---
title: "Compliance"
description: "Regulated ground: payment licences, payroll, tax, KYC, HIPAA and SOC 2, legal liability. A moat made of time, lawyers and a right to be wrong that small players do not have — the price of a mistake here is not a bug, it is a revoked licence."
canonical: https://moa.giglabo.com/moats/7/
locale: en
---

# Compliance

> Markdown twin of https://moa.giglabo.com/moats/7/ — the same content as the HTML page, a fraction of the bytes.
> Every page of this site has one: append `.md` to any URL, or `index.md` to a directory URL.
> Site structure and the full page list for agents: https://moa.giglabo.com/llms.txt

- Sheet 7 / 35

## Passport

- **Rock**: Rules
- **Depth**: 3 · Drill rig
- **Time to dig**: 3–10 years
- **Capital**: ● · high
- **Solo**: ✗ no
- **AI**: ↑ AI-resistant
- **Rent**: ✓ rentable

## Sample

- **Share of apps**: 10.1%
- **No-rate**: 68%
- **Median price**: $20

Figures from the canivibecodeit sample. No-rate is the share of apps carrying this tag that cannot be vibe-coded — a proxy for structural strength. Only the first thirteen mechanics were measured.

## Essence

Regulated ground: payment licences, payroll, tax, KYC, HIPAA and SOC 2, legal liability. A moat made of time, lawyers and a right to be wrong that small players do not have — the price of a mistake here is not a bug, it is a revoked licence.

## How it is built

### Deel and Gusto — jurisdictions as a collection

Payroll and hiring require compliance with tax and labour law in every country and every state separately: employer-of-record licences, local entities, contracts, filings. Deel assembled that over years and on investors' money; every new jurisdiction is months of work a competitor has to repeat one at a time. The moat is additive — dozens of small moats, one per jurisdiction.

### Stripe — licences plus banking relationships

Under the simple API sit money-transmitter licences state by state, sponsor banks, PCI DSS certification and anti-fraud obligations to the card networks. That is precisely why "build a Stripe" cannot be vibe-coded: the code is the smaller half of the product and the regulatory scaffolding and contracts are the larger one.

### DocuSign — legal force as the product

The value of a signature is that courts recognise it: DocuSign's audit trails have been tested by precedent and its compliance with ESIGN and eIDAS is documented. The customer is paying for the signature to survive a dispute. The moat is reinforced by every case won — a competitor has to earn recognition not from the market but from the legal system.

## How it is bypassed

### Vanta and Drata — compliance as a service

SOC 2 and ISO 27001 used to be an incumbent's moat: a year of work and hundreds of thousands paid to auditors. Vanta automated the evidence gathering and turned that into months and thousands. The pattern: as soon as an infrastructure service grows around a regulatory barrier, the barrier stops being a moat and becomes a line item a startup can afford.

### Banking-as-a-Service — rent the licence

Chime is a "bank" without a banking licence: the accounts and cards live at partner banks while Chime owns the product and the customer. BaaS providers and sponsor banks rent out regulatory status. The caveat is obligatory: the collapse of Synapse in 2024 showed how fragile long rental chains are — the bypass works, but it transfers the intermediary's risk onto you.

### The regulatory ladder — Revolut

Start where the threshold is low and climb: Revolut operated for years on an e-money licence, fast and cheap, building its base and its revenue, and only then obtained a banking one. Crypto players started from soft jurisdictions the same way. The bypass is sequencing: run the business in the light regime first, buy the heavy licences with the money it earns.

## Verdict

Build it by collecting jurisdictions, licences and court precedents. Bypass it by renting — compliance as a service, banking as a service — and by the regulatory ladder, remembering that renting a licence also means renting someone else's risk.

## Related

- HTML version of this page: https://moa.giglabo.com/moats/7/
- Русский: https://moa.giglabo.com/ru/moats/7/
- Previous: https://moa.giglabo.com/moats/6/
- Next: https://moa.giglabo.com/moats/8/
- Atlas: https://moa.giglabo.com/
- Catalogue: https://moa.giglabo.com/moats/
- Calculator: https://moa.giglabo.com/calculator/
- Site map for agents: https://moa.giglabo.com/llms.txt