Does an MSB need an independent review of its AML program, and who can perform it?

Yes. An MSB's AML program must provide for independent review to monitor and maintain an adequate program, and an officer or employee of the MSB may perform it as long as that person is not the person designated to assure day to day compliance.

What the rule says:

• The program must provide for independent review to monitor and maintain an adequate program (31 CFR 1022.210(d)(4)).
• The scope and frequency of the review must be commensurate with the risk of the financial services the MSB provides (31 CFR 1022.210(d)(4)).
• The review may be conducted by an officer or employee of the MSB, so long as the reviewer is not the person designated under 31 CFR 1022.210(d)(2), who assures day to day compliance with the program (31 CFR 1022.210(d)(4)).

In practice:

• Pick a reviewer other than your designated compliance person. That exclusion is the one limit the rule states.
• Set scope and frequency from the risk of the services you actually offer. The rule gives no fixed schedule, so a riskier product mix points to a broader or more frequent review.
• The provision expressly permits an officer or employee other than the designated person. It does not address outside or third-party reviewers, so this answer does not say whether one may be used.
• Because the rule is silent on reviewer qualifications, reporting lines and how to document the review, check these points against your own program and your examiner or sponsor bank expectations.

Sources

1. 31 CFR § 1022.210(d)(4): https://www.law.cornell.edu/cfr/text/31/1022.210
2. 31 CFR 1022.210 (eCFR): https://www.ecfr.gov/current/title-31/section-1022.210

This answer is general information, not legal advice. Forteris is not a law firm.