AML Compliance Basics for Money Services Businesses

If you run a money services business (MSB) — check cashing, currency exchange, money transmission, prepaid access, or any combination of these — anti-money-laundering (AML) compliance isn't optional. It's a core operating requirement, and getting it wrong carries real consequences: fines, loss of banking relationships, and in serious cases, loss of your license to operate.

Here's what actually matters, in plain terms.

The four things regulators expect from every MSB

1. A written AML program. Not a policy you downloaded once and filed away — a program that reflects how your business actually operates, gets reviewed regularly, and has a named person responsible for it (your BSA/AML Compliance Officer).

2. Customer due diligence (CDD). Before you do business with someone, you need to know who they are. For most transactions this means basic identity verification; for higher-risk customers or larger transactions, it means enhanced due diligence — understanding the source of funds, the purpose of the relationship, and ongoing monitoring.

3. Ongoing transaction monitoring. A customer's risk profile isn't static. Someone who opens an account for modest personal transfers and then starts moving large sums to high-risk jurisdictions is a pattern your program needs to catch — ideally before a regulator or law enforcement flags it for you.

4. Timely, accurate reporting. Suspicious Activity Reports (SARs) in the US, Suspicious Transaction Reports (STRs) in Canada and elsewhere — whatever your jurisdiction calls them, the expectation is the same: when something looks wrong, you report it, and you don't sit on it.

Where MSBs most often fall short

It's rarely one dramatic failure. It's usually a slow accumulation of small gaps:

• Risk assessments that were done once at onboarding and never revisited
• Alerts that get generated but not consistently reviewed or resolved
• A compliance officer who's also doing three other jobs and can't keep pace with transaction volume
• No clear, auditable trail showing why a decision was made on a given case — which becomes a real problem the moment a regulator asks

What "good" looks like

A mature AML program isn't defined by having the most tools — it's defined by having a clear, defensible, and consistently-applied process: risk is assessed with a documented methodology, reassessment happens on a real trigger rather than an arbitrary calendar, alerts are worked through to a resolution with a note attached, and everything is reconstructable after the fact.

That reconstructability is the part that gets underestimated. When a regulator examines your program, they're not just asking "did you catch the bad actor" — they're asking "can you show me the process that would have caught them, applied consistently, every time."

This article is general information, not legal advice. AML/BSA requirements vary by jurisdiction and license type — consult your compliance counsel for guidance specific to your business.