FinTech: Ground Rules and Checklist for Starting Up and Going Global

Lothar Determann Manuel Lorenz

By Lothar Determann and Manuel Lorenz

Lothar Determann is a partner at Baker McKenzie in San Francisco & Palo Alto. He has been assisting companies take products, business models, intellectual property and contracts global for nearly 20 years. Lothar advises on data privacy law compliance, information technology commercialization, copyrights, open source licensing, electronic commerce, technology transactions, sourcing and international distribution. He is a member of the firm’s International/Commercial Group and the Global Privacy & Information Management Working Group.

Manuel Lorenz is a partner at Baker McKenzie in Frankfurt, Germany. Manuel is a financial services and capital markets lawyer with particular focus on cross-border offerings of financial services, helping clients navigate the challenges of offering their products and services and/or establishing a physical presence outside their home market. Manuel has assisted in several international roll-outs and scale-ups of FinTech companies. In addition he has assisted in IPOs and other securities offerings of a number of tech and biotech companies.

Technology companies are riding the wave to global expansion faster than firms in most other industries. As soon as tech firms have a viable product they can turn to global markets hungry for the latest and greatest innovation. On the quick trip from the garage to foreign markets, tech businesses face a number of common legal and regulatory issues. FinTech companies operate in a highly regulated environment and may find themselves subject to banking, securities or payment services regulation. Startups cannot always address these issues proactively due to limited time and resources. Thus, having a checklist of important issues to keep in mind is key to navigating the early days of international expansion.

Where to Incorporate?

Entrepreneurs should incorporate a new company for each new venture, as a liability shield, to clarify ownership percentages and to allocate intellectual property ownership. This raises the threshold question: Where to incorporate? Key checklist items to consider are where do you and any other founders want to live and work.

Incorporating in one jurisdiction and living or working in another country usually complicates things from a tax and regulatory perspective and is rarely advisable. If you and co-founders are flexible, you should consider location preferences of potential investors, incubators, accelerators, business angels and other business partners. For example, Venture Capitalists in Silicon Valley and New York like to invest in U.S. companies (particularly companies incorporated in Delaware), because their corporate laws are familiar and flexible.

FinTech founders specifically should also consider the regulatory environment and enforcement climate in the context of incorporation location choices, while keeping in mind that they will usually also have to comply with the laws in each jurisdictions where they target customers. If the business model is regulated, applicable laws may prescribe that the regulated entity must be incorporated in the jurisdiction where the company is supervised and that cross-border business is not permitted.

A characteristic example of this is Germany, where normally foreign financial or banking services providers will need to acquire a license - which requires a permanent establishment in Germany - in order to offer their services to customers in Germany, supposing that the EU passport (as considered below) does not apply. Another example is Hong Kong, where in order to determine whether cross-border activities will be subject to the licensing requirements (and thus whether they should incorporate in Hong Kong or register a branch), the key question to ask is whether that overseas person has actively marketed its regulated activities (RA) - services to the Hong Kong public.

On the other hand, the U.K. operates a relatively open regime in regards with Third Country Firms (TCFs) which enables TCFs to deal with U.K.-based clients under certain exemptions in relation both to the need to be authorized and in relation to marketing to U.K. persons. In the European Economic Area (EEA), for certain types of firms (e.g. deposit taking banks, investment firms, payment services institutions, insurance intermediaries) the situation is more relaxed, since companies licensed in one EEA country may offer their services across the border or establish a branch office without having to obtain a further license in the host country (so-called “European Passport"). That allows a greater freedom of choice if the target customers sit in the EEA.

Even on the early stage of their venture, entrepreneurs should keep in mind the exit perspective from their business. Sometimes, incorporation close to the prospective acquirers may maximize your exit opportunities and there are certain places of incorporation that attract the investors more than the others (we described them further in the last part of this article).

Other features to consider include tax, employment (law and ability to find skilled personnel), general ease of doing business (e.g., familiarity of languages), availability of government subsidies/financing for startup businesses, proximity of first-rate academic research institutions and possibly proximity to technical infrastructure (e.g., co-location providers of shared servers or space for proprietary servers).

