🇺🇸FinCEN MSB in the US: the Registration That Does Not Replace a State Licence

MSB Status Attaches to Activity, Not to a Permission

A money services business is not a licence category in US law but a description of what a person actually does, and it lives in the Bank Secrecy Act rulebook rather than in any chartering statute. 31 CFR 1010.100(ff) lists seven capacities: dealer in foreign exchange, check casher, issuer or seller of traveler's checks or money orders, provider of prepaid access, money transmitter, the US Postal Service, and seller of prepaid access. Falling into one is a question of fact: the status arises “whether or not on a regular basis or as an organized business concern” and turns on neither corporate form, nor profitability, nor whether any state has licensed you (2011 final rule).

The “$1,000 per person per day” threshold, repeated as though universal, reaches only three of the seven capacities — dealer in FX, check casher, and issuer or seller of money orders and traveler's checks. A money transmitter has no threshold at all: a systematic $50 transfer creates the status exactly as a $5 million one does. A seller of prepaid access has its own trigger, $10,000 of sales in a day.

The only substantive filter at the gate is the exclusions. Banks, SEC- and CFTC-registered persons, and a natural person acting “on an infrequent basis and not for gain or profit” sit outside the definition. A separate set is carved out of money transmitter, and that set feeds half of fintech: providers of delivery, communication and network access; payment processors; operators of clearance systems between regulated institutions; and activity “integral to the sale of goods or the provision of services other than money transmission”. Mapping those exclusions against your own flow of funds comes before building a compliance programme: each is narrow, and a marketplace loses “integrality” the moment money moves to an unrelated third party.

Registration: 180 Days, Form 107, and the Fifty-Minute Estimate

FinCEN Form 107 (RMSB) is filed only through BSA E-Filing, and it is due no later than 180 days from the day after the business is established (31 CFR 1022.380(b)(3)). The registration period runs two calendar years, and renewal is filed by the last day of the calendar year preceding the new period — 31 December, not “two years from your own date”. Re-registration within 180 days is triggered by a change of ownership or control requiring re-registration under state law, by a transfer of more than 10% of voting power, and by a rise of more than 50% in the number of agents during a period; the year of the event becomes year one of a fresh cycle. A funding round is a regulatory event.

The agent list is never filed with FinCEN, yet it must exist by the initial registration date, be updated each 1 January for the preceding twelve months, and be kept in the United States. It carries each agent's details and services, the months in which the agent's gross transaction amount exceeded $100,000, and the depository institution holding the agent's transaction account.

What registration does not mean. FinCEN reviews neither capital, management nor solvency: this is a notice, not an authorisation. The agency prices its own burden at 0.83 hours for an initial registration, 0.67 for renewal and 0.5 hours a year for the agent list — 14,047 hours and $1,752,126 for the entire industry (PRA notice, comments closed 29 June 2026). The same filings size the industry: 45,272 Forms 107 filed in 2023–2025, roughly 24,856 active principal MSBs, some 307,212 agents — and about 75% of registrants report having no agents at all (NPRM of 10 April 2026). Fifty minutes is the price of the notice, not of compliance: the same NPRM puts industry-wide BSA compliance cost at “several billion dollars per year” while conceding that the data for a robust estimate does not exist.

The Foreign MSB: the Customer Base Triggers the Regime, Not the Office

The rule attaches status neither to an office nor to a place of incorporation: an MSB is a person carrying on the relevant activity “wholly or in substantial part within the United States” (31 CFR 1010.100(ff)). A Dubai or Singapore company is pulled in by its customer base, with no US employee and usually no awareness that it has happened. Treasury confirmed the same logic for digital assets: service providers “generally fall within the scope of existing anti-money laundering laws based on the activities they perform wholly or substantially in the United States” (report to Congress under the GENIUS Act, 6 March 2026).

The obligations that follow are narrower than practitioner guides suggest. The rule asks for two things: a person resident in the United States authorised to accept service of legal process, and a US address where records are kept (31 CFR 1022.380(a)(2)). Federal law requires no US entity and prescribes no FBI fingerprinting for FinCEN registration — those are state licensing conditions, routinely and wrongly presented as federal ones.

