What must an MSB's AML program include?

An MSB's AML program must be in writing and reasonably designed to prevent the MSB from being used to facilitate money laundering and terrorist financing. At a minimum it must have four elements: policies, procedures and internal controls; a designated compliance person; education and/or training; and independent review (31 CFR 1022.210(a), (c), (d)).

What the rule says:

• The MSB must develop, implement and maintain an effective program, and it must be commensurate with the risks posed by the MSB's location and size and the nature and volume of its financial services (31 CFR 1022.210(a), (b)).
• The program must be in writing, and copies must be available for inspection by the Department of the Treasury on request (31 CFR 1022.210(c)).
• Policies, procedures and internal controls must include provisions for complying with chapter X requirements, to the extent applicable to the MSB, on verifying customer identification, filing reports, creating and retaining records, and responding to law enforcement requests (31 CFR 1022.210(d)(1)(i)). An MSB with automated data processing systems should integrate its compliance procedures with them (31 CFR 1022.210(d)(1)(ii)).
• A designated person must assure day to day compliance, including proper report filing and recordkeeping, updating the program for current requirements and Treasury guidance, and appropriate training (31 CFR 1022.210(d)(2)).
• Appropriate personnel must receive education and/or training on their responsibilities, including detecting suspicious transactions to the extent the MSB must report them (31 CFR 1022.210(d)(3)).
• Independent review must monitor and maintain an adequate program, with scope and frequency commensurate with the risk of the services provided. An officer or employee may do it if that person is not the designated compliance person (31 CFR 1022.210(d)(4)).
• Prepaid access providers and sellers must have procedures to verify identity and collect name, date of birth, address and identification number from a person who obtains prepaid access. Sellers must do the same for access to funds exceeding $10,000 during any one day. Providers keep the information five years after last use of the device or vehicle; sellers keep it five years from the date of sale (31 CFR 1022.210(d)(1)(iv)).
• An MSB that is an MSB only because it is an agent of another MSB may agree with its principal on who develops policies, procedures and internal controls, but each MSB remains solely responsible for implementing the requirements (31 CFR 1022.210(d)(1)(iii)).

What we would look at:

• There is no standalone customer identification program rule for MSBs. Part 1022 has none, so the program must point to the chapter X identification requirements that apply to your activities (31 CFR 1022.210(d)(1)(i)(A)). These include funds transfer rules for transmittors and recipients that are not established customers (31 CFR 1010.410(e)(2), (e)(3), (e)(5)), currency transactions that must be reported (31 CFR 1010.312), and sales of bank checks or drafts, cashier's checks, money orders or traveler's checks for $3,000 to $10,000 in currency (31 CFR 1010.415(a)).
• The rule lists no separate customer due diligence element. Still, the program must be commensurate with your location, size, and the nature and volume of your services, so build it around your own risks.
• Keep the independent reviewer separate from the designated compliance person.
• Keep the written program current and ready to give to Treasury on request.
• Training frequency is not set by the rule, so match training to each person's responsibilities.

Sources

1. 31 CFR § 1022.210(a)-(b): https://www.law.cornell.edu/cfr/text/31/1022.210
2. 31 CFR 1022.210 (eCFR): https://www.ecfr.gov/current/title-31/section-1022.210

This answer is general information, not legal advice. Forteris is not a law firm.