Financial Services Regulation

What distinguishes FinTech businesses from many other tech companies is that they operate in or close to a highly regulated environment. Many FinTechs realize that their business model is a regulated activity way too late when the product is close to being marketed or — even worse — when it is already on the market or as part of a due diligence during a financing round.

In the U.S., for example, FinTech companies face a maze of laws and regulators at the federal and state level. Companies offering virtual currencies or payment processing services typically have to register as money transmitters in each U.S. state comply with varying procedural requirements and standards regarding net worth, bonding and investor due diligence.” Legislatures conceived many current laws with large financial institutions in mind - not technology focused start-up companies - and some regulatory regimes are prohibitively burdensome and unevenly applied and enforced.

Currently in the U.S., there is a tension between the Office of the Comptroller of the Currency (OCC) and specific individual states, like New York and California, as to whether the federal Bureau or the states should set the regulatory framework for the FinTech companies. The OCC wants to create a new national bank charter for FinTech companies, whereas the states want to be the competent bodies for this task in order to avoid regulatory arbitrage and forum shopping.

In the European Economic Area (EEA), large areas of financial services regulation have been harmonized in the EEA, but this does not apply for every form of business in the financial sector. A prime example is lending to businesses. While consumer lending is pretty much a regulated activity everywhere, lending to businesses is a license-free activity in many countries, while in others a banking or other license may be required. Three examples of jurisdictions that provide for such a license-free activity are the U.K., Belgium and Poland, while Germany, France, Italy, Austria, the Netherlands and Luxembourg are license-requiring jurisdictions.

Moreover, many FinTech businesses combine existing services and bundle them or unbundle regulated services and provide only parts of the value chain, while leaving other parts to be delivered by established players. This can create difficult questions whether the unbundled element delivered by the FinTech company is subject to regulation or not. Representative examples are the e-wallet and crowdfunding platforms that FinTech companies have developed in their capacity as financial intermediaries.

Other FinTechs invent completely new types of services. An example are firms that provide technical access to bank accounts via the internet as part of a payment solution. Is this a regulated payment service? The answer under EU law is: currently not but this type of activity will be regulated as soon as the Second Payment Services Directive (PSD II) enters into force in January 2018.

Why is the issue of regulation so critical? The reason is that a regulated business activity typically requires a license from the local regulator. Applying for the license not only requires skilled and reliable managers (usually at least two), sufficient capital, but also the submission of a business plan which must also show the organizational setup that enables the company to comply with applicable regulation.

Getting the license may take several months, sometimes more than a year and the resulting compliance obligations will be manifold, including risk management, stress testing, internal audit, a compliance department, extensive compliance handbooks, anti-money laundering compliance etc. Moreover, the company will have to go through a compliance audit every year and is subject to numerous recurring and event-driven filing obligations. Certain firms like banks must also fulfill regulatory capital and liquidity requirements and provide regular financial reporting to the supervisory authority.

Such a license requirement can thus operate as a business killer quite easily for sheer cost and timing reasons — unless the founders find ways to overcome the obstacles (see next section with examples of options). And who wants to go through all these steps for a business model that hasn’t even been tested in the market?

Certain countries and governments have recognized that license requirements may hamper innovation in the financial sector and are working on solutions to allow FinTech companies to “test drive” their business model without the necessary licenses in a “controlled environment”. This is referred to as the regulatory “sandbox” and is used for example in the U.K., Singapore, Australia, Hong Kong and Abu Dhabi. There are intense efforts to develop a “sandbox” in Poland, while Switzerland and Malta are having high level discussions about this issue.

Some regulators provide other forms of relief for startup companies. An example is the exemption that will be implemented in the EU with the PSD II for mobile network providers to process payments to charities and to pay for tickets if the single payment is less than 50 EUR and the monthly transaction volume per customer does not exceed 300 EUR. Another example is Germany, which exempts crowdlending from prospectus requirements below certain investment limits.

As a result, every FinTech company should analyze quite early whether its business model is regulated. Since FinTechs are low-budget companies, the question is how to do this on a budget.

