A SaaS founder can ship on Monday and invoice on Friday. A payments or lending founder usually can't move a single dollar until a bank, a regulator or both have said yes, and that yes can take most of a year. The product may be ready long before the business is allowed to run it.
That gap shapes everything about how you operate. Your burn includes compliance people before it includes salespeople. Your biggest pipeline is often three banks, not three hundred customers. And the most sensitive data you'll ever hold must never sit in a general-purpose workspace. This page is about the operating layer around all of that.
Why a fintech company runs on a different clock
The usual startup loop is build, sell, learn. In fintech there's a gate in the middle. You need a licence of your own, a sponsor bank that holds the licence for you, or a place in a regulator's test programme. Until one of those lands, revenue is zero and the clock still runs.
So the number that matters most early is runway measured against the partner timeline, not against a sales plan. Record cash, MRR and burn each month in Startup Health. With MRR at zero, the dashboard is really a runway gauge, and its alerts fire when runway drops below 6 months. That threshold is built in and can't be changed, which is fine: six months is roughly when a delayed bank signature turns into a bridge round conversation.
Then model the wait. In the Financial Planner, put compliance and risk salaries under Operating Expenses from month one, and add legal opinions, audits and application fees as Non-Recurring Expenses. Clone the project and push the first transaction back by two quarters in the copy. Put the two side by side with Compare. If the stressed case runs out of cash before launch, you know how much to raise, and you know it before an investor asks.
Software for fintech startups, sorted by the job
Most fintech stacks mix two kinds of tool. Some run the regulated product and touch customer money or identity. Others run the company: plans, people, investors and partners. Nautis is only ever the second kind.
| Job | What it looks like in fintech | In Nautis | Still needs a specialist |
|---|---|---|---|
| Bank or sponsor partner | Months of diligence, then ongoing monitoring by the bank | A partner pipeline in Leads CRM, a diligence data room | Your counsel, and the bank's own onboarding process |
| Licence or sandbox | Applications, restricted permissions, regulator questions | A task board for the application, Decision Loop for the route you pick | Regulatory counsel or a compliance consultant |
| Runway before revenue | Burn with no MRR for a long time | Startup Health alerts, Financial Planner scenarios | Accounting software and an accountant |
| Card data | Any company that stores, processes or transmits it falls under PCI DSS | Nothing. Keep it out | A processor or vault built for card data |
| Identity checks and monitoring | KYC, AML screening, transaction alerts | Nothing. Keep it out | A KYC and transaction monitoring vendor |
| Investor diligence | Investors ask about compliance as much as growth | Data rooms, Investor Readiness, Fundraising CRM | Your lawyer for the legal documents |
| Team logins and vendor keys | Many vendor dashboards, sandbox keys | Credentials Vault, AES-256 encrypted, shared per person | Production secrets management inside your own infrastructure |
Read the empty cells in the Nautis column as a design choice. A company workspace that also held card numbers would pull itself into your compliance scope, and that's the last thing an early fintech needs.
How do fintech startups manage a bank partnership?
Treat the bank as your most important customer, with its own pipeline and its own paper trail. US bank regulators expect it. Their 2023 interagency guidance on third-party relationships names relationships with financial technology companies directly, and it walks banks through a life cycle: planning, due diligence and selection, contract negotiation, ongoing monitoring and termination. That last pair matters. The diligence doesn't stop when you sign.
In Nautis, create a separate pipeline in the Leads CRM called something like Bank partners. The guide suggests one pipeline per sales process or partnership track, and each pipeline can have its own stages, so you can mirror the bank's process: Intro, Questionnaire, Diligence, Contract, Live, Monitoring. Mark Live as Closed Won. Add a custom field for the bank's risk contact, and log every call under the lead's Meetings tab.
For the document side, open a data room per bank. Share it with a private, passcode-protected link, leave Allow downloads off unless they ask, and set an expiry. The Analytics tab shows who opened which file and when, which tells you whether the risk team has read your policies or is still waiting on someone. Each file keeps a version history, so when the bank asks for the third draft of your complaints policy, they get it and you keep the first two.
Licences, sandboxes and the decisions you can't undo
Some founders skip the partner route and test under a regulator's eye. The UK FCA's Regulatory Sandbox takes applications at any point in the year, from authorised firms, unauthorised firms seeking authorisation and technology companies serving regulated firms. Any authorisation you get there is restricted to the agreed test. The FCA is also clear that the sandbox is not exempt from regulation, and that a no enforcement action letter covers only its own disciplinary action during the test, not your liabilities to consumers.
