AML Requirements for Money Service Businesses: A Practical Guide

Start by determining your MSB obligations

FinCEN defines several categories of money services business. The rules that apply depend on what the company actually does, not simply what it calls itself. A business should document its activities, jurisdictions, products, transaction channels, customer types, and applicable registration or licensing requirements.

For businesses subject to FinCEN MSB registration, registration is only one part of the framework. The operating compliance program must address the risks created by the business itself.

Build and maintain a written AML program

An AML program should translate legal requirements and the company's risk assessment into procedures employees can actually follow. For covered MSBs, the program is expected to be reasonably designed to prevent the business from being used for money laundering or terrorist financing.

• Policies, procedures, and internal controls appropriate to the business
• A designated person responsible for day-to-day AML compliance
• Training for appropriate personnel
• Independent review or testing of the program
• Risk-based customer, transaction, and escalation procedures

Know your customers and counterparties

The appropriate level of customer due diligence depends on the business model and risk. Useful controls can include identity information, sanctions screening, PEP screening where appropriate, expected activity, geography, source-of-funds information when warranted, and enhanced review for higher-risk relationships.

A screening alert should not be treated as an automatic conclusion. Potential matches need a documented review using available identifying information and the company's escalation procedures.

Monitor transactions and investigate unusual activity

Transaction monitoring should be designed around the activity the MSB actually conducts. Cash-intensive businesses, currency exchanges, money transmitters, check cashers, and digital-asset businesses can have very different risk patterns.

Alerts should lead to a repeatable investigation process. The file should show what triggered the review, what information was considered, what the investigator concluded, and whether escalation or reporting was required.

File required reports and keep supporting records

Depending on the transaction and business, BSA obligations can include suspicious activity reports, currency transaction reports, funds-transfer or monetary-instrument records, and other required records. Filing thresholds and exceptions are technical, so businesses should use the current FinCEN rules and instructions for the specific report.

Good recordkeeping matters beyond the filing itself. An examiner should be able to understand how a decision was reached and locate the supporting evidence without reconstructing the case from scattered emails and spreadsheets.

Train staff and independently test the program

Training should be relevant to each employee's responsibilities and documented so the business can demonstrate completion. Independent review should evaluate whether the program is not only written correctly but operating effectively in practice.

Findings from reviews should be assigned, remediated, documented, and closed rather than allowed to remain as recurring observations year after year.

Keep the program risk-based

There is no single AML workflow that fits every MSB. A small currency exchange and a nationwide money transmitter should not have identical controls. The goal is a defensible program calibrated to the company's actual risk and updated when products, customers, geographies, vendors, or regulations change.

PeakAML can help organize screening, training, reviews, risk assessments, documents, and remediation evidence. Software supports the compliance process; it does not replace legal advice, management responsibility, or an independent assessment of the requirements applicable to a particular business.