The Federal Layer: FinCEN and MSB Registration
In 2009, I was working with a company that had just gotten its first money transmitter license. The founder was excited. We had cleared the state hurdle. The founder asked, "What about the federal stuff? Do we need to register with the Fed or something?" I said, "Not the Federal Reserve. But you need to register with FinCEN. And you need to understand what FinCEN's rules actually require, because they are more detailed than anything the state asks for." The founder looked at me and said, "I thought getting the state license was the hard part." I said, "You thought wrong. The state license gets you in the door. FinCEN keeps the door open."
That conversation crystallizes the relationship between state and federal money transmission regulation. You need state licenses to operate as a money transmitter. But you also need to comply with federal law as administered by FinCEN. The federal layer is not optional. It is a separate regime that applies to all money services businesses regardless of state licensing. This chapter covers the federal layer in detail.
3.1 What Is an MSB (Money Services Business)?
FinCEN uses the term "Money Services Business" or MSB to describe entities that are subject to federal money transmission regulation. An MSB is any person, wherever located, that engages in the business of accepting currency, funds, or value that substitutes for currency, and transmitting that currency, funds, or substitute value. The definition is functional and technology-neutral.
The critical feature of the definition is the word "business." You do not need to be a money transmitter once. You need to be engaged in money transmission as a regular business activity. This suggests there is a frequency or regularity test. If you move money once, you are not an MSB. If you move money repeatedly as part of your regular operations, you are an MSB.
But how much is enough? FinCEN has not given a precise threshold. Does once a month make you an MSB? Once a week? Once a day? The regulation does not say. This creates ambiguity. The pragmatic answer is that if you are holding yourself out as a money transmitter, if you have systems in place to transmit money, if you are accepting money from customers with the expectation that you will transmit it, you are an MSB. You do not need to have actually transmitted any money yet. You need to be in the business of transmitting money.
The definition also includes certain activities specifically. An MSB includes a money transmitter, a dealer in foreign exchange, a check cashing business, a money changer, a currency dealer, and certain other categories. For the purposes of money transmission licensing, the key category is the money transmitter. But the definition is broader. You might be an MSB for federal purposes without being licensed as a money transmitter in your state.
The definition applies to persons who are located anywhere—United States or abroad—who conduct business with persons located in the United States. This means a money transmitter incorporated in a foreign country that has customers in the United States is subject to FinCEN regulation. It also means a United States money transmitter that serves customers outside the United States is subject to FinCEN regulation. The test is whether you conduct business with persons in the United States, not where you are incorporated.
3.2 FinCEN Registration: Who Must Register and When
Every MSB must register with FinCEN. Registration is done through a system called the Money Services Business Registration system. You go to the FinCEN website, fill out a registration form with information about your company, your location, your key personnel, and your business activities, and submit the form. FinCEN assigns you a registration number. You are now registered.
Registration is free. You do not pay a fee to register. But registration has consequences. Once you are registered, you are subject to all FinCEN requirements. You are also on the FinCEN registry, which is searchable by law enforcement and by regulators. If you become aware that you are an MSB and you have not registered, you should register immediately. If you register late, FinCEN might impose penalties for the time you operated unregistered. But it is better to register late than to never register.
Who must register? Any MSB must register. If you are accepting money from customers and transmitting it as a regular business activity, you must register. If you are operating as an agent for a licensed transmitter, you do not register yourself, but the principal transmitter must register. If you are processing payments on behalf of merchants, you might not be an MSB if you are not yourself accepting funds from customers for transmission. If you are a bank chartered by the federal government or licensed as a bank by a state, you do not register as an MSB because banks are exempt from the MSB registration requirement.
When must you register? The regulation says you must register with FinCEN. It does not specify a deadline. The practical answer is that you should register before you start accepting customer funds. If you are going to get a state money transmitter license and you are going to accept customer funds, you should be registered with FinCEN before you start accepting those funds. If you have already started accepting funds and you have not registered, you should register immediately.
The registration form asks for basic information: your company name, your address, your business activity, your key personnel. It is not a detailed application like a state license application. It is a relatively simple form. The purpose is to put you on the registry so FinCEN knows you exist and can reach you.
3.3 The BSA (Bank Secrecy Act): Your Federal Compliance Backbone
The Bank Secrecy Act is a federal law enacted in 1970 that gives the federal government authority to regulate financial institutions for anti-money laundering and counterterrorism financing purposes. The BSA applies to banks, securities brokers, insurance companies, and money services businesses. For money services businesses, the BSA is the foundation of federal compliance obligations.
