MSB Compliance: FinCEN Registration, State Licensing, and AML Requirements

A money services business (MSB) is a category of financial institution regulated under the Bank Secrecy Act (BSA). For businesses that move money, exchange currency, cash checks, or provide certain prepaid services, compliance begins with identifying which activities are regulated and which requirements apply to each activity. That distinction has immediate operational consequences. FinCEN registration, state licensing, customer identification, transaction monitoring, and reporting involve different legal tests and timelines. A business needs a coordinated approach to all of them.

On October 30, 2026, the Financial Crimes Enforcement Network (FinCEN) issued FIN-2026-Alert009, titled FinCEN Alert on Risks Associated with Foreign-Agent-Directed Transactions. The alert highlights risks arising when foreign agents direct U.S. money services businesses (MSBs) to make payments to third parties with limited transparency into the recipients or the transactions’ commercial purpose. These concerns are particularly relevant to MSB owners, fintech executives, and compliance officers overseeing expanding payment networks.

What is an MSB under U.S. law?

The federal definition includes money transmitters, foreign exchange dealers, check cashers, issuers or sellers of money orders or traveler’s checks, and certain providers and sellers of prepaid access.

The activity thresholds differ. 

• Foreign exchange, check cashing, and issuing or selling money orders or traveler’s checks generally use a threshold exceeding $1,000 per person per day, subject to the particular definition and exclusions. 
• Money transmission has no minimum dollar threshold. 
• Prepaid access has a separate framework.

A small transfer amount therefore does not, by itself, remove a money transmitter from regulation. Reporting thresholds also serve different purposes from the thresholds used to classify a business.

When does a payment business become a money transmitter?

Federal money transmission generally involves receiving money or equivalent value from someone and transmitting it to another person or location. Application turns on the actual facts and available exclusions.

A useful regulatory analysis follows the funds from sender to recipient. It asks

who receives customer value
who controls payment instructions
what obligations the parties owe, and
how settlement occurs.

Descriptions such as “software platform,” “payment facilitator,” or “merchant services provider” should be tested against the actual operation. The federal payment-processor exclusion, for example, depends on specific conditions involving payments for goods or services, qualifying clearance and settlement, and an agreement with the seller or creditor. A state agent-of-payee exemption does not independently establish a federal exclusion.

Consider a hypothetical platform that initially routes payment instructions but later starts accepting customer funds into its own account before paying merchants. That change warrants renewed analysis of the platform’s role, contracts, and settlement process. It does not produce an automatic classification answer.

The most useful work product is a written analysis supported by a funds-flow diagram, customer agreements, banking arrangements, and a clear explanation of any exemption or exclusion relied upon.

FinCEN MSB registration: requirements, exemptions, and renewal

An MSB subject to registration generally must file FinCEN Form 107 within 180 days after establishment. Renewal follows two-calendar-year periods, with the renewal filing due by December 31 before the next period. Businesses should calculate the actual deadline rather than assume it is exactly 24 months after the initial filing.

Registration exceptions include businesses qualifying solely as another MSB’s agent and businesses whose only MSB activity is selling prepaid access. Additional independent MSB activities can change the result. Registrants also need to maintain required agent information and assess events that trigger re-registration.

FinCEN registration does not constitute a government license or endorsement. FinCEN has expressly warned against presenting registration as proof that it has approved a company or vetted its compliance program. Marketing materials and investor presentations should describe registration accurately.

State money transmitter licensing and multi-state strategy

State licensing is a separate workstream. Federal MSB status does not decide whether a particular state requires a money transmitter license, and federal registration does not replace that license. New York, for example, separately regulates receiving money for transmission under its Banking Law.

A practical multi-state strategy begins with the planned customer footprint and activities. For each jurisdiction, the business should assess:

NMLS and coordinated licensing processes can reduce duplication. The Money Transmission Modernization Act promotes common standards, but adoption and interpretation vary. Expansion planning should still identify the legal basis for operating in every relevant jurisdiction.

The federal registration period should not be treated as permission to launch without required state authority.

What must an MSB AML compliance program contain?

The current MSB anti-money laundering (AML) rule requires a written, effective program proportionate to the business’s risks. Its minimum components are:

For a newly established MSB, the federal program implementation deadline generally is 90 days after establishment. This is a different timetable from FinCEN registration.

Operationally, management should be able to explain how products, customers, agents, transfer corridors, and transaction volumes influence the controls selected. Independent review should test implementation and lead to tracked corrective action. FinCEN’s guidance does not impose a universal annual outside-audit requirement; review scope and frequency follow risk, and an appropriately independent employee may perform the review.

FinCEN published proposed AML and countering the financing of terrorism program reforms on April 10, 2026. Businesses should monitor the rulemaking while continuing to apply the operative requirements.

KYC, customer due diligence, and the Travel Rule

MSB customer identification requirements depend on the service and transaction involved. “Know your customer” (KYC) is a useful operational label, but it does not identify a single universal MSB rule.

Ordinary MSB status alone does not bring a business within the bank Customer Identification Program rule or the beneficial-ownership CDD rule for covered financial institutions. Those rules have defined institutional scope.

