---
# === IDENTITY ===
id: compliance/startup-legal/payment-processing-compliance/2026
canonical_question: "What are PCI DSS requirements, payment provider constraints, cross-border payment regulations for startups?"
aliases:
  - "How do I set up PCI-compliant payment processing for my startup?"
  - "Stripe vs Adyen vs Braintree PCI compliance comparison for startups"
  - "What payment licenses and regulations do startups need for cross-border payments?"
entity_type: execution_recipe
domain: compliance > startup-legal > payment processing compliance
region: global
jurisdiction: global
temporal_scope: 2025-2026

# === VERIFICATION ===
last_verified: 2026-03-11
confidence: 0.85
version: 1.0
first_published: 2026-03-11

# === TEMPORAL VALIDITY ===
temporal_validity:
  status: volatile
  last_breaking_change: "PCI DSS 4.0.1 mandatory compliance deadline March 31, 2025 — 47 new requirements including script protection (6.4.3, 11.6.1); PSD3 expected 2026-2027"
  next_review: 2026-09-07
  change_sensitivity: high

# === CONSTRAINTS ===
constraints:
  - "PCI DSS compliance is mandatory for any entity that stores, processes, or transmits cardholder data — non-compliance penalties range from $5,000 to $100,000 per month"
  - "US money transmitter licenses required in 40+ states if holding or transmitting customer funds — operating without a license is a federal offense with fines up to $250,000 and up to 5 years imprisonment"
  - "PSD2 Strong Customer Authentication (SCA) required for EU/EEA transactions — 3D Secure 2 implementation mandatory"
  - "BSA/AML compliance requires Customer Due Diligence (CDD), transaction monitoring, and Suspicious Activity Reports (SARs) for all payment processors"
  - "Customer identification records and transaction logs must be retained for 5+ years after the business relationship ends"
  - "PCI DSS 4.0.1 SAQ A eligibility requires either full redirect to payment processor OR iframe with script protection controls (CSP headers)"

# === SKIP CONDITIONS ===
skip_this_unit_if:
  - condition: "Startup only needs general legal entity formation guidance"
    use_instead: "business/startup/legal-formation-playbook/2026"
  - condition: "Startup is building a cryptocurrency or digital asset payment platform"
    use_instead: "Search knowledgelib.io for crypto and digital-asset regulation — no dedicated unit yet"
  - condition: "Startup needs general fintech licensing strategy, not payment-specific"
    use_instead: "compliance/startup-legal/industry-specific-regulatory-map/2026"

# === AGENT HINTS ===
inputs_needed:
  - key: business_model
    question: "What is the startup's payment model?"
    type: choice
    options: ["ecommerce (selling own products)", "marketplace/platform (facilitating payments between parties)", "SaaS with subscriptions", "fintech (holding/transmitting funds)", "no preference — auto-select"]
  - key: target_markets
    question: "Which geographic markets will you process payments in?"
    type: choice
    options: ["US only", "EU/EEA only", "US + EU", "global (US + EU + other)"]
  - key: technical_skill
    question: "What is the user's technical skill level?"
    type: choice
    options: ["non-technical (no-code only)", "semi-technical (can edit code)", "developer (can write code)"]
  - key: annual_transaction_volume
    question: "What is the expected annual transaction volume?"
    type: choice
    options: ["under 20,000 transactions", "20,000 to 1 million transactions", "1 million to 6 million transactions", "over 6 million transactions"]