  •  This is best approached by identifying key jurisdictions (e.g., the home market and a few larger neighboring countries) and narrow down the analysis to not more than a handful of countries.
  •  The second step should be to develop the business model facts and acceptable modifications and alternatives in case the initial model proves to be subject to a license requirement.
  •  The third step is to work on the basic legal model, since no lawyer or regulator will be able to pass opinion on the license requirements unless a few basic legal questions can be answered: Which different parties are involved? Which party undertakes which obligations to which other party? Who is the customer, who is the supplier, who is a business counterparty? Who is the agent, who is the principal? What other contractual relationships are needed, e.g. a distributor, service or license arrangement?
  •  Once this is done, it may be possible to contact the regulator and ask (potentially on a no name basis through outside counsel) whether the model is regulated. Some regulators may still refuse to answer the question, arguing that they are not the legal advisers of the FinTech, while others may be more cooperative and might even have a special designated department that deals with FinTech queries.
  •  It is therefore a good idea to develop your own first view of the risk of being regulated before discussing your model with the regulator. Many regulators put out guidance in the form of circulars or information leaflets that will at least give a first view of the topic. Other guidance may be coming from free materials published by law firms. Baker & McKenzie has published the Global Financial Services Regulatory Guide App which provides a first overview of the types of business activities in the financial sector that are regulated and the trigger points for regulation of cross-border provision of financial services (The App may be downloaded for free from AppStore). Joining a FinTech industry association may also provide valuable access to information.
  •  Sometimes, it may also be helpful to study competitors and how they are regulated, but be aware that small details in the business model may have a big impact on the question whether a business model is regulated or not.
  •  If no clarity can be obtained, it may be advisable to invest at least a small amount into a feasibility study prepared by a specialized law firm. This may still be a lot cheaper than having to pay a hefty fine and receiving an order from the regulator that shuts down the business. In some countries, operating a regulated business in breach of respective regulations is a criminal act that could get the operators of such business into jail!
  •  When planning on expansion into other markets, FinTechs should not assume that their unregulated status automatically applies also in other countries. Each country has a different regulatory environment. Therefore, legal advice should be taken before expanding the business into new markets abroad.
  •  Finally, the regulatory risk needs to be reassessed regularly, since the regulatory environment changes and businesses previously unregulated may require a license in the future.

Alternative Strategies

If a FinTech business model is regulated and the FinTech company does not (yet) want to apply for a license, alternatives need to be explored.

First, small variations of the model may bring it outside of the scope of regulation. Typical triggers of regulation are specific asset classes, e.g., securities vs. fund interests, handling customer assets vs. just providing technical services, dealing vs. distributing or advising, providing regulated services vs. aggregation of third party regulated services; providing wholesale services vs. serving retail clients.

Thus, FinTechs could try to avoid such triggers by:

  •  not handling customer monies or assets.
  •  focusing on delivering the technical solution and communicating factual information rather than the financial service.
  •  not delivering “classic” banking or investment services such as deposits, loans or brokerage activities.
  •  concentrating on distribution or aggregation models.

Not in all cases, this will avoid regulation. If tweaking the business model does not help, consider partnering with a regulated institution whose license may cover the FinTech company’s activity as part of its extended enterprise. Some models that have worked so far are:

  •  “White Label” arrangements where the regulated entity provides the service under its own name to the customer and the FinTech provides only the technical infrastructure.
  •  “Fronting Bank” models, where a regulated financial institution legally provides the service to the customer, but under the brand of the FinTech and with the FinTech owning the client relationship and handling most of the services based on an outsourcing agreement with the regulated entity (also know as “reverse outsourcing").
  •  “Tied Agent” models, where the FinTech operates in its own name, but as an agent of a regulated institution which is responsible for its agent and ensures compliance with applicable regulation.

FinTechs should not expect that their services or products stay wholly unregulated if they operate in a cooperation model with a regulated institution. To the contrary: In case of white label arrangements, the services or products must be “fit” for being offered by a licensed financial institution and this will require compliance with regulation. In the case of a reverse outsourcing, the licensed outsourcing institution will impose unto the FinTech the observance of all regulatory rules applicable to the institution. The same applies in the tied agent model. However, in each case the FinTech will have avoided the need for a costly own banking, investment or payment services license. Needless to say that partnering with a financial institution also means that the earnings must be shared with the cooperation partner and the cooperation partner will have to pass through some of its statutory and regulatory obligations by way of contract to the FinTech company.