MSBs nevertheless have concrete identification and recordkeeping obligations. Examples include applicable funds transmittals of $3,000 or more, associated Travel Rule information, and cash purchases of specified monetary instruments from $3,000 through $10,000 inclusive. Requirements vary with transaction roles, customer relationships, and applicable exclusions. These amounts are not universal thresholds below which customer diligence becomes unnecessary.

Risk-based diligence can also help establish expected activity, payment purpose, relevant ownership, and the reason for unusual transactions. Businesses should distinguish legal requirements from additional controls adopted to manage risk or meet banking-partner expectations.

Transaction monitoring should produce explainable decisions

Effective monitoring connects customer information with actual payment activity. Useful questions include whether amounts, frequency, recipients, geography, and settlement patterns are consistent with the stated relationship.

Practical controls may identify

Investigation, escalation, reporting decisions, and follow-up should have clear owners.

For example, repeated transfers below a reporting threshold may warrant review in context. A monitoring rule should help investigators examine the pattern, supporting records, and explanation rather than automatically treat every alert as proof of wrongdoing. These are practical implementation considerations drawn from the examination framework.

Agent and correspondent oversight in cross-border money transmission

An agent contract should be supported by ongoing oversight. FinCEN’s guidance expects principals to assess agent risks, monitor activity, reassess changing circumstances, and address deficiencies. Principals and agents may allocate development responsibilities, but each remains responsible for implementing its applicable AML obligations.

FinCEN’s foreign-counterparty guidance provides the relevant MSB framework.

The October 2026 alert illustrates a specific concern: a foreign agent instructs a U.S. MSB to pay an unrelated overseas trading company as “settlement.” The MSB should examine the commercial purpose, recipient, contractual authority, and supporting documentation. A third-party instruction is a reason for appropriate assessment; it does not alone establish illegality.

SAR and CTR compliance: thresholds and filing deadlines

Suspicious Activity Reports (SARs) and Currency Transaction Reports (CTRs) serve different purposes. A CTR is triggered by qualifying cash activity; a SAR requires the applicable suspicion criteria and reporting threshold.

The SAR rule has category-specific provisions. 

A business qualifying solely as a check casher is outside the mandatory MSB SAR rule. 

• A $5,000 threshold applies to certain suspicious activity identified by money-order or traveler’s-check issuers through clearance or similar records. SAR copies and supporting documentation must be retained for five years, and SAR confidentiality must be protected.
• For CTR aggregation, known transactions by or on behalf of the same person are combined when cash in or cash out exceeds $10,000 during one business day. Cash-in and cash-out activity should not be netted to avoid reporting.
• Geographic targeting orders can impose lower thresholds and extra identification duties. FinCEN’s September 2026 Southwest Border order covers specified locations and includes court-related exclusions. Businesses should determine coverage using the operative order and applicable court relief.

Foreign MSBs: when U.S. obligations can apply

Foreign incorporation does not settle U.S. MSB status. A business located abroad can fall within the federal definition when it conducts covered business wholly or in substantial part within the United States, even without a U.S. office. Serving customers located in the United States is a relevant factor.

Cross-border controls also need to address sanctions. The Office of Foreign Assets Control (OFAC) has separate blocking, rejection, and reporting requirements; blocked and rejected transactions generally must be reported within 10 business days. A SAR decision does not determine the required OFAC response.

Preparing for MSB regulatory examinations and investigations

FinCEN delegates BSA examination authority over MSBs to the IRS. State regulators separately examine licensed activities. The practical question is whether the business can demonstrate that its controls work.

An examination file should connect legal conclusions with operational evidence: classification and licensing analyses, current registrations, AML procedures, training records, independent-review findings, agent diligence, transaction investigations, reporting records, and remediation tracking. Management should be able to explain who owns each control and how identified weaknesses were addressed.

If an investigation begins, priorities include 

• preserving relevant records, 
• identifying response deadlines, 
• protecting SAR confidentiality, and 
• coordinating accurate responses through counsel. 

The potential exposure depends on the applicable law and conduct. Operating a qualifying money transmitting business without required state authority or FinCEN registration can create federal criminal exposure under 18 U.S.C. § 1960, which authorizes up to five years’ imprisonment.

Frequently asked questions about MSB compliance

Is FinCEN registration an MSB license?

No. FinCEN registration is a federal filing requirement for covered MSBs. State operating authority requires a separate assessment, and registration does not mean FinCEN has endorsed the business.

Does using a bank or licensed partner resolve an MSB’s obligations?

The business still needs to assess its own activities and legal role. A genuine agent arrangement may affect particular requirements, while the principal and agent retain their applicable implementation duties.

Does every MSB need an annual outside AML audit?

FinCEN’s MSB rule requires independent review proportionate to risk. Its guidance permits an appropriately independent internal reviewer and does not require every MSB to engage an outside auditor annually. Other applicable requirements and contractual commitments also need consideration.

Can a foreign company be subject to US MSB regulation?

Yes. Covered business conducted wholly or in substantial part within the United States can trigger federal MSB obligations without a U.S. office. The company’s actual U.S. activities require analysis.

Building a defensible MSB compliance framework

Before launch or expansion, management should be able to explain why the business falls within or outside each relevant regulatory category, which authorizations it needs, and how its controls address the resulting risks.

The same questions should be revisited when the business adds a product, enters a new jurisdiction, changes settlement arrangements, or expands its agent network. A documented connection between legal analysis and daily operations makes compliance more manageable and regulatory responses more credible.