AML Compliance Programs for Money Services Businesses: U.S. Requirements and Practical Checklist

An anti-money laundering (AML) compliance program is a core operating requirement for a U.S. money services business (MSB). For payment and remittance companies, an effective program is more than a policy manual: it connects customer onboarding, transaction monitoring, reporting, staff responsibilities, and independent testing to the activities the business actually performs.

Under 31 CFR § 1022.210, covered MSBs must develop, implement, and maintain a written AML program reasonably designed to prevent their services from being used to facilitate money laundering or terrorist financing. The program must reflect the business’s size, location, products, services, and transaction volume. It should be operationally workable from the start, not simply drafted to accompany a state license application.

1. Which money services businesses need an AML program?

Federal MSB categories include money transmitters, certain currency exchangers and check cashers, and businesses dealing in money orders, traveler’s checks, or covered prepaid access. Some digital asset businesses may also qualify as money transmitters, depending on their functions. Whether an entity falls within an MSB category is a fact-specific question under the federal regulations.

Federal registration, state money transmitter licensing, and BSA/AML obligations are separate questions. A business may have an AML program obligation even if it is exempt from FinCEN registration because it acts solely as an agent of another MSB. Likewise, registration is not a government approval of the company’s controls.

Timing matters. Section 1022.210 provides a federal AML-program implementation deadline generally tied to the 90-day period after the MSB is established. That period should not be mistaken for authorization to conduct activities requiring state licenses or for a reason to delay operational readiness. Businesses should assess applicable obligations and deploy necessary controls before beginning regulated operations.

2. The four minimum elements of an MSB AML program

FinCEN’s current MSB rule requires four minimum elements. The precise design should be proportionate to the financial-crime risks presented by the business.

Written policies, procedures, and internal controls

The program must describe how the business identifies relevant customers and transactions, complies with applicable reporting and recordkeeping rules, handles law-enforcement requests, and manages internal escalation. Policies should specify responsible personnel, evidence to retain, review intervals, and actions when a control fails.

For a digital remittance platform, this may include customer verification rules, transaction limits, behavioral monitoring, alert investigations, controls over third-party payouts, and procedures for placing transactions on hold where legally and operationally appropriate. Controls for a cash-intensive storefront may look substantially different.

A designated BSA/AML compliance officer

The business must designate a person responsible for day-to-day AML compliance. This includes overseeing the program, required reporting and records, regulatory updates, and appropriate training. The individual should have enough authority, information, and resources to challenge questionable activity and escalate problems to management.

A third-party vendor or consultant may support program administration, but outsourcing tasks does not transfer the MSB’s responsibility for compliance. Responsibilities, reporting lines, access to transaction data, and escalation rights should be documented.

Training for appropriate personnel

Training should cover the responsibilities of staff whose work affects compliance. Depending on the operating model, that can include onboarding, operations, support, fraud, treasury, payments, and senior management. Scenarios should reflect relevant risks such as structuring, unusual transaction patterns, inconsistent customer activity, or suspected sanctions exposure.

FinCEN’s rule does not impose one universal training schedule for every MSB. Frequency and content should respond to actual risk, employee roles, incidents, and material changes to the business. Keep attendance, materials, testing results, and follow-up records.

Independent review of the AML program

An MSB must provide for an independent review to evaluate whether the program is adequate and operating as intended. FinCEN explains that the review need not be performed by a CPA or an external firm; a sufficiently independent internal reviewer can qualify. The designated compliance officer should not review their own program, and the review should be fair and unbiased.

The scope and frequency are risk-based. Federal MSB rules do not impose a universal annual independent-review requirement. Higher-risk operations, significant weaknesses, rapid expansion, or material business changes can justify more frequent testing. Also evaluate any separate state, bank-partner, contractual, or licensing requirements.

A useful independent review tests transactions and control operations, documents findings, identifies corrective actions, and tracks remediation, not merely whether a policy document exists.

3. Start with a business-specific financial crime risk assessment

Although the current MSB regulation identifies four minimum program elements, a documented risk assessment is a practical foundation for showing that the written program is commensurate with the business’s risks. Assess both inherent risks and the controls used to reduce them. For each significant risk, document the assessment rationale and the accountable owner.

