Software companies keep hearing that their business customers need capital and are leaving to find it elsewhere. The demand is real. In the Federal Reserve Banks' 2026 Report on Employer Firms, 38% of small employer firms said they had applied for a loan, line of credit or merchant cash advance in the prior 12 months, and the share of applicants who went to online lenders rose from 17% in the 2020 survey to 29% in the 2025 survey.
What that report does not show is how long it takes a platform to put a lending offer in front of those customers. The original version of this article promised a launch in under 30 days. We could not find a public, independent benchmark for launch timelines, so this rewrite drops the promise. The honest answer is that the schedule depends on two things a platform does not fully control: the partner's onboarding and the platform's own legal review. What follows is the order of work, with the rules that apply at each step.
For background on how the arrangements work, see our explainer on embedded lending and the broader picture in what embedded finance is.
Step 1: Pick the delivery model before the partner
The delivery model decides almost everything downstream: how much engineering it takes, what data you handle, and how regulators may classify your role. There are three common setups.
| Model | What the user sees | What your platform handles | Typical role |
|---|---|---|---|
| Referral link | A link or banner that opens the partner's own application | Placement and tracking only | Referrer |
| Lead form | A form inside your product that passes the user's details to the partner | Collection and transfer of applicant data | Referrer, or broker depending on activities |
| API integration | Offers, applications and status shown inside your product | Data mapping, display of offers, status updates | Depends on activities; needs the closest legal review |
The further right you move, the more your platform looks like a participant in the credit transaction rather than a bystander. That is not a reason to avoid an API build, but it is a reason to decide on the model first and bring counsel in before signing.
Two questions settle the choice for most teams:
- Do you want to touch applicant data? A referral link sends users away and keeps you out of the data flow. A lead form or API means you collect financial and personal information and pass it on, which brings privacy and security duties (Step 6).
- Will anyone at your company talk to applicants about loan terms? If your support or sales staff will explain offers, compare them, or help negotiate, you are drifting from referral into brokering (Step 3).
Step 2: Vet the lending partner the way a bank would vet you
Start with licensing. In participating states, licenses for non-bank financial companies run through NMLS, which the Conference of State Bank Supervisors describes as "the system of record for non-depository financial services licensing." Its public lookup, NMLS Consumer Access, is a free service to confirm that a financial-services company is authorized to do business in a state. Check the partner's entities, not just the brand name.
Then expect scrutiny in the other direction. If the money ultimately comes from a bank, that bank must manage you as a third party. The Interagency Guidance on Third-Party Relationships, issued by the Federal Reserve, FDIC and OCC in June 2023 (OCC Bulletin 2023-17), says third-party relationships can include "referral arrangements," and that a relationship can exist even without a contract or payment. The guidance walks banks through five stages: planning, due diligence and third-party selection, contract negotiation, ongoing monitoring, and termination. In practice that means questionnaires, contract terms on marketing and complaints, and periodic reviews. Budget time for it.
A partner diligence checklist that reflects those rules:
- Licenses and registrations for each state where your users operate, verified in NMLS where applicable.
- Who the lenders are. A single lender, a panel, or a marketplace that routes to many. Ask for the list and which products each offers.
- Product mix and pricing disclosure. Does the partner show total cost, payment amount and term for every product, including merchant cash advances? Our guide to merchant cash advances explains why that matters.
- Complaint handling. Who receives complaints from your users, and will you see them?
- Marketing review. Will the partner approve or supply the copy you show users?
- Compensation terms in writing, including what triggers a payment and whether you are paid on approval, funding or repayment.
Step 3: Decide whether you are a referrer or a broker
This is the decision with the most legal weight, and the line is drawn by state law, by activity rather than by job title.
California shows how the line works. The Department of Financial Protection and Innovation's California Financing Law FAQ describes a broker as "any person engaged in the business of negotiating or performing any act as broker" in connection with loans made by a licensed finance lender. Separately, California Financial Code section 22602 lets a licensed finance lender pay an unlicensed person for referring a borrower for a commercial loan, but only under conditions: among them, the loan's annual percentage rate cannot exceed 36%, the lender must underwrite the loan, and the unlicensed referrer may not take part in loan negotiation or counsel or advise the borrower about a loan. The statute defines a referral as introducing the borrower and lender or passing the borrower's contact information to the lender.
