Fintech start-ups show a world of promise, but regulation will determine whether they unseat incumbents. ( David Locke/Flickr/Creative Commons )

Nearly 20 years ago, the launch of online payments giant PayPal shook the financial services industry.  Now, a new generation of financial technology or “fintech” companies is once again breaking down the oversized doors of the conservative banking business. From facilitating loans to wealth management to mobile payments to tax preparation, fintech companies are attacking traditional — and often inefficient — practices that shut out as many as two billion consumers (most outside the United States) from the most basic financial services.

The recent growth of fintech start-ups is impressive.  Four of the top 20 companies in Inc. magazine’s latest list of the 500 fastest-growing private companies are financial services start-ups, who hold 27 slots on the list overall. In data collected by KPMG, thirteen fintech startups are valued at over $1 billion, achieving the status Silicon Valley investors refer to as a “unicorn” because of their rarity. These include Square (mobile payments), Prosper (peer-to-peer lending), Shopify (retail sales management) and Credit Karma (financial management).

Incumbent bankers are worried, and rightly so. In a recent letter to shareholders of JP Morgan Chase, America’s largest bank, chief executive Jamie Dimon warned investors that “Silicon Valley is coming.” Goldman Sachs, according to Inc., “estimates that upstarts could steal up to $4.7 trillion in annual revenue” from incumbent banks, a potential payday that is driving venture investors to pour nearly $25 billion annually into the sector.

In addition to the potential disruption of Bitcoin and other payment innovations, Dimon acknowledged the speed and flexibility of “hundreds of start-ups with a lot of brains and money working on various alternatives to traditional banking,” particularly those that use big data to make loans more efficiently than traditional banks. For his part, Dimon believes his company can make its own investments, or, where necessary, partner with the disruptors.

This is a story being played out in many industries. But more than any other, the winners and losers in the “big bang” disruption of financial services will be determined by how government regulators apply laws that may go back a hundred years or more. From commercial banking to insurance to payment processing to investment management, traditional financial services are subject to intensive regulation from a wide variety of global, federal, and state overseers.

On the one hand, that regulation imposes considerable costs and innovation delays from which the start-ups are largely immune.  But those same rules can also provide potent protections for incumbents, keeping the start-ups out of markets that require licensing and other government approvals before serving customers.

Some fintech companies have foundered on the rocks by hewing too close to regulated activities and inviting the sudden and devastating wrath of the watchdogs. You think you’re just offering investment information, but the SEC sees it as unlicensed financial advice. You create a start-up to facilitate crowdfunding, until a state regulator bans it as the illegal sale of unregistered securities. Bitcoin and other payment innovators are already under the gun as alternative forms of currency — or, from the regulator’s perspective, as fronts for electronic money laundering.

Here are five legal threats start-ups face, which for now at least give the edge to incumbents:

1. Regulatory burdens becoming regulatory barriers ­

Traditional financial services companies I work with regularly complain about start-ups who don’t have to play by the same rulesBut as we’ve seen in industries as different as transportation (Uber) and hospitality (Airbnb), it’s a short step from envying the start-ups to applying pressure on the regulators to throw the book at them — even when doing so kills innovation consumers want.  Banking incumbents have likewise become adept at turning regulations that slow their own innovation into effective barriers blocking fintech startups from launching new products and services. Earlier, for example, I wrote about how the business model of software-based insurance broker Zenefits was being challenged by state regulators, urged on by traditional brokers who would rather fight than innovate.  Zenefits continues to win its regulatory battles, but could be stopped short at any time.

