United States – Utah

Licensing, Authorisation & Market Access

Utah requires a money transmitter license under Title 7, Chapter 25, the Money Transmitter Act, administered by the Department of Financial Institutions through the NMLS system; applicants must show independently audited net worth of at least $1,000,000, while depository institutions and US or state government entities are exempt. Utah's Industrial Bank charter, granted by DFI jointly with FDIC deposit-insurance approval under Utah Code 7-1-704/706, is the primary US bank-charter venue for fintech and payments companies, permitting industrial banks to accept federally insured deposits and make consumer and commercial loans while being examined annually alongside the FDIC. PayPal Holdings submitted applications to Utah DFI and the FDIC on 2025-12-15 to establish PayPal Bank as a Utah-chartered ILC, though as of the July 2026 collection window DFI's public application-status page showed no recorded approval or withdrawal, leaving the filing pending. Commercial financing providers, including merchant cash advance firms, must separately register with DFI under Title 7, Chapter 27 (effective January 2023), unless exempt, such as being already MTL-licensed under Chapter 25 or transacting five or fewer deals annually in-state.

Conduct, Safeguarding & Promotions

Safeguarding for Utah money transmitters rests on a minimum $50,000 surety bond rather than a UK-style statutory segregation regime, with DFI able to raise the bond requirement and, where a licensee is found unsafe or unsound, to compel it to deposit funds with an acceptable financial institution or to cap or prohibit further payment-instrument issuance. Conduct and promotions oversight for consumer-facing fee practices sits with the Division of Consumer Protection, which treats undisclosed or mischaracterised card and surcharge fees as a deceptive act under its general unfair-and-deceptive-practices authority, in the absence of any dedicated payments conduct code.

Stablecoins & Digital Money

Utah has taken a deliberately permissive approach to crypto assets: blockchain tokens were carved out of the Money Transmitter Act's licensing perimeter in 2019-2020, and the 2025 HB230 blockchain amendments further shield self-custody, node-running, staking and mining from state money-transmitter licensing and limit local zoning or noise rules targeting digital-asset mining, though the bill's original state-treasury 5% digital-asset reserve provision was stripped before Senate passage. Utah has since enacted HB72 during its 2026 session, signed 2026-03-25 and effective 2026-05-06, creating Title 13, Chapter 82, the Virtual Currency Kiosk Regulation, which imposes graduated transaction limits, disclosure requirements, bilingual fraud-prevention warnings, annual location reporting to the Division of Consumer Protection, and recordkeeping duties, superseding the November 2025 interim-committee draft that had only proposed such protections and correcting the earlier draft-only characterisation of the state's kiosk-consumer-protection position.

Operational Resilience & Critical Infrastructure

Utah's operational-resilience baseline for payments runs through the Protection of Personal Information Act, in force since 2006, and the 2024 SB98 breach-notification amendments, which require notice to the Attorney General and the Utah Cyber Center with prescribed content whenever misuse affects 500 or more Utah residents, alongside a general standard of notification without unreasonable delay once an investigation confirms a breach. A federal Gramm-Leach-Bliley Act carve-out under 15 U.S.C. 6809 exempts financial institutions and their affiliates from Utah's state breach-notification chapter entirely, while civil fines for non-exempt entities are capped at $2,500 per violation, generally $100,000 in aggregate, unless more than 10,000 residents are affected.

Scheme & Network Compliance

Debit-card surcharging is prohibited nationwide, including in Utah, under the federal Durbin Amendment's interchange-fee and network-rule framework, a floor that applies independently of any state-level permission to surcharge credit transactions. In the absence of a state-specific interchange or surcharge cap, since Utah's 2013-2014 surcharge ban lapsed unrenewed, merchants surcharging credit cards must instead comply with card-network limits such as Mastercard's 4% cap, which may not exceed actual processing cost. Separately, Utah merchants sit within the nationwide Rule 23(b)(3) Visa/Mastercard interchange-fee antitrust settlement class covering card acceptance between January 2004 and January 2019, with a court-approved second distribution of settlement funds dated June 2026.

Payment Corridor Dynamics

Utah has no distinct state-level cross-border payment corridor or remittance-scheme regime; its corridor relevance is instead structural, arising from Utah-chartered industrial banks' ability to export their home-state interest rate nationwide under Section 27 of the Federal Deposit Insurance Act, making the Utah charter a de facto national consumer-credit distribution corridor for partner fintechs. MX, headquartered in Lehi, Utah, aggregates bank transaction data nationally and functions as connective infrastructure within the broader US open-banking data corridor, an adjacent signal rather than a dedicated cross-border payment programme.

Industry Structure & Commercial Dynamics

Utah remains the leading US jurisdiction for Industrial Bank charters: Stellantis Bank USA's FDIC approval reportedly brought the state's industrial-bank total to 16, alongside Ford, GM and Edward Jones approvals in the same period, though Utah DFI's own industrial-banks page lists 15 active charters, an unreconciled discrepancy flagged for confirmation next cycle. Utah already hosts an established payments-relevant industrial-bank cluster, including WebBank, Merrick Bank, Comenity Capital Bank and Block Inc., which obtained its charter in 2020; PayPal's application follows this pattern, underscoring Utah's position as the payments industry's preferred bank-charter venue.

