At a glance

1. FinCEN registration is only the entry point. A US money services business must operate a written, risk-based anti-money laundering program that matches its products, customers, locations, delivery channels and transaction volume. [1]

2. The current MSB rule requires four minimum elements: internal controls, a designated compliance person, training and independent review. The program must also cover applicable customer identification, reporting, recordkeeping and law-enforcement requests. [1]

3. Money transmitters and most other covered MSB categories generally file a Suspicious Activity Report when a conducted or attempted transaction involves at least $2,000 and meets the regulatory suspicion test. A SAR is generally due within 30 calendar days after initial detection. [2]

4. Currency Transaction Reports apply to transactions in physical currency of more than $10,000. Funds-transfer recordkeeping and Travel Rule requirements generally begin at $3,000. These are different rules and thresholds. [3, 4]

5. FinCEN issued a proposed AML/CFT program reform in April 2026. As of 16 October 2026, the current eCFR text remains in force. An MSB should meet the current rule now and keep its framework adaptable for the final reform. [1, 10]

A FinCEN registration number does not prove that an MSB is compliant. It shows that a registration was filed. The operating obligation begins with a business model that can identify customers, preserve transaction data, detect suspicious activity, file reports, manage agents and produce evidence during an examination.

1. What are the US MSB compliance requirements in 2026?

The Bank Secrecy Act treats an MSB as a financial institution based on the activities it conducts. Covered businesses can include money transmitters, currency dealers or exchangers, check cashers, issuers or sellers of money orders and traveller's checks, and providers or sellers of prepaid access. The exact category and any threshold or exception must be tested against the service actually provided.

For an operating money transmitter, the core federal compliance stack normally includes:

• FinCEN registration and renewal where required;
• a written AML program proportionate to the business's risks;
• a designated person responsible for day-to-day compliance;
• customer and transaction controls that support reporting and recordkeeping;
• employee and agent training;
• independent review with documented remediation;
• SAR, CTR and funds-transfer controls where applicable;
• five-year retention for key regulatory records;
• an agent list and agent oversight where the MSB distributes services through agents; and
• state licences, reporting and prudential obligations where state law applies.

Federal registration and state licensing answer different questions. FinCEN administers the BSA layer. State authorities decide whether the company may conduct money transmission or another regulated activity involving their jurisdiction. A complete compliance plan must cover both.

2. The four minimum elements of an MSB AML program

31 CFR 1022.210 requires each MSB to develop, implement and maintain an effective AML program. The program must be reasonably designed to prevent the business from being used for money laundering or terrorist financing and must be proportionate to its location, size, services and transaction volume. It must be in writing and available to the US Treasury on request. [1]

The rule does not prescribe one universal AML manual. A retail remittance network, a B2B cross-border platform and a crypto money transmitter need different controls. The program should describe the company's real customers, corridors, payment methods, settlement partners, wallet architecture, agents and data flows.

An MSB with automated processing should integrate compliance procedures with those systems. This requires more than buying screening software. The company must determine what data enters the tool, when checks run, what happens when data is incomplete, how alerts are prioritised and how decisions are returned to the payment or wallet system. [1]

3. Start with a documented MSB risk assessment

The current MSB rule requires a program commensurate with risk. A practical risk assessment connects inherent risk, controls and residual risk across five areas:

1. Products: money transmission, foreign exchange, card or account funding, stablecoin settlement, hosted wallets, cash access and agent services.
2. Customers: consumers, merchants, financial institutions, high-risk businesses, non-residents, intermediaries and beneficial owners.
3. Geographies: customer residence, transaction origin and destination, sanctioned exposure, corruption risk and higher-risk corridors.
4. Channels: remote onboarding, API clients, mobile apps, cash agents, kiosks and third-party introducers.
5. Transactions: size, speed, frequency, funding method, reversals, linked accounts, wallet exposure and expected behaviour.

The assessment should lead to controls and should be updated when a new country, asset, settlement bank, agent network or customer type changes the assumptions used when the program was approved.

4. Customer identification and due diligence

MSBs do not have a single general Customer Identification Program rule identical to the bank CIP rule. Their identification duties arise from the AML program, transaction-specific recordkeeping, reporting obligations, prepaid-access rules and the need to understand activity well enough to identify suspicious transactions. The correct onboarding standard therefore depends on the service and customer.