# === EXECUTION METADATA ===
execution:
  required_inputs:
    - name: "Business model and product description"
      source: "user/founder"
      format: "text description"
    - name: "Target market list (countries/regions)"
      source: "user/go-to-market strategy"
      format: "country list"
    - name: "Expected transaction volume and average order value"
      source: "user/financial projections"
      format: "structured data"
  outputs:
    - name: "Payment Compliance Checklist"
      format: "structured checklist document"
      description: "Complete regulatory checklist with PCI DSS level, required licenses, and compliance timeline"
    - name: "Provider Selection Matrix"
      format: "comparison spreadsheet"
      description: "Scored comparison of payment providers based on startup requirements, compliance burden, and cost"
    - name: "Compliance Implementation Plan"
      format: "phased project plan"
      description: "Step-by-step implementation plan with regulatory milestones, estimated costs, and responsible parties"
  tools_required:
    - name: "Stripe"
      purpose: "Primary payment processing with built-in PCI compliance"
      tier: paid
      cost: "2.9% + $0.30 per transaction (US online)"
      alternatives: ["Adyen", "Braintree", "Square"]
    - name: "Stripe Checkout or Elements"
      purpose: "PCI-compliant payment form integration (reduces to SAQ A)"
      tier: free
      cost: "$0 (included with Stripe account)"
      alternatives: ["Adyen Drop-in", "Braintree Hosted Fields"]
    - name: "Compliance management platform"
      purpose: "Track PCI DSS requirements and evidence collection"
      tier: paid
      cost: "$200-500/month"
      alternatives: ["Vanta", "Drata", "Secureframe", "manual spreadsheet tracking"]
  credentials_needed:
    - service: "Stripe"
      type: "API key (publishable + secret)"
      where_to_get: "https://dashboard.stripe.com/register"
      free_tier_limits: "No free tier — pay per transaction, but test mode is free"
    - service: "PCI SSC"
      type: "Registered account for SAQ submission"
      where_to_get: "https://www.pcisecuritystandards.org/"
      free_tier_limits: "SAQ self-assessment is free; QSA audit costs $15K-50K+"
  estimated_duration: "2-8 weeks depending on business model complexity"
  estimated_cost: "$0 (using Stripe + self-assessment) to $50,000+ (QSA audit + money transmitter licensing)"

# === DISTRIBUTION ===
canonical_source: "https://knowledgelib.io/compliance/startup-legal/payment-processing-compliance/2026"
suggested_citation: "Source: knowledgelib.io — AI Knowledge Library (verified 2026-03-11)"

# === RELATED UNITS ===
related_kos:
  depends_on:
    - id: "business/startup/legal-formation-playbook/2026"
      label: "How to form a startup legal entity — Delaware C-Corp vs LLC vs international — exact steps, costs, and deadlines"
  feeds_into:
    - id: "compliance/startup-legal/data-privacy-compliance-decision-tree/2026"
      label: "Which data privacy regulations apply to a startup — GDPR, CCPA, PIPEDA, LGPD, HIPAA by user location, data type, and business model"
    - id: "business/startup-legal/startup-banking-financial-setup/2026"
      label: "Startup banking and financial setup (US) — business bank accounts, accounting software (QBO vs Xero vs Wave), bookkeeping, payroll"
  related_to:
    - id: "compliance/startup-legal/terms-of-service-privacy-policy-requirements/2026"
      label: "What Terms of Service and privacy policies must include by jurisdiction — mandatory disclosures, template requirements, and common drafting mistakes"
  alternative_to: []

# === SOURCES ===
sources:
  - id: src1
    title: "PCI DSS v4.0.1 Quick Reference Guide"
    author: PCI Security Standards Council
    url: https://blog.pcisecuritystandards.org/pci-dss-v4-whats-new-with-self-assessment-questionnaires
    type: official_docs
    published: 2025-01-01
    reliability: authoritative
  - id: src2
    title: "How to Comply with PCI DSS 4.0.1 (2026 Guide)"
    author: UpGuard
    url: https://www.upguard.com/blog/pci-compliance
    type: technical_blog
    published: 2025-06-01
    reliability: high
  - id: src3
    title: "What is PSD2? A guide to PSD2 compliance"
    author: Stripe
    url: https://stripe.com/resources/more/what-is-psd2-here-is-what-businesses-need-to-know
    type: official_docs
    published: 2025-01-01
    reliability: authoritative
  - id: src4
    title: "2026 Fintech Regulation Guide for Startups"
    author: InnReg
    url: https://www.innreg.com/blog/fintech-regulation-guide-for-startups
    type: industry_report
    published: 2026-01-15
    reliability: high
  - id: src5
    title: "Money Transmitter License in 2026: Requirements, Costs, and a Practical Roadmap for Fintechs"
    author: Finextra
    url: https://www.finextra.com/blogposting/30783/money-transmitter-license-in-2026-requirements-costs-and-a-practical-roadmap-for-fintechs
    type: industry_report
    published: 2026-02-01
    reliability: high
  - id: src6
    title: "PCI DSS Compliance Guide: Merchant Levels"
    author: Adyen
    url: https://docs.adyen.com/development-resources/pci-dss-compliance-guide/merchant-levels
    type: official_docs
    published: 2025-06-01
    reliability: authoritative
  - id: src7
    title: "PSD3 vs PSD2: What It Means for the Payment Sector"
    author: DashDevs
    url: https://dashdevs.com/blog/psd3-vs-psd2-regulations-what-new-eu-directive-means-for-payment-sector/
    type: technical_blog
    published: 2025-08-01
    reliability: high
  - id: src8
    title: "Integration Security Guide"
    author: Stripe
    url: https://docs.stripe.com/security/guide
    type: official_docs
    published: 2025-01-01
    reliability: authoritative
---

