🇺🇸US MSB Registration and Money Transmitter Licences: FinCEN plus the State Map

Concept: FinCEN registration and state licences

The United States has no single "payments licence". Two separate obligations run in parallel and neither substitutes for the other. The federal one is registration as a money services business (MSB) with FinCEN, the Treasury's financial intelligence unit — an AML-supervision record, free and filed online. The state one is a money transmitter license (MTL) in every state where the customers are — the document that actually authorises moving funds, with capital, bonds and exams. 31 CFR 1022.380 requires registration "whether or not licensed as a money services business by any State": the rule itself fixes that these are two separate obligations.

A provider presenting FinCEN registration as a "US licence" either misunderstands its own status or assumes nobody will check — and checking takes minutes via FinCEN's public MSB registry and NMLS Consumer Access for the sender's state. For the company building the business the order is reversed: FinCEN is a first-week formality, the state map is the main project for a year or two. Transmitting without a required state license is a federal crime under 18 U.S.C. § 1960 — up to five years.

Criminal liability lives in the gap between the two regimes. 18 U.S.C. 1960 punishes operating an unlicensed money transmitting business with up to five years' imprisonment, in three distinct ways.

• Branch (b)(1)(A) covers operating without a state licence where that is punishable as a misdemeanour or felony, “whether or not the defendant knew that the operation was required to be licensed”.
• Branch (b)(1)(B) covers failure to comply with the federal registration requirements.
• Branch (b)(1)(C) covers transmitting funds known to derive from crime or intended to promote unlawful activity, and does not require the business to be unlicensed at all.

The registration rule itself points straight at the statute: “See 18 U.S.C. 1960 for a criminal penalty for failure to comply with the registration requirements”.

The civil scale is not symbolic either:

The figures are those of the 31 CFR 1010.821 table as adjusted on 17 January 2025; FinCEN has published no 2026 inflation adjustment, although the statute requires one annually. None of this stayed theoretical: Brink's Global Services USA paid $37 million on 31 January 2025 for failing to register, to maintain an effective AML programme and to file SARs, and Paxful paid $3.5 million on 9 December 2025 for the same. Meanwhile FinCEN's page “Enforcement Actions for Failure to Register as a Money Services Business” has not been updated since 2017: neither Brink's nor Paxful appears there, so diligence relying on that list is nine years blind.

FinCEN mechanics: 180 days, RMSB and the AML program

The scope is set by 31 CFR 1010.100(ff), and the monetary triggers differ by capacity. Dealer in foreign exchange, check casher, and issuer or seller of money orders and traveler's checks — (ff)(1)–(3) — are caught above $1,000 per person per day. A seller of prepaid access, (ff)(7), is caught above $10,000 to one person in a day. A provider of prepaid access, (ff)(4), has no monetary threshold, and neither does a money transmitter: accepting and transmitting "currency, funds, or other value that substitutes for currency" in any amount qualifies. The definition reaches a person "wherever located" doing business wholly or in substantial part within the US: a foreign company with no American office registers like a domestic one.

The only substantive filter at the gate is the exclusions. Banks, SEC- and CFTC-registered persons, and a natural person acting “on an infrequent basis and not for gain or profit” sit outside the definition. A separate set is carved out of money transmitter, and that set feeds half of fintech:

• providers of delivery, communication and network access;
• payment processors;
• operators of clearance systems between regulated institutions;
• activity “integral to the sale of goods or the provision of services other than money transmission”.

Mapping those exclusions against the business's own flow of funds comes before building a compliance programme: each is narrow, and a marketplace loses “integrality” the moment money moves to an unrelated third party.

Registration itself is form RMSB (successor to Form 107), filed through BSA E-Filing within 180 days of the business being established; renewal follows every two calendar years, by December 31 of the preceding year. An agent of another MSB does not register — its principal does, keeping an annual agent list. Lateness costs the statutory $5,000 per violation as adjusted to $10,556 under 31 CFR 1010.821, each day counting separately, plus criminal exposure under § 1960.

The agent list is never filed with FinCEN, yet it must exist by the initial registration date, be updated each 1 January for the preceding twelve months, and be kept in the United States. It carries each agent's details and services, the months in which the agent's gross transaction amount exceeded $100,000, and the depository institution holding the agent's transaction account.

FinCEN reviews neither capital, management nor solvency: this is a notice, not an authorisation. The agency prices its own burden at 0.83 hours for an initial registration, 0.67 for renewal and 0.5 hours a year for the agent list — 14,047 hours and $1,752,126 for the entire industry (PRA notice, comments closed 29 June 2026).

