Compliance
Passport
- Rock
- Rules
- Depth
- 3 · Drill rig
- Time to dig
- 3–10 years
- Capital
- ● · high
- Solo
- ✗ no
- AI
- ↑ AI-resistant
- Rent
- ✓ rentable
Sample
- Share of apps
- 10.1%
- No-rate
- 68%
- Median price
- $20
Figures from the canivibecodeit sample. No-rate is the share of apps carrying this tag that cannot be vibe-coded — a proxy for structural strength. Only the first thirteen mechanics were measured.
Essence
Regulated ground: payment licences, payroll, tax, KYC, HIPAA and SOC 2, legal liability. A moat made of time, lawyers and a right to be wrong that small players do not have — the price of a mistake here is not a bug, it is a revoked licence.
How it is built
Deel and Gusto — jurisdictions as a collection
Payroll and hiring require compliance with tax and labour law in every country and every state separately: employer-of-record licences, local entities, contracts, filings. Deel assembled that over years and on investors' money; every new jurisdiction is months of work a competitor has to repeat one at a time. The moat is additive — dozens of small moats, one per jurisdiction.
Stripe — licences plus banking relationships
Under the simple API sit money-transmitter licences state by state, sponsor banks, PCI DSS certification and anti-fraud obligations to the card networks. That is precisely why "build a Stripe" cannot be vibe-coded: the code is the smaller half of the product and the regulatory scaffolding and contracts are the larger one.
DocuSign — legal force as the product
The value of a signature is that courts recognise it: DocuSign's audit trails have been tested by precedent and its compliance with ESIGN and eIDAS is documented. The customer is paying for the signature to survive a dispute. The moat is reinforced by every case won — a competitor has to earn recognition not from the market but from the legal system.
How it is bypassed
Vanta and Drata — compliance as a service
SOC 2 and ISO 27001 used to be an incumbent's moat: a year of work and hundreds of thousands paid to auditors. Vanta automated the evidence gathering and turned that into months and thousands. The pattern: as soon as an infrastructure service grows around a regulatory barrier, the barrier stops being a moat and becomes a line item a startup can afford.
Banking-as-a-Service — rent the licence
Chime is a "bank" without a banking licence: the accounts and cards live at partner banks while Chime owns the product and the customer. BaaS providers and sponsor banks rent out regulatory status. The caveat is obligatory: the collapse of Synapse in 2024 showed how fragile long rental chains are — the bypass works, but it transfers the intermediary's risk onto you.
The regulatory ladder — Revolut
Start where the threshold is low and climb: Revolut operated for years on an e-money licence, fast and cheap, building its base and its revenue, and only then obtained a banking one. Crypto players started from soft jurisdictions the same way. The bypass is sequencing: run the business in the light regime first, buy the heavy licences with the money it earns.
Verdict
Build it by collecting jurisdictions, licences and court precedents. Bypass it by renting — compliance as a service, banking as a service — and by the regulatory ladder, remembering that renting a licence also means renting someone else's risk.