# Payment Processing Compliance for Startups

## Purpose

This recipe produces a complete payment processing compliance implementation — covering PCI DSS level determination and SAQ completion, payment provider selection and integration, cross-border regulatory compliance (PSD2/SCA for EU, money transmitter licensing for US), and KYC/AML program setup. The output is a production-ready payment system that passes PCI compliance validation, handles multi-region transactions legally, and scales without accumulating regulatory debt. [src1]

## Prerequisites

- [ ] **Legal entity formed** — incorporated business with EIN/tax ID and business bank account
- [ ] **Business model documented** — clear description of what is sold, who pays, and how funds flow (direct sale vs. marketplace)
- [ ] **Target market list** — countries where you will accept payments, with expected volume per region
- [ ] **Financial projections** — expected annual transaction count and average order value (determines PCI compliance level)
- [ ] **Technical environment** — web application or platform where payment integration will be deployed
- [ ] **Legal counsel access** — attorney familiar with fintech/payments for license applications (recommended for marketplace or fintech models)

## Constraints

- PCI DSS 4.0.1 became mandatory March 31, 2025. All 12 requirements plus 47 new sub-requirements apply. Non-compliance penalties are $5,000-$100,000/month from card brands. [src1]
- If your startup touches customer cardholder data directly (stores, processes, or transmits card numbers), you are a service provider subject to SAQ D or full Report on Compliance (ROC) — not the simpler SAQ A. Use hosted payment forms to avoid this. [src2]
- Marketplace and platform models where you facilitate payments between buyers and sellers may trigger money transmitter licensing in 40+ US states. Processing time averages 6-12 months per state. [src5]
- PSD2 Strong Customer Authentication (SCA) is mandatory for EU/EEA transactions over EUR 30. Transactions failing SCA will be declined by issuing banks. [src3]
- BSA/AML program is required if you qualify as a Money Services Business (MSB) under FinCEN — includes CDD, transaction monitoring, SAR filing, and 5-year record retention. [src4]
- PSD3, expected 2026-2027, will extend liability for fraud to technical service providers including digital wallet operators. Plan for increased compliance scope. [src7]

## Tool Selection Decision

```
Which path?
├── Ecommerce startup (selling own products) AND US or US+EU
│   └── PATH A: Stripe Checkout — hosted redirect, SAQ A, fastest setup
├── SaaS with subscriptions AND any market
│   └── PATH B: Stripe Elements + Billing — embedded payment form, SAQ A, recurring billing
├── Marketplace/platform (facilitating payments between parties)
│   └── PATH C: Stripe Connect — platform payments, KYC handled by Stripe, money transmitter exemption possible
└── Fintech or custom payment flow (holding/transmitting funds)
    └── PATH D: Adyen + custom compliance — dedicated merchant account, full PCI program, MTL required
```

| Path | Tools | Setup Cost | Per-Transaction | Compliance Burden |
|------|-------|-----------|-----------------|-------------------|
| A: Stripe Checkout | Stripe Checkout | $0 | 2.9% + $0.30 | SAQ A (29 items) — lightest |
| B: Stripe Elements + Billing | Stripe Elements, Billing | $0 | 2.9% + $0.30 + 0.5% for Billing | SAQ A (29 items) — light |
| C: Stripe Connect | Stripe Connect, Dashboard | $0 | 2.9% + $0.30 + Connect fees | SAQ A + Connect compliance — moderate |
| D: Adyen + Custom | Adyen, compliance platform | $500-5,000 setup | 0.12-0.15% + $0.12-$0.30 | SAQ D or ROC + MTL — heaviest |

