Field Guide
B2B payments: spend management
07
Rules and risks
3 min read · Chapter 7 of 10
How the rules work
Almost everything written reaches a spend fintech through its bank.
- Anti-money laundering is enforced, through banks. In 2024 the Fed issued a cease-and-desist order to Synapse's main partner bank, the FDIC put four banks under consent orders over fintech partners, and one bank was ordered to drop "significant" fintech partners. In April 2026 the OCC ordered a payments-heavy New York savings association to fix monitoring that auto-closed alerts. More orders are ending than starting, but findings keep coming.
- Guidance is loosening. The OCC and FDIC dropped reputation risk (final rule effective June 9, 2026), and the FDIC's custodial-account rule has no date. On September 11, 2026, the bank agencies proposed non-binding third-party guidance: deviating "will not alone support supervisory criticism". Whether banks relax their contracts is open.
- Money transmission matters once the platform holds money. As I read it, holding a company's funds to pay employees or suppliers needs money transmitter licenses, an exemption or a bank structure. States are adding exemptions for payroll processors (Maryland from October 1, 2026), but reimbursements aren't named. Florida fined a software company $155,000 for unlicensed money transmission in March 2026.
- Section 1071 arrives in 2028, maybe for cards. The CFPB's revised small-business lending data rule (May 1, 2026) applies from January 1, 2028, to lenders with 1,000 covered originations in each of two years. Summaries list credit cards as covered, but I couldn't confirm card coverage in the rule text, and who reports in a sponsor-bank model is open. For now I'd treat it as a design question for counsel.
- Tax and labor law are enforced in bulk, through employment-tax audits that reclassify a whole plan, and California class actions, rarely one claim. That's my own read, and I haven't confirmed it.
| Jurisdiction | Rule | Deadline |
|---|---|---|
| California | Reimburse "all necessary expenditures or losses"; unwaivable | None; interest from the day spent, plus attorney's fees |
| Illinois | Necessary expenses within the scope of employment | Employee submits within 30 days, unless policy allows more |
| Iowa | Authorized expenses | Within 30 days of the claim |
| New Hampshire | Expenses at the employer's request | Within 30 days of proof of payment |
| New York | A "wage supplement", if agreed | Misdemeanor 30 days after due |
| North Dakota, South Dakota, Montana | Indemnify necessary expenditures | None |
| Canada, federally regulated employers | Reasonable work-related expenses (since 2023) | Within 30 days of the claim |
California's labor agency treats the IRS mileage rate as reasonable and says employers can't force reimbursement by direct deposit (a 1997 opinion, still published). I found no general duty in Massachusetts, Minnesota or DC. In Canada, the Bank of Canada has published RPAA notices of violation since June 12, 2026.
US regulators loosened guidance in 2025 and 2026 and kept enforcing anti-money-laundering rules. A spend fintech feels both through its bank's contract, and feels tax and labor law through its customers.
What mistakes cost
Mistakes show up in different places:
- Cash. Expense reimbursement schemes ran a median of about $35,000 over 18 months in ACFE's 2026 report, so they tend to be small and long-running. Tips caught about a third of US and Canadian frauds, automated monitoring 4%. One expense-audit vendor says AI-generated documents went from almost none of the fake receipts it flagged in early 2025 to about 70% by mid-May 2026; I'd trust the trend more than the level.
- Tax. Unsubstantiated charges become wages, a badly designed allowance is taxable in full, and a card statement instead of a receipt loses a Canadian tax credit.
- Wage claims. A late reimbursement in California accrues interest from the day of the expense, plus attorney's fees.
- Bank access. A consent order on the sponsor bank can freeze onboarding overnight, or force a migration that reissues every card.
- Customers. In 2020 a venture-backed spend fintech cut limits without warning; in 2022 it dropped tens of thousands of small-business customers. When a startup-focused bank failed in March 2023, cash-balance underwriting suddenly hung on where that cash sat. The underwriting model defines the market and decides who gets cut when funding tightens.