New technology is upending everything in finance, from saving to trading to making payments.

Varo Money is poised to become a full-fledged bank, making it the first of a new wave of fintech upstarts to win that approval in the US. The company’s long and expensive journey through a thick barrier of regulation is a reason why America’s banks have repelled the tech disruption sweeping through other industries.

The five-year-old mobile bank got approval from the Federal Deposit Insurance Corporation (FDIC) to receive deposit insurance, according to a statement yesterday. That brings the San Francisco-based company a step closer to a national banking charter, which will allow it to hold deposits itself instead of relying on a partner, to make loans in all 50 US states, and to offer credit cards.

Varo is still awaiting final, expected sign-offs from the Office of the Comptroller of the Currency (OCC) and the Federal Reserve.

For Varo, the process of becoming a bank has stretched out more than three years, and CEO Colin Walsh told American Banker that the effort has likely cost the company around $100 million. Varo pulled its first FDIC application in 2018 when it became clear the company wasn’t yet ready for the agency’s scrutiny.

Financial authorities are selective because they want to make sure customer money is protected and that taxpayers and other banks don’t end up on the hook for reckless loans. Banks can also be a conduit for money laundering and illicit finance.

On the flip side, heavy regulation helps protect the incumbents. Established banks fought back when the OCC developed a national license for banking startups, and a federal judge ultimately blocked the fintech charter.

While the FDIC approved a dozen or so applications last year, and the US has had branchless banks for years, the process has been much slower for newer mobile-only companies that are often venture-capital funded. These firms have typically resorted to partnering with existing banks to get up and running more quickly. Varo, for example, works with The Bancorp Bank for now. (Goldman Sach’s online brand Marcus, introduced in 2016, is a subsidiary of a much larger bank that is obviously not a startup.)

Companies have approached the regulatory impasse in different ways. Tech giants like Apple and Google have gone into things like payments, but stopped short of activities that involve the regulatory burden of becoming a bank (Apple partners with Goldman Sachs for its credit card, leaving the heavy financial lifting to the Wall Street bank). Square, a fintech, has applied to become an industrial loan company, which falls under a somewhat different regulatory umbrella.

Regulatory roadblocks have made the American market something of an outlier. Banks like Monzo, based in the UK, and Germany’s N26, have been blessed with licensing by their domestic central banks, but have had to partner with existing banks when opening up in the US. Singapore is offering five digital bank licenses to boost competition in its financial sector.

While the fintech sensation is unquestionably overhyped (Quartz member exclusive), it is also keeping established banks, some of which were founded a century or more ago, on their toes. The upstarts often compete with lower fees (though sometimes subsidized with unsustainable venture capital funding) and offer innovative features like early paycheck deposits and slick interfaces.

“We should not underestimate how significant this is for the banking industry as it’s the first time a mobile-centric company is poised to be a chartered bank in the United States,” Jo Ann Barefoot, CEO of Barefoot Innovation Group and formerly deputy comptroller of the OCC, said in Varo’s statement.

“Getting through this very high regulatory hurdle now opens the door for Varo to become the biggest mobile-centric national bank.”

The risk for the startups is that older companies will copy their tech and innovation if these things prove successful. In the meantime, the fintechs aren’t going to make an end-run around the incumbents by ignoring established rules and regulations, like Uber arguably did in the taxi industry. Government authorities aren’t going to allow it.