Money Transmitter Licensing in the US: FinCEN Registration, State Licences and the Evidence Examiners Ask For

A US money transfer business answers to two layers of regulation. Federally, it registers with FinCEN as a money services business and runs a Bank Secrecy Act (BSA) anti-money laundering programme. At state level, it needs a money transmitter licence in each state where it serves customers, with its own bond, net worth and examination regime. Registration is quick. Licensing is the long part, and the order you choose shapes your first two years.

This guide is for founders, compliance officers and operations leads planning a US launch. It covers FinCEN registration, a state licensing strategy, the BSA/AML programme, OFAC compliance, and the technology evidence state examiners ask for. We show where RemitSo helps and where the work stays with your team. Requirements differ by state and change often; confirm them with each regulator or a US licensing adviser.

• FinCEN registration makes you a registered money services business (MSB) and brings you under the BSA. It is a registration, not a licence: it does not by itself permit you to transmit money anywhere.
• State money transmitter licences permit you to serve customers in each state. Almost every state licenses money transmission, each with its own regulator, application, bond, net worth and reporting rules.
• OFAC sanctions apply to every US person and business, licensed or not.

In general, the licence you need follows where your customer is, not where your office is. A business in one state serving customers in five needs to be licensed, or covered by an exemption or a partner's licence, in all five.

An MSB must register with FinCEN within 180 days of the date it is established, filing electronically through BSA E-Filing. After that:

• Renew every two years, and re-register within 180 days of certain changes: a change of ownership or control that requires re-registration under state law, a transfer of more than 10 percent of voting power or equity, or an increase of more than 50 percent in the number of agents during a registration period.
• Keep an agent list if you use agents, revised each 1 January and available to examiners.
• Keep a copy of your registration and supporting records in the United States for five years.

Registering is also the trigger for the BSA programme described below. Banks will ask for your registration and your AML programme before opening an account; see our guide to business bank accounts for US money transfer companies.

Most states take applications through the Nationwide Multistate Licensing System (NMLS), which holds your company record, control persons, licences and ongoing filings in one place. Each state still decides its own application. Expect to provide:

• Business plan and financial projections, including expected transfers by state.
• Audited financial statements and evidence of the net worth the state requires.
• A surety bond, usually sized by your expected activity in that state.
• Background checks, including fingerprints, on owners, directors and senior managers.
• Your BSA/AML, OFAC and information security policies, and your risk assessment.
• A description of your technology, your providers, and how customer money flows.

Once licensed, you will typically hold permissible investments at least equal to your outstanding customer obligations, file regular reports through NMLS (including MSB call reports), renew annually and seek approval before a change of control. The Conference of State Bank Supervisors reports that 31 states had enacted its Money Transmission Modernization Act in full or in part as of September 2026. The model law sets common standards for net worth, surety bonds and permissible investments; check whether, and how fully, your target states have adopted it.

To pick your first states, rank them on four things:

1. Where your customers are. Diaspora communities are concentrated; a handful of states may cover most of your market.
2. How demanding the state is. Some large states, New York and California among them, are widely regarded as among the most demanding to license in. They may be worth it, but rarely as your first application.
3. What it costs to hold. Bond, net worth and ongoing reporting in each state.
4. Whether it follows the model law. Consistent rules make later applications more predictable.

Many operators combine paths: launch under a partner, apply in priority states, and move across as licences arrive. Agree in writing who holds which obligation under the partner arrangement.

Every MSB must have a written, risk-based AML programme. It rests on four pillars:

1. Policies, procedures and internal controls based on a risk assessment of your customers, corridors, products and channels.
2. A designated compliance officer with the authority and resources to run the programme.
3. Training for staff and agents, matched to their roles.
4. Independent review of the programme, by someone who does not run it.

Inside that programme sit the reports and records you must produce:

• Currency transaction reports (CTRs) for cash transactions over $10,000 in a business day, including several smaller cash transactions that add up. Mostly relevant if you or your agents take cash.
• Suspicious activity reports (SARs) filed with FinCEN when a transaction, or a pattern of transactions, involves at least $2,000 and you know or suspect it involves illicit funds, is designed to evade BSA requirements, or has no apparent lawful purpose. File within 30 days of first detecting the facts, and never tell the customer. See our guide to suspicious activity reports.
• Funds transfer records for transfers of $3,000 or more, with sender and recipient details passed along the payment chain where the rules require.
• Record retention for five years.

Watch for structuring: customers splitting payments to stay under a record-keeping or reporting threshold. Your monitoring needs to see transfers together, across days and recipients, not one at a time. See transaction monitoring rules.