The BSA is not a short statute. It is a complex law with multiple titles and provisions. It has been amended many times. It has been interpreted through extensive regulations, guidance, and enforcement actions. Understanding the BSA requires understanding how it is implemented through FinCEN regulations.
The core of the BSA is the obligation to know your customer and to report suspicious activity. If you are a money services business, you need to know who your customers are. You need to collect information about them. You need to verify the information is accurate. You need to monitor their activity and report to law enforcement if you see activity that appears to be suspicious.
These obligations exist because money laundering—moving proceeds from illegal activity through the financial system to make the proceeds appear legitimate—is a serious problem. Terrorism financing—moving money to support terrorist organizations—is a serious problem. The BSA framework gives law enforcement visibility into financial flows so law enforcement can detect and disrupt these illicit flows.
The framework is not perfect. It creates false positives. It creates compliance burden. It sometimes gets in the way of legitimate business. But the framework is the law. As a money services business, you are required to comply with it.
The BSA is administered by FinCEN. FinCEN has issued detailed regulations implementing the BSA. These regulations cover who must comply, what they must do, what information they must collect and verify, what suspicious activity must be reported, and what records must be maintained. FinCEN also issues guidance documents explaining the regulations. This guidance is not binding law, but it carries substantial weight. Courts and regulators defer to reasonable interpretations of the law in FinCEN guidance.
3.4 AML Program Requirements at the Federal Level
Under the BSA, every MSB must establish and maintain an anti-money laundering program. An AML program is a system of policies, procedures, controls, and training designed to detect and prevent money laundering and terrorism financing.
The AML program has several required components. First, you must have a compliance officer who is responsible for overseeing the AML program. This person does not need to be full-time, but someone needs to own the responsibility. Second, you must have written policies and procedures that describe how your company complies with AML requirements. Third, you must conduct due diligence on your customers. Fourth, you must monitor your customers' transactions for suspicious activity. Fifth, you must file reports of suspicious activity. Sixth, you must maintain records that law enforcement can access. Seventh, you must conduct regular training for your staff about AML requirements. Eighth, you must conduct periodic audits of your AML program to identify weaknesses.
The requirement to establish an AML program is not a requirement to do certain specific things. It is a requirement to have a program that is reasonably designed to accomplish the goal of detecting and preventing money laundering and terrorism financing. This gives you flexibility in how you structure the program. Different companies will have different AML programs based on their size, their business model, and their risk profile.
But the requirement is also not toothless. If FinCEN examines you and concludes your AML program is inadequate, FinCEN can force you to fix it or can penalize you for non-compliance. The standard is reasonableness. Your program needs to be reasonable given your size and risk profile.
For a startup money transmission company, a reasonable AML program might be relatively basic. You collect customer information, you verify it, you monitor transactions for activity that appears suspicious, you file suspicious activity reports, you maintain records. You conduct initial training for staff and annual refresher training. You review your program annually to look for gaps.
For a larger company with higher transaction volumes or customers in higher-risk jurisdictions, the AML program might be significantly more elaborate. You might have a dedicated AML team. You might have sophisticated transaction monitoring systems that automatically flag suspicious patterns. You might conduct customer risk assessments for each customer. You might have enhanced due diligence for customers that are higher-risk. The program scales with the complexity and risk of the business.
3.5 SAR Filing Obligations and Thresholds
A Suspicious Activity Report, or SAR, is a form you file with FinCEN if you detect activity that appears to be suspicious. The form asks you to describe the activity and explain why you think it is suspicious. You file the SAR confidentially. Law enforcement uses the information in the SAR to investigate potential criminal activity.
You are required to file a SAR if you detect activity that involves funds or transactions that are subject to your AML program and that meet certain criteria. The criteria are that the transaction involves or aggregates to more than five thousand dollars and the transaction meets at least one of the following: involves a potential violation of federal law, is designed to evade BSA requirements, involves potential money laundering or terrorism financing, or is otherwise suspicious in a way that warrants reporting.
The five thousand dollar threshold is critical. Transactions under five thousand dollars do not require a SAR even if they are suspicious. If a customer makes a series of transactions that aggregate to more than five thousand dollars over a period of time, and the pattern is designed to keep each individual transaction under the reporting threshold, that pattern—called "structuring"—is itself suspicious and might warrant a SAR. But individual transactions under five thousand dollars do not trigger the SAR requirement.