2. Lack of global standards

One of the great benefits of virtual financial services firms, is that they can efficiently tap a global market of like-minded individuals willing and able to provide financial support to companies and individuals who are otherwise shut out of the capital markets because of their small size or non-traditional risk profile. In peer-to-peer lending, for example, you choose who you loan your money to, supporting businesses or individuals who share your political or social values. But up until now laws regulating lending practices have remained both fiercely local and bizarrely complex, reflecting historic and religious skepticism about the practice of moneylending. On the Internet, it’s just as easy to borrow globally as it is from neighbors, but fintech lending and fundraising start-ups have already been caught short trying to navigate the maze of different laws that might apply.  Until banking regulations are rationalized across borders, local lenders will maintain a distinct and unearned advantage.

3. Square regulation, round innovation

It’s not just incumbents who can be surprised by technology-based innovations that disrupt traditional financial services. Banking regulators who haven’t seen significant change in the industries they oversee since the Great Depression can also be blindsided by fintech innovation, pushing them to mechanically apply square regulations to round disruptors.  In 2008, for example, Prosper and Lending Club had their operations stymied by the SEC, which claimed the peer-to-peer loans the companies were issuing were really unregistered securities. Why?   Because those providing the loans did so expecting to earn a profit “in the form of interest, which is at a rate generally higher than that available from depository accounts at financial institutions.”  Both companies struggled to redesign their business to suit the regulators, nearly wiping out Prosper along the way. Partly in response, the SEC was tasked by Congress in 2012 with developing streamlined rules for investment-oriented crowdfunding—rules that were finally approved only a few months ago.

4. Government monopolies on currency

Much of the financial system has already migrated to all-electronic formats, but the production of cash stubbornly remains a government monopoly in much of the world. Now, Bitcoin and other digital currencies are testing the possibility of financial exchanges based on new forms of trust. Intentionally or not, they’re also testing the limits of a legal system that has grown, often by accident, to rely on money as a tool of control, whether for law enforcement, taxation, or foreign trade and debt. If digital currencies achieve the critical mass and security needed to become a more stable form of money than scrip, it won’t just be the banking system that will have to adapt. Already, governments and industry trade associations have attacked crypto-currencies, sowing the seeds of doubt among users that could undermine their future growth and development.  If digital currencies fail, it won’t be from a lack of innovation.

5. Technology challenging the need for traditional regulators at all

As we’ve seen since the early days of buyer-seller rating systems on eBay, Amazon, and other e-commerce platforms, one of the things that makes disruptive technologies so unsettling is that they not only break down conventional wisdom about how industries are organized but also how they are most effectively regulated. The banking system — incumbent and emerging — clearly needs strong oversight, but there’s no reason to believe that regulation will always have to come from physical governments, which are slow to change, easily corrupted, and inefficient.

Self-regulation by fintech companies may prove the better approach, but even more promising is the emergence of rating systems built into new lending, banking, and investment platforms that empower consumers to do a lot of the policing themselves for each other’s benefit.  Automated safeguards, for example, are perhaps the key advantage of digital currency over traditional money. While they’re hardly perfect (yet), they may soon prove superior to traditional currency risk management, and an independent source of innovation.  And future unicorns.

Even fintech start-ups trying to play by the rules are undone by the complexity and expense of multiple layers of conflicting regulatory oversight. Navigating these roiling legal waters is, in some sense, the true core competence of the incumbent financial services companies — at the very least the one that continues to buy them time to come up with their own innovations or swoop in and acquire the disruptors at pre-IPO prices.

But while decidedly favoring the incumbents today, fintech innovators may find ways to reverse growing regulatory barriers and turn them to their own advantage. Incumbents can’t rest on their gilded laurels. As JP Morgan Chase’s Jamie Dimon and other industry leaders have learned from the experience of other industries, consumer demand for big bang disruptors can catalyze that change to happen faster than anyone predicts.

Maybe even overnight.

Correction: An earlier version of this column stated that Lending Tree received a cease and desist from the SEC. We regret the error.

Larry Downes is co-author with Paul Nunes of “Big Bang Disruption:  Strategy in the Age of Devastating Innovation” (Portfolio 2014). He is a project director at the Georgetown Center for Business and Public Policy.