FORTERIS.Risk & Compliance Group
Client sign-in Free MSB check
Guides › Program

What must an MSB AML program contain?

Checked against the cited sources: October 2026

Every money services business (MSB) must keep a written anti-money laundering (AML) program. At a minimum it must have four parts: policies, procedures and internal controls; a person who runs day-to-day compliance; training; and an independent review (31 CFR 1022.210). The program must fit your own risks, and a new MSB must have it in place within 90 days after the date it is established.

Who needs a program

The rule covers each MSB "as defined by § 1010.100(ff)". That definition includes dealers in foreign exchange, check cashers, issuers and sellers of traveler's checks or money orders, providers and sellers of prepaid access, money transmitters and the U.S. Postal Service. It sets thresholds and exclusions for these categories.

Registration with FinCEN (the Financial Crimes Enforcement Network, the Treasury bureau that administers the Bank Secrecy Act, or BSA) has exceptions, for example for a business that is an MSB only as another MSB's agent. The program rule has no such exception: an agent, or a seller of prepaid access, that meets the MSB definition (for a seller, the conditions in 31 CFR 1010.100(ff)(7)) needs a program too.

Whether your business is an MSB turns on what you do, for whom, and in what amounts.

The baseline

  • Effective. The program must be "reasonably designed to prevent the money services business from being used to facilitate money laundering and the financing of terrorist activities" (§ 1022.210(a)).
  • Risk-based. It must be "commensurate with the risks posed by the location and size of, and the nature and volume of the financial services provided by" the MSB (§ 1022.210(b)).
  • Written. It must be in writing. You must make copies available to the Treasury Department on request (§ 1022.210(c)).

The rule also requires four minimum parts, covered below: policies, procedures and internal controls; a designated compliance person; training; and independent review (§ 1022.210(d)(1)-(4)).

FinCEN says MSBs are examined for BSA compliance by the IRS "under a delegation of authority by FinCEN" (91 FR 18588; 31 CFR 1010.810(b)(8)).

A new MSB must develop and implement its program by the end of the 90-day period beginning on the day after "the date the business is established" (§ 1022.210(e)). The rule does not define "established," so have the program working before you start MSB activity.

Part 1: Policies, procedures and internal controls

Your policies, procedures and internal controls must be reasonably designed to assure compliance with FinCEN's rules in 31 CFR chapter X (§ 1022.210(d)(1)). To the extent they apply to you, they must cover:

  • verifying customer identification;
  • filing reports, such as suspicious activity reports (SARs) and currency transaction reports on cash transactions of more than $10,000;
  • creating and retaining records; and
  • responding to law enforcement requests.

There is no separate customer identification program (CIP) rule for MSBs. Your identification duties come from specific rules, including identity checks for certain funds transfers of $3,000 or more (31 CFR 1010.410(e)), for cash transactions that must be reported (31 CFR 1010.312), and for cash sales of money orders, traveler's checks and similar instruments of $3,000 to $10,000 (31 CFR 1010.415). Providers and sellers of prepaid access have their own identification and five-year retention rules (§ 1022.210(d)(1)(iv)).

Agents. A business that is an MSB only because it acts as another MSB's agent may agree with that MSB on who develops the policies and controls. But each MSB "shall remain solely responsible for implementation" (§ 1022.210(d)(1)(iii)). FinCEN guidance says a principal's program is required to include risk-based, ongoing monitoring of its agents. At a minimum, it says, principals must identify the owners of their agents, evaluate agents' operations on an ongoing basis, and evaluate how agents carry out their policies, procedures and controls (FIN-2016-G001).

Part 2: A designated compliance person

You must "designate a person to assure day to day compliance with the program and this chapter." That person's duties include making sure that:

  • reports are filed, and records created and kept, as required;
  • the program is updated for current rules and Treasury guidance; and
  • appropriate training and education are provided.

The statute adds that the duty to establish, maintain and enforce the program "shall remain the responsibility of, and be performed by, persons in the United States who are accessible to, and subject to oversight and supervision by, the Secretary of the Treasury and the appropriate Federal functional regulator" (31 U.S.C. 5318(h)(5)). The current MSB rule (§ 1022.210) says nothing about where compliance staff must be located.

