Regulatory Applicability Matrix

What is a regulatory applicability matrix?

A regulatory applicability matrix is the list of laws, rules, and binding standards that apply to an institution’s products, with the reason each one applies. Sponsor banks ask fintechs for one during due diligence, examiners use one to scope a review, and a compliance risk assessment starts from one. The article Your Sponsor Bank Will Ask for a Regulatory Map. Build It First. explains why the map matters and where homemade versions usually break.

What the workbook covers

The matrix lists 57 federal requirements in six areas:

• Deposits and payments (13), including Regulation E, Regulation DD, Regulation CC, deposit insurance signage, and the Nacha rules
• Privacy and communications (12), including GLBA, information security, FCRA, Red Flags, TCPA, and CAN-SPAM
• BSA/AML and sanctions (10), including the program rule, CIP, beneficial ownership, SARs, CTRs, and OFAC
• Lending (8), including Regulation Z, Regulation B, the Military Lending Act, the SCRA, and Regulation F
• Cross-product consumer protection (7), including UDAAP, state UDAP laws, E-SIGN, and complaint response
• Governance and oversight (7), including third-party risk management, bank-fintech deposit arrangements, CRA, and Regulation O

Each row gives the citation, the agency, what the rule covers, and the product answers that trigger it. The workbook then shows whether the rule applies, room to override that result with a reason, how the rule applies to a fintech or to a bank or credit union, the lifecycle stages it touches (marketing, onboarding, disclosures, servicing and transactions, errors and disputes, collections, and records and closure), the KCG library documents that address it, and a dated note on recent changes. Owner, policy adopted, and last reviewed columns turn the list into a working control. A summary tab counts the applicable rules by area and by lifecycle stage.

How do you use it?

1. On the Profile tab, choose the institution type (a fintech in a sponsor bank program, a bank, or a credit union) and answer the product and activity questions.
2. On the Matrix tab, review the calculated result for every row. Where your facts differ, enter an override and the reason.
3. Add rows for state laws, licenses, and anything else specific to your program.
4. Assign an owner to each applicable row, record whether a policy is adopted, and clear the Check column.
5. Review the matrix at least once a year and whenever products, states, or laws change, and use it to scope the compliance risk assessment.

What it does not cover

The matrix covers federal consumer, BSA/AML, sanctions, privacy, and key governance requirements for deposit, payment, card, and consumer and small business lending products. It does not cover mortgage lending, securities, insurance, or most state requirements, which you add yourself. Wire transfer rules (UCC Article 4A and Regulation J) are not listed, so add a row if your program sends wires. Applicability depends on your facts; confirm close calls with counsel.

Who should use it

• Fintech compliance leads preparing for sponsor bank due diligence or a periodic bank review
• Compliance officers at banks and credit unions scoping the annual compliance risk assessment
• Sponsor bank partner oversight teams checking a fintech partner’s regulatory map

The matrix is also part of the Documentation and Tools Kit, the Sponsor Bank Review Kit, and the Fintech Partner Oversight Kit, alongside the policies and workbooks it points to. Fintechs can check the rest of their program against the free Sponsor Bank Readiness Checklist.