Anti-money laundering requirements for payment processors kick in when the business qualifies as a Money Services Business under the Bank Secrecy Act. If that classification applies, you owe FinCEN a registration, a written AML program, customer identity checks, transaction monitoring, suspicious activity reports, and five years of records. If your operation fits a narrow payment processor exemption, none of the direct obligations apply — though your bank will still ask about your controls. The first question is which side of that line you sit on.
Does Your Processor Count as an MSB
The Bank Secrecy Act is the foundation of U.S. anti-money laundering law, and FinCEN administers it.1Financial Crimes Enforcement Network. The Bank Secrecy Act Under the implementing regulations, an MSB is any person doing business in the United States as a money transmitter, dealer in foreign exchange, check casher, issuer or seller of money orders or traveler’s checks, or provider or seller of prepaid access.2eCFR. 31 CFR 1010.100 – General Definitions Payment processors typically land in the money transmitter category because they accept funds from one party and move them to another.
A payment processor is excluded from the money transmitter definition only if it facilitates purchases of goods or services (or bill payments) through a clearance and settlement system that admits only BSA-regulated financial institutions, and it does so under a formal agreement with the seller or creditor receiving the funds.3Financial Crimes Enforcement Network. Application of Money Services Business Regulations to a Company Acting as an Independent Sales Organization and Payment Processor All four conditions have to be met:
- The processor facilitates a purchase or bill payment, not a standalone money transfer.
- Funds move through a clearance and settlement system that admits only BSA-regulated financial institutions.
- A written agreement governs the arrangement.
- That agreement is with the party receiving the funds (the seller or creditor), not only the payer.
A traditional card processor routing transactions between a merchant’s bank and the cardholder’s bank generally fits. Processors that disburse funds outside regulated banking channels, hold customer money in pooled accounts, or move funds between individuals rather than closing out a sale generally do not.4Financial Crimes Enforcement Network. Application of Money Services Business Regulations to a Company Acting as an Independent Sales Organization and Payment Processor Peer-to-peer platforms, crypto exchanges that convert between fiat and digital currency, and processors that pool customer funds before disbursement usually cannot claim the exemption.
Even exempt processors are not invisible to the AML system. Banks that provide accounts to payment processors carry their own BSA obligations for those relationships and routinely push AML-style requirements down by contract.5FFIEC BSA/AML InfoBase. FFIEC BSA/AML Manual – Third-Party Payment Processors Everything below assumes your processor is an MSB.
Registering With FinCEN
Every MSB (other than an agent registered through its principal, and sellers of prepaid access who are not otherwise agents) must register with FinCEN on Form 107.6eCFR. 31 CFR 1022.380 – Registration of Money Services Businesses The initial filing is due within 180 days of the business being established. Registration renews every two years, with the renewal form due by December 31 of the second calendar year before the renewal period begins.7Financial Crimes Enforcement Network. Money Services Business (MSB) Registration
Operating unregistered is a federal crime. Under 18 U.S.C. § 1960, knowingly running an unlicensed money transmitting business carries up to five years in prison, and FinCEN can add civil penalties of up to $5,000 for each day the violation continues.8Financial Crimes Enforcement Network. Enforcement Actions for Failure to Register as a Money Services Business Filing false or materially incomplete registration information counts as a failure to comply.
The Written AML Program
Once you are an MSB, you must develop and maintain a written AML program with four required elements:9eCFR. 31 CFR 1022.210 – Anti-Money Laundering Programs for Money Services Businesses
- Internal policies and controls reasonably designed to ensure BSA compliance, including procedures for verifying customer identity, filing reports, keeping records, and responding to law enforcement requests.
- A designated compliance officer responsible for day-to-day compliance, including reports, records, program updates, and staff training.
- Ongoing training for appropriate personnel on their specific responsibilities and on detecting suspicious activity.
- Independent testing to verify the program actually works.
The program has to match your actual risk. A processor handling high-volume cross-border transfers faces different exposure than one processing domestic retail payments, and a template lifted from another company will not survive an examination.
The regulation does not fix a testing schedule. Every 12 to 18 months is a common baseline, with more frequent reviews after errors, system changes, or heavy turnover.10FFIEC BSA/AML InfoBase. BSA/AML Independent Testing Testing can be done by an outside firm or by an internal team that is independent of the compliance function being reviewed.
Verifying Customers
Your program must include risk-based procedures for verifying customer identity. Providers and sellers of prepaid access have a specific statutory list — name, date of birth, address, and identification number — while other MSB categories operate under the broader risk-based standard rather than the prescriptive Customer Identification Program rules that apply to banks.9eCFR. 31 CFR 1022.210 – Anti-Money Laundering Programs for Money Services Businesses In practice, most MSB payment processors collect the same core data points banks collect and verify them with government-issued ID, database checks, or both. Higher-risk products, larger transactions, and cross-border activity warrant more rigorous verification.