## Execution Flow

### Step 1: Determine Your PCI DSS Compliance Level

**Duration**: 30 minutes
**Tool**: PCI SSC documentation

Identify your compliance level based on projected annual card transaction volume. This determines whether you need a self-assessment questionnaire (SAQ) or a full qualified security assessor (QSA) audit. [src6]

```
PCI DSS Merchant Levels:
════════════════════════════════════════════
Level 1: > 6 million transactions/year
  → Full QSA audit required (ROC)
  → Cost: $15,000-$50,000+/year
  → Quarterly ASV scans mandatory

Level 2: 1-6 million transactions/year
  → Annual SAQ + quarterly ASV scans
  → Cost: $1,000-$5,000/year

Level 3: 20,000-1 million e-commerce transactions/year
  → Annual SAQ + quarterly ASV scans
  → Cost: $500-$2,000/year

Level 4: < 20,000 e-commerce transactions/year
  → Annual SAQ (ASV scans recommended)
  → Cost: $0-$500/year

Most startups: Level 3 or Level 4
════════════════════════════════════════════

SAQ Type Selection (for Levels 2-4):
────────────────────────────────────
SAQ A:  Card data fully outsourced to PCI-compliant provider
        (Stripe Checkout redirect, hosted iframes)
        → 29 requirements — RECOMMENDED for startups

SAQ A-EP: E-commerce with partial outsourcing
          (Your server controls payment page but doesn't store data)
          → 139 requirements

SAQ D:  All other environments / service providers
        → 260+ requirements — AVOID unless necessary
```

**Verify**: Your projected annual volume maps to a specific level, and your integration approach maps to a specific SAQ type. If using Stripe Checkout or Elements, you qualify for SAQ A.
**If failed**: If volume is uncertain, assume Level 3 and SAQ A. You can reclassify later.

### Step 2: Set Up Payment Provider and PCI-Compliant Integration

**Duration**: 1-3 days
**Tool**: Stripe (Path A/B/C) or Adyen (Path D)

For most startups, Stripe with Checkout or Elements provides the fastest path to PCI-compliant payment acceptance. The hosted payment fields ensure cardholder data never touches your servers, keeping you at SAQ A. [src8]

```
PATH A — Stripe Checkout (Redirect):
──────────────────────────────────────
1. Create Stripe account at https://dashboard.stripe.com/register
2. Complete business verification (EIN, business address, bank account)
3. Integrate Stripe Checkout (server-side session creation):

   // Server-side: Create Checkout Session
   const session = await stripe.checkout.sessions.create({
     payment_method_types: ['card'],
     line_items: [{ price: 'price_xxx', quantity: 1 }],
     mode: 'payment',  // or 'subscription' for recurring
     success_url: 'https://yoursite.com/success?session_id={CHECKOUT_SESSION_ID}',
     cancel_url: 'https://yoursite.com/cancel',
   });
   // Redirect customer to session.url

4. Enable 3D Secure for EU transactions (automatic with Stripe Radar)
5. Configure webhook endpoint for payment confirmations

PATH B — Stripe Elements (Embedded):
──────────────────────────────────────
1. Steps 1-2 same as above
2. Add Stripe.js to payment page (loads from Stripe CDN)
3. Mount Payment Element with appearance customization
4. Handle payment confirmation client-side
5. Set up Content-Security-Policy headers for iframe protection:

   Content-Security-Policy: frame-src https://js.stripe.com;
     script-src https://js.stripe.com;

PATH C — Stripe Connect (Marketplace):
──────────────────────────────────────
1. Steps 1-2 same as above
2. Apply for Stripe Connect (platform account)
3. Set up connected account onboarding flow
4. Configure payment splits and platform fees
5. Stripe handles KYC/AML for connected accounts
   → This may exempt you from state MTL requirements
      (consult counsel — exemption not guaranteed)

PATH D — Adyen (Custom/Fintech):
──────────────────────────────────────
1. Apply at https://www.adyen.com/ (dedicated merchant account)
2. Complete underwriting process (1-4 weeks)
3. Integrate Adyen Drop-in or API
4. Implement full PCI DSS program (SAQ D: 260+ requirements)
5. Engage QSA if processing > 1M transactions
```

**Verify**: Process a test transaction end-to-end in sandbox/test mode. For Stripe: use test card 4242 4242 4242 4242. Confirm webhook fires and payment appears in dashboard.
**If failed**: If Stripe verification stalls, check that business information matches exactly with state registration. International founders may need a US business entity (e.g., via Stripe Atlas).