Whichever path you take, the choice between owning a licence and renting one is about as close to a one-way door as a startup gets. Log it in the Decision Loop with Reversible? switched off, a 90-day review and the assumptions written plainly: the bank will sign by March, compliance hires cost what we budgeted, the regulator's questions take one round. Because the call is irreversible, the form suggests waiting 24 to 48 hours before you save it. Take the pause.
The built-in legal advisor, Keel, can give you a first read on a partner agreement or a list of questions for counsel. It's a starting point. Nautis doesn't replace a lawyer, and in fintech you'll want one who has filed this exact kind of application before.
Data you should never put in Nautis
Draw this line on day one and write it into your onboarding doc. The PCI Security Standards Council says PCI DSS applies to entities that store, process or transmit cardholder data, and to entities that could affect the security of that environment. A tool where someone pasted a card number into a note is now part of that conversation.
Nautis holds no certification for regulated financial data, and you shouldn't treat it as if it did. Keep these out of it entirely:
- Card numbers, CVVs or bank account details of your users. Your processor handles these.
- Identity documents from KYC. Passports, selfies and proof of address stay with your verification vendor.
- Transaction records and suspicious activity notes. They belong in your monitoring system and your compliance records.
- Customer complaints with personal financial detail. Log the count and the theme in Nautis if you like, never the case file.
What does belong in Nautis is the company layer: policies in draft, board packs, partner correspondence, hiring plans and investor updates. Custom forms are fine for a waitlist or a partner intake form. Don't build a form that asks applicants for their income or account numbers. And use the Credentials Vault for team logins and sandbox keys, while production keys for systems that move money stay in your own secrets manager under your security programme.
A month inside a pre-launch payments company
Picture a five-person team building business payment accounts on top of a sponsor bank. They have $1.4 million in the bank, burn about $95,000 a month and no revenue. Here's one realistic month.
- Day 1. The CEO records last month in Startup Health. Runway reads a little under 15 months. No alert yet, but the trend line is clear.
- Day 4. The bank's risk team sends a 140-question vendor questionnaire. The COO splits it into tasks on a board called Bank diligence, with owners and due dates.
- Day 11. Updated policies go into the bank's data room. Analytics shows the risk lead opened the AML policy twice and nothing else, so the next call is about AML.
- Day 15. An investor asks how the delay affects the plan. The CEO shares the investor snapshot by link, with Allow history on, and sends the stressed Financial Planner export as a PDF.
- Day 22. The bank asks for a named compliance officer before contract. The team logs the hire as a Hiring decision, high confidence, 60-day review.
- Day 30. The 7:00 am Chief of Staff briefing shows two overdue diligence tasks and a review due in the Decision Loop. Nothing is sent to the bank without someone approving it.
Notice what never happened in Nautis: no customer onboarded, no card issued, no transaction screened. Those all ran, or will run, in the regulated stack.
When Nautis isn't the right tool for a fintech
- You need a compliance management system. Policy attestation, risk registers mapped to rules and exam-ready audit trails are a specialist category. Nautis tasks and data rooms don't replace it.
- A partner or customer requires vendor certification from every tool. Some bank programmes ask this of all software that touches the relationship. Ask Nautis what it can provide, and don't assume any certification.
- You're past the startup stage. A regulated firm with a compliance department, internal audit and complex permission needs will usually outgrow a startup workspace.
- You want a ledger. Nautis isn't an accounting system, and it has no general ledger, reconciliations or regulatory reporting.
- You want a long vendor track record. Nautis launched publicly in July 2026, so independent reviews are still few.
If those don't apply, start with runway, the partner pipeline and the diligence room. Those three cover most of what a pre-launch fintech founder loses sleep over. For the raise itself, see the investor diligence guide.
FAQ
What software do fintech startups need before launch?
Before launch you need tools to run the company: runway tracking, a financial model with a delayed-launch scenario, a pipeline for bank partners and a controlled place to share diligence documents. You also need the regulated stack, meaning a processor, identity verification and transaction monitoring, chosen with your partner bank. Keep those two groups separate.
Can I store customer KYC documents or card data in Nautis?
No. Nautis holds no certification for regulated financial data, and putting card or identity data in a general workspace widens your compliance scope. Keep that data with your processor and your verification vendor. Use Nautis for company records such as policies, plans and partner correspondence.
How should a fintech startup track a sponsor bank relationship?
Give it its own pipeline with stages that match the bank's process, from intro to diligence, contract and ongoing monitoring. In Nautis that's a separate Leads CRM pipeline plus a data room per bank, with a passcode link and an expiry. The data room's Analytics tab shows which documents the bank has opened.
Does Nautis help with a licence application?
It helps you run the project around it: a task board for every document and deadline, the Decision Loop for the route you choose, and a data room for drafts. It doesn't prepare filings or give legal advice. Work with regulatory counsel who has handled your type of application.