance review;

5. Change-of-control requirements;

6. Customer-funds and financial reconciliation;

7. Banking and provider continuity;

8. Operational and technology capability;

9. Litigation, enforcement, and reputation findings;

10. Suitability for the intended business;

11. Remediation, cost, and timing; and

12. A clear proceed, proceed-with-conditions, renegotiate, or reject recommendation.

The report should distinguish facts, seller statements, legal opinions, assumptions, and items not verified.

How Faisal Khan LLC Can Help

Faisal Khan LLC helps buyers, investors, founders, and financial institutions assess whether a purported MSB, money transmitter, EMI, SPI, crypto authorization, exemption, or regulated company is genuine, active, usable, and suitable for the intended business.

The review connects registry and corporate verification with scope, change of control, banking, compliance, customer funds, providers, operations, and commercial fit. The objective is to prevent a buyer from paying for a permission that is false—or, more commonly, real but functionally useless.

Selected Authoritative References

These references support the current regulatory and supervisory context. They are not a substitute for jurisdiction-specific legal advice.

1. FinCEN - Money Services Business Registration

2. CSBS - State Money Transmission Framework

3. Bank of Canada - Retail Payments Supervision

4. New York DFS - Regulated Entities