OFAC sanctions prohibit dealings with people and entities on its lists, and with countries and regions under comprehensive sanctions. OFAC's framework for compliance programmes covers management commitment, risk assessment, internal controls, testing and training; examiners will expect to see each.

• Screen the SDN list and OFAC's consolidated non-SDN lists, for senders, recipients and anyone paying on a customer's behalf, at onboarding and on every transfer.
• Apply the 50 percent rule. Entities owned 50 percent or more by blocked persons are blocked too, even if they are not listed.
• Block or reject as the programme requires, and report blocked or rejected transactions to OFAC within 10 business days.
• Screen geography as well as names: identity documents, payment details and sign-in locations from sanctioned or high-risk countries.
• Keep lists current, with a record of which version you screened against and an alert if updates fail.

For list management and match review in detail, see sanctions screening for remittance companies.

State examiners, often working together on multistate licensees, test whether your programme works in practice. Much of what they request comes straight from your platform. Have it ready before the first request letter.

For a walk-through of a first exam, see your first regulatory audit.

The figures are illustrative, not drawn from any real operator.

The set-up. An operator holds licences in three states and serves only customers resident there. Its USD AML rule asks for proof of address once a customer's total passes $5,000 over 90 days, and for source of funds above $8,000. A risk rule combines linked transaction patterns with frequent transfers to the same recipient.

Monday to Wednesday. A customer sends $2,900, then $2,950, then $2,800 to the same recipient. Each is under $3,000. The second transfer takes the 90-day total past $5,000 and the customer uploads proof of address. The third passes $8,000; the app asks for source of funds, and the risk rule holds the transfer for a person.

Thursday. The customer cancels rather than provide source of funds. The analyst records the pattern and escalates. The compliance officer concludes the transfers appear designed to stay under the $3,000 record-keeping threshold, decides a SAR is required, prepares it from the case, and files it within the deadline. The customer is told only that the transfer was cancelled.

Eight months later. A state examiner samples held transfers. The operator produces the AML rule and its change history, the risk rule that fired, the analyst's notes, the SAR decision and its filing date. The examiner moves on to the next sample.

RemitSo is a white label remittance platform: customer apps in your brand and an admin panel where your team runs compliance, operations and finance. See the admin features.

• AML rules per currency, paying country and payout country: set USD rules for your corridors, with windows from every transaction to one year, document tiers as totals grow, and a history of who changed each rule.
• 46 risk indicators, including linked transaction patterns, frequent transfers to the same recipient and high-risk countries, combined into your own rules: risky transfers wait for a person.
• Screening against 8 lists, including OFAC SDN and OFAC consolidated non-SDN, loaded every night with version and load history, re-screening the people a change could affect, decisions recorded per match, and a "Sanction lists out of date" alert.
• Suspicious activity reports generated, managed and submitted from the console, so the case, the decision and the transactions sit together.
• ID check and selfie inside the first transfer, with documents approved or rejected and the reason kept: customer files examiners can sample.
• Double-entry accounting with a chart of accounts and journals, and deposits matched to the declared amount: the balances behind your outstanding obligations.
• 89 permissions, two-step sign-in, login sessions, and staff training by department (an optional add-on) signed off by someone else: governance evidence on request.
• ISO 27001:2022 and ISO 9001:2015 certification, a software bill of materials, and your own AWS account in your region: answers for the information security section of your applications.

Your team still holds the licences and bonds, writes the programme, files SARs and CTRs, submits NMLS reports, arranges the independent review and deals with examiners. RemitSo does not generate US regulator reports for you.

See getting started or book a demo.

• 31 CFR 1022.380: Registration of money services businesses
• FinCEN: Money Services Business (MSB) Registration
• 31 CFR 1022.210: Anti-money laundering programs for money services businesses
• 31 CFR 1022.320: Reports by money services businesses of suspicious transactions
• 31 CFR 1010.311: Filing obligations for reports of transactions in currency and 31 CFR 1010.313: Aggregation
• 31 CFR 1010.410: Records to be made and retained by financial institutions (funds transfers of $3,000 or more)
• 31 CFR 1010.430: Nature of records and retention period
• 31 CFR 501.603: Reports of blocked property and 31 CFR 501.604: Reports of rejected transactions
• CSBS: Money Transmission Modernization Act (MTMA)
• NMLS: Money Services Businesses (MSB) Call Report

Checked October 2026. Regulations change; confirm current requirements with the regulator or your adviser.