The will to enforce is most certainly there today, and the moment you get a little bit of press (not even necessarily bad press) everyone, including your competitors, will check to see if you have the necessary certificates on file. If not, they will just narc on you to the regulatory authorities...who they are on a first name basis with, as they have known them for years. And if you get bad press, you can't just ride it out. Reporters will strip away all context and ask: "why is an unlicensed payment processor allowed to do business in the State of California"?
Especially when prompted by the press or their friends, regulators can spring into action out of nowhere and levy a host of civil and criminal penalties, up to but not limited to pulling your product from the market and freezing your assets so you can't meet payroll.
So, in short, you don't want to screw around with regulators under this administration. They treat businesses a LOT more harshly than college students. Indeed, no less an authority than Peter Thiel himself has commented that it might be impossible to clone Paypal today as the bridge seems to have been pulled up behind them:
http://news.cnet.com/8301-31921_3-20114584-281/talking-tech-...
CNET: I wrote a retrospective piece for CNET recently
about how significant the post-9/11 regulatory shift was,
especially when it comes to privacy.
Thiel: It's not exactly clear to me whether Paypal could
be built as a business today. That may be too strong....
As a startup, these kinds of regulations are much more
onerous. Paypal was able to be built at a time that was
pre-9/11 on a regulatory basis. Post-9/11 it would be much
more difficult to build. It makes the franchise more
valuable. I think no competitors will ever be built.