One thing is about to change, and it changes operations rather than paperwork. The proposal of 10 April 2026 requires the AML/CFT officer to be “located in the United States” and “accessible to, and subject to oversight and supervision by, FinCEN and its designee”. For an offshore team running compliance from London or Dubai that is a rebuild of the operating model. The phrase “foreign-located” does not appear in the NPRM at all, leaving open how the requirement lands on an MSB with no US staff.

The Crypto Boundary: Custody, Control, and a Split Between Regulator and Prosecutor

FinCEN's line rests on three documents. FIN-2013-G001 introduced the user / exchanger / administrator split: a user is not a money transmitter, while “an administrator or exchanger that (1) accepts and transmits a convertible virtual currency or (2) buys or sells convertible virtual currency for any reason” is one. FIN-2019-G001 sharpened the boundary with a four-factor wallet test: who owns the value, where it is stored, whether the owner interacts directly with the payment system, and whether the intermediary has “total independent control over the value”. The fourth factor is the crypto boundary: control over funds makes you a money transmitter, its absence does not. Hence the distinctions the industry is built on — an anonymising services provider is a money transmitter, an anonymising software provider is not; a DApp developer is not, a DApp operator is; CVC kiosks are. Kiosks have their own notice, FIN-2025-NTC1 of 4 August 2025: the installed base grew from 4,128 in January 2019 to 37,342 in January 2025, with about $246.7 million of losses reported to IC3 for 2024.

The problem is that the regulatory line and the prosecutorial line have diverged. In the Samourai Wallet case prosecutors reportedly asked FinCEN whether non-custodial CoinJoin was money transmission, were told no, and charged anyway: Keonne Rodriguez received five years (6 November 2025) and William Lonergan Hill four (19 November 2025) (Ballard Spahr analysis). On 6 August 2025 an SDNY jury convicted Roman Storm of conspiracy to operate an unlicensed money transmitting business under the 1960(b)(1)(C) branch; the Rule 29 motion was argued on 9 April 2026 and remains undecided as of 13 August 2026, while the government has proposed a retrial on 5 or 12 October 2026 (DeFi Education Fund; The Block). Department of Justice policy has formally softened — the Blanche memorandum of 7 April 2025 requires a knowing and wilful violation for the (b)(1)(A) and (B) branches, and Galeotti in August 2025 promised no new (b)(1)(C) charges against decentralised non-custodial software. That is policy, not law, and one memorandum can withdraw it.

The Real Load: Four Pillars and the Reporting Stack

A written AML programme under 31 CFR 1022.210 must be “reasonably designed to prevent the money services business from being used to facilitate money laundering and the financing of terrorist activities” and contain four elements: policies and internal controls; a designated person responsible for day-to-day compliance; staff training; and an “independent review to monitor and maintain an adequate program”. A review, not an audit: an in-house employee may run it so long as it is not the compliance officer, and the rule sets no frequency — the FinCEN examination manual offers only a risk-based formulation. The deadline is 90 days from establishment, half the registration window. There is no fifth pillar: MSBs sit outside the beneficial-ownership CDD rule, because “covered financial institution” in 31 CFR 1010.605(e)(1) means banks, broker-dealers, FCMs and introducing brokers, and mutual funds.

CTRs are due for currency transactions above $10,000, filed within 15 days (31 CFR 1010.306). SARs carry a $2,000 threshold, a 30-calendar-day deadline from initial detection, and a statutory bar on telling the customer (31 CFR 1022.320). Two asymmetries rarely make it into overviews. Check cashers are outside the mandatory SAR regime: the rule lists categories (ff)(1), (3), (4), (5), (6) and (7), and (ff)(2) is simply absent. And a bank under 31 CFR 1020.320(b)(3) gets an extra 30 days where no suspect has been identified; an MSB gets nothing. On top sit the monetary instrument log for cash sales of instruments of $3,000 or more (31 CFR 1010.415) and the Travel Rule at $3,000 (31 CFR 1010.410(f)). The FinCEN and Federal Reserve proposal to cut that threshold to $250 and extend it to convertible virtual currency was withdrawn on 16 April 2025 (RIN 1506-AB41), so any briefing still calling its fate uncertain is out of date.

