Financial institutions that depend on “federal only” regulatory coverage are taking on more risk than they may realise. States pursue their own regulatory agendas, and the current administration’s push towards deregulation has encouraged many of them to introduce financial services rules of their own to close what they view as gaps in federal oversight.
According to AscentAI, this shift means that tools which simply track and monitor “US regulations” can leave firms with a dangerously incomplete view.
The commercial fallout goes beyond regulatory exposure, as firms may also face delayed product launches, flawed licensing assumptions and repeated legal research.
State-level oversight matters most in money transmission, lending, insurance, consumer finance and digital assets. Digital assets offer a clear example of federal retreat being followed by state intervention.
The Department of Justice (DOJ) disbanded its National Cryptocurrency Enforcement Team and said it would no longer “pursue litigation or enforcement actions that have the effect of superimposing regulatory frameworks on digital assets.” States have moved in the opposite direction.
New York’s Attorney General has sued crypto firms for trading tokens without registering with the state, while in Iowa, crypto businesses have breached the state’s Consumer Fraud Act. Changing federal enforcement priorities clearly do not remove exposure, and firms must still handle separate state licensing, regulatory and enforcement obligations.
Money transmission presents a similarly fragmented picture. The Money Transmission Modernization Act (MTMA) was approved for state adoption as a single set of nationwide standards, yet only 31 states have adopted it in full or in part. The Conference of State Bank Supervisors (CSBS) has also warned that uneven adoption and differing interpretations have led to inconsistent implementation.
Consumer finance adds further complexity. Firms must navigate state licensing laws for financial services organisations, state lending rules, interest rate caps and state-level unfair, deceptive or abusive acts or practices (UDAAP/UDAP) statutes, alongside related consumer protection regimes.
On top of this, the Consumer Financial Protection Act of 2010 (CFPA) allows states to enforce the federal consumer protection laws that sit under it. For multi-jurisdictional organisations, these rules and guidance cannot be overlooked.
The lesson for compliance leaders is straightforward. Whenever “US regulatory coverage” is discussed, it should include state regulators, regulations and guidance. Without that, firms significantly raise their risk profile and leave themselves open to multiple compliance failures.
When assessing compliance automation and RegTech tools, firms should ask several key questions. They should confirm whether “US coverage” spans all 50 states, which document types and issuing bodies are included, and whether coverage is comprehensive or only added on request. They should also check whether obligations are extracted consistently across states and how state adoptions and variations are kept up to date.
Read the full post from AscentAI here.
Copyright © 2026 FinTech Global