Relevant factors may include:

• Products and transaction types: domestic or cross-border transfers, stored value, cash activity, virtual currency activity, or business-to-business settlement.
• Customers and counterparties: individuals, businesses, intermediaries, beneficial ownership complexity, and higher-risk customer profiles.
• Geographies and corridors: sender and recipient locations, cross-border exposure, and markets presenting elevated illicit-finance risk.
• Distribution and technology: mobile or API onboarding, agents, white-label arrangements, outsourced processors, and third-party data quality.
• Transaction characteristics: size, frequency, velocity, unusual patterns, funding sources, and payout methods.

Risk assessments should be revisited when the business introduces a new product, expands into a state or country, adds an agent or banking partner, or experiences significant monitoring findings. A generic risk matrix copied from another MSB is not an adequate substitute for understanding the company’s actual funds flow.

4. Customer identification, diligence, and ongoing monitoring

A sound MSB AML framework uses risk-appropriate customer identification, verification, due diligence, and ongoing monitoring controls. The exact federal requirements depend on the MSB category and activity; the bank-style Customer Identification Program and Customer Due Diligence rules should not be described as universally applicable to every MSB.

Practical controls can include checking that onboarding information is complete, validating identities where required or warranted, understanding expected activity, reviewing business ownership where relevant, identifying unusual activity, and periodically refreshing customer information based on risk. State license conditions and banking or payment-network agreements may impose additional expectations.

Monitoring should connect behavior to the risks identified in the business model. A system that flags only transaction amounts can miss rapid transfers, repeated failed verification, unusual counterparty patterns, or customer behavior inconsistent with the stated purpose of the account.

Where the business relies on monitoring software, governance should cover alert logic, data feeds, tuning, investigations, quality assurance, and evidence retention. Manual controls can be appropriate for some smaller MSBs, provided they are demonstrably effective for the volume and risk of the activities.

5. Suspicious activity reports, cash reporting, and recordkeeping

Suspicious Activity Reports (SARs)

Money transmitters and certain other MSB categories must file SARs when the applicable regulatory conditions are met. For money transmitters, suspicious transactions conducted or attempted through the business generally trigger the federal SAR requirement at $2,000 or more. The threshold does not mean every $2,000 transaction must be reported; suspicious circumstances are essential.

FinCEN generally requires an MSB to file a SAR within 30 days after initially detecting facts that form the basis for filing. Filed SARs and supporting documentation are generally retained for five years, and the fact of a SAR filing is subject to strict confidentiality rules. The firm needs documented investigation, decision, filing, and escalation procedures, including how it handles cases in which it does not file a SAR.

Currency Transaction Reports (CTRs) and other BSA records

Certain MSBs must file a CTR for covered transactions involving more than $10,000 in physical currency, including applicable aggregation of cash transactions by or for the same person during one business day. A purely electronic transfer is not automatically a currency transaction simply because it exceeds $10,000.

Other recordkeeping obligations, including those relating to certain funds transfers, money orders, and currency exchanges, must be mapped to the MSB’s services. Retention periods and data fields differ across rules. A compliance checklist should therefore identify the actual triggering activity, threshold, required record, responsible owner, and retention period.

6. OFAC sanctions controls are related, but distinct

U.S. sanctions compliance and BSA/AML compliance overlap operationally, but they do not represent the same legal obligation. Depending on the risk profile, an MSB may need sanctions screening of customers and counterparties, transaction screening, restrictions management, investigations, and escalation for potential blocked or prohibited transactions.

The Treasury Department’s Office of Foreign Assets Control (OFAC) identifies management commitment, risk assessment, internal controls, testing, and training as core components of its sanctions compliance framework. Sanctions procedures should address applicable law and the company’s actual exposure, not assume that a FinCEN AML program alone satisfies all OFAC requirements.

7. Agents, licensed partners, and outsourced compliance

An MSB that distributes its services through agents or authorized delegates must evaluate the compliance risks created by those relationships. FinCEN guidance requires MSB principals to use risk-based agent monitoring controls, including assessing agent operations, reviewing activity variations, and addressing noncompliance.

FinCEN also makes clear that a principal and its agent cannot avoid their respective AML responsibilities merely by assigning obligations to one another in a contract. Agreements can divide responsibilities for developing controls, but they do not remove the need for each covered MSB to maintain an effective program.