Alternatively, if regulation cannot be avoided, the FinTech company should consider moving to a different jurisdiction with a potentially lighter regulatory environment, for example:

  •  a country where for some reason, the service is not regulated or;
  •  where the regulator offers a “sandbox” or some temporary exemption for small startup companies or;
  •  where the regulator is known to be less strict than in more developed markets (regulatory arbitrage). This strategy can backfire, however, since business partners may be less enthused by a player who takes a minimalistic approach to regulation.

Also, a company operating on the basis of an exemption or in a regulatory “sandbox” may be precluded from offering its services across the border using the passport mechanism.

Intellectual Property

To exploit their intangible valuables, FinTech businesses need to own, perfect and protect their intellectual property rights. Like property rights in real estate and chattels, intellectual property rights are territorial and subject to different legal regimes in every country. When entrepreneurs pick names for their company and products, they should think ahead about whether trademark registrations and domain names are available, how the chosen names sound in other languages and what connotations a term may have abroad.

While copyrights are as territorial as other intellectual property rights, they are largely harmonized by international treaties. Authors tend to acquire copyrights simultaneously in their home country and around the world simply by writing their works down, be it text or software code. Patents, however, require local filings, prosecution and greater budgets; thus, companies must be more selective and strategic about where to obtain patents.

In choosing a home base for their company, entrepreneurs are often focused on customer demand and costs of doing business. However, they should also consider the tax and overall regulatory environment most favorable for their business. If they start in a suboptimal jurisdiction, companies can still migrate intellectual property ownership to low tax jurisdictions later, but this comes at a price that increases quickly as the business expands and its valuation increases.

Seizing International Opportunities

Most startups focus initially on domestic success. At this stage, unsolicited purchase orders or requests for trial arrangements from abroad may start arriving. Why not seize the opportunity for extra revenue and to establish the product internationally?

There are also certain situations, when you really should think about your product from an international perspective just from the beginning of your operation. Especially if you operate in smaller markets. Take the example of Poland. In Poland analytics talk about the “38 million’s curse” (38 million it is an approximate number of the Poles —the number may appear to create a big market, but it is only a mirage). The Polish market is not big enough to enable the domestic collection of funds sufficient to develop an excellent product, but at the same time it is big enough to not force a startup to think about the foreign expansion from the first day of its operation. As a result, there are ventures in the Polish market which started with a good idea, but could not develop it due to a lack of funds). Some Polish FinTech entrepreneurs should have acted like their peers from smaller neighboring countries — like Estonia with population of 1.3 million — that have no other choice but to design their products for international markets.

Some care should be applied to international operations. Many laws will not apply regulation in case of customers who send unsolicited purchase orders for financial products and services or who inquire about such products and services ("reverse solicitation” or “passive freedom of services"). However, some laws may use a different approach and focus on territoriality. In other words, personal visits, or signing agreements at the location of the customer may trigger a license requirement for the business in that country.

In a pure business-to-business contact, a FinTech company that is unsure of the foreign legal, tax and customs regimes that apply to its products can contractually shift most foreign compliance and tax burdens to a foreign business customer particularly in the context of software licenses (e.g., software for financial institutions). Many companies refer to their primary place of business in sales terms, including in the choice of law, dispute resolution forum, and place of delivery or performance. In some cases, however, a choice of a foreign law can be just as good or better for a company, so if a foreign buyer insists on a contract governed by their domestic law, a comparative analysis may prove helpful.

Companies have to ensure compliance with export control laws before they sell any products or transfer technical know-how to foreign buyers, even if the buyers come to their jurisdictions. Sales to embargoed countries or ‘denied parties’ and transfers without the required prior approvals or notifications can result in serious sanctions, particularly in the U.S.