A workable framework verifies identity, screens relevant names, identifies business ownership and control, assigns a risk rating and applies enhanced due diligence where risk warrants it.

For a non-established customer sending a funds transfer of $3,000 or more, 31 CFR 1010.410 requires specific records and additional identification information. In-person and remote orders have different verification and payment-record requirements. [4]

5. SAR requirements for MSBs

Under 31 CFR 1022.320, covered MSBs generally must file a SAR when a transaction is conducted or attempted by, at or through the MSB, involves or aggregates at least $2,000, and the business knows, suspects or has reason to suspect one of the regulatory conditions. These include proceeds of illegal activity, concealment, evasion of BSA requirements, no apparent lawful purpose or use of the MSB to facilitate criminal activity. [2]

An issuer of money orders or traveller's checks using clearance or similar records has a separate $5,000 threshold in the circumstances described by the rule. The filing obligation otherwise rests with each MSB involved, although one complete report can satisfy the transaction when the participating MSBs coordinate appropriately. [2]

Immediate threats may require contact with law enforcement in addition to a SAR. Filing a SAR does not replace action needed to prevent loss, block a prohibited transaction or comply with another legal obligation.

6. CTR requirements and aggregation

A Currency Transaction Report is about physical currency. Under 31 CFR 1010.311, a financial institution other than a casino must report each deposit, withdrawal, exchange or other payment or transfer involving more than $10,000 in currency, subject to the applicable rules and exceptions. [3]

The MSB must identify multiple currency transactions that should be aggregated when it knows they are by or on behalf of the same person during one business day. A customer using several branches or agents does not necessarily create separate thresholds. The system must bring relevant transactions together.

CTR and SAR duties can apply to the same activity. A properly filed CTR does not remove the need to review suspicious structuring or other unusual behaviour. A transaction below $10,000 can still require a SAR when the SAR conditions and threshold are met.

7. Funds-transfer records and the Travel Rule

For a transmittal of funds of $3,000 or more, non-bank financial institutions must create and retain specified information. Depending on the MSB's role, this can include the transmittor's name and address, amount, execution date, payment instructions, recipient financial institution and available recipient identifiers. Additional identification records apply to non-established customers. [4]

The Travel Rule requires specified information to be included in the transmittal order passed to the next financial institution. The recordkeeping and transmission obligations should be designed into the payment message and database, rather than added manually after launch.

The current eCFR also notes that a 2024 amendment affecting this section has been delayed until 1 January 2028. For 2026 operations, the current $3,000 provisions remain the relevant baseline. [4]

For crypto transfers, the BSA analysis depends on the role and transaction. The MSB should map wallet addresses, customer identifiers, counterparties and transaction hashes into a retrievable record that supports monitoring, investigation and lawful requests.

8. Record retention and retrievability

Five years is the central retention period across several MSB requirements, including SARs and supporting documentation, FinCEN registration records and many transaction records. The exact start date depends on the record: for example, five years from SAR filing differs from five years from a transaction or registration filing.

Retention alone is insufficient. Records must be retrievable by customer, transaction, account or other required identifier. Preserve:

• the information available at the time of the transaction;
• screening and monitoring results;
• alert and case history, including who made each decision;
• copies of filed reports and supporting documentation;
• policy versions, training, testing and remediation evidence.

A vendor contract should state what happens to data when the service ends. Export capability, timestamps, immutable audit history and access controls should be confirmed before the vendor becomes the system of record.

9. Agent oversight is part of the principal's program

An MSB that distributes services through agents must maintain an agent list. The list is not filed with Form 107, but it must be maintained at the reported US location, updated as required and made available to FinCEN or appropriate authorities on request. The rule specifies information including the agent's identity, address, services, certain volume data, relevant bank-account information, start year and branches or subagents. [5]

FinCEN has also stated that the principal's AML obligations include risk-based agent monitoring. A contract that allocates tasks does not remove the principal's responsibility to maintain an effective program. [6]

A scalable agent framework includes risk-based onboarding, training, transaction monitoring, periodic review, escalation and termination. Higher-risk agents should receive stronger review.

10. Independent review and examination readiness

The independent review must match the risk of the business. The rule does not impose one fixed annual frequency for every MSB. Document why the frequency and scope are proportionate and review more often after material changes or control failures.

The reviewer may be an officer or employee, but cannot be the person designated for day-to-day compliance or simply test their own work without challenge.