The same filings size the industry: 45,272 Forms 107 filed in 2023–2025, roughly 24,856 active principal MSBs, some 307,212 agents — and about 75% of registrants report having no agents at all (NPRM of 10 April 2026). Fifty minutes is the price of the notice, not of compliance: the same NPRM puts industry-wide BSA compliance cost at “several billion dollars per year” while conceding that the data for a robust estimate does not exist.

Treasury has confirmed the extraterritorial logic for digital assets: their providers “generally fall within the scope of existing anti-money laundering laws based on the activities they perform wholly or substantially in the United States” (report to Congress under the GENIUS Act, 6 March 2026).

The obligations on a foreign MSB are narrower than practitioner guides suggest: a person resident in the United States authorised to accept service of legal process, and a US address where records are kept (31 CFR 1022.380(a)(2)). Federal law requires no US entity and prescribes no FBI fingerprinting for FinCEN registration — those are state licensing conditions, routinely and wrongly presented as federal ones.

Examination sits with the tax authority, not a banking supervisor: the function is delegated to the Commissioner of Internal Revenue (31 CFR 1010.810(b)(8)), and nothing guarantees how often it happens.

The AML program and reporting

The real burden is the written AML program under 31 CFR 1022.210: risk-based, commensurate with the business, on four pillars — internal controls, a designated compliance officer, training, independent review — plus SAR and CTR reporting; what must physically exist before the first transaction is mapped in the operator's compliance stack.

A written AML programme under 31 CFR 1022.210 must be “reasonably designed to prevent the money services business from being used to facilitate money laundering and the financing of terrorist activities”. The independent check is a review, not an audit: an in-house employee may run it so long as it is not the compliance officer, and the rule sets no frequency — the FinCEN examination manual offers only a risk-based formulation. The deadline is 90 days from establishment, half the registration window. There is no fifth pillar: MSBs sit outside the beneficial-ownership CDD rule, because “covered financial institution” in 31 CFR 1010.605(e)(1) means banks, broker-dealers, FCMs and introducing brokers, and mutual funds.

Federal reporting rests on four thresholds:

Telling the customer about a SAR is barred by statute. Check cashers are outside the mandatory SAR regime: the rule lists categories (ff)(1), (3), (4), (5), (6) and (7), and (ff)(2) is simply absent. And a bank under 31 CFR 1020.320(b)(3) gets an extra 30 days where no suspect has been identified; an MSB gets nothing.

The FinCEN and Federal Reserve proposal to cut the Travel Rule threshold to $250 and extend it to convertible virtual currency was withdrawn on 16 April 2025 (RIN 1506-AB41), so any briefing still calling its fate uncertain is out of date.

A parallel regime runs above all of this without notice-and-comment: geographic targeting orders. The southwest border order (7 March to 2 September 2026) covers every MSB category in counties of Arizona, New Mexico and Texas, lifts the threshold into the $1,000–$10,000 range, allows 30 days for a CTR instead of 15, and requires the marker “MSB0326GTO”; courts still block it in Imperial and San Diego Counties (Federal Register). The Minnesota order was extended from 11 August 2026 to 6 February 2027: a $3,000 threshold, Hennepin and Ramsey Counties, monthly CSV filing through the FinCEN Financial Industry Portal, and a field found nowhere else — whether the source of funds includes payments under government contracts or benefit programmes (Federal Register).

On April 10, 2026 FinCEN published a proposed overhaul of AML/CFT program rules, superseding the July 2024 draft: a codified risk assessment, an AML officer who is "a person in the United States" under Treasury oversight (some functions may stay offshore), and — new for MSBs — program approval by the board or senior management. Comments ran until June 9, 2026; for offshore-run compliance it is the draft's most sensitive line.

The proposal (91 FR 18704, RIN 1506-AB72) states that it “fully supersedes” the July 2024 draft (FinCEN press release). The “establish” plus “maintain through implementation” construction creates two distinct violations where there was one — and while banks get a protective threshold for implementation failures through the new 1020.221(b), MSBs get none. Ongoing CDD is not extended to MSBs. The proposed effective date is twelve months after the final rule.

The MTL map: 49 states, NMLS and the MTMA

Money transmission is licensed by 49 states, DC and the territories; the single exception is Montana, whose banking regulator states outright that it does not regulate money transmitters. The license attaches to where the customer is, so full coverage means up to 49 parallel NMLS files: control-person filings with fingerprints, a surety bond, minimum net worth, permissible investments continuously covering customer obligations, reporting and exams in each state.