You must file the SAR within thirty days of when you first detect the suspicious activity. If you need additional time to investigate, you have until the end of the next day after the thirty-day period to file. But you must file within a reasonable time window.
Filing a SAR does not mean you are accusing your customer of a crime. It means you have detected activity that appears suspicious and you are reporting it to law enforcement. Your customer does not have to be told that you filed a SAR. In fact, there are legal restrictions on telling the customer. You cannot tip off the customer that you have filed a SAR without violating federal law. The exception is that if you are required to disclose the SAR as part of a legal process—for example, you are subpoenaed to produce it—you can disclose it.
SAR filing is one of the most important and most litigation-prone aspects of money transmission compliance. If you file a SAR without a good faith basis for suspicion, you can face liability from your customer. If you fail to file a SAR when you should have, you can face enforcement action from FinCEN. The line between filing and not filing is not always clear. You need judgment and reasonable systems to make the call.
3.6 CTR Filing Requirements
A Currency Transaction Report, or CTR, is a form you file with FinCEN if you conduct a transaction involving currency in the amount of ten thousand dollars or more. The form reports information about the transaction: who the parties were, what the transaction was, when it occurred, how much currency was involved.
CTR filing is different from SAR filing. A CTR is required regardless of whether the transaction appears suspicious. If a transaction meets the size threshold and involves currency, you file a CTR. If you detect suspicious activity, you file a SAR. You might file both forms for the same transaction if the transaction is both large and suspicious.
The ten thousand dollar threshold applies to all transactions involving currency that aggregate to ten thousand dollars or more within a single business day. This means multiple transactions by the same person that aggregate to ten thousand dollars trigger a CTR filing requirement for the entire amount.
For money transmission companies, the CTR requirement is usually less relevant than the SAR requirement because money transmission often does not involve physical currency. But if you accept physical currency from customers, or if you send physical currency to customers, you need to file CTRs for transactions that meet the threshold.
3.7 Recordkeeping: The 5-Year Rule and Beyond
The BSA requires that you maintain certain records for a specified period of time. The general rule is that you maintain records for five years. This means any record related to a customer transaction—information about the customer, details of the transaction, communications with the customer—must be maintained for five years from the date of the transaction.
The purpose of the recordkeeping requirement is to give law enforcement a historical record. If law enforcement is investigating a transaction that occurred three years ago, they need to be able to get information about that transaction. If you have deleted the records, law enforcement cannot investigate. The five-year retention period gives a window for investigation.
But recordkeeping is more complex than just keeping files for five years. The records need to be organized in a way that you can retrieve them quickly if law enforcement requests them. The records need to be accurate. The records need to be protected against loss or destruction.
Some records you need to maintain are not records of individual transactions. They include records of your AML program, records of your training, records of SAR filings, records of audits, records of policies and procedures. These records need to be maintained for as long as you are in business and for some period after you cease business.
The recordkeeping requirement applies to electronic records, paper records, and any other format. You need to be able to produce records in response to a law enforcement request or a regulatory request. If you maintain records in a system that is not easily accessible, or if you maintain records in a format that is not easily retrievable, you are not in compliance with the recordkeeping requirement.
For a money transmission company that is processing significant transaction volume, the data storage requirements can be substantial. You might generate millions of records per year. Maintaining that data for five years requires planning around data retention, data security, and data retrieval.
3.8 FinCEN 314(a) and 314(b) Information Sharing
Section 314 of the BSA authorizes FinCEN to facilitate information sharing between financial institutions and law enforcement. There are two subsections that are relevant to money transmission.
Under 314(a), law enforcement agencies can request that FinCEN ask all financial institutions to search their records for information about a particular person or account. For example, law enforcement might be investigating money laundering and might want to know whether a particular person has conducted transactions with any financial institution in the United States. Law enforcement makes a request to FinCEN. FinCEN contacts all registered financial institutions, including MSBs, and asks them to search their records. If an MSB has information about the person, the MSB reports that information back to FinCEN or directly to law enforcement.
Your obligation under 314(a) is to maintain systems that allow you to search your customer records in response to these requests and to report what you find. You need to be able to do this within a specified timeframe, usually ten days.
Under 314(b), financial institutions can voluntarily share information with each other about customers and transactions that they believe are suspicious. The purpose is to allow financial institutions to work together to identify patterns of suspicious activity. For example, if Bank A detects a series of transactions involving a particular customer that appear suspicious, Bank A can share information about those transactions with Bank B if Bank B is also transacting with the same customer. The two banks together might identify a pattern that neither bank would identify alone.
