Capture a market. Become big enough to jump hurdles XYZ due to scale and amount of, say, lawyers and compliance officers you can field. Then push for more compliance. It’s effectively a moat and one of the most durable kind since lawmakers aren’t very agile. It also opens a second front (first front being: product) to go up against newcomers. Kindly point out to the regulatory agencies that they are not compliant and demand enforcement due to “equal playing field”.

To make this point concrete: KYC in banks in Europe is on a scale of 1000s FTE per bank. No newcomer can ever comply with KYC the way big banks have implemented this by pure meat. Trouble ensue for all newcomer. That’s a moat!