Fintech Launch Readiness Checklist

Regulatory items below are orientation, not legal advice. Financial services regimes vary sharply by jurisdiction and by activity, and the details decide the outcome. Confirm your position with qualified counsel before launch.

Product: _______________ Owner: _______________ Date: _______ Jurisdictions: _______________

1. Permission to operate#

• [ ] The regulated activity being performed is identified precisely
• [ ] Authorisation, licence, exemption or agent status confirmed in writing
• [ ] If operating under another firm's permission, the agreement is signed and its limits understood
• [ ] Client money / safeguarding requirements identified
• [ ] Consumer-facing communications reviewed against the applicable rules
• [ ] Complaints procedure exists and is published

🔴 "We are just the technology provider" is a position that requires legal confirmation, not an assumption. It frequently does not survive contact with the regulated activity actually being performed.

2. Money movement#

• [ ] Every path money can take is drawn, including failure and reversal paths
• [ ] Every payment operation is idempotent — a retried request cannot pay twice
• [ ] Idempotency keys generated by the client, stored, and honoured
• [ ] Timeouts do not create ambiguity — you can always determine whether a payment happened
• [ ] Partial failure handled: money left neither in limbo nor duplicated
• [ ] Refund, reversal and chargeback paths built, not assumed

Test performed: submit the same payment twice. Result: _______________

The double-payment defect is the most common serious bug in payment systems, and it is nearly always a missing or ignored idempotency key.

3. Ledger integrity#

• [ ] Double-entry ledger — every movement has a matching pair
• [ ] Ledger is append-only; corrections are new entries, never edits
• [ ] Balances derived from the ledger, not stored and updated independently
• [ ] Currency handled in minor units as integers, never floating point
• [ ] Rounding rule defined, documented and consistent
• [ ] Multi-currency conversions record the rate and its timestamp

4. Reconciliation#

• [ ] Automated reconciliation against every external party — bank, processor, scheme
• [ ] Runs daily, with a defined cut-off
• [ ] A break process exists: who investigates, in what time, and who is told
• [ ] Unreconciled items age-tracked and escalated
• [ ] Reconciliation status visible to someone accountable

What happens to an unexplained break older than a week? _______________

A reconciliation nobody acts on is a report. The break process is the control.

5. Financial crime#

• [ ] KYC / identity verification appropriate to the risk
• [ ] Sanctions screening at onboarding and on an ongoing basis
• [ ] Transaction monitoring with tuned thresholds
• [ ] Suspicious activity reporting route defined, with a named responsible person
• [ ] Records retained for the required period
• [ ] Staff training completed

6. Data and security#

• [ ] Card data handling scope determined; PCI DSS obligations understood
• [ ] Card data not stored unless genuinely required and permitted
• [ ] Personal and financial data encrypted in transit and at rest
• [ ] Access to production financial data restricted, logged and reviewed
• [ ] Production data not copied into test environments unmasked
• [ ] Penetration test completed and findings addressed

7. Operational resilience#

• [ ] Behaviour when a payment provider is unavailable — queue, fail, or fail over
• [ ] Customer-facing message for each failure mode
• [ ] Recovery objectives defined and tested
• [ ] Restore tested on ____ — took ____
• [ ] Incident process names who decides, who communicates, and regulatory notification duties
• [ ] Dependencies on third parties documented, with their own resilience assessed

8. Before go-live#

• [ ] End-to-end test with real money, small amounts, including a refund
• [ ] Reconciliation run on that test and balanced
• [ ] Duplicate submission tested
• [ ] Rollback plan that does not strand customer funds
• [ ] Support team briefed on what to do when money appears missing
• [ ] Someone is accountable for the financial position daily

Sign-off#

Back to FinTech