Trace the product before naming it
Fintech and DeFi are labels, not explanations of who holds customer value. Walk through a customer depositing funds or tokens, exchanging, transferring and redeeming them. Name each entity controlling the interface, custody, pricing, execution and settlement, including outsourced providers. Mark where the customer and each provider are located.
Draw the flow for a normal transaction and a failed one. Identify when the customer has a claim against an operator, when assets are held by a third party and who can stop or reverse a transfer. If a smart contract is involved, record its actual permissions, upgrade keys and dependencies instead of assuming the word decentralized removes an operator.
Compare promises with contractual rights
Put the onboarding screen, marketing, terms and transaction records next to each other. If the interface promises fast withdrawals or always-available liquidity, test wait periods, limits, suspensions and provider outages. A warning should explain the product's real failure points, not bury them in generic risk language.
Trace fees, rates, custody arrangements and complaints from customer view to ledger. Identify who can answer a dispute and where the evidence resides. Simulate a transfer failure: can support tell the customer what happened without revealing another person's information or making an unsupported guarantee?
Check each function in each market
Payment, custody, lending, exchange and investment functions may call for different questions in each location. Ask qualified local advisers to check current requirements for the actual product version, entities and intended customers. Include consumer-facing terms, identity and transaction controls, data handling and marketing where relevant to that review. A foreign partner's permission does not automatically cover local activity.
Record the countries reached by the service and how access is restricted or offered. A local team, language-specific campaign or payment partner may change the analysis. Do not treat one regional legal memo as permission to launch a feature everywhere; record the source, date, assumptions and open issues market by market.
Version the assessment with the product
Keep a dated map of money, token and data flows, responsible entities, contract versions, provider roles and legal questions. A new staking option, hosted wallet, yield feature or cross-border withdrawal can change the original facts. Product, legal, risk and marketing reviewers should approve the same current description before launch.
Build a change trigger into development. If custody, asset type, user location or redemption terms change, revisit the map and disclosures. Test an outage, lost access and complaint process, and log who can pause activity and notify customers. The review remains useful only while it matches the live service.
First-review file
- Current screens, marketing claims and customer terms.
- Normal and failed transaction flow diagrams by product version.
- Custody, bank, payment, exchange and technical provider agreements.
- Market and customer list with dated local advice and open issues.
- Risk, incident, complaint and product-change ownership.
For related issues, see banking and finance and blockchain legal consultancy.