Texas now requires registration for brokers of sales-based financing. House Bill 700 added Chapter 398 to the Texas Finance Code. Under the rules adopted by the Texas Office of Consumer Credit Commissioner, providers and brokers of commercial sales-based financing must register with the OCCC by December 31, 2026, through NMLS, with a $1,000 fee for initial registration and for each annual renewal (as of November 2026). Chapter 398 also prohibits unfair, deceptive or abusive acts. Whether your platform counts as a broker turns on the statute's definitions, so get that read in writing before December 31.
Federal fair lending law reaches referrers too. Regulation B, which implements the Equal Credit Opportunity Act and covers business credit, defines "creditor" for its anti-discrimination and anti-discouragement rules to include a person who "regularly refers applicants or prospective applicants to creditors, or selects or offers to select creditors," according to the CFPB's text of 12 CFR 1002.2. So the logic you use to decide which users see a funding offer, and how you word it, should be reviewed for discouragement and disparate treatment, even if you never make a credit decision.
A practical way to stay on the referral side, where state law allows it: keep your platform's role to placement and introduction, let the licensed partner present terms, and do not let your staff advise users on which offer to take. If your business model needs your team to advise, plan for licensing.
Step 4: Map the disclosure rules to whoever makes the offer
Several states now require consumer-style disclosures on small business financing. The duty usually sits with the provider that makes the offer, but your interface may be where the user sees it, so the contract should say who delivers what and where.
- California: Under SB 1235, a "provider," meaning a person who extends a specific offer of commercial financing, must give disclosures when it makes the offer, and the recipient must sign them before the transaction is finalized, per the DFPI's commercial financing disclosures page. The DFPI said the regulations took effect December 9, 2022 and cover installment loans, open-end credit, factoring and merchant cash advances.
- New York: The Department of Financial Services' commercial finance disclosure regulation, 23 NYCRR 600, applies to financing in amounts up to $2,500,000 and includes duties for brokers as well as providers.
- Texas: Chapter 398 requires providers to give written disclosures at or before the time they extend a specific offer, and to send corrected disclosures if they learn one was inaccurate, per the OCCC rules.
Other states have passed similar laws, and the list changes. Ask your partner for its current state-by-state matrix and have counsel confirm it against each statute.
Step 5: Get consent right before anyone calls or texts
Many lending flows end in a phone call or text from a funding specialist. The Telephone Consumer Protection Act governs that step. Under 47 CFR 64.1200(a)(2), a telemarketing call to a wireless number using an autodialer or an artificial or prerecorded voice needs the called party's "prior express written consent." The rule's text turns on the type of number called, so a business owner's mobile phone is covered. The FCC's telemarketing page also says telemarketing robocalls must offer an opt-out during each call.
The written consent itself must be a signed agreement (electronic signatures count) that clearly authorizes the seller to send those messages to a specific number, with a clear disclosure that signing is not a condition of purchase. In 2023 the FCC tried to tighten this into "one-to-one" consent for each seller. The Eleventh Circuit vacated that change, and the FCC restored the prior definition effective August 29, 2025.
What that means for a platform:
- Name the company that will contact the user on the consent screen. Do not bury it in terms.
- Keep a record of the consent text, timestamp and phone number the user gave.
- If you pass a lead to a marketplace that shares it with several lenders, ask how each lender's calls are covered by the consent you collected.
Step 6: Review marketing and data handling
Marketing. The Federal Trade Commission has said plainly that "small businesses are protected under the FTC Act," and its 2020 guidance on small business financing names brokers and lead generators among the parties it watches. It warned against misrepresenting a product's features, cost or payment amounts, or a tie to government programs such as the SBA. For consumer products, the CFPB applies its own test for unfair, deceptive or abusive practices; its UDAAP examination procedures ask whether a representation is likely to mislead, whether the reader's interpretation is reasonable, and whether the point is material. That three-question test is a useful checklist for any funding banner, even on a business-only product. Phrases to cut on review: "guaranteed approval," "no credit check" when the partner does check, and "pre-approved" when nobody has underwritten anything.