Convergence comes from the CSBS model law, the Money Transmission Modernization Act: uniform definitions, exemptions, prudential and control standards. On the official CSBS count as of 26 February 2026, 31 states have enacted it in whole or in part, and transmitters licensed in them account for 99% of reported money transmission activity; counting the 2026 Louisiana and Oklahoma enactments takes it to roughly 33, with bills also live in Alaska, Delaware and Michigan. The CSBS tracker of April 23, 2026 shows higher figures because it aggregates enacted with introduced.

Networked supervision adds the second axis: since 2021 "one company, one exam" gives companies operating in 40 or more states one coordinated examination instead of dozens; the launch cohort — 78 of the largest payments and crypto firms, over $1 trillion a year. MTMA capital and bond formulas, the states' three crypto regimes, § 1960 and the federal bypasses are set out in the money transmitter license article.

Exemptions and grey zones

Three lawful bases allow a business to operate without an MTL, all narrow. First, agent of the payee: the platform takes money as the recipient's agent — a marketplace for its merchants, a booking system for hotels — payment is deemed received by the payee at the moment of payment; no transmission arises. An explicit exemption exists in 39 states, and the related agent-of-the-bank exemption in 35 (Troutman Pepper Locke, 2026); elsewhere the same model remains licensable money transmission.

Second, the payment processor carve-out: federally, processing payments for goods and services through clearing systems admitting only BSA-regulated institutions is excluded from the money transmitter definition, as is transmission "integral to the sale of goods". States need not mirror that logic, so the analysis runs twice and answers diverge.

Third, the bank agency model: banks are exempt from state transmission laws, so a program on a sponsor bank, with customer money at the bank at every moment, can run without its own licenses — much of the licence-for-rent market works this way. Everything turns on who actually controls the funds; the grey zone is FBO accounts.

The Synapse lesson: the intermediary kept the ledger over pooled for-benefit-of accounts at four banks; after its Chapter 11 of 22 April 2024 the banks were left without reconciled records. The four partner banks held about $219 million for end users, and by the trustee's status report of 12 November 2024 about $187 million of it (85%) had been returned; the trustee's June 2024 reports put the gap between the banks' FBO balances and Synapse's ledger at $65–96 million (third status report, 20 June 2024), cited as $60–90 million in the CFPB's complaint of 21 August 2025, with customers of about a hundred fintech programmes frozen for months; the CFPB has since allocated $55.2 million from its Civil Penalty Fund to affected consumers. The collapse prompted the FDIC's September 2024 recordkeeping proposal on direct, continuous bank access to the records. "Who keeps the ledger, and what if the intermediary fails" is now the first question in provider due diligence, and the same question decides bank onboarding for the operator itself.

Full-state budget and timelines

These are market estimates from licensing consultancies, not statute. Per Cornerstone (August 2026), a typical state takes 3–12 months, New York and California 12–18 or longer; files run in parallel, the slowest state sets the full-coverage date, and a realistic full-state horizon is 12–24 months. Per InnReg (December 2025), a multistate program starts around $1 million: fees, bonds, lawyers and the first year of compliance.

Then the running costs: compliance staff, NMLS reporting, exams, audit.

Most projects sequence identically: home state plus key markets first, the rest as revenue justifies it. For calibration: in Canada a comparable product closes with one federal FINTRAC registration plus a PSP registration — one reason some teams enter North America from the north. Set against the other payment regimes, the US map is the costliest route into a single market: an EEA EMI reaches thirty states from one regulator on €350,000 of capital, and a Singapore MPI starts at S$250,000, while US coverage means up to 49 files and a budget from about $1 million. The eighteen payment regimes are compared on capital, clock and safeguarding in the fintech licence map, and the crypto regimes in the crypto licence map.

Virtual currency: the federal definition and New York

The phrase "other value that substitutes for currency" makes crypto services money transmitters federally, and most states pull virtual currency into their transmission statutes; the MTMA carries a dedicated module for it, and fresh bills — like Delaware's S.B. 18 — arrive with virtual currency provisions. New York is the special case: the BitLicense under 23 NYCRR Part 200 has run since June 2015, covering five kinds of virtual currency business activity; the NYDFS register holds several dozen firms, many also carrying a New York MTL for the dollar side of the business. The in-state alternative is a limited purpose trust charter from NYDFS: fiduciary status and transmission rights without a separate MTL.

