Written by Tommy Hartono
Before I write a check to a fintech startup, the most important thing I want to know is also the most boring one: is it profitable? A lot of fintechs are being built every year, and a lot of them are being closed every year, so profitability is still the key question for me. The market in 2026 is chasing flashy AI features, and I think the potential is still in boring, sustainable profit.
And I mean real profit. What I look for before I write a check to a fintech startup is whether the profit a founder shows me is the real thing or just floated or bloated profit. If you can get that right, you can actually see the good potential of the fintech itself. Whatever product they’re going to build, or have built already, it matters that they can get some profit out of it, because that profit is what builds them a runway.
Key Takeaways
- Investors target fintech founders solving specific cultural problems, such as an application allowing Indonesian Hajj travelers to connect directly to the Saudi payment system to avoid carrying dangerous cash.
- Fintech investors frequently withdraw funding over anti-money laundering compliance risks, such as executive involvement in Indonesia’s illegal online gambling market which saw IDR359.81 trillion in 2024 transactions.
- Investors evaluate payment founders by testing how they handle unreliable infrastructure, such as managing transactions through Bank Indonesia’s BI Fast system which operates with a 70% notification reliability rate.
- AI-generated fintech applications often lack critical foundational logic, such as implementing Stripe-style idempotency keys to prevent duplicate QR code payments from triggering automated fraud alerts.
- Securing software partnerships with large banks requires multi-year operational consistency from fintech startups, because financial institutions frequently evaluate new technology vendors on strict three-year licensing cycles.
Why Do Investors Target Fintech Founders Solving Highly Specific Cultural Problems?
Fintech is very wide. You can bring it into every aspect of people’s lives, so I pay attention to founders who double down on one specific thing, especially a problem that belongs to one culture.
One fintech I admire helps Indonesian Hajj travelers. Most Indonesians are Muslim, and one of their goals is to go to Mecca, in Saudi Arabia, for the Hajj. When they go, they need to bring a big pile of cash for food, accommodation and everything else. Carrying that much cash can be very, very dangerous. It also raises suspicion, because cash transactions there are categorized as potential money laundering.
The founder built an application that connects them to the Saudi payment system, so they can use their funds there without the risk of carrying cash. It’s very specific and very simple: he just wanted Indonesian people to be able to spend in Saudi. He earned from there, and now he’s earning a lot of money from that one specific case.
How Do Investors Evaluate Active User Retention Versus Manufactured Growth in Fintech Startups?
When a founder shows me growth, one very, very important part is retention, and more and more I’m looking at how active the users are. You can have a lot of users to start with. What makes the real number is how many of them actively use your solution and contribute to your growth. You can get 1,000,000 users and maybe only 1,000 of them are really using your fintech application every day.
Hyper-growth in sign-ups is a red flag for me when the activity underneath it is manufactured, and faked activity is actually pretty easy to spot.
One very important aspect is time. Activity that’s been faked might not be sustainable in the long run, and it isn’t even a very long run, just six months to one year. Over that window you see how consistent the company is, and how consistent the information they share with us is when you check it against reality.
Why Is Regulatory Compliance and Anti-Money Laundering Critical for Fintech Startup Investments?
Quite a lot of fintechs lose funding over compliance, especially funding from investors in the United States, who care deeply about fraud, bribery and money laundering. I think those investors bring a good influence into countries like Indonesia, Singapore and the Philippines. What they look for is a fintech that complies with the regulators and with the specific practices that keep it still within the corridor.
I come at this from the anti-money laundering side. At Mulai we build anti-money laundering and fraud prevention tools for fintechs and banks in Southeast Asia, and before that I did business development at Tookitaki and Flagright, both in the same space. A lot of things can go wrong in fintech. Criminals can use a fintech to launder money, and in a way that fintech might look sexy, because it processes a lot of transactions, while some of those transactions are criminal.
Regulators put a price on that risk: recent anti-money laundering fines against fintechs in the US, UK and Netherlands range from about US$0.8 million to US$80 million.
| Fintech (country) | Regulator and date | Fine (local currency and US$) | Compliance failure cited |
|---|---|---|---|
| Modulr Finance B.V. (Netherlands) | De Nederlandsche Bank (DNB), September 2026 | €722,160 (≈US$809,000) | Inadequate ongoing monitoring of customers and transactions, 2023-2024 |
| Paxos Trust Company (US) | NYDFS, August 2025 | US$26.5 million | Systemic AML failures and insufficient due diligence on Binance |
| Monzo Bank (UK) | FCA, July 2025 | £21.1 million (≈US$28.6 million) | Inadequate onboarding, risk assessment and transaction monitoring |
| Robinhood Financial and Robinhood Securities (US) | FINRA, March 2025 | US$26 million total, AML share not stated | Failure to detect, investigate or report suspicious activity |
| Block, Inc. – Cash App (US) | 48 US state money-transmission regulators, January 2025 | US$80 million in costs and penalties | BSA/AML program deficiencies, 2021-2023 examination |
One of the biggest fintechs in Indonesia was recently sued by a bank as well as an investor, and the news has covered it. It’s the company anybody who wants to build fintech in Indonesia looks at. They were hiding quite a lot of malicious transactions, not to mention potentially illegal gambling.
Gambling came up in my own investing too. Online gambling is illegal in Indonesia, and the money in it is huge: PPATK, the country’s financial intelligence agency, identified IDR359.81 trillion in online-gambling transactions in 2024, which is more than US$20 billion. There was one fintech I almost gave a small check to, and then I found out one of their executives was involved in online gambling. I backed out at the last minute because of that.
How Do Investors Test Fintech Founders on Handling Unreliable Payment API Confirmations?
When a founder tells me they offer international payments, I try to think like their customer. I share what my trouble is, and then I see how they react to it. Based on that response, you can see whether they really understand how international payments work in real life.
One use case I usually ask about comes from Indonesia. We have a fast transfer system called BI Fast, run by Bank Indonesia, and it is not very reliable. From what I see on the API side, the notification from the government side is usually only at around 70%. That notification is how you know whether a transfer went through, and for an API, 70% is totally not reliable. A lot of payments run on it, too: Bank Indonesia says BI Fast processed about 3.4 billion transactions in 2024.
Sometimes the founder in front of me is offering payments through BI Fast, so I ask how they make sure the transaction really goes through, or fails, without losing money. Quite a lot of fintechs lose money on that, and the way a founder answers shows me whether they really own the topic.
Why Does AI-Generated Fintech Code Require Foundational Programming Reasoning and Idempotency Guardrails?
Answering that well takes reasoning, and reasoning is the most important skill I see missing in this era. With AI, quite a lot of people leap straight into building something without the basic knowledge of the technology. Those of us who learned to program before these tools had the experience of building the logic ourselves, and that isn’t being shared with the next generation. The logic in building or programming challenges your brain to actually be better.
Now it’s as simple as writing a prompt, and behind the scenes it becomes a black box. They don’t understand what’s being built, why it’s being built, why the AI chose this way instead of that way, or this programming instead of that programming. That reasoning is being pulled away from the new generation. In fintech I think the ease of these tools is dangerous, because you need exactly that reasoning to handle financial edge cases.
There was a fintech I was about to invest in that built one of its features through AI, and they didn’t get the full picture of that system. The feature was a QR code payment. The customer scans a QR code, authenticates, and the money goes through to the merchant. With AI, you can build it like that. The problem comes up when people click twice.
You click twice, so what happens? Does it trigger the transaction two times, or is it okay? Is there any guardrail on it? If you know the logic, you already understand that you have to make sure none of these transactions create a duplicate. A duplicate transaction is a basic thing, and it can also become a malicious thing, because the system might see the duplicate and think, hey, maybe you’re a fraudster.
Payments have known guardrails for this. Stripe’s API, for example, uses idempotency keys so a request can be retried safely without creating a second object or repeating the operation. Someone still has to understand the flow well enough to put a guardrail like that in the right place, and that understanding is the difference I see between the current generation of programmers and the one before it.
How Do Investors Use Software Hackathons to Identify Dedicated Bootstrapped Fintech Founders?
I usually spot the quiet, bootstrapped winners through hackathons. I join a lot of them, and because I’m a programmer myself, talking with these future founders gives me an idea of which ones will really double down on what they’re doing and which ones are just having fun.
Sometimes a hackathon happens in teams, and you can spot the difference between people who are just attending, or just trying to prove their hypotheses, and people who really care about what they’re doing. I’m not an expert in this, but you get that feeling. The trait I see in the ones who care is that they’re open to sharing, because when you really care about a topic, it makes you happy to share something with people.
Why Is Multi-Year Consistency Required for Fintech Startups to Secure Bank Partnerships?
I know the grit it takes with big, slow banks from my own side, because I sell to them too, now at Mulai. It definitely takes time, and you have to be consistent, because banks like consistency. Maybe you don’t win in the first year. Sometimes a bank’s licensing cycle is three years, so three years later they come back and look, and you are still doing the same thing. That is great material for them when they look at a potential partner to work with.
So when I’m testing whether a technical founder has the grit to close hard deals with big banks, consistency is what I’m looking for. One founder worth checking out is Khaled from Dobin. His work is connecting people to their business banking, with multiple business banks in one application. It’s not easy to get data from banks, and he has been doing it very well.
Why Should Fintech Founders Disclose Previous Product Failures and Pivots to Investors?
Some founders have admitted failure to me, and I very, very much welcome it when people share that, because failure is a receipt for success.
So if you’re a founder heading into a raise this year, the product that didn’t work or the pivot that cost you a year belongs in the conversation with an investor like me, right next to your profit and your retention numbers, because I’d much rather hear it from you.
FAQs
I ignore top-line growth if credit quality is trash. Exploding loan books mean nothing if borrowers default. You must measure growth against past-due rates. Indonesia saw lending jump 26% in 2026, but 90-day past-due loans sat at 4.26%. I want founders managing risk, not blindly deploying capital.
Not automatically. The DOJ/SEC FCPA guide notes applicability depends on specific facts, like operating in U.S. territory. U.S. backers bring healthy pressure for anti-bribery standards, but exact legal jurisdiction requires real reasoning. Don’t assume. Know your compliance footprint.
I look for people transacting on a regular cadence, not dormant accounts inflating a pitch deck. Grab reported 47.2 million monthly transacting users in 2025 by tracking unique individuals who actually spent money. I expect founders to track that exact raw utility. Vanity sign-ups do not pay bills.
You need an end-to-end system, not a flashy AI patch. OJK Regulation No. 12 outlines four solid pillars: prevention, detection, investigation, and monitoring. Showing me you have these basic guardrails in place proves you actually understand financial crime risks and aren’t just building a black box.
Own them with raw clarity. Complaints are inevitable – regulators recorded nearly 11,948 fintech complaints in late 2024 alone. I want to see how you handle those edge cases. Hiding friction is a red flag. Using it to improve your product’s underlying logic shows real grit.
About the Author
Tommy Hartono is an angel investor building Mulai, which makes anti-money laundering and fraud prevention tools for fintechs and banks in Southeast Asia. He was the founding APAC business development manager at Flagright (YC W22), an AML compliance and fraud detection startup. Before that, he worked in business development at Tookitaki, an end-to-end AML operating system. He’s a programmer by background and a certified Microsoft Professional, and he previously founded and led Scrapiro, a decentralized recycling platform.
