Purpose

This recipe identifies which industry-specific regulations, licenses, and compliance requirements apply to a startup based on its vertical, data types handled, and operating regions. The output is a prioritized regulatory map with applicable laws, required licenses, compliance timelines, penalty ranges, and recommended first steps.

Prerequisites

Entity formed — completed Startup Legal Checklist
Business description — product, data handled, user types, revenue model
Target market — jurisdictions served
Data inventory — personal data categories collected and processed

Constraints

Regulations apply based on activities, not company labels. Processing payments = money transmitter regardless of branding. [src1]
Penalties: HIPAA up to $1.9M/category/year; COPPA up to $50,120/violation; money transmitter violations carry criminal charges. [src2][src3]
State requirements often exceed federal. Fintech may need all 50 state licenses. [src5]
Always engage specialized counsel before implementing compliance programs. [src1]

Tool Selection Decision

Industry	Primary Regulators	License Cost	Timeline	Penalty Range
Fintech	FinCEN, State regulators	$2K-$100K+/state	3-18 months	Criminal charges
Healthtech	HHS/OCR, FDA, State	$5K-$50K initial	3-12 months	Up to $1.9M/cat/yr
Edtech	FTC, State AGs	$0-$10K	1-6 months	Up to $50,120/violation
Insurtech	State DOI (50 states)	$5K-$50K/state	6-24 months	License revocation
Crypto/Web3	SEC, CFTC, FinCEN	$10K-$500K+	6-24 months	Criminal + civil

Execution Flow

Step 1: Identify Applicable Regulatory Categories

Duration: 30-60 minutes. Answer trigger questions: handles money/payments = MSB + MTL; handles PHI = HIPAA; users under 13 = COPPA; used in schools = FERPA; processes payments = PCI DSS. Regulations apply based on activities, not labels.

Verify: All trigger questions answered. Applicable categories identified.

Step 2: Map Fintech Requirements (if applicable)

Duration: 1-2 hours. Federal: MSB registration with FinCEN (free, within 180 days), AML/KYC program. State: MTL via NMLS in 49 states + DC. Surety bonds $25K-$1M per state. Shortcuts: BaaS partnership, sponsor bank model, regulatory sandboxes.

Verify: MSB filed. State licensing strategy determined. AML program documented.

Step 3: Map Healthtech Requirements (if applicable)

Duration: 1-2 hours. HIPAA: Privacy Rule, Security Rule (risk assessment required), Breach Notification Rule (60-day notice), Enforcement Rule. BAA required for every vendor touching PHI. 2025 proposed rule: annual audits, real-time monitoring. FDA: SaMD classification if software diagnoses/treats.

Verify: HIPAA applicability confirmed. BAA template ready. FDA pathway identified.

Step 4: Map Edtech/Children's Data Requirements (if applicable)

Duration: 1 hour. COPPA: verifiable parental consent, security coordinator, annual risk assessments, data minimization. 2025 amendments effective April 2026. FERPA: school official exception, no marketing use. 40+ states have student privacy laws.

Verify: COPPA applicability determined. Consent mechanism identified.

Step 5: Build Compliance Priority Matrix

Duration: 30 minutes. Prioritize by penalty severity (criminal > license revocation > fines), timeline urgency (pre-launch > 90 days > first year), and business impact (blocks revenue > blocks customers > operational risk). Pre-launch blockers: MTL (fintech), HIPAA Security Rule (healthtech), COPPA consent (edtech).

Verify: All regulations in matrix. Priorities assigned. Owners designated.

Quality Benchmarks

Quality Metric	Minimum	Good	Excellent
Regulation coverage	> 80% identified	> 90%	100% with state-level
Priority accuracy	Major blockers identified	Correct ordering	Attorney-validated
Cost estimates	Order of magnitude	Within 50%	Provider-quoted
Timeline accuracy	Correct phase	Within 2 months	Specific deadlines

Error Handling

Error	Cause	Recovery
Missed regulation post-launch	Incomplete analysis	Engage counsel, begin remediation, self-report if required
License rejected	Incomplete application	Address deficiencies, reapply, consider alternative structure
Compliance cost exceeds budget	Underestimated scope	Prioritize critical items, explore BaaS/compliance-as-a-service
Regulatory change	New legislation	Subscribe to alerts, engage compliance monitoring

Cost Breakdown

Component	DIY	Compliance Platform	Full Legal
Regulatory mapping	$0	$100-$500/mo	$5K-$15K
License applications	Filing fees only	Fees + support	Fees + $10K-$50K
Compliance program	Manual ($0)	$5K-$30K/yr	$20K-$100K/yr
Total Year 1	$500-$5K	$10K-$50K	$35K-$200K+

Anti-Patterns

Wrong: Assuming regulations don't apply because you're "just a tech company"

If your tech touches money, health data, or children's data, industry regulations apply regardless of branding. [src1]

Correct: Map regulations based on data types and activities

Use trigger questions. Handle PHI = HIPAA applies, even as a "wellness app." Handle money = MSB registration, even as a "platform."

Wrong: Delaying compliance until after launch

Operating without required licenses is a felony in many states (fintech). Handling PHI without HIPAA compliance exposes personal liability. [src5]

Correct: Map requirements before building

Identify regulations during planning. Build compliance into architecture from day one. Budget for compliance in initial fundraising.

When This Matters

Use immediately after entity formation, before product development. Regulatory requirements shape product architecture, data handling, vendor selection, and fundraising needs.

Industry-Specific Regulatory Map