Are you a charitable organization? Join our verified registry →
No custody, no money transmission, no licensing problem. How architecture decisions make vendor review straightforward.
Every fintech company that touches money faces a version of the same question: do you need a money transmitter license? In 49 states plus the District of Columbia, the answer depends on whether you receive, hold, or transmit funds on behalf of another person. Montana is the only state that does not require one.
The licensing process is not fast and not cheap. A single state application takes three to twelve months. New York runs eighteen to twenty-four months or longer. Nationwide coverage requires parallel filings with up to 49 regulators, surety bonds that vary by state (Massachusetts alone requires the greater of $100,000 or 100% of average daily transmission liability), and a total cost that consultancies estimate at $500,000 to $2 million or more, per Buckingham Capital Consulting.
Companies that skip this step get caught. Florida fined Square $507,000 in 2013 for operating as a money transmitter without a license. In 2026, Texas fined a payroll processor $75,000 and a surrogacy escrow provider $90,000 for the same violation. Florida fined a Delaware-based software company $155,000 after discovering it had been transmitting money since 2011 without a license. The pattern is consistent: regulators find out, penalties follow, and the company still has to get licensed.
GivEZ does not receive, hold, pool, or route client funds. The institution originates every transfer on its own rails, under its own controls, through its own banking relationships. GivEZ sends the institution a signed instruction. The institution decides whether to act on it.
This is not a workaround. It is the core architectural decision the entire system is built on. The patent drawings show it explicitly: the disbursement step routes through the integration layer to the institution's own transfer infrastructure. There is no GivEZ account in the funds path. There is no moment where client money sits in a GivEZ-controlled account waiting to be forwarded.
The instruction path and the funds path are separate by design. GivEZ sits only on the instruction path. Designations come in, signed transfer instructions go out, settlement status comes back. The funds path runs entirely through the institution.
In 2023, the OCC, FDIC, and Federal Reserve issued joint guidance establishing a unified framework for third-party risk management at financial institutions. That framework, building on OCC Bulletin 2013-29 and FDIC FIL 44-2008, tells banks to evaluate a vendor's financial condition, relevant experience, knowledge of applicable laws, reputation, and the scope and effectiveness of its operations and controls.
The guidance also makes one thing clear: outsourcing a function does not shift accountability. The institution remains responsible for everything its vendors do on its behalf. That means vendor review teams are not just checking boxes. They are assessing whether working with a vendor creates risk the institution has to manage.
For a vendor that takes custody of funds, the risk surface is large. The vendor's licensing status, its segregation of client funds, its insurance coverage, its operational controls around fund movement, and its contingency plans if it becomes insolvent all become the institution's problem.
For a vendor that never touches funds, most of those questions do not apply. The review surface shrinks to: does the vendor handle data securely, does it maintain an auditable record, and does it operate reliable controls? Those are standard software vendor questions, not money movement questions.
When an institution's risk team evaluates GivEZ, the review covers six areas.
Custody of funds. None. GivEZ never holds, pools, or routes client money. There is nothing to sweep and nothing to safeguard on GivEZ's side.
Transfer origination. Institution only. Every transfer is initiated by the institution, on its own rails, under its own payment controls and approvals. GivEZ sends an instruction. The institution decides whether to execute it.
Audit trail. Append-only, hash-chained ledger. Every designation, allocation, safeguard evaluation, and disbursement confirmation is recorded as an immutable entry. Each entry contains a SHA-256 hash of its content plus the previous entry's hash. The full chain is exportable for internal and external audit.
Pre-transfer controls. The safeguard engine evaluates every gift before an instruction is released. Recipient verification against the IRS Exempt Organizations database, OFAC screening, institution-specific limits and rules. A failed check halts the flow and routes it to review. No instruction is sent to the institution until all checks pass.
Data minimization. GivEZ receives the minimum data required to process a designation: an account reference, a recipient identifier, and an amount. Client credentials, balances, and account details stay with the institution. Encryption at rest and in transit.
Assurance. SOC 2 Type II audit and penetration testing. SOC 2 Type II requires a six to twelve-month observation window during which controls are tested for consistent operation, followed by four to six weeks of fieldwork. Reports are available under NDA.
The typical fintech compliance path is: build the product, discover you need licenses, spend twelve to twenty-four months and a million dollars getting them, then explain the complexity to every institution that evaluates you.
GivEZ took a different path. The architecture was designed from the start so that the institution never loses control of the money. That single decision eliminated the need for money transmitter licensing, simplified the vendor review, and reduced the compliance surface to standard software vendor territory.
The result is a shorter path to production for every institution that integrates. Their compliance team is not evaluating a money services business. They are evaluating a software vendor that sends instructions and keeps records. That is a review most institutions can complete in weeks, not months.
If your compliance or risk team wants to evaluate the custody model and vendor review surface, the details are easier to show than to describe. Request a technical walkthrough.
Research and perspectives on embedded giving, delivered when we publish.