Going Global Online

Once a company goes ‘live’ with a web or mobile site, it immediately becomes subject to various foreign laws. Under public international law, every country can and does enact laws that apply worldwide, including trade laws, competition regulations, data privacy laws, content restrictions and consumer protection laws. While countries generally have neither the interest nor the resources to enforce these laws outside their borders, a few types of laws tend to cause companies trouble if not addressed early on.

A company that sells to consumers in other countries should clarify to visitors of its web or mobile site that it is intended only for residents of jurisdictions for which the company has conducted at least some basic legal due diligence. Not doing so may expose such firms to the risk of running afoul of financial services license requirements or consumer protection laws on distance selling or telemedia laws.

Most financial services regulators have put out detailed guidance under what conditions an internet offering is triggering a licence requirement. As a rule of thumb, firms should try to keep out consumers from other jurisdictions by using “legal gates” (customers having to enter their country of origin and a postal code before being able to proceed), disclaimers, limiting credit card acceptance, or geo-targeting. For specifically targeted jurisdictions, consumer site operators should familiarize themselves and comply with financial services regulation, tax obligations, translation requirements and restrictions on contract terms.

Even wholesale offerings to professional clients and counterparties may trigger a license requirement if a website offering is targeted at a specific market.

Data privacy laws in Europe and other countries require affirmative opt-in choices for marketing emails and cookies placement, specific disclosures in privacy notices, data subject access rights and adequate safeguards for international data transfers. An operator of a passive dotcom site can relatively safely rely on a disclosure that it complies only with the laws of its home jurisdiction. But an interactive site that places cookies on foreign computers and targets consumers in other countries with translated websites should consider additional compliance steps to satisfy data privacy laws in the targeted jurisdictions.

Signing up Suppliers and Distributors

A FinTech company that buys products, web hosting or other services abroad needs to consider import restrictions like customs laws, prohibitions on importation of encryption technologies, and must also comply with local withholding tax obligations at home and adjust its contracts. Additionally, those firms should consider numerous tax and legal issues when selecting the best distribution model. Options include buy-sell models, involving sales to wholesale distributors, resellers, franchisees and referral agent models, where intermediaries receive a commission for referring buyers.

FinTech companies who are regulated should be aware that by using distributors or intermediaries to sell their products or services abroad they may be found to engage in regulated activities also in those jurisdictions where their products or services are offered by such agents and intermediaries. Also, depending on the product or service, the intermediaries themselves may be subject to a license agreement.

Each distribution model has pros and cons in terms of risks, opportunities and the degree of control preserved by the company. The tradeoffs vary from jurisdiction to jurisdiction, subject to the following general principles:

  •  By appointing dependent agents in other jurisdictions, companies can establish a taxable presence with resulting tax reporting and remittance burdens, known as a “PE problem.”
  •  If a company engages an individual person as commission agent or other intermediary, employment laws and rules on misclassification have to be considered.
  •  By selling products to intermediaries abroad, companies can exhaust their intellectual property rights with respect to the sold items (e.g., software copies), which can prompt undesired re-importation and price disruptions.
  •  Under mandatory dealer protection laws in many countries, particularly Latin America, Europe and the Middle East, intermediaries are entitled to severance and other protections against termination. In some cases, companies can mitigate risks with contractual disclaimers, alternative dispute resolution clauses and or picking a less protected distribution model.
  •  Under foreign competition laws, particularly in Europe, companies face prohibitions regarding resale price maintenance, territory and customer allocation and other restraints of trade. As a rule of thumb, companies are allowed to exercise more control in the context of commission agency than buy-sell arrangements.
  •  Commission agents tend to involve greater risks of entanglement with foreign anti-corruption laws and the U.S. Foreign Corrupt Practices Act, particularly in the context of sales to governments or government-owned businesses.
  •  As a company enters into substantive, riskier, contractual relationships with companies abroad, it is more likely to face disputes. Arbitral awards tend to be enforceable in most developed nations under the New York Convention, whereas court judgments are often not recognized in other countries, particularly not injunctions.

Putting Boots on the Ground Abroad

As companies intensify foreign expansion, they will eventually find it necessary to have full-time, local representatives to supervise and audit suppliers, develop business or engage in direct sales. At this stage, foreign labor, corporate and tax laws will become acutely relevant.

