TL;DR: A business is an MSB under 31 CFR 1010.100(ff) if it transmits money in any amount, or if it cashes checks, exchanges currency, or sells money orders above $1,000 for one person in one day. MSBs must register with FinCEN on Form 107 and renew every two years, hold state money transmitter licenses where required, and run a written AML program under 31 CFR 1022.210 with a $2,000 SAR threshold rather than the $5,000 threshold banks use. The IRS examines non-bank MSBs, and a TIGTA review of closed IRS Title 31 examinations found that 75% ended with at least one BSA violation.
Who Counts as an MSB, and the $1,000 Line That Decides It
A money services business is any person doing business in the United States, whether or not on a regular basis or as a licensed concern, in one of the capacities listed at 31 CFR 1010.100(ff): dealer in foreign exchange, check casher, issuer or seller of traveler's checks or money orders, provider or seller of prepaid access, money transmitter, and the U.S. Postal Service. The definition turns on activity, not on how the business describes itself.
For every category except money transmission, the definition applies only when the business conducts more than $1,000 in that activity for any one person on any one day, and FinCEN's MSB registration guidance notes that the threshold applies separately to each activity. Money transmission has no threshold. Accepting funds or value that substitutes for currency from one person and transmitting it to another makes the business a money transmitter regardless of volume, which captures remittance companies, payment apps, and, under FinCEN's 2019 guidance on convertible virtual currency, most crypto exchanges and hosted wallet providers. Banks and SEC- or CFTC-regulated firms are excluded.
Registration Is Federal. Licensing Is State. Most MSBs Need Both
FinCEN registration and state money transmitter licensing are separate obligations, and holding one does not satisfy the other. Under 31 CFR 1022.380, the owner or controlling person files FinCEN Form 107 within 180 days of the business being established and renews every two calendar years by December 31. The MSB must also maintain an agent list, updated each January 1 and produced to FinCEN or the IRS on request.
A money transmitter generally needs a license in each state where it serves customers, with net worth, surety bond, and permissible investment requirements that vary by state. According to CSBS, 31 states have enacted the Money Transmission Modernization Act in full or in part as of September 2026, and licensees in at least one MTMA state account for 99% of reported money transmission activity.
What 31 CFR 1022.210 Actually Requires
Every MSB, including agents, must develop, implement, and maintain a written AML program reasonably designed to prevent the business from being used to facilitate money laundering and terrorist financing. 31 CFR 1022.210 requires the program to be commensurate with the location, size, nature, and volume of the services provided, and to include at a minimum:
- Policies, procedures, and internal controls covering customer identification, report filing, record retention, and law enforcement requests.
- A designated compliance person responsible for day-to-day compliance.
- Training for appropriate personnel, including on detecting suspicious transactions.
- Independent review, with scope and frequency matched to risk.
Those four elements map closely to the pillars of a bank AML compliance program, minus a separate beneficial ownership pillar. Written and effective are different things, though. IRS examiners test whether the program is implemented, and a template describing controls the business does not actually run is one of the most common ways an examination goes badly.
The Thresholds MSBs Get Wrong
The most consequential difference between MSB and bank obligations is the SAR threshold. Under 31 CFR 1022.320, an MSB must file a SAR within 30 days of detection when a transaction or pattern of transactions involves or aggregates at least $2,000 and the MSB knows, suspects, or has reason to suspect it is illicit, structured, purposeless, or facilitates crime. An MSB that tunes its monitoring to the $5,000 bank threshold is systematically under-filing.
The CTR obligation is the same $10,000 aggregate that applies to banks, and it carries the same structuring exposure. Customers who split cash across agents or days to stay under the threshold are engaged in structuring, which is itself reportable on a SAR. The IRS reported that 94% of IRS Criminal Investigation cases were searched against BSA data in fiscal year 2025, and two thirds of new investigations had a subject with an associated CTR.
The funds transfer rule adds identity verification for non-established customers sending $3,000 or more. OFAC sits outside the BSA but binds every U.S. person on a strict liability basis.
The Agent Problem: Principals Own Their Agents' Risk
Principal MSBs, the money transmitters and instrument issuers that distribute through agent networks, carry an AML obligation that extends to every storefront selling their product. FinCEN's 2016 guidance on agent monitoring requires a principal's program to include risk-based controls for ongoing monitoring of agent activity. Principals and agents may contractually allocate who writes the procedures, but neither can avoid liability by pointing to the contract.
At a minimum, FinCEN expects principals to identify the owners of their agents, evaluate agent operations on an ongoing basis, and evaluate whether agents are actually implementing the required controls, with documented procedures for corrective action and termination. A principal with several thousand agents cannot visit each one, so the burden falls on transaction analytics: agents whose volumes or corridor mix diverge from peers, clustered just-under-threshold transactions, and agents whose SAR referrals are suspiciously absent.
