# Licensing, Legal, And Market Access Owner: Legal with Compliance, Risk, Finance and Operations Last updated: 2026-07-26 This document is an engineering and operations control map, not legal advice. Real-money launch requires qualified counsel, licensed partner/provider approval, contract evidence and executive go/no-go signoff for every target jurisdiction. ## Official Reference Points - De Nederlandsche Bank states that payment services in the Netherlands require DNB authorisation or an exemption: https://www.dnb.nl/en/sector-information/open-book-supervision/open-book-supervision-sectors/payment-institutions/licensing-requirement-for-payment-service-providers-overview/provision-of-payment-services/ - De Nederlandsche Bank public register is the reference point for checking supervised payment service providers: https://www.dnb.nl/en/public-register/register-of-payment-service-providers/ - The European Commission identifies GDPR as part of the EU data protection framework: https://commission.europa.eu/law/law-topic/data-protection/legal-framework-eu-data-protection_en - The European Commission describes DORA as the EU framework for financial-sector digital operational resilience: https://finance.ec.europa.eu/digital-finance/cyber-resilience_en - PCI SSC defines PCI DSS requirements for environments that store, process or transmit payment account data: https://www.pcisecuritystandards.org/standards/ ## Launch Rule The product remains demo/test-money only unless all required legal market-access controls are approved, signed or explicitly marked out of scope. Production-like environments must set legal evidence references through config before startup: - `BANKING_LEGAL_APPROVAL_REFERENCE` - `BANKING_REGULATED_ACTIVITIES_REFERENCE` - `BANKING_OPERATING_MODEL_REFERENCE` - `BANKING_LEGAL_MEMO_PACK_REFERENCE` - `BANKING_RESTRICTED_TERMS_REFERENCE` - `BANKING_PROVIDER_CONTRACTS_REFERENCE` - `BANKING_SAFEGUARDING_MODEL_REFERENCE` - `BANKING_LEGAL_POLICY_PACK_REFERENCE` - `BANKING_JURISDICTION_RULES_REFERENCE` ## Regulated Activity Decision Matrix Each regulated activity has an admin-managed `regulated_activity_decision` record in `legal_market_access_controls`. Required decisions: - E-money issuance - Payment initiation - Account information - Money transmission - Card issuing - FX - Crypto custody - Stablecoins - Savings/deposits wording and product behavior - Credit - Investment services Allowed launch states: - `approved`: Counsel has approved the activity for the target jurisdiction and evidence is attached. - `out_of_scope`: The product explicitly does not perform this activity. - `needs_legal_review`, `in_review`, `draft` or `blocked`: Real-money launch is blocked. ## Operating Model The operating model control must name the chosen model and supporting evidence: - Licensed entity - Registered agent - Sponsor bank - EMI/payment institution partner - Bank-as-a-service partner - Software-only model The model must map which entity owns safeguarding, customer funds, complaints, chargebacks, KYC/AML responsibility, provider contracts, regulatory reporting and customer-facing disclosures. ## Legal Memo Evidence Pack Every launch jurisdiction needs a `legal_memo` record with: - Jurisdiction and product scope. - Counsel-approved memo reference or evidence pack reference. - Expiry or next review date. - Explicit coverage for payments, IBAN/account issuance, cards, FX, crypto/stablecoins, savings/deposit wording and customer disclosures. - Residual restrictions and required customer disclosures. Draft memo records are seeded for `NL`, `EU` and `US`. They are placeholders only and do not approve launch. ## Restricted Terms Restricted words such as `bank`, `savings` and `deposit` are tracked as `product_term_approval` records. The default rule is conservative: - `bank`: Requires legal approval and wording review. - `savings`: Requires disclaimer unless a licensed savings/deposit model is approved. - `deposit`: Prohibited until deposit-taking permissions and protection disclosures are approved. Frontend and customer policy text must not imply licensed banking, deposit protection or protected savings unless the matching control is approved. ## Provider Contracts Real-money operations require signed provider contract controls before production traffic: - Licensed bank/payment provider for real IBAN/account issuance and payment rails. - Card issuer/processor for card creation, authorization handling, clearing and disputes. - KYC, sanctions, PEP, adverse media and transaction monitoring providers for onboarding and ongoing monitoring. - Crypto custody/provider contract or explicit disabled real-movement decision for crypto/stablecoins. Signed provider controls require `contract_reference`. Provider integration config separately blocks local adapters in production-like environments. ## Safeguarding The safeguarding model must define: - Client money and funds segregation model. - Insolvency treatment. - Which legal entity or provider holds customer funds. - Reconciliation owner and break escalation. - Finance signoff and ongoing review cadence. An approved safeguarding model requires evidence and finance/legal ownership. ## Customer Policies The following `policy_document` controls are seeded and must be approved before real customer onboarding: - Terms of service - Privacy notice - Fee schedule - Risk disclosures - Complaints policy - Chargeback/dispute policy Published policy records require `policy_version` and `evidence_reference`. Customer-facing wording must match the approved operating model and provider contracts. ## Jurisdiction Blocking Jurisdiction rules are tracked as `jurisdiction_product_rule` controls. Seeded rules keep Netherlands and EU/EEA access in test-only mode and block United States real-money access until legal eligibility is approved. The API and admin dashboard can store: - Allowed, prohibited, blocked or test-only status. - Required disclosures. - Product scope. - Evidence reference. - Expiry/review timing. ## Admin Operations Admin endpoints live under `/v1/admin/legal/*`: - Dashboard and all controls. - Regulated activities. - Operating models. - Legal memos. - Product-term approvals. - Provider contracts. - Safeguarding models. - Policy documents. - Jurisdiction rules. Writes require admin write scope and step-up authentication. Every write records an audit event with the control key, type, jurisdiction, product scope and status. ## Required Evidence Before real-money launch, attach evidence for: - Counsel memo per jurisdiction. - Operating model decision. - Restricted-term approval. - Signed provider contracts and certification packs. - Safeguarding and client-money model. - Customer policy pack. - Jurisdiction eligibility rules. - Executive go/no-go signoff.