Why there are two layers: FinCEN and the states
The United States has no single "payments licence" — only two layers that do not substitute for each other. The federal one is registration as a money services business (MSB) with FinCEN, the Treasury's financial intelligence unit — an AML-supervision record, free and filed online. The state layer is a money transmitter license (MTL) in every state where the customers are — the document that actually authorises moving funds, with capital, bonds and exams. 31 CFR 1022.380 requires registration "whether or not licensed as a money services business by any State": the rule itself fixes that these are two separate obligations.
A provider presenting FinCEN registration as a "US licence" either misunderstands its own status or assumes nobody will check — and checking takes minutes via FinCEN's public MSB registry and NMLS Consumer Access for the sender's state. For the company building the business the order is reversed: FinCEN is a first-week formality, the state map is the main project for a year or two. Transmitting without a required state license is a federal crime under 18 U.S.C. § 1960 — up to five years.
FinCEN mechanics: 180 days, RMSB and the AML program
The perimeter is set by 31 CFR 1010.100(ff): dealer in foreign exchange, check casher, issuer or seller of money orders and traveler's checks, provider and seller of prepaid access — all triggered above $1,000 per person per day. A money transmitter has no threshold: accepting and transmitting "currency, funds, or other value that substitutes for currency" in any amount qualifies. The definition reaches a person "wherever located" doing business wholly or in substantial part within the US: a foreign company with no American office registers like a domestic one.
Registration itself is form RMSB (successor to Form 107), filed through BSA E-Filing within 180 days of the business being established; renewal follows every two calendar years, by December 31 of the preceding year. An agent of another MSB does not register — its principal does, keeping an annual agent list. Lateness costs $5,000 per violation in civil penalties, plus criminal exposure under § 1960.
The real burden is the written AML program under 31 CFR 1022.210: risk-based, commensurate with the business, on four pillars — internal controls, a designated compliance officer, training, independent review — plus SAR and CTR reporting; what must physically exist before the first transaction is mapped in the operator's compliance stack.
On April 10, 2026 FinCEN published a proposed overhaul of AML/CFT program rules, superseding the July 2024 draft: a codified risk assessment, an AML officer who is "a person in the United States" under Treasury oversight (some functions may stay offshore), and — new for MSBs — program approval by the board or senior management. Comments ran until June 9, 2026; for offshore-run compliance it is the draft's most sensitive line. The federal layer end to end — the seven 1010.100(ff) capacities, foreign MSBs, FinCEN's crypto boundary and the geographic targeting orders — is unpacked in the dedicated FinCEN MSB deep dive.
The MTL map: 49 states, NMLS and the MTMA
Money transmission is licensed by 49 states, DC and the territories; the single exception is Montana, whose banking regulator states outright that it does not regulate money transmitters. The license attaches to where the customer is, so full coverage means up to 49 parallel NMLS files: control-person filings with fingerprints, a surety bond, minimum net worth, permissible investments continuously covering customer obligations, reporting and exams in each state.
Convergence comes from the CSBS model law, the Money Transmission Modernization Act: uniform definitions, exemptions, prudential and control standards. Per the CSBS update of April 23, 2026, 38 states have enacted it in whole or in part, with 2026 bills pending in Alaska, Delaware, Louisiana, Michigan and Oklahoma. Networked supervision adds the second axis: since 2021 "one company, one exam" gives companies operating in 40 or more states one coordinated examination instead of dozens; the launch cohort — 78 of the largest payments and crypto firms, over $1 trillion a year. The state layer in detail — MTMA capital and bond formulas, the states' three crypto regimes, § 1960 and the federal bypasses — sits in the money transmitter license deep dive.
| Map segment | Where it stands | What it means |
|---|---|---|
| MTMA enacted in whole or in part | 38 states (CSBS, April 23, 2026) | requirements converge: uniform definitions, exemptions, prudential rules |
| MTMA bills in 2026 sessions | Alaska, Delaware, Louisiana, Michigan, Oklahoma | the map keeps converging on the model text |
| No MTL regime | Montana | the only state not licensing money transmission |
| Separate crypto layer | New York: BitLicense, 23 NYCRR 200 | virtual currency adds a second licence on top of the MTL |
| Coordinated supervision | operating in 40+ states | one joint exam instead of parallel state exams |
Exemptions and grey zones
Three lawful corridors run around the MTL, all narrow. First, agent of the payee: the platform takes money as the recipient's agent — a marketplace for its merchants, a booking system for hotels — payment is deemed received by the payee at the moment of payment; no transmission arises. An explicit exemption exists in roughly 22 states, three more decide case by case — a market count; elsewhere the same model remains licensable transmission.
Second, the payment processor carve-out: federally, processing payments for goods and services through clearing systems admitting only BSA-regulated institutions is excluded from the money transmitter definition, as is transmission "integral to the sale of goods". States need not mirror that logic, so the analysis runs twice and answers diverge.
