It's a complete pita, but even without any security rules you still need to figure out how to clear payments using something like ACH, weird and usually 99% undocumented bank APIs, building a lot of automation, reporting & monitoring tools yourself, etc. It's a lot of work.