Legal & Litigation

Colorado's UCCC Administrator sued fintech Avant, alleging that Utah-based WebBank was merely a pass-through lender rather than the true lender under the predominant-economic-interest test drawn from CashCall v. Morrisey; the case was resolved through a 2020 safe-harbor settlement that now structures Colorado's approach to bank-fintech lending partnerships. In the District of Columbia, the Attorney General found that Utah-chartered FinWise Bank was not the true lender for loans made with nonbank partner Elevate carrying APRs up to 149%, producing a $4 million settlement that requires at least $3.3 million in consumer relief and halted the DC arrangement. WebBank has since formally intervened in FDIC rulemaking on federal interest-rate authority, citing its role in the Colorado litigation and urging the agency to confirm that a loan's federal-law validity survives its sale to a nonbank purchaser.

Merchant Acquiring & Risk

Utah has no dedicated merchant-acquirer licensing regime or high-risk-MCC statute; acquiring-related consumer risk is addressed only indirectly, through DFI's general oversight of payment service providers and the Division of Consumer Protection's surcharge-disclosure enforcement, an under-indexed area relative to more heavily regulated jurisdictions.

Outlook

Absent legislative action, Utah's acquiring oversight is likely to remain indirect; a dedicated acquirer-licensing or high-risk-merchant framework is not currently signalled, leaving this the thinnest-covered module in the state's payments regime.

Product Innovation & Market Development

Utah's Regulatory Sandbox Program, established under Utah Code 13-55-101 in 2019 and administered by the Department of Commerce, was the third such fintech sandbox launched by a US state and lets peer-to-peer lending, money transmission and blockchain or crypto products test for up to two years without prior state licensure, with participants deemed appropriately licensed for federal-law purposes. Utah's 2025 Earned Wage Access Services Act (HB279), effective 2025-05-07, creates a registered on-demand-pay product category, the seventh such state framework enacted, with a grandfathering path running through October 2025 for existing providers.

Consumer Protection & APP Fraud

The Utah Consumer Privacy Act, effective 2023-12-31, gives the Attorney General exclusive enforcement authority with no private right of action, requires a 30-day non-sunsetting cure period, and caps civil penalties at $7,500 per violation. Utah has no dedicated authorised-push-payment fraud reimbursement mandate; consumers instead rely on the federal Regulation E and Electronic Fund Transfer Act unauthorised-transfer framework, with no primary source located that directly negates an APP-fraud mandate for the state.

AML/CFT & Financial Crime

This module's content for Utah is Sentinel.gi-fed: money-transmitter licence applicants must provide the most current review of their AML policy as part of the NMLS application package reviewed by DFI, a procedural touchpoint rather than an original illicit-finance assessment, which readers should follow up via the Sentinel.gi feed directly. Also Sentinel-flagged: since 2016, Utah deferred-deposit (payday) lenders must check a borrower's credit report before lending and report loan information to consumer reporting agencies and a state database, a financial-crime-adjacent data-sharing control noted here for completeness rather than analysed as a WPM conclusion.

Correspondent Banking, Settlement & Access

PayPal's proposed Utah-chartered bank would seek direct card-network membership to complement, not fully replace, its existing processing and settlement relationships with program banks Goldman Sachs, Wells Fargo and JPMorgan Chase, a correspondent-dependency-reduction rationale central to the ILC bid. All Utah industrial banks are FDIC-insured and undergo joint annual safety-and-soundness examinations by DFI and the FDIC, underpinning access to federally backed settlement and deposit-insurance infrastructure, while Sections 23A and 23B of the Federal Reserve Act limit affiliate transactions between industrial banks and their nonbank parents.

Commercial Intelligence (M&A, Investment & Product)

2025-12-15 -- PayPal Holdings filed applications with Utah DFI and the FDIC to establish PayPal Bank, explicitly framed as reducing reliance on third-party program-bank partners; amount not publicly disclosed and the filing remained pending regulatory decision at collection time. FDIC approval (completed) -- Edward Jones' Utah ILC charter, first filed 2020 and resubmitted April 2025, will launch with at least $330 million in initial funds, targeting a 2027 opening. FDIC approval (completed) -- Stellantis Bank USA received Utah ILC charter approval, subject to a minimum $150 million initial capital requirement and a 15% tier-1 leverage-ratio condition. Conditional FDIC approval, January 2026 -- Ford Motor Credit and GM Financial each received conditional approval for a Utah ILC charter after multi-year pending applications; final capitalisation terms were not disclosed in reporting. Signalled interest, November 2025 -- BNPL provider Sezzle's chief executive indicated the company may apply for a Utah ILC charter within the following year to gain distance from state-by-state BNPL regulatory fragmentation; no formal application had been filed at collection time.