Third, the bank agency model: banks are exempt from state transmission laws, so a program on a sponsor bank, with customer money at the bank at every moment, can run without its own licenses — much of the licence-for-rent market works this way. Everything turns on who actually controls the funds; the grey zone is FBO accounts. The Synapse lesson: the intermediary kept the ledger over pooled for-benefit-of accounts at four banks; after its Chapter 11 in April 2024 the banks lost the ledger, a $65–95 million shortfall surfaced in a custodial pool of about $219 million, and customers of a hundred fintech programs froze for months — prompting the FDIC's September 2024 recordkeeping proposal on direct, continuous bank access to the records. "Who keeps the ledger, and what if the intermediary fails" is now the first question in provider due diligence — and in the operator's own bank onboarding.
Full-state budget and timelines
These are market estimates from licensing consultancies, not statute. Per Cornerstone (August 2026), a typical state takes 3–12 months, New York and California 12–18 or longer; files run in parallel, the slowest state sets the full-coverage date, and a realistic full-state horizon is 12–24 months. Per InnReg (December 2025), a multistate program starts around $1 million: fees of $500–5,000 and bonds of $10K–$1 million per state at 1–5% annual premium (California's scale reaches $7 million), lawyers, the first year of compliance; net worth mostly $100–500K, growing with volume. Then the running costs: compliance staff, NMLS reporting, exams, audit.
Most projects sequence identically: home state plus key markets first, the rest as revenue justifies it. For calibration: in Canada a comparable product closes with one federal FINTRAC registration plus a PSP registration — one reason some teams enter North America from the north.
The crypto layer
The phrase "other value that substitutes for currency" makes crypto services money transmitters federally, and most states pull virtual currency into their transmission statutes; the MTMA carries a dedicated module for it, and fresh bills — like Delaware's S.B. 18 — arrive with virtual currency provisions. New York is the special case: the BitLicense under 23 NYCRR Part 200 has run since June 2015, covering five kinds of virtual currency business activity; the register holds about 40 firms, many also carrying a New York MTL for the fiat leg. The in-state alternative is a limited purpose trust charter from NYDFS: fiduciary status and transmission rights without a separate MTL.
Federal alternatives to the state map
By 2026 the 49-file map acquired its first federal bypasses — for two specific models. For a stablecoin issuer, the GENIUS Act, signed July 18, 2025: federal qualification as a permitted payment stablecoin issuer through the OCC exempts it from state licensing, including money transmission; under $10 billion the state track is open. The ban on issuing outside the perimeter starts on the earlier of January 18, 2027 or 120 days after final rules; the OCC's proposed rules appeared in March 2026, the issuers' AML proposal on April 10, 2026.
For custody and settlement infrastructure, the OCC national trust charter: on December 12, 2025 conditional approvals went to five companies at once — Circle's First National Digital Currency Bank, Ripple National Trust Bank, and Paxos, BitGo and Fidelity Digital Assets converting from state trusts. One federal charter replaces dozens of MTLs at the price of fiduciary duties and OCC supervision; Federal Reserve rails are a separate battle, covered under master accounts.
The backdrop is the 2026 thaw: on April 10 the OCC and FDIC finalised a rule banning reputation risk in supervision — the formal end of the tool that debanked payments and crypto firms last cycle. For everything else — transfers, payouts, on- and off-ramps — the default remains FinCEN registration plus the state map.
Q/A
A provider shows its FinCEN registration as a "US licence". Is that enough?
No. MSB registration is an AML-supervision record: mandatory, but conferring no right to transmit money in any state. That right comes from state MTLs, checkable in minutes via NMLS Consumer Access for the state the money leaves from. If there are none, the lawful explanations are three — bank or licensee agent, agent of the payee, processor carve-out — and the provider should name its basis.
How many state licenses does a business actually need?
As many as there are states with customers: the license follows the sender, not the company's office. Full coverage is 49 states plus DC and the territories; only Montana has no regime. Licensing runs in waves — home state and key markets first, the rest as revenue arrives; past 40+ states comes the coordinated "one company, one exam" review.
Can a payments product launch in the US without any MTL at all?
Yes — via agent of the payee (roughly 22 states with an explicit exemption), the processor carve-out for payments for goods and services, or a sponsor bank holding customer funds at every moment. Each corridor is verified state by state; Synapse showed the price of a careless FBO structure: a $65–95 million shortfall and frozen customer funds. FinCEN registration usually remains mandatory throughout.
What does the federal track give a crypto business instead of 49 licenses?
Two doors. A stablecoin issuer takes PPSI status under the GENIUS Act: federal qualification through the OCC removes state licensing, including money transmission; under $10 billion, the state track is available. A custodian takes the OCC national trust charter, as Circle, Ripple, Paxos, BitGo and Fidelity Digital Assets did on December 12, 2025. Exchanges and on-ramps have no bypass: their route is still the MTL map, plus the BitLicense for New York.