FinCEN's April 2026 proposal on anti-money laundering and countering the financing of terrorism (AML/CFT) programs would require the designated individual to be located in the United States. FinCEN said that, as proposed, "personnel located outside of the United States would still be permitted to perform certain AML/CFT functions" (91 FR 18720).

Part 3: Training

You must train appropriate personnel on their duties under the program. That includes training in detecting suspicious transactions, to the extent you must report them (§ 1022.210(d)(3)). The rule does not set a frequency. The statute calls for "an ongoing employee training program" (31 U.S.C. 5318(h)(1)(C)).

Part 4: Independent review

The program must provide for an independent review "to monitor and maintain an adequate program." Its scope and frequency must be commensurate with the risk of your financial services, so the rule sets no fixed interval. An officer or employee may do the review, as long as that person is not your designated compliance person (§ 1022.210(d)(4)).

What today's MSB rule does not say

  • No beneficial ownership rule. FinCEN's rule on the beneficial owners of legal entity customers (31 CFR 1010.230) applies to "covered financial institutions": banks, broker-dealers, futures commission merchants, introducing brokers in commodities, and mutual funds. MSBs are not on that list.
  • No named approver. The current rule does not say who must approve the program.
  • No named risk assessment. The current rule does not use the term "risk assessment," though it ties the program to your risks.

Treasury's Office of Foreign Assets Control (OFAC) says "All U.S. persons must comply with OFAC sanctions."

What may change

On April 10, 2026, FinCEN proposed to "fundamentally reform" AML program rules, including the MSB rule (91 FR 18704). As proposed, an MSB would have to:

  • identify, assess and document its risks through "risk assessment processes," and review and, as appropriate, incorporate the AML/CFT priorities that Treasury publishes;
  • designate an individual who is located in the United States; and
  • have the written program approved by its board, an equivalent governing body, or appropriate senior management.

FinCEN proposed that a final rule take effect 12 months after it is issued. As of October 22, 2026, no final rule had been published, so the current § 1022.210 still applies.

Stablecoin issuers

In a joint April 2026 proposal, FinCEN and OFAC wrote that stablecoin issuers "generally are subject to BSA obligations as financial institutions, specifically money transmitters, which are a type of MSB" (91 FR 18588). Issuers that are MSBs need the program this guide describes: written, risk-based, and with policies, procedures and internal controls, a designated compliance person, training, and independent review (31 CFR 1022.210). The same proposal (91 FR 18582) would set AML program requirements for permitted payment stablecoin issuers under the GENIUS Act, the federal stablecoin law of July 2025 (Pub. L. 119-27). On October 22, 2026, Federal Register records still showed it as a proposal.

State rules

State money transmission laws can add their own requirements, which vary by state. For example, the model Money Transmission Modernization Act of the Conference of State Bank Supervisors (CSBS) lets the state regulator examine licensees to enforce other applicable law, "including the Bank Secrecy Act and the USA PATRIOT ACT." A model act applies only where, and as, a state adopts it.

Next steps

  1. Get a first read on whether you are an MSB, and which kind, with the free MSB check.
  2. Map each of the four parts to written procedures that match your products, customers, locations and volumes.
  3. Check who does your compliance work and where. The statute already says the program duty must be performed by persons in the United States (31 U.S.C. 5318(h)(5)), and the April 2026 proposal would require a U.S.-located designated individual (91 FR 18755).

Discuss with Forteris. For a second look at your program, email [email protected].

This guide is general information, not legal advice. Forteris is not a law firm.

