US Money Services Businesses: AML Program Rule 31 CFR 1022 Guide

In the United States, a money services business (MSB) is regulated under the Bank Secrecy Act through Part 1022 of Title 31 of the Code of Federal Regulations. The rule that matters most day to day is 31 CFR 1022.210, which requires every MSB to run a written anti-money laundering (AML) program. This guide walks through what that section says, how the $2,000 suspicious activity reporting trigger works, and how registration with FinCEN operates. If you are comparing it with the UK position, our guide to money service businesses and HMRC registration covers the UK side.

All text below comes from the regulation as reproduced by the Cornell Legal Information Institute, plus FinCEN's proposed rule in the Federal Register. The regulation text is the authority; always check the current eCFR before relying on any figure.

What 31 CFR 1022.210 requires

Section 1022.210 says each MSB, as defined in 31 CFR 1010.100(ff), must develop, implement and maintain an effective AML program. The standard for "effective" is a program reasonably designed to prevent the business being used to facilitate money laundering, and it must also address terrorist financing. The program must be commensurate with the risks of the business, taking in its location, size, and the nature and volume of the financial services it offers. It must be in writing, and copies must be available to the Treasury Department on request.

The four minimum parts

• Policies, procedures and internal controls. These must be designed to ensure compliance with the Bank Secrecy Act rules in Chapter X. The section lists customer identification verification, report filing, record creation and retention, and responses to law enforcement requests. An MSB with automated data processing systems should integrate its compliance procedures into them.
• A compliance officer. The MSB must designate a person to oversee day-to-day compliance, who must make sure reports are filed and records kept properly, that the program is updated for current requirements and Treasury guidance, and that training is provided.
• Training. Appropriate staff must receive education or training on their responsibilities, including spotting suspicious transactions where the MSB must report them.
• Independent review. The MSB must provide for independent review to monitor and maintain an adequate program. Scope and frequency should match the risk of its services. An officer or employee may carry out the review, so long as that person is not the designated compliance officer.

Agents and prepaid access

Many MSBs operate through agents. The regulation allows an agent that is an MSB only because it acts for another MSB, together with its principal, to allocate by agreement who develops the internal controls. It then states that each MSB remains solely responsible for implementing the section, and the allocation does not relieve either party of the duty to maintain an effective program. In plain terms, a principal cannot hand its compliance duty to an agent and walk away.

The section also adds identity rules for prepaid access. Providers and sellers must verify the identity of people obtaining prepaid access and collect name, date of birth, address and identification number. Sellers must also verify identity for access to funds over $10,000 in a single day. Providers keep the information for five years after the last use of the device or vehicle, and sellers keep it for five years from the date of sale. Our guide to the US customer identification program for banks shows how a different sector approaches the same identity-verification idea.

Suspicious activity reports under 31 CFR 1022.320

Section 1022.320 sets the reporting duty. It applies to MSBs described in the categories listed in the section (paragraphs (1), (3), (4), (5), (6) and (7) of the 1010.100(ff) definition), and any MSB may also report voluntarily. A transaction is reportable when it is conducted or attempted by, at or through an MSB, involves or aggregates at least $2,000, and the MSB knows, suspects or has reason to suspect it falls into one of four categories:

1. It involves illegal funds, or is meant to hide them, as part of a plan to violate or evade federal law or reporting requirements.
2. It is designed, including through structuring, to evade Bank Secrecy Act requirements.
3. It has no apparent lawful purpose, and the MSB knows of no reasonable explanation after reviewing the facts.
4. It uses the MSB to facilitate criminal activity.

For issuers of money orders or traveler's checks reviewing clearance records, the figure is $5,000. A report is due no later than 30 calendar days after the MSB first detects facts that may warrant one. For urgent matters such as ongoing money laundering, the MSB must also notify law enforcement by telephone immediately. A copy of each report and its supporting documentation must be kept for five years from filing.

Confidentiality is strict. A report, and any information revealing that it exists, may not be disclosed by the MSB or its staff, apart from the permitted sharing the section lists, such as with FinCEN, law enforcement or regulators, or within the corporate structure for Bank Secrecy Act purposes. For the equivalent rule in the UK, see our guide to suspicious activity reports and tipping off.

Registration under 31 CFR 1022.380

MSBs must register with FinCEN. A new business must file its initial registration form within 180 days after the day following the date it is established. Registration runs in two-calendar-year periods, and renewal is due by the last day of the calendar year before each renewal period begins. The regulation also lists events that trigger re-registration within 180 days, including a transfer of more than 10 percent of voting power or equity interests and an increase of more than 50 percent in the number of agents during a registration period.

The section requires a list of agents, revised each January 1 for the preceding 12 months. It is not filed with the registration form; it is kept at the US location reported on the form and given to FinCEN and law enforcement on request. Exemptions include the US Postal Service, federal and state agencies, and persons who are MSBs only because they act as agents of another MSB. The regulation states a civil penalty of $5,000 per violation for failing to register, with each day of a continuing violation counted separately.

FinCEN's 2026 proposal for program rules

On 10 April 2026 FinCEN published a proposed rule titled "Anti-Money Laundering and Countering the Financing of Terrorism Programs" in the Federal Register (91 FR 18704). The Federal Register page lists eleven institution types, and Part 1022 for MSBs is among the parts it would amend. The proposal would require a risk-based program with risk assessment processes, ongoing training and independent testing, and an AML/CFT officer located in the United States. The comment period closed on 9 June 2026. A BDO regulatory tracker current to August 2026 reported that no final rule had been issued and that FinCEN had not announced a date for finalising it. This is a proposal, not law, so section 1022.210 as described above is still the rule to follow.

Practical steps

These are our suggestions, not legal requirements, and they do not replace advice from a US-qualified lawyer.

• Map each of the four program parts in section 1022.210 to a named owner and a document, so an examiner can see all four quickly.
• Keep the $2,000 trigger and the 30-day clock visible in your case management process, with the date of first detection recorded.
• If you use agents, write down who does what, but keep your own oversight of how they apply the controls.
• Put the registration renewal year and the January agent list refresh in your compliance calendar.
• Make sure the independent reviewer is not your compliance officer.

For ongoing professional development in this area, see the Learnsignal CPD courses.

What we could not confirm

We did not reproduce the list of MSB categories in 31 CFR 1010.100(ff), so check that definition to see which of your activities make you an MSB. We did not read the currency transaction reporting sections (1022.310 to 1022.315) in full, so this guide does not state their thresholds. We also did not verify whether the $5,000 civil penalty in section 1022.380 has since been adjusted for inflation. The proposed program rule's effective date and final wording could not be confirmed from the primary text we reviewed.

Frequently asked questions

Does the $2,000 SAR threshold apply to every MSB?

The $2,000 figure applies to the MSB types covered by section 1022.320. Issuers of money orders or traveler's checks reviewing clearance records use $5,000.

Can an agent be responsible for the program instead of its principal?

They can allocate who develops the controls by agreement, but the regulation says each MSB remains solely responsible for implementing the section.

How often must an MSB renew its registration?

Registration runs in two-calendar-year periods, with renewal due by the last day of the calendar year before each new period begins.

Is the 2026 program proposal in force?

No. It was a proposed rule when we checked, so the current Part 1022 text still applies.

Learnsignal publishes this guide for general education only. It is not legal advice.