A parallel regime runs above all of this without notice-and-comment: geographic targeting orders. The southwest border order (7 March to 2 September 2026) covers every MSB category in counties of Arizona, New Mexico and Texas, lifts the threshold into the $1,000–$10,000 range, allows 30 days for a CTR instead of 15, and requires the marker “MSB0326GTO”; courts still block it in Imperial and San Diego Counties (Federal Register). The Minnesota order was extended from 11 August 2026 to 6 February 2027: a $3,000 threshold, Hennepin and Ramsey Counties, monthly CSV filing through the FinCEN Financial Industry Portal, and a field found nowhere else — whether the source of funds includes payments under government contracts or benefit programmes (Federal Register).

Federal Registration Does Not Replace a State Licence

The rule says it in terms: you must register “whether or not licensed as a money services business by any State” (31 CFR 1022.380(a)(1)). The converse holds just as firmly: FinCEN registration confers no right to transmit money in any state. A money transmitter licence is required in 51 of the 52 US jurisdictions — the 50 states, the District of Columbia and Puerto Rico, with Montana the exception. Surety bonds run from $10,000 to $1 million and up to $7 million in California, minimum net worth from $100,000, and processing in New York and California can take eighteen months; industry estimates of nationwide coverage frequently exceed $1 million (industry data on MTL parameters). Harmonisation is slow and the primary sources disagree with themselves: CSBS reports that 31 states have adopted Money Transmission Modernization Act provisions, while its own June 2026 legislative tracker gives 38 counting 2026 enactments and pending bills. The application mechanics are covered on the page about money transmitter licences in the US.

Criminal liability lives in the gap between the two regimes. 18 U.S.C. 1960 punishes operating an unlicensed money transmitting business with up to five years' imprisonment, in three distinct ways. Branch (b)(1)(A) covers operating without a state licence where that is punishable as a misdemeanour or felony, “whether or not the defendant knew that the operation was required to be licensed”. Branch (b)(1)(B) covers failure to comply with the federal registration requirements. Branch (b)(1)(C) covers transmitting funds known to derive from crime or intended to promote unlawful activity, and does not require the business to be unlicensed at all. The registration rule itself points straight at the statute: “See 18 U.S.C. 1960 for a criminal penalty for failure to comply with the registration requirements”.

The civil scale is not symbolic either: failure to register draws up to $10,556 per violation, with each day counted separately; a wilful BSA violation runs from $71,545 to $286,184; a pattern of negligence, $111,308 (the 31 CFR 1010.821 table as adjusted on 17 January 2025). FinCEN has published no 2026 inflation adjustment, although the statute requires one annually. None of this stayed theoretical: Brink's Global Services USA paid $37 million on 31 January 2025 for failing to register, to maintain an effective AML programme and to file SARs, and Paxful paid $3.5 million on 9 December 2025 for the same. Meanwhile FinCEN's page “Enforcement Actions for Failure to Register as a Money Services Business” has not been updated since 2017: neither Brink's nor Paxful appears there, so diligence relying on that list is nine years blind.

What Changed in 2025–2026, and the Calendar to 2028

The 2024 picture is obsolete. The Program Rule NPRM of 3 July 2024 was not refined but withdrawn and replaced: the proposal of 10 April 2026 (91 FR 18704, RIN 1506-AB72) states that it “fully supersedes” the earlier one (FinCEN press release). For MSBs it rewrites 1022.210 end to end: documented risk assessment processes incorporating the national AML/CFT Priorities, an obligation to steer resources towards higher-risk customers, a US-located AML officer, and formal approval of the written programme by the board or appropriate senior management. The “establish” plus “maintain through implementation” construction creates two distinct violations where there was one — and while banks get a protective threshold for implementation failures through the new 1020.221(b), MSBs get none. Ongoing CDD is not extended to MSBs. The proposed effective date is twelve months after the final rule.