Last checked: October 2026

Sources

  1. 31 CFR 1022.210, AML programs for MSBs: https://www.ecfr.gov/current/title-31/section-1022.210
  2. 31 CFR 1010.100(e) and (ff), BSA and MSB definitions: https://www.ecfr.gov/current/title-31/section-1010.100
  3. 31 CFR 1022.380, MSB registration: https://www.ecfr.gov/current/title-31/section-1022.380
  4. 31 U.S.C. 5318(h): https://www.law.cornell.edu/uscode/text/31/5318
  5. 31 U.S.C. 310, FinCEN: https://www.law.cornell.edu/uscode/text/31/310
  6. 31 CFR 1010.311, 1010.312, 1010.410, 1010.415, 1010.810: https://www.ecfr.gov/current/title-31/subtitle-B/chapter-X/part-1010
  7. 31 CFR 1022.320, MSB SAR rule: https://www.ecfr.gov/current/title-31/section-1022.320
  8. 31 CFR 1010.230 and 1010.605(e)(1): https://www.ecfr.gov/current/title-31/section-1010.230
  9. FinCEN, FIN-2016-G001 (Mar. 11, 2016): https://www.fincen.gov/system/files/2023-07/FIN-2016-G001.pdf
  10. FinCEN, proposed rule, 91 FR 18704 (Apr. 10, 2026): https://www.federalregister.gov/documents/2026/04/10/2026-07033/anti-money-laundering-and-countering-the-financing-of-terrorism-programs
  11. FinCEN and OFAC, proposed rule, 91 FR 18582 (Apr. 10, 2026): https://www.federalregister.gov/documents/2026/04/10/2026-06963/permitted-payment-stablecoin-issuer-anti-money-launderingcountering-the-financing-of-terrorism
  12. GENIUS Act, Pub. L. 119-27 (July 18, 2025): https://www.congress.gov/119/plaws/publ27/PLAW-119publ27.htm
  13. OFAC, FAQ 11: https://ofac.treasury.gov/faqs/topic/1501
  14. CSBS, Model Money Transmission Modernization Act: https://www.csbs.org/sites/default/files/2023-08/CSBS%20Money%20Transmission%20Modernization%20Act.pdf
  15. CSBS, About CSBS: https://www.csbs.org/about
  16. Federal Register API, record for 91 FR 18704: https://www.federalregister.gov/api/v1/documents/2026-07033.json
  17. Federal Register API, FinCEN documents since April 1, 2026: https://www.federalregister.gov/api/v1/documents.json?conditions[agencies][]=financial-crimes-enforcement-network&conditions[publication_date][gte]=2026-04-01&per_page=100&order=newest&fields[]=document_number&fields[]=citation&fields[]=type&fields[]=title&fields[]=publication_date
  18. eCFR versioner API, title 31 status and part 1022 history: https://www.ecfr.gov/api/versioner/v1/titles.json and https://www.ecfr.gov/api/versioner/v1/versions/title-31.json?part=1022

Short answers

What must an MSB AML program include at a minimum?

Under 31 CFR 1022.210(d), an MSB's AML program must at a minimum include policies, procedures and internal controls reasonably designed to assure compliance with FinCEN's rules, a person designated to assure day-to-day compliance, education and/or training of appropriate personnel, and an independent review. The program must be in writing and commensurate with the risks posed by the MSB's location, size, and the nature and volume of its financial services. Whether a business is an MSB at all is a separate question that turns on its facts.

Can an MSB's own employee do the independent review of its AML program?

Yes, under the current rule an officer or employee of the MSB may conduct the independent review, as long as that person is not the individual designated to assure day-to-day compliance. The scope and frequency of the review must be commensurate with the risk of the MSB's financial services, so the rule sets no fixed interval (31 CFR 1022.210(d)(4)).

Is FinCEN changing the AML program rule for MSBs?

FinCEN proposed on April 10, 2026 to fundamentally reform AML program rules, including the MSB rule at 31 CFR 1022.210 (91 FR 18704). As proposed, an MSB would, among other things, have to identify, assess and document its risks through risk assessment processes; designate a compliance individual located in the United States (while staff outside the United States could still perform certain AML/CFT functions); provide for independent program testing and an ongoing employee training program; and have the written program approved by its board, an equivalent governing body or appropriate senior management. FinCEN proposed that a final rule take effect 12 months after issuance. Federal Register records checked on October 22, 2026 showed no final rule, so the current § 1022.210 still applies. Separately, the statute already says the program duty must be performed by persons in the United States who are accessible to, and subject to oversight and supervision by, the Secretary of the Treasury and the appropriate Federal functional regulator (31 U.S.C. 5318(h)(5)).

General information, not legal advice. Checked against the cited primary sources in October 2026.