Monitoring Transactions and Filing SARs
You need systems that flag unusual activity. What qualifies as unusual depends on your business, but familiar red flags include sudden volume spikes, patterns that look like someone is breaking up transactions to duck a threshold, activity involving high-risk jurisdictions, and transactions with no apparent business purpose.
The SAR Threshold and Deadline
For MSBs, a Suspicious Activity Report is required for any transaction or pattern of transactions involving $2,000 or more when you know, suspect, or have reason to suspect the funds come from illegal activity, the transaction is designed to evade BSA reporting, it serves no apparent lawful purpose, or it facilitates criminal activity. The filing deadline is 30 calendar days from the date you first detect facts that may warrant a report.11eCFR. 31 CFR 1022.320 – Reports by Money Services Businesses of Suspicious Transactions
Thirty days sounds generous until you realize the clock starts when anyone in the organization first identifies something suspicious, not when a fully packaged case reaches the compliance team. Clear internal escalation procedures are how programs meet the deadline consistently.
SAR Confidentiality
You cannot tell the customer, or anyone involved in the transaction, that a SAR has been filed or is being considered. The prohibition binds directors, officers, and employees. If someone subpoenas a SAR or otherwise demands it, decline and notify FinCEN.12Financial Crimes Enforcement Network. Disclosure Prohibited Violating this rule is one of the fastest routes to enforcement attention.
Structuring
Structuring is one of the most common suspicious patterns processors see. It happens when someone deliberately splits a transaction into smaller pieces to stay under a reporting threshold — for example, breaking a $15,000 cash transaction into two $7,500 pieces to avoid the $10,000 Currency Transaction Report line.13FFIEC BSA/AML InfoBase. Appendix G – Structuring No single transaction has to cross the threshold for the conduct to qualify. A customer running a series of $9,000 cash transactions across multiple days with no business reason for cash is exhibiting textbook structuring. Your monitoring should catch it.
Currency Transaction Reports
If your operation touches physical currency, you must file a Currency Transaction Report for any transaction or set of same-day transactions by the same person that exceeds $10,000 in cash.14Financial Crimes Enforcement Network. Notice to Customers: A CTR Reference Guide Most electronic processors do not handle cash and file CTRs rarely, if ever. When a cash transaction is both over the threshold and suspicious, a CTR and a SAR are both required; neither substitutes for the other.15Financial Crimes Enforcement Network. Frequently Asked Questions Regarding Suspicious Activity Reporting Requirements
Recordkeeping
Records required under BSA regulations must be kept for five years.16eCFR. 31 CFR 1010.430 – Nature of Records and Retention Period That covers SARs, CTRs, customer identification records, transaction records, and program documentation. For prepaid access providers, customer identification data must be retained for five years after the last use of the prepaid device or account.9eCFR. 31 CFR 1022.210 – Anti-Money Laundering Programs for Money Services Businesses Storage must allow retrieval within a reasonable timeframe; in an examination, delays are not tolerated.
State Money Transmitter Licensing
Federal MSB registration does not replace state licensing. Money transmission is regulated primarily at the state level, and most states require a separate license in each state you operate in. Federal registration covers your nationwide BSA obligations. It does not give you legal authority to transmit money in any given state.
State applications typically require a detailed business plan, financial statements, background checks for key personnel, a surety bond, and a minimum net worth. Fees, bond amounts, and net worth thresholds vary widely. Many states process applications through the Nationwide Multistate Licensing System, which reduces some friction but does not eliminate state-by-state approval. Combined federal registration and multi-state licensing is one of the most expensive parts of launching a money transmission business.
What Non-Compliance Costs
FinCEN’s penalty authority is broad. Civil penalties for willful violations can reach the greater of $25,000 or the amount involved in the transaction, up to $100,000. Negligent violations carry penalties of up to $500 per violation, and a pattern of negligent violations can reach $50,000.17Office of the Law Revision Counsel. 31 USC 5321 – Civil Penalties
Criminal exposure is steeper. A willful BSA violation carries fines up to $250,000, imprisonment up to five years, or both. If the violation is part of a pattern of illegal activity involving more than $100,000 within a 12-month period, the maximum fine doubles to $500,000 and the maximum sentence rises to ten years.18Office of the Law Revision Counsel. 31 USC 5322 – Criminal Penalties
These are not theoretical numbers. In December 2025, FinCEN assessed a $3.5 million penalty against the peer-to-peer platform Paxful for willfully failing to register as an MSB, failing to implement an effective AML program, and failing to file SARs.19Financial Crimes Enforcement Network. FinCEN Assesses $3.5 Million Penalty Against Paxful for Facilitating Suspicious Transactions Every major compliance failure showed up in the same action: no registration, no program, no reporting. That is the pattern when a company decides BSA rules do not apply to it and turns out to be wrong.