### Step 3: Complete PCI DSS Self-Assessment

**Duration**: 1-5 days (SAQ A) or 2-8 weeks (SAQ D)
**Tool**: PCI SSC SAQ forms or compliance platform (Vanta, Drata)

Complete the applicable SAQ and implement all required controls. For SAQ A (the startup-recommended path), the 29 requirements focus on access controls, vendor management, and policy documentation. [src1]

```
SAQ A Key Requirements (PCI DSS 4.0.1):
════════════════════════════════════════════
Requirement 2: Secure default configurations
  → Change all default passwords on systems handling payments
  → Document system configurations

Requirement 6: Secure systems and software
  → Keep all payment-facing systems patched
  → For iframe integrations: implement CSP headers
    that restrict script sources (Requirements 6.4.3/11.6.1)
  → For redirect integrations: exempt from 6.4.3/11.6.1

Requirement 7: Restrict access to cardholder data
  → Limit access to payment dashboards to need-to-know
  → Use individual accounts (no shared logins)

Requirement 8: Identify users and authenticate access
  → MFA on all payment system access
  → Minimum 12-character passwords
  → Lock accounts after 10 failed attempts

Requirement 9: Restrict physical access
  → Secure any devices that interact with payment data
  → N/A for most cloud-only startups

Requirement 11: Regular security testing
  → Quarterly ASV (Approved Scanning Vendor) scans
    Cost: $100-$500/quarter
    Vendors: Qualys, SecurityMetrics, ControlScan
  → ASV scan is MANDATORY — not future-dated

Requirement 12: Information security policies
  → Document security policies
  → Annual security awareness training for staff
  → Incident response plan
════════════════════════════════════════════

Completion checklist:
[ ] All 29 SAQ A requirements answered "Yes" or "N/A"
[ ] First quarterly ASV scan passed
[ ] Security policy document created
[ ] Incident response plan documented
[ ] Staff security training completed
```

**Verify**: All SAQ questions answered "Yes" or justified "N/A." ASV scan shows no high or critical vulnerabilities. SAQ signed by authorized officer.
**If failed**: If ASV scan fails, remediate vulnerabilities and re-scan. Most ASV vendors allow unlimited re-scans within the quarter.

### Step 4: Implement Cross-Border Compliance (EU: PSD2/SCA)

**Duration**: 1-3 days (if using Stripe/Adyen) or 2-4 weeks (custom integration)
**Tool**: Payment provider SCA features

If accepting payments from EU/EEA customers, PSD2 Strong Customer Authentication (SCA) is mandatory. Most payment providers handle this automatically, but you must verify it is active. [src3]

```
PSD2/SCA Compliance Checklist:
════════════════════════════════════════════
[ ] 3D Secure 2 (3DS2) enabled for EU transactions
    → Stripe: automatic with Radar (enabled by default)
    → Adyen: configure 3DS2 in risk settings
    → Braintree: enable via merchant portal

[ ] SCA exemptions configured for low-risk transactions:
    → Transactions under EUR 30 (up to cumulative EUR 100)
    → Recurring payments after initial authentication
    → Merchant-initiated transactions (MIT)
    → Low-risk transactions (TRA) via Stripe Radar

[ ] Payment failure handling for SCA challenges:
    → Retry logic for soft declines
    → Customer-facing 3DS challenge UI
    → Webhook handling for authentication_required status

[ ] PSD3 preparation (expected 2026-2027):
    → Monitor ECB/EBA announcements
    → Plan for extended liability scope
    → Digital wallet providers: prepare for direct compliance
════════════════════════════════════════════

SCA Exemption Strategy (reduces friction, increases conversion):
  Low-value: auto-exempt < EUR 30
  Low-risk TRA: provider applies if fraud rate < 0.13%
  Recurring: authenticate once, exempt subsequent
  → Stripe Radar optimizes exemptions automatically
```

**Verify**: Process a test transaction with a 3DS-required test card (Stripe: 4000 0027 6000 3184). Confirm 3DS challenge appears and completes successfully.
**If failed**: If 3DS is not triggering, check Stripe Radar rules or Adyen risk engine configuration. EU acquiring banks will soft-decline non-SCA transactions.