Keeping a Bank Account When Banks Are De-risking
MSBs lose bank accounts at a rate no other regulated category matches. FinCEN and the federal banking agencies issued a joint interpretive guidance in 2005 stating that the BSA does not require banks to serve as the de facto regulator of the MSB industry and that not all MSBs pose the same risk, and FinCEN restated it in 2014. Treasury's 2023 De-risking Strategy still identified small and medium-size money transmitters as the customer category most acutely affected, with profitability, driven in part by due diligence cost, the primary factor.
The 2005 guidance also tells MSBs exactly what a bank will ask for. At a minimum: customer identification, confirmation of FinCEN registration, state licensing, and agent status, and a basic risk assessment. Where risk is elevated, the bank may request the written AML program, independent testing results, the agent list, agent termination practices, and employee screening practices. A bank that learns a customer is an unregistered or unlicensed MSB is expected to file a SAR. An MSB should treat that list as a standing deliverable, and the banks still willing to serve MSBs are the ones that can monitor higher-risk business customers efficiently.
Fintechs: Registered MSB or Riding a Sponsor Bank?
Fintechs fall into two structurally different compliance positions. A fintech that accepts and transmits customer funds in its own name is a money transmitter: it registers with FinCEN, holds state licenses, and is examined by the IRS and state regulators directly. A fintech operating as a program manager on top of a chartered sponsor bank, with the bank holding the funds and accounts, is generally not itself the MSB; its obligations flow through the bank's third-party oversight framework.
The sponsor bank model shifts examination exposure but not operational work, because sponsor banks pass their regulator's expectations down contractually. Crypto and stablecoin businesses mostly sit on the MSB side under FinCEN's 2019 guidance, and increasingly carry stablecoin compliance requirements on top of FinCEN registration and state licenses.
What IRS Examiners Actually Find
FinCEN delegated BSA examination authority over non-bank MSBs to the IRS Small Business/Self-Employed Division. Under the Internal Revenue Manual, examiners review filed CTRs and SARs for incomplete fields and for common transaction types that never generate a filing, test a three-month transaction sample and expand to six months if problems appear, and assess whether the written program is actually implemented.
TIGTA's 2018 review of a statistical sample of 140 IRS Title 31 cases closed between fiscal years 2014 and 2016 found that 105, or 75%, closed with at least one BSA violation, totaling 383 violations across the sample.
The recurring findings cluster around a few themes. Programs that exist on paper but are not followed. SARs filed late, filed on a single transaction rather than the underlying pattern, or not filed because monitoring used a bank-level threshold. Missing $3,000 records. Independent reviews never performed or never remediated. Stale agent lists. A weak SAR narrative is a finding in its own right, because examiners read filed SARs to judge whether the MSB understood what it was reporting.
Where Sphinx Fits
Sphinx deploys AI compliance agents that work inside an MSB's existing systems to handle the high-volume work IRS examiners test: reviewing alerts against the $2,000 SAR threshold, flagging structuring across agents and days, monitoring agent-level activity for deviations from peers, and drafting SAR narratives with the supporting facts attached. Every decision is logged with its reasoning, giving the compliance officer a defensible record for an examiner or a sponsor bank. Sphinx does not replace the designated compliance person or the independent review; edge cases are escalated to human analysts with the case already built.
Frequently Asked Questions
Does a business have to register with FinCEN if it only acts as an agent for another MSB?
No. A business that is an MSB solely because it serves as an agent of another MSB, such as a retailer selling a principal's money orders, is not required to file Form 107, though it must still maintain its own AML program under 31 CFR 1022.210. If it also conducts MSB activity on its own account above the $1,000 threshold, it must register.
What is the SAR threshold for a money services business?
An MSB must file a SAR when a transaction or pattern of transactions involves or aggregates at least $2,000 and the MSB knows, suspects, or has reason to suspect the activity is illicit, structured, or without lawful purpose. Issuers of money orders or traveler's checks reviewing clearance records have a $5,000 threshold. SARs are due within 30 days of initial detection.
Is FinCEN registration the same as a state money transmitter license?
No. FinCEN registration is a federal BSA obligation filed on Form 107 and renewed every two years. A state money transmitter license is issued by each state's financial regulator with its own capital and bonding requirements. A money transmitter generally needs both.
Who examines MSBs for BSA compliance?
The IRS Small Business/Self-Employed Division examines non-bank MSBs for BSA compliance under authority delegated by FinCEN. State regulators separately examine licensed money transmitters. FinCEN retains civil penalty authority and receives referrals from IRS examiners for serious or repeated violations.
.png)