Transparency also matches what borrowers report. In the same Fed report, 60% of firms that borrowed from online lenders said actual borrowing costs were higher than expected, compared with 37% at small banks and 32% at large banks.
Data. A lead form or API sends financial information about your users to a third party. Get explicit permission before you transmit it, update your privacy policy to say what goes where, and limit fields to what the partner needs. The FTC's Safeguards Rule, which sets security requirements for non-bank financial institutions, added "finders" as an example of a covered financial institution in 2021, described as firms that bring together buyers and sellers. Whether your flow is covered depends on whose information you handle, a question for counsel, but the rule's controls are a sound baseline either way.
Step 7: Pilot, measure, then widen
Launch to a small, engaged group of users first and track the funnel from offer view to application, offer, and funding. A simple illustration using the Fed's survey rates shows why the numbers will look small at first. Suppose 1,000 of your users are small employer firms that behave like the survey sample. About 380 would apply for financing somewhere in a year (1,000 × 38%). Of those, about 160 would get the full amount they sought (380 × 42%), since the survey found 42% of applicants received everything they asked for, 36% got some and 22% got nothing. Your platform will capture only a share of that demand, and your users may differ from the survey's. Measure your own rates before forecasting.
Metrics worth tracking from day one:
- Offer view to application start, and start to completion
- Share of applicants who receive at least one offer
- Funded share and the mix of products funded
- Complaints per hundred applications, and their themes
- Support tickets that ask about loan terms (a sign your staff are being pulled into a broker role)
Common mistakes
- Treating the partner's license as yours. A partner's license covers the partner. Your own role is set by what your platform and staff do.
- Letting placement logic go unreviewed. Under Regulation B, steering who sees an offer is part of the referrer's exposure.
- Collecting consent that names nobody. A checkbox that says "partners may contact you" invites TCPA trouble.
- Shipping marketing copy the partner never saw. Both of you carry the risk; review it together.
Loanistry is owned by Trulli, which runs a lending platform for brokers, agencies and software companies: trulli.ai.
Sources
- Federal Reserve Banks: 2026 Report on Employer Firms, Small Business Credit Survey, checked November 2026
- Conference of State Bank Supervisors: Nationwide Multistate Licensing System (NMLS), checked November 2026
- Federal Reserve, FDIC and OCC: Interagency Guidance on Third-Party Relationships: Risk Management, checked November 2026
- OCC: Bulletin 2023-17, Third-Party Relationships: Interagency Guidance on Risk Management, checked November 2026
- California DFPI: California Finance Lenders License Frequently Asked Questions, checked November 2026
- California Financial Code section 22602 (Public.Law), checked November 2026
- Texas OCCC: Commercial Sales-Based Financing rules adoption, 7 TAC Chapter 86, checked November 2026
- CFPB: Regulation B, 12 CFR 1002.2 Definitions, checked November 2026
- California DFPI: California Financing Law, Commercial Financing Disclosures, checked November 2026
- California DFPI: Commercial Financing Disclosure Regulations Approved to Become Effective as of December 9, 2022, checked November 2026
- New York DFS: Superintendent Adopts Updated Regulation for Disclosure Requirements for Commercial Financing, checked November 2026
- GovInfo: 47 CFR 64.1200, Delivery restrictions, checked November 2026
- FCC: Telemarketing, checked November 2026
- Federal Register: FCC rule conforming the prior express written consent definition to the Eleventh Circuit decision, August 29, 2025, checked November 2026
- FTC: Protecting small businesses seeking financing during the pandemic, checked November 2026
- CFPB: Unfair, Deceptive, or Abusive Acts or Practices examination procedures, checked November 2026
- FTC: FTC Safeguards Rule: What Your Business Needs to Know, checked November 2026