### Step 5: Assess and Implement Licensing Requirements (US: MTL, FinCEN)

**Duration**: 1 week (assessment) to 6-12 months (licensing)
**Tool**: Legal counsel, FinCEN registration portal

Determine whether your business model requires money transmitter licensing and/or FinCEN MSB registration. This step is critical for marketplace, platform, and fintech models. [src5]

```
Do You Need a Money Transmitter License?
════════════════════════════════════════════
                      ┌─────────────────┐
                      │ Do you hold,    │
                      │ control, or     │
                      │ transmit        │
                      │ customer funds? │
                      └────┬───────┬────┘
                         YES      NO
                          │        │
                    ┌─────┴──┐   ┌──┴──────────────┐
                    │ MTL    │   │ No MTL needed.   │
                    │ likely │   │ Using Stripe     │
                    │ needed │   │ Checkout/Connect │
                    └────┬───┘   │ may exempt you.  │
                         │       └──────────────────┘
                    ┌────┴───────────────┐
                    │ Register with      │
                    │ FinCEN as MSB      │
                    │ (free, 1-2 weeks)  │
                    │ + Apply for state  │
                    │ MTLs (40+ states,  │
                    │ 6-12 months each)  │
                    └────────────────────┘

Models that typically NEED MTL:
  - Payment facilitator holding funds in escrow
  - Wallet/stored-value provider
  - Money transfer/remittance service
  - Cryptocurrency exchange

Models that typically DO NOT need MTL:
  - Ecommerce selling own products (merchant)
  - SaaS subscription billing (merchant)
  - Marketplace using Stripe Connect (Stripe is the MTL holder)
  → CONFIRM WITH LEGAL COUNSEL — exemptions vary by state

FinCEN MSB Registration (if applicable):
────────────────────────────────────
  1. Register at https://www.fincen.gov/msb-registration
  2. Free registration, must be renewed every 2 years
  3. Designate a compliance officer
  4. Implement AML program:
     - Written AML policy
     - Customer Due Diligence (CDD) procedures
     - Transaction monitoring system
     - Suspicious Activity Report (SAR) filing process
     - Record retention (5+ years)
     - Annual employee training

State MTL Application (per state):
────────────────────────────────────
  Typical requirements per state:
  - Application fee: $500-$5,000
  - Surety bond: $25,000-$500,000 (varies by state)
  - Net worth minimum: $100,000-$500,000
  - Background checks for all officers
  - Audited financial statements
  - Written compliance policies
  - Processing time: 6-12 months

  MTMA adoption (31 states as of June 2025):
  → Standardized requirements across adopting states
  → Reduces variability but does not eliminate per-state filing
```

**Verify**: Legal counsel has confirmed whether your business model requires MTL. If required, FinCEN MSB registration is filed. If not required, document the exemption rationale.
**If failed**: If legal counsel is unavailable, err on the side of caution — assume licensing is needed for any model that touches customer funds. Use Stripe Connect to potentially inherit Stripe's MTL coverage.

### Step 6: Set Up KYC/AML Program

**Duration**: 1-2 weeks
**Tool**: Stripe Identity (automated) or manual compliance program

If your startup qualifies as an MSB or processes payments for others, implement a KYC/AML program that satisfies BSA requirements. [src4]

```
KYC/AML Program Components:
════════════════════════════════════════════
1. CUSTOMER IDENTIFICATION PROGRAM (CIP)
   Collect and verify for each customer:
   - Full legal name
   - Date of birth
   - Address
   - Government-issued ID number (SSN/TIN for US)
   Tool: Stripe Identity ($1.50/verification)
         or Persona, Jumio, Onfido

2. CUSTOMER DUE DILIGENCE (CDD)
   - Risk-rate each customer (low/medium/high)
   - Verify beneficial owners (25%+ ownership)
   - Screen against sanctions lists (OFAC, EU)
   - Enhanced Due Diligence for high-risk customers

3. TRANSACTION MONITORING
   - Flag transactions exceeding $10,000 (CTR filing)
   - Monitor for structuring (splitting to avoid thresholds)
   - Detect unusual patterns (velocity, geography, amount)
   - Tool: Stripe Radar (included) or Unit21, Sardine

4. REPORTING
   - Currency Transaction Reports (CTR): > $10,000
   - Suspicious Activity Reports (SAR): suspicious patterns
   - File via FinCEN BSA E-Filing System

5. RECORD RETENTION
   - Customer identification: 5 years after relationship ends
   - Transaction records: 5 years
   - SAR records: 5 years from filing date

6. TRAINING
   - Annual AML training for all employees
   - Document training completion
   - Update training when regulations change
════════════════════════════════════════════
```