Regulated businesses may require a license from the host country when setting up a branch office there (and may also have to inform their home state regulator). Establishing a representative office instead (e.g. to supervise distributors, scan the market and providing marketing support) may avoid the license requirement, but then great care should be taken that the rep office is not involved in the marketing or operative business.

Within the EEA, regulated companies may be able to use the EU passport to set up a branch office, but still their home state regulator needs to be notified and there will be waiting period before business may be commenced. Also, while the main competent regulator for the branch office will be the home state regulator, there will be additional supervision by the regulatory authorities of the host state.

Moreover, setting up a local presence with persons on the ground requires companies to address employment law requirements. Employees enjoy protections under local labor laws regardless of the contractual choice of law or attempt to characterize a relationship as one of independent contractors. Misclassified employees create increasing exposure each year a firm does not comply with labor laws and payroll tax requirements.

Most countries do not recognize the concept of “employment at will” and imply or require employment contracts. Companies should use employment agreements that conform with local law, are translated into the local language, and efficiently protect employers with respect to foreign labor laws by providing, for example, for probationary periods during which termination is relatively less restricted.

Working hours, whistleblower hotlines, computer monitoring and other programs must also be adapted to, and in many cases approved by, local governments to avoid running afoul of mandatory local laws. Granting stock options or other benefits is subject to various mandatory local law restrictions and consequences that need to be carefully considered and addressed to avoid costly surprises down the road.

Employees, offices and other foreign presences usually trigger tax reporting and remittance duties on the basis that they constitute taxable ‘permanent establishments’ of a company in another jurisdiction. This can result in double taxation and administrative burdens that can be avoided or mitigated by the incorporation of a local subsidiary. In this regard, entity options have to be examined.

During trial phases, companies occasionally establish temporary arrangements with the assistance of local ‘employee leasing,’ with businesses or contractors working from home under time-limited contracts. These arrangements have various disadvantages. As a rule of thumb, companies should seriously consider incorporating a local company or other entity if they engage a sales person, a provider of chargeable service or more than two other kinds of employees for more than six months in a foreign jurisdiction.

Additionally, companies need to document funding arrangements with foreign subsidiaries in intercompany agreements that comply with international transfer pricing principles and reflect arm’s length commercial arrangements.

International M & A

Apart from early organic growth, tech companies frequently expand internationally through mergers, acquisitions, spin-offs, asset sales and other corporate transactions. Also, your VC/PE partners would be interested in a good exit opportunities from their investment in your venture.

Preparation to both the funding rounds and the exit may be connected with incorporation of a company in a right place. It is good to think about it and select the place in advance.

Companies that buy or sell businesses across borders face a maelstrom of international tax and legal issues. Tax, corporate and securities laws often treat international deals quite differently from domestic ones and companies need to give careful thought to the transaction’s overall structure. Rules on if and when letters of intent are binding vary. Data privacy laws, language barriers, and unfamiliar documentation practices can hamper due diligence investigations.

Different rules on antitrust filings, collective labor consultations and acquired employee rights apply in case of business transfers, and in some cases even mere asset transfers or license arrangements. So from the practical perspective, the investors may prefer to buy a company incorporated under the laws that are familiar to them.

Also, some places are more attractive for the investors or buyers than the others. The study by Mind the Bridge and CrunchBase shows that in years 2012-2016 “3 out of 4 startups have been acquired by US companies” (in Europe London is the most active market in terms of exits — however it is still to be determined if it will remain after the Brexit, so you may notice that Paris and Frankfurt/Berlin are on the next positions).

You may think that it is irrelevant from the buyer’s perspective where its target is incorporated. However as the study further shows: “Both U.S. and Europe acquire startups primarily from their own region” and the data show “a very strong correlation between the countries and cities that have the largest amount of exits and the countries and cities with the most active acquirers.” So by transferring your office to the right place, you may increase your chance for a smooth exit and a high price (for example U.S. startups are more expensive than their counterparts from the EU).

Copyright © 2017 The Bureau of National Affairs, Inc. All Rights Reserved.