The second line is stablecoins. An NPRM issued the same day (91 FR 18582) defines permitted payment stablecoin issuers as a separate class of financial institution under 31 U.S.C. 5312(a)(2)(Y) and expressly removes them from the MSB definition; issuers that do not qualify as PPSIs remain MSBs. PPSI duties sit closer to a bank's: ongoing CDD and beneficial ownership collection, a US-located AML officer, SARs limited to primary market activity, the ability to block and freeze transactions, and OFAC screening. The GENIUS Act statutory deadline of 18 July 2026 was missed, and a separate CIP proposal followed on 22 June. For the first time a business that classical analysis would treat as a money transmitter is legislated out of the MSB regime — a template other verticals will copy; the product consequences are worked through on the pages about the GENIUS Act, stablecoins and the OCC trust charter.

The third line is beneficial ownership. On 11 August 2026 FinCEN issued a final rule: US companies are permanently exempt from BOI reporting, previously filed information about US persons will be deleted, and foreign reporting companies report only their non-US beneficial owners (FinCEN; Treasury). MSBs are not directly affected, having never been covered financial institutions. The indirect effect is heavier: correspondent banks have lost the federal ownership registry for US companies just as EO 14406 of 19 May 2026 demands stronger risk-based CDD and names “unregistered money services businesses” as a suspicious-activity typology. Banks will push owner verification onto the MSB customer by contract. Meanwhile EO 14331 orders “reputation risk” out of supervisory manuals and EO 14405 directs regulators to streamline charters and registrations for fintech. Three orders pulling in different directions do not add up to a thaw for a borderline MSB; they add up to sharper sorting.

Who Supervises an MSB and What Protects Client Money

An entry in the MSB Registrant Search confirms exactly one thing — that somebody filed a form. It says nothing about capital or about whether the operator has ever been examined: there are no federal prudential requirements for MSBs at all. Net worth, permissible investments and surety bonds exist only at state level and only where a licence exists, and a bond can be $10,000 against hundreds of millions in flow. The right question to an operator is not “are you FinCEN registered” but “which states have licensed you, what bond stands behind that, and how are client funds segregated”; the segregation mechanics are set out on the page about correspondent banking and safeguarding.

Examination sits with the tax authority, not a banking supervisor: the function is delegated to the Commissioner of Internal Revenue (31 CFR 1010.810(b)(8)), and nothing guarantees how often it happens. The beneficial-ownership CDD rule does not reach MSBs, which means fewer questions about a customer's ownership structure and equally less assurance that the operator understands who its other customers are. Transfers of $3,000 and above travel with the sender's data under the Travel Rule, a SAR is filed from a $2,000 threshold and the law forbids telling the customer, and inside a GTO zone the thresholds fall further. Above all: a regulatory penalty does not restore client funds. Paxful shut down, and the fine arrived afterwards.

Where the Regime Breaks the Product Plan

Three mistakes recur. The first is sequencing: teams assume they have 180 days, when the written AML programme is due on day 90, and the 2026 proposal keeps that deadline. The second is treating registration as authorisation: the federal layer is roughly one per cent of the work, and the rest is 51 jurisdictions, bonds up to $7 million, timelines up to eighteen months, and the (b)(1)(A) branch that turns a missing state licence into a federal crime regardless of what you knew. The third is the agent list: 75% of registrants report no agents, very likely a future enforcement seam.

Four items belong in the 2027–2028 plan: an AML officer physically in the United States, a documented risk assessment incorporating the national priorities, formal board approval of the programme, and the PPSI-versus-MSB fork if the product includes stablecoin issuance. The bank account is critical path rather than a parallel track: under the FinCEN, IRS and state regulator statement of 10 November 2014 a bank need not act as “de facto regulator” of the MSB industry, but must understand the customer's business model and the general nature of its customer base. Where the banking layer is rented from someone else's licence, read BaaS and sponsor banks alongside license for rent: under the 2026 proposal a principal and an agent may allocate policy development by contract, but “each money services business will remain solely responsible for implementation”.

Non-custodial design protects you before the regulator and not before the prosecutor: FinCEN says an anonymising software provider is not a money transmitter, and Rodriguez and Hill received five and four years. The gap between those two lines is your risk, not theirs.