**Verify**: Written AML policy approved by compliance officer. CIP procedures tested with sample customer onboarding. Sanctions screening tool integrated and tested.
**If failed**: If building AML in-house is too complex, consider a compliance-as-a-service provider (Unit21, Alloy, or Sardine — $500-$2,000/month).

## Output Schema

```json
{
  "output_type": "payment_compliance_plan",
  "format": "JSON",
  "columns": [
    {"name": "compliance_area", "type": "string", "description": "PCI DSS, PSD2/SCA, MTL, KYC/AML", "required": true},
    {"name": "status", "type": "string", "description": "not_started, in_progress, compliant, not_applicable", "required": true},
    {"name": "level_or_type", "type": "string", "description": "PCI Level 1-4, SAQ A/D, MSB status", "required": true},
    {"name": "provider", "type": "string", "description": "Payment provider or compliance tool selected", "required": true},
    {"name": "estimated_cost", "type": "string", "description": "Annual compliance cost estimate", "required": true},
    {"name": "completion_date", "type": "date", "description": "Target or actual completion date", "required": false},
    {"name": "next_action", "type": "string", "description": "Immediate next step for this area", "required": true}
  ],
  "expected_row_count": "4-6",
  "sort_order": "risk priority descending",
  "deduplication_key": "compliance_area"
}
```

## Quality Benchmarks

| Quality Metric | Minimum Acceptable | Good | Excellent |
|---------------|-------------------|------|-----------|
| PCI SAQ completion | All items answered | Passed + ASV scan clean | Passed + pen test + annual review scheduled |
| SCA implementation | 3DS enabled for EU | 3DS + exemption optimization | 3DS + exemptions + conversion monitoring |
| Licensing assessment | Legal counsel opinion obtained | All required registrations filed | All licenses granted + renewal calendar set |
| KYC/AML program | Written policy exists | Policy + automated screening | Full program + monitoring + annual audit |
| Documentation | Basic compliance records | Policies + evidence binder | Full audit trail + incident response tested |

**If below minimum**: Do not launch payment processing in production until at least minimum acceptable thresholds are met for PCI DSS and applicable licensing. Non-compliance risks are financial penalties, card brand fines, and potential criminal liability.

## Error Handling

| Error | Likely Cause | Recovery Action |
|-------|-------------|----------------|
| Stripe account verification rejected | Business information mismatch with state records | Ensure legal entity name, EIN, and address match state registration exactly. Re-submit with supporting documents. |
| ASV scan fails with high-severity findings | Unpatched systems or exposed services on payment page | Patch identified vulnerabilities, remove unnecessary services, re-scan (unlimited re-scans per quarter with most ASVs). |
| 3DS challenge loop — transaction never completes | Misconfigured return URL or webhook handler | Check Stripe webhook for `payment_intent.requires_action` event. Ensure client-side handles `stripe.confirmPayment()` return. |
| EU transactions declining at high rate | SCA not properly implemented or exemptions not configured | Verify 3DS2 is active (not 3DS1). Enable Stripe Radar optimized exemptions. Check that acquiring bank supports TRA exemptions. |
| MTL application denied by state | Insufficient surety bond, incomplete application, or background check issue | Address specific deficiency cited. Engage specialized fintech licensing attorney. Consider MTMA states first for more uniform requirements. |
| FinCEN registration delayed | Incomplete beneficial ownership information | Verify all 25%+ beneficial owners are listed with correct SSN/TIN. Re-file via BSA E-Filing System. |