FinCEN's line rests on three documents. FIN-2013-G001 introduced the user / exchanger / administrator split: a user is not a money transmitter, while “an administrator or exchanger that (1) accepts and transmits a convertible virtual currency or (2) buys or sells convertible virtual currency for any reason” is one. FIN-2019-G001 sharpened the boundary with a four-factor wallet test: who owns the value, where it is stored, whether the owner interacts directly with the payment system, and whether the intermediary has “total independent control over the value”. The fourth factor is the crypto boundary: control over funds makes a money transmitter, its absence does not.

Hence the distinctions the industry is built on — an anonymising services provider is a money transmitter, an anonymising software provider is not; a DApp developer is not, a DApp operator is; CVC kiosks are. Kiosks have their own notice, FIN-2025-NTC1 of 4 August 2025: the installed base grew from 4,128 in January 2019 to 37,342 in January 2025, with about $246.7 million of losses reported to IC3 for 2024.

The problem is that the regulatory line and the prosecutorial line have diverged. In the Samourai Wallet case prosecutors reportedly asked FinCEN whether non-custodial CoinJoin was money transmission, were told no, and charged anyway: Keonne Rodriguez received five years (6 November 2025) and William Lonergan Hill four (19 November 2025) (Ballard Spahr analysis). On 6 August 2025 an SDNY jury convicted Roman Storm of conspiracy to operate an unlicensed money transmitting business under the 1960(b)(1)(C) branch; the Rule 29 motion was argued on 9 April 2026 and remains undecided as of 30 August 2026, and the retrial on the hung counts has been moved from the requested October 2026 dates to 26 April 2027 (The Block).

Department of Justice policy has formally softened — the Blanche memorandum of 7 April 2025 requires a knowing and wilful violation for the (b)(1)(A) and (B) branches, and Galeotti in August 2025 promised no new (b)(1)(C) charges against decentralised non-custodial software. That is policy, not law, and one memorandum can withdraw it.

Federal alternatives to the state map

By 2026 the 49-file map acquired its first federal bypasses — for two specific models. For a stablecoin issuer, the GENIUS Act, signed July 18, 2025: federal qualification as a permitted payment stablecoin issuer through the OCC exempts it from state licensing, including money transmission; under $10 billion the state track is open. The ban on issuing without permitted-issuer status starts on the earlier of January 18, 2027 or 120 days after final rules — no final rule has been adopted, so the calendar date governs; the OCC's proposed rules were published in the Federal Register on 2 March 2026, the issuers' AML proposal on April 10, 2026.

A companion NPRM issued the same day (91 FR 18582) defines permitted payment stablecoin issuers as a separate class of financial institution under 31 U.S.C. 5312(a)(2)(Y) and expressly removes them from the MSB definition; issuers that do not qualify as PPSIs remain MSBs. PPSI duties sit closer to a bank's: ongoing CDD and beneficial-ownership collection, a US-located AML officer, SARs limited to primary-market activity, the ability to block and freeze transactions, and OFAC screening. The GENIUS Act statutory deadline of 18 July 2026 was missed, and a separate CIP proposal followed on 22 June. For the first time a business that classical analysis would treat as a money transmitter is legislated out of the MSB regime — a template other verticals will copy.

For custody and settlement infrastructure, the OCC national trust charter: on December 12, 2025 conditional approvals went to five companies at once — Circle's First National Digital Currency Bank, Ripple National Trust Bank, and Paxos, BitGo and Fidelity Digital Assets converting from state trusts. One federal charter replaces dozens of MTLs at the price of fiduciary duties and OCC supervision; direct access to Federal Reserve settlement is a separate question, covered under master accounts.

The supervisory climate shifted too: on April 10 the OCC and FDIC finalised a rule banning reputation risk in supervision — the formal end of the tool that debanked payments and crypto firms last cycle. For everything else — transfers, payouts, on- and off-ramps — the default remains FinCEN registration plus the state map.

A third line runs through beneficial ownership: on 11 August 2026 FinCEN issued a final rule: US companies are permanently exempt from BOI reporting, previously filed information about US persons will be deleted, and foreign reporting companies report only their non-US beneficial owners (FinCEN; Treasury). MSBs are not directly affected, having never been covered financial institutions. The indirect effect is heavier: correspondent banks have lost the federal ownership registry for US companies just as EO 14406 of 19 May 2026 demands stronger risk-based CDD and names “unregistered money services businesses” as a suspicious-activity typology. Banks will push owner verification onto the MSB customer by contract.

Meanwhile EO 14331 orders “reputation risk” out of supervisory manuals and EO 14405 directs regulators to streamline charters and registrations for fintech. Three orders pulling in different directions do not ease matters for a borderline MSB; they produce sharper sorting.

The federal calendar through 2028: