By sector
Fintech diligence
Licensing, unit economics that depend on interest rates, credit risk that appears late, and the sponsor-bank dependency that decides whether the company can operate at all.
Realistic time Ten to twenty hours
Fintech diligence has a question that comes before all the others: is the company permitted to do what it is doing. Financial services are licensed activities almost everywhere, and a company operating under someone else's licence, under an exemption, or in the belief that its activity falls outside the regime has a regulatory position that must be understood before anything else is worth assessing.
The second distinctive feature is that risk arrives late. A lending business writing new loans looks excellent for the first year, because defaults have not happened yet. Growth flatters credit quality, and a portfolio that is growing fast will always show a low default rate as a proportion of the total. Static-pool analysis by vintage is the only honest view.
Third, much fintech revenue depends on variables the company does not control: interest rates, interchange fees, sponsor-bank terms and regulatory decisions. A business whose margin comes from deposit interest has a business model that central banks can change.
01
Licensing and regulatory position
Establish precisely what the company is authorised to do, by whom, and whether the authorisation is its own. Operating as an agent of a licensed institution, under a sponsor bank, or through a partner's permissions is common and workable — and it means the company's ability to operate depends on a relationship it does not control.
The site's regional desks link to the relevant regulators. Registers are public in most jurisdictions and checking a claimed authorisation takes minutes: search the regulator's own register for the entity name and confirm the permissions match the activity.
Then ask about the pipeline of regulatory change affecting the category. Payments, consumer credit, crypto assets and buy-now-pay-later have all seen substantial regulatory tightening, and a business model that depends on a current gap is a business model with a deadline.
Check
- What licences or authorisations does the company hold, in its own name?
- Check the regulator's public register directly rather than accepting a claim.
- If operating under a partner's licence, what are that agreement's termination terms?
- Which regulatory changes in the pipeline affect this model?
- Are anti-money-laundering and know-your-customer processes documented and tested?
02
Where the revenue actually comes from
Fintech revenue lines behave very differently. Interchange is regulated and has been cut in several jurisdictions. Interest income on deposits moves with central bank rates and is not an achievement of the business. Subscription revenue is the most durable. Lending margin carries credit risk that has not yet materialised.
Ask for revenue split by line and by driver, then ask what each line would be under a materially different rate environment. A company whose profitability appeared when rates rose has a different quality of earnings from one whose subscription revenue grew.
Check
- Revenue by line: interchange, interest, subscription, lending margin, fees.
- What each line would look like with rates several points lower.
- Are interchange rates in this market subject to a regulated cap?
- What proportion of revenue depends on a single partner relationship?
- Unit economics per customer, excluding interest income.
03
Credit risk, if the company lends
Any business extending credit must be assessed on vintage. Group loans by the month they were written and track how each group performs over time. A growing book will always show a flattering aggregate default rate, because the newest and largest cohort has not had time to default.
Establish whether the company holds the credit risk on its own balance sheet or passes it to a funding partner, and what happens to the funding line under stress. Facilities have covenants, and a breach in a downturn can stop originations at exactly the moment the company most needs them.
Finally, ask whether the underwriting model has been tested through any kind of downturn. A model trained entirely on benign conditions has not been validated against the conditions in which it matters.
Check
- Static-pool default and loss curves by vintage.
- Who bears the credit risk, and under what terms?
- Funding facility covenants, and what happens if they are breached.
- Has the underwriting model been tested against a downturn?
- Collection and recovery rates, and how they are achieved.
04
Operational dependencies
Fintech companies typically depend on a stack of third parties: a sponsor bank, a card issuer, a payment processor, an identity verification provider, a core banking platform. Each of those relationships is a potential single point of failure, and the contracts are often terminable at surprisingly short notice.
Ask which relationship would take longest to replace. That answer identifies the company's real operational risk more directly than any risk register.
Check
- List every regulated or infrastructural third party the business depends on.
- Termination and change-of-control terms in each key agreement.
- Which relationship would take longest to replace, and how long?
- Any history of a partner terminating or repricing?
Stop and think
Red flags
- Operating in a regulated activity without clear authorisation or a documented exemption.
- A licence claim that cannot be confirmed on the regulator's public register.
- Default rates presented as a proportion of a rapidly growing book rather than by vintage.
- Profitability that appeared when interest rates rose, presented as operating leverage.
- A sponsor-bank agreement terminable at short notice with no alternative in progress.
- An underwriting model never tested outside benign conditions.
- Compliance treated as a cost centre to be minimised rather than a licence to operate.
Take these into the room
Questions to ask the founders
- What are you authorised to do, by whom, and in whose name is the permission?
- Show me the default curves by vintage rather than in aggregate.
- What does the P&L look like if rates fall three points?
- Which third-party relationship would take longest to replace?
- What regulatory changes are coming that affect this model?
- Who bears the credit risk, and what are the funding covenants?
- When did a regulator last examine you, and what did they say?
From the decoder