## Cost Breakdown

| Component | Startup (< 20K txn/yr) | Growth (20K-1M txn/yr) | Scale (1M+ txn/yr) |
|-----------|----------------------|----------------------|-------------------|
| Payment processing | 2.9% + $0.30/txn (Stripe) | 2.9% + $0.30/txn (volume discounts at scale) | Custom pricing (Stripe/Adyen: 2.2-2.5% negotiable) |
| PCI compliance | $0-$500/yr (SAQ A self-assessment) | $500-$2,000/yr (SAQ A + ASV scans) | $15,000-$50,000/yr (QSA audit) |
| Compliance platform | $0 (manual tracking) | $200-$500/month (Vanta, Drata) | $500-$1,500/month |
| ASV quarterly scans | $100-$200/quarter | $200-$500/quarter | Included with QSA engagement |
| Money transmitter licensing | $0 (if exempt) | $10,000-$50,000 (if needed — bonds + fees) | $50,000-$200,000 (full 50-state) |
| KYC/AML program | $0 (Stripe handles) | $500-$2,000/month (compliance tooling) | $2,000-$10,000/month |
| Legal counsel | $2,000-$5,000 (initial assessment) | $5,000-$15,000/yr (ongoing) | $15,000-$50,000/yr |
| **Total Year 1** | **$2,000-$6,000** | **$15,000-$75,000** | **$100,000-$350,000** |

## Anti-Patterns

### Wrong: Handling raw card numbers on your own servers
Storing or processing cardholder data directly escalates you from SAQ A (29 requirements) to SAQ D (260+ requirements). This difference is not incremental — it transforms PCI compliance from a two-week project into a six-month effort costing $50,000+. [src2]

### Correct: Always use hosted payment fields
Use Stripe Checkout (redirect), Stripe Elements (iframe), Adyen Drop-in, or Braintree Hosted Fields. Your server never sees card numbers, keeping you at SAQ A.

### Wrong: Launching a marketplace without assessing MTL requirements
Operating as a money transmitter without a license is a federal offense with penalties up to $250,000 and 5 years imprisonment. Several fintech startups have received cease-and-desist orders from state regulators after launching without proper licensing. [src5]

### Correct: Get legal assessment before processing third-party funds
Before launching any marketplace or platform payment feature, have fintech counsel assess your money transmission exposure. Use Stripe Connect to potentially shelter under Stripe's licenses while you apply for your own.

### Wrong: Ignoring PSD2/SCA for EU customers
Transactions without proper SCA will be soft-declined by EU issuing banks, causing 10-30% payment failure rates. Startups often see sudden revenue drops when expanding to EU without SCA implementation. [src3]

### Correct: Enable 3DS2 before accepting EU payments
Activate 3D Secure 2 for all EU-originating transactions. Configure exemptions (low-value, TRA, recurring) to minimize checkout friction while maintaining compliance. Stripe Radar handles this automatically when enabled.

### Wrong: Treating PCI compliance as a one-time checkbox
PCI DSS requires ongoing compliance — quarterly ASV scans, annual SAQ re-assessment, continuous monitoring. Letting compliance lapse risks fines and, if breached, liability for all fraud losses plus forensic investigation costs ($100,000+). [src1]

### Correct: Schedule recurring compliance activities
Set quarterly reminders for ASV scans, annual reminders for SAQ re-assessment and staff training, and integrate compliance monitoring into your development workflow.

## When This Matters

Use this recipe when a startup is setting up payment processing for the first time or expanding to new geographic markets. It produces a compliant payment infrastructure with clear regulatory standing. Required before accepting any real payment transactions — launching without PCI compliance or proper licensing exposes the startup to fines, fraud liability, and potential criminal penalties.

## Related Units

- [Legal Entity Formation Guide](/compliance/startup-legal/legal-entity-formation-guide/2026) — prerequisite: form entity before applying for payment processing
- [Data Privacy Compliance (GDPR/CCPA)](/compliance/startup-legal/data-privacy-compliance-gdpr-ccpa/2026) — payment data handling feeds into broader privacy compliance
- [Terms of Service and Privacy Policy](/compliance/startup-legal/terms-of-service-privacy-policy/2026) — payment terms must be included in ToS
- [Startup Banking Setup](/business/startup-finance/startup-banking-setup/2026) — payment provider selection connects to banking infrastructure
- [Fintech Licensing Requirements](/compliance/startup-legal/fintech-licensing-requirements/2026) — deeper dive on licensing for fintech models