Similarly, a fintech operating through a bank sponsor, payments processor, or technology provider should document which party owns customer due diligence, alert investigation, reporting, record retention, and regulator communications. A service provider’s monitoring software does not replace the fintech’s obligation to oversee the controls for which it remains responsible.

8. Common weaknesses regulators and banking partners may identify

Weaknesses are often practical implementation failures rather than the absence of a written policy. Examples include:

• A standard AML manual that does not match actual customers, products, states, corridors, or funds flow.
• A named compliance officer with no meaningful authority, data access, or documented reporting line.
• Incomplete customer or transaction data preventing alerts from being investigated reliably.
• Monitoring rules that were never calibrated, tested, or adjusted after a material business change.
• Inadequate investigation records, late SAR decisions, or failures to protect SAR confidentiality.
• Unclear division of responsibilities across principals, agents, banks, and third-party vendors.
• Independent reviews that do not test implementation, or that leave identified weaknesses unresolved.

For new MSBs, the most effective approach is to test real workflows end to end: from onboarding and funding through monitoring, alert disposition, payout, reporting, and record retrieval. Document remediation and assign owners before launch wherever practicable.

9. Practical AML program launch checklist

Before beginning regulated operations, management should be able to demonstrate that the following decisions and controls are addressed:

1. Confirm the entity’s MSB classification, applicable BSA requirements, and state licensing position.
2. Document products, transaction flows, customer types, jurisdictions, third parties, and inherent risks.
3. Approve a written AML program suited to those risks, with clear governance and control owners.
4. Designate the compliance officer and provide the tools, authority, and escalation channels needed.
5. Implement applicable customer identification, monitoring, reporting, sanctions, and recordkeeping procedures.
6. Test operational workflows and investigate material exceptions before scaling transactions.
7. Train the personnel responsible for onboarding, monitoring, escalation, and regulatory reporting.
8. Set a risk-based independent-review schedule, document independence, and establish remediation tracking.
9. Reassess program requirements when regulations, services, agents, or banking arrangements change.

The checklist is a planning tool, not a substitute for a documented assessment of the specific obligations that apply to the business.

10. What changed in the 2026 AML/CFT rulemaking?

On April 7, 2026, FinCEN announced a proposed, not final, rule to modernize financial institutions’ AML/CFT program requirements. The proposal emphasizes risk-based effectiveness, clearer distinction between program design and implementation, and changes to independent testing expectations. It superseded the 2024 proposal.

As of this article’s October 28, 2026 editorial review, the April proposal should not be treated as an operative replacement for the existing MSB regulation. Companies should continue complying with applicable current requirements and track whether a final rule changes their policies, staffing, risk assessment, or implementation obligations.

Frequently asked questions

Is FinCEN MSB registration enough to satisfy AML requirements?

No. Registration is distinct from maintaining an effective AML program and complying with applicable federal reporting and recordkeeping requirements. It does not amount to a FinCEN approval of the company’s controls.

Does every MSB need an annual independent AML audit?

No universal annual interval is imposed by the federal MSB program rule. Frequency and scope must be commensurate with the business’s risks. State regulators, bank partners, and contractual arrangements may impose additional requirements.

Can an MSB hire an outside compliance officer or AML consultant?

Outside expertise can help design, administer, and test a program, subject to appropriate responsibilities and independence. The MSB remains accountable for meeting its own obligations, and an independent reviewer should not test work for which they are responsible.

Do all MSBs have to file SARs for transactions of $2,000 or more?

No. SAR requirements depend on the MSB category and whether there are grounds for reporting suspicious activity. For money transmitters, the $2,000 threshold is relevant when the transaction is suspicious, not merely because it meets the dollar amount.

Does a bank sponsorship or authorized delegate agreement remove AML obligations?

Not automatically. Federal AML obligations depend on the party’s status and activities. Principals, agents, and partners must assess their respective requirements and implement the controls assigned to them.

How Fidamont helps money services businesses

Fidamont supports U.S. fintech and payments businesses with AML program design, regulatory readiness, compliance gap assessments, agent and third-party risk oversight, and independent-review planning. We align the compliance framework with the company’s actual activities and regulatory exposure, not generic policies.

For businesses preparing to launch, expand into additional states, or respond to bank-partner diligence, an AML readiness assessment can identify missing controls, evidence gaps, and remediation priorities before they delay the project.