Dive Deeper
Transcript
Episode Overview
When Marina Gracias joined Varo in 2016, the company had eight employees, no product in market, and a plan to become a bank. Ten years, a three-year de novo charter, and a Series G later, she is still its chief legal officer.
Building a culture of compliance in a regulated startup starts with legal refusing to be the department of no. Ask the business what it wants to accomplish, find the path that gets there within the regulations, and check how competitors have read the same rule.
Gracias hires for that instinct, and she says the payoff is direct. Once the business sees that legal will partner with it, it becomes more willing to comply.
About Marina Gracias
Marina Gracias is Chief Legal Officer and Corporate Secretary at Varo Bank, the first all-digital, nationally chartered consumer bank in the US. She joined in April 2016 as employee number eight and the company's only lawyer.
She led Varo's three-year process to win a de novo national bank charter from the OCC, the FDIC, and the Federal Reserve. The charter, approved July 31, 2020, made Varo the first consumer fintech to hold a full-service national bank charter.
Before Varo, she was a managing director at Accenture negotiating deals for financial services clients, spent close to six years as Chief Procurement Officer at Visa, and spent 15 years at Providian Financial, first as assistant general counsel and later as a senior vice president on the business side.
She holds a JD from Berkeley Law and an MBA from UC Berkeley's Haas School of Business, where she has served on the board since 2022.
Key Takeaways
Legal cannot be the department of no: Gracias hires lawyers who ask the business what it wants to accomplish, then work out how to get there within regulations that usually leave more room for interpretation than a first read suggests.
A bank charter is about owning the customer, the deposits, and the data: Most fintechs are a marketing arm for a sponsor bank; Varo's charter lowered its cost of capital, unlocked products like Zelle, and lets it use AI across the board because it owns the data.
The charter took three years and close to a million dollars, against a 120-day estimate: The FDIC asking Varo to withdraw and refile was the low point, and watching competitors now line up for charters is the vindication.
Generalists last longer in-house: Gracias went from securitization counsel to M&A and bank deals in the UK and Argentina at Providian, and that range is why she still had interesting work after the home equity portfolio was sold.
Ask AI for the exact quote, then check it: Varo's contracts lawyer asks the tool where a point appears in the contract and for the exact language, and the product lawyer runs AI across every set of customer terms for consistency.
Why Are the Best In-House Lawyers Generalists?
Because the work changes underneath you. A lawyer who has built range inside one field has somewhere to go when a business line is sold or a product retires.
She was hired at Providian as a securitization lawyer managing the home equity portfolio, and kept asking for other work. She does not mean hopping from employment law to litigation; she means range inside your field.
Gracias recalled:
"I started doing work for the credit bureaus, I started doing M&A work. We opened a bank in the UK and bought portfolios, and then I did the same thing in Argentina."
When Providian sold the home equity portfolio and securitizations slowed, she already had other work to do. The same pattern has held across ten years at Varo, from the first financing round to the charter to every product since.
What Does the De Novo Bank Charter Process Look Like From the Legal Seat?
Longer and more expensive than anyone tells you. Gracias and Walsh met with the OCC, the FDIC, and the Fed before filing, and every agency said the application would be done in 120 days.
The low point came when the FDIC realized it could not work in parallel with the OCC.
Gracias said:
"They said, withdraw your application and come back later. I was like, oh my god, this could take us a lot longer than we thought, and would become way more expensive than we thought."
The process took three years and close to a million dollars, while competitors without charters kept shipping. Even after the charter arrived, the second-guessing did not stop right away.
What settled it was what the charter made possible:
"But then you just see how it helps you control your destiny, you're able to control your data, you're able to offer so many more services, your cost of capital and all is lower."
Now that the OCC has opened the chartering process back up, she watches competitors line up for the same thing. That, she says, validates the decision.
What Is the Difference Between a Fintech and a Chartered Bank?
Ownership. A fintech without a charter is, in Gracias's words, a marketing arm for a bank. The sponsor bank owns the customer and the deposits, and the fintech borrows from the outside market to fund operations.
A chartered bank owns the customer relationship and the deposits, works directly with the Fed and the regulators, and can offer products a fintech cannot. Zelle is her example, because only a bank can offer it.
Gracias said:
"More importantly, you control the customer relationship, you own the data."
Owning the data is what turns the charter into an AI strategy. Varo has used machine learning in underwriting for years, and the charter means generative AI can run across the whole business.
Gracias explained:
"We can use it really much more across the board because we own the data. And when you're fintech, you don't own the data, the bank owns the data."
What Does a Solo Lawyer at a Regulated Startup Do All Day?
The law and the business, at the same time. Gracias has only worked in financial services since leaving private practice, so regulation on everything is the baseline, and the startup added product work on top.
She said:
"All lawyers need to learn, you work business and you work the law. You have to understand the product, you work very closely with the engineers."
The surprise was the vendor ecosystem that exists to support a bank: one startup ran Bank Secrecy Act identity checks instantaneously, and another took an imprint of the customer's phone to flag a device claiming to be an iPhone it was not.
The solo lawyer also sees everything the customer sees:
"When you're the solo attorney in a regulated environment, you learn marketing scripts, you look at screens to see everything the customer is going to see."
How Is a Bank's Legal Team Using AI?
For the drafting that used to eat hours, with a human reading behind it. Gracias expects most bank charter applications are now drafted with an AI tool, because the public portion of every application is public and similar lines of business use similar language.
The same logic applies to policies:
"Most bank policies are fairly standard. Again, why wouldn't you use an AI tool to create all the policies? A human will go back and look at it and make sure if there are changes that need to be made or make it more specific to your company."
Her favorite use case came from Varo's product lawyer. Customer terms for different products get written at different times by different people, so she runs an AI tool across all of them for consistency.
Gracias said:
"To make sure that even if they're written at different times, even if they're written by different people, they're consistent for the consumer. And so there are all these different uses that before would have taken somebody hours to sit and read all the terms."
She is not naive about hallucinations, which have already put more than a thousand lawyers in front of sanctions orders. Her contracts lawyer has a simple guard when she asks for a contract summary.
Gracias explained:
"To also make sure that the tool doesn't create and tell her what the tool thinks she wants to hear, she asks the tool, give me the references of where does this occur in the contract, or give me the exact quote of the language."
She said:
"I think all lawyers will have to adapt to using AI in order to make not only the job more efficient, but I think in many ways it helps the lawyer do a better job."
How Do You Build a Culture of Compliance Without Being the Department of No?
Start by convincing the business that legal will listen. Cecilia raised Uber, whose early model treated the law as a cost to absorb after the fact, and Gracias noted that a chartered bank cannot do that, because regulators can issue consent orders and come down hard.
Her answer is to hire lawyers who ask a different first question.
Gracias said:
"Somebody who is more likely to ask the business, tell me what you want to accomplish. So don't focus so much on how they come to you to tell you, I want to do this. Try to figure out, what's your ultimate goal? What are you trying to do? And then work with them to figure out how we can do it within the regulations we have."
Banking regulation is sometimes cut and dry. More often it is open to interpretation, and the work is checking how it has been read and finding the version of the plan that fits.
The second move is benchmarking. When the business says a competitor is already doing it, look at how, because sometimes the competitor found an interpretation that works.
The third is what the first two produce:
"Once you show the business you're willing to partner with them, it makes them more willing to want to comply."
Varo has lived with the bank-versus-technology-company tension for years, and her position is that you can be both if legal stays flexible. For the in-house teams building the monitoring and policy-alignment half of that culture, the AI for Legal Compliance guide picks up where this episode leaves off.
What Advice Would a Bank CLO Give a New GC in a Regulated Industry?
Build the regulator relationships before you need them. Cecilia asked for two sentences of advice for Molly Abraham, who stepped into the Coinbase general counsel seat this summer, and Gracias gave her the playbook Varo ran during the charter.
Gracias said:
"You invest the time to meet with them, to get to know them, and also create a level of trust with them so that they can feel comfortable that when they meet with you, you will be open, you will talk to them, you will explain things to them."
Varo was in the cloud with no branches, which the regulators had not seen before, so the team spent the time explaining security and how customers would reach their money. Regulators are still learning your business, and being a sounding board for them pays off when something goes wrong and you pick up the phone.
The second piece is the one she opened the episode with:
"Always put your customer first. Always think, are you meeting your mission of what you were established to serve your customer?"
If you are the first lawyer in the door at a regulated company, or the one asked to find the yes, start with GC AI's legal AI classes, or try GC AI free on a set of customer terms today.
Recommended Reading
AI for Legal Compliance: The In-House Guide (2026): how in-house teams use AI to track regulatory change and align contracts with policy, the work Gracias describes running across Varo's customer terms.
Built to Last by Jim Collins and Jerry I. Porras: the one book Gracias named on air as having shaped her, a fit for a CLO who picked a ten-year build over a faster exit.