As a money transmission company, you should have systems in place to respond to 314(a) requests and you should consider whether to participate in 314(b) information sharing.
3.9 The FinCEN Beneficial Ownership Rule (CDD Final Rule)
In late 2024, FinCEN finalized a new rule requiring financial institutions to collect beneficial ownership information about their customers. The beneficial ownership rule is part of a broader effort to combat financial crime by increasing transparency about who actually owns and controls companies.
The rule requires that when you open an account for a business customer, you must collect information about the beneficial owners of that business. A beneficial owner is a person who owns at least 25 percent of the equity of the company, or who otherwise exercises significant control over the company. For a company with multiple shareholders, you need to identify the individuals who collectively own at least 25 percent.
You must collect this information before you open the account. You must verify the information is accurate. You must maintain the information in your files. You must provide the information to law enforcement if requested.
The rule is complex because it requires judgment about what constitutes a beneficial owner. If a company has ten shareholders each owning 10 percent of the equity, and no one person owns 25 percent, you might conclude there are no beneficial owners. But if one person controls the company through voting agreements or board control even though they do not own 25 percent, they might still be a beneficial owner.
The rule also creates challenges for compliance because you need to verify beneficial ownership information, and verification can be difficult. For a company with a clear ownership structure, verification is straightforward. For a company with complex ownership, or with ownership held through trusts or other entities, verification is more challenging.
The beneficial ownership rule is scheduled to become effective in 2025. If you are getting licensed as a money transmitter, you need to build systems for collecting and verifying beneficial ownership information before the rule becomes effective.
3.10 What Happens During a FinCEN Examination
FinCEN conducts examinations of money services businesses. An examination is an investigation of your compliance with FinCEN requirements. FinCEN examines a sample of MSBs each year. The examination process takes weeks or months. FinCEN asks for documents, interviews your staff, and assesses whether you are complying with AML requirements, recordkeeping requirements, and other BSA obligations.
An examination can be triggered in different ways. FinCEN might randomly select you for examination. You might be selected because you are in a higher-risk category or jurisdiction. You might be selected because FinCEN received a referral or complaint about your company.
When FinCEN decides to examine you, FinCEN contacts your company and schedules the examination. FinCEN usually starts with a document request. FinCEN asks you to produce your policies and procedures, training records, AML program documentation, samples of customer files, records of transactions, SAR filings, and other documentation. You have a specified timeframe, usually two to four weeks, to produce the requested documents.
After FinCEN reviews the documents, FinCEN might conduct on-site interviews. FinCEN examiners will meet with your compliance officer and other staff members and ask detailed questions about your AML program, your compliance procedures, and how you actually implement your policies in practice.
FinCEN might also request transaction data. FinCEN might ask you to produce information about a sample of your customers and their transactions, or might ask about transactions involving high-risk jurisdictions or indicators of suspicious activity.
After the examination is complete, FinCEN issues an examination report. The report describes what FinCEN examined and identifies any areas of non-compliance. If FinCEN finds violations, the report will describe the violations and might recommend specific remedial actions.
If violations are found, you have an opportunity to respond. You can explain your perspective on the findings. You can describe remedial actions you are taking. You can provide additional information that might change FinCEN's assessment.
After FinCEN evaluates your response, FinCEN can issue a final report and can bring enforcement action if violations are substantiated. Enforcement action can take the form of a civil penalty, a cease and desist order, or other remedial action.
An examination is not a casual process. FinCEN examiners are skilled financial crime investigators. They understand money laundering tactics and the ways companies can fall short of compliance. If you are examined, you need to take the examination seriously and respond completely and honestly.
3.11 Practitioner's Bottom Line
Federal regulation of money services businesses is separate from state licensing and is just as important. Every money services business must register with FinCEN and must comply with Bank Secrecy Act requirements, which include maintaining an AML program, conducting customer due diligence, monitoring for suspicious activity, and filing reports to law enforcement. The beneficial ownership rule, effective in 2025, adds new compliance obligations. FinCEN examines MSBs for compliance and can bring enforcement action for violations. You must build compliance systems that satisfy both FinCEN and your state regulators, and those systems must be reasonably designed to prevent money laundering and terrorism financing.
END OF SECTION 01: FOREWORD AND PART ONE
Word count: Approximately 6,400 words