FinCEN's MSB Examination Manual and workprogram show the type of evidence examiners review: risk assessment, program documentation, transaction samples, reporting, records, training and independent review. The best preparation is a control environment that produces this evidence continuously, rather than a file assembled when an examination notice arrives. [7]

11. What changes under FinCEN's proposed 2026 AML/CFT rule?

On 7 April 2026, FinCEN issued a Notice of Proposed Rulemaking intended to reform AML/CFT programs across financial institutions. The proposal emphasises effective, risk-based programs, separates program establishment from maintenance, incorporates the national AML/CFT Priorities and clarifies expectations around risk assessments, testing and supervision. It superseded FinCEN's 2024 program proposal. [10]

This is a proposal, not the current operating rule. As of 16 October 2026, 31 CFR 1022.210 still states the four existing minimum elements described above. An MSB should not replace current obligations with proposed language. It should monitor the rulemaking and keep its risk assessment, governance and change process ready for a final rule.

12. A 90-day implementation plan

US MSB compliance checklist

1. Confirm the federal MSB category and every applicable state licensing requirement.
2. Map the customer, funds, information and settlement flow.
3. Document the product, customer, geography, channel and transaction risk assessment.
4. Appoint a compliance person with authority and access to management.
5. Approve a written AML program that matches the live product.
6. Implement customer, sanctions, transaction and enhanced due-diligence controls.
7. Configure SAR detection, investigation, decision, filing and confidentiality.
8. Configure CTR aggregation and filing for physical-currency activity.
9. Capture funds-transfer and Travel Rule data at the $3,000 threshold where applicable.
10. Retain complete and retrievable records for the required period.
11. Maintain and monitor agents and critical compliance vendors.
12. Train relevant staff and agents before they perform regulated work.
13. Schedule independent review based on risk and track remediation to closure.
14. Maintain FinCEN registration, renewals and event-driven re-registration.
15. Monitor the 2026 AML/CFT Program Rule proposal and prepare for final changes.

Frequently asked questions

Is FinCEN registration enough to operate an MSB?

No. Registration does not replace the federal AML, reporting and recordkeeping requirements, and it does not grant state money transmitter authority. The company must implement its compliance program and obtain every required state licence or valid exemption before conducting covered business.

What are the four pillars of an MSB AML program?

The current MSB rule requires policies, procedures and internal controls; a designated person responsible for day-to-day compliance; education or training; and independent review. The scope must be proportionate to the MSB's risks. [1]

When must an MSB file a SAR?

Covered MSBs generally file when a conducted or attempted transaction involves or aggregates at least $2,000 and the business knows, suspects or has reason to suspect a condition listed in 31 CFR 1022.320. The report is generally due within 30 calendar days after initial detection. [2]

What is the CTR threshold for an MSB?

A CTR generally applies to transactions in physical currency of more than $10,000, with aggregation rules for transactions by or on behalf of the same person during one business day. [3]

What is the MSB Travel Rule threshold?

The current recordkeeping and Travel Rule provisions generally apply to covered transmittals of funds of $3,000 or more. The required data depends on the institution's role and whether the customer is established. [4]

Has FinCEN's 2026 AML/CFT reform taken effect?

Not as of 16 October 2026. FinCEN issued a proposed rule in April 2026, while the current eCFR text for MSBs still contains the existing requirements. Businesses should comply with the current rule and monitor the proposal. [1, 10]

Related DM Strategy guides

• How to Register an MSB with FinCEN, covering Form 107, eligibility and the federal registration process.
• US MSB Licence Cost in 2026, covering federal compliance budgets and state money transmitter licensing costs.
• Canada MSB vs US MSB, comparing registration, state or provincial coverage and compliance.
• Cross-Border Payment Licence in 2026, comparing EMI, PI, MSB and PSP routes.
• US Money Services Business Registration, outlining DM Strategy's registration and operational support.

Key primary sources

Disclaimer

This article is for information only and is not legal, tax or regulatory advice. MSB obligations depend on the activities performed, customer and transaction locations, state law, delivery channels, agents, assets and available exemptions. Confirm the federal and state perimeter before launching or changing a regulated service.

DM Strategy helps payment and crypto founders classify US activities, prepare the FinCEN and state licensing file, design the AML operating model and organise evidence for banking and examinations. If you are building or remediating a US MSB, book an introductory call with DM Strategy before implementation decisions become expensive to reverse.