Money Transmitter Compliance Requirements in 2026: The Full Yearly Cycle

A licensed money transmitter in the United States answers to two sets of rules every year. Federally, it must run a written anti-money laundering programme under the Bank Secrecy Act, file currency and suspicious activity reports, keep records and renew its FinCEN registration every two years. In each state, it must keep its net worth, surety bond and permissible investments at the required level, file quarterly MSB Call Reports and audited accounts, seek approval before a change of control and renew every licence in NMLS between 1 November and 31 December.

Most enforcement against money transmitters is not about one dramatic failure. It is about routine work done late or not at all: an independent review that was not independent, a risk assessment that no longer matches the business, a call report that does not agree with the audited accounts. This guide sets out the full yearly cycle in one place, with the rule behind each obligation and the month it falls due.

The two layers at a glance

Federal: the Bank Secrecy Act programme

Every money services business must have an anti-money laundering programme that is in writing, available to examiners and "commensurate with the risks posed by the location and size" of the business. The rule at 31 C.F.R. 1022.210 requires four elements:

1. Policies, procedures and internal controls reasonably designed to ensure compliance: customer identification, transaction monitoring, reporting, record keeping, agent oversight and sanctions screening.
2. A designated compliance person who ensures day-to-day compliance, filing of reports, record keeping, updates to the programme and training.
3. Training for staff and agents on their duties, including how to spot suspicious transactions.
4. An independent review of the programme, with scope and frequency matched to risk.

The written programme is only the start. Examiners test whether it runs: whether alerts were reviewed in time, whether high-risk customers received more scrutiny, whether agents followed the same rules as employees. A programme that describes a business the firm no longer runs, for example one written before it added a crypto product or a new corridor, is the most common finding.

Money transmitters file two main reports with FinCEN. A suspicious activity report is required for transactions of at least USD 2,000 that the firm knows or suspects involve illegal funds, are designed to evade reporting, or have no apparent lawful purpose (31 C.F.R. 1022.320). It must be filed within 30 days of initial detection. A currency transaction report is required for cash in or out of more than USD 10,000 in one business day, filed within 15 days.

Funds transfers of USD 3,000 or more carry specific record keeping and travel rule duties under 31 C.F.R. 1010.410: the firm must collect and pass on the sender and recipient details. Bank Secrecy Act records must be kept for five years (31 C.F.R. 1010.430).

Some firms carry extra duties. FinCEN's Southwest border geographic targeting order, reissued in September 2026, requires money services businesses in listed ZIP codes in Texas and New Mexico to file currency transaction reports for cash transactions between USD 1,000 and USD 10,000 (FinCEN).

A money services business registers with FinCEN on Form 107 within 180 days of being established and renews every two years by 31 December. It must re-register within 180 days if control changes in a way that requires state re-licensing, if more than 10% of voting power or equity is transferred, or if its number of agents rises by more than 50% (FinCEN). It must keep a list of its agents and the supporting documents at a location in the United States for five years. Our FinCEN MSB registration page covers the filing itself.

OFAC sanctions apply to every transfer, with no minimum amount. A money transmitter screens senders, recipients and, for cross-border payments, the countries and banks involved, and blocks or rejects payments as the rules require (OFAC). Sanctions screening sits inside the AML programme in practice, and examiners test it in the same review.

On 10 April 2026 FinCEN proposed a new rule for AML programmes across all financial institutions, including money services businesses (Federal Register). Comments closed on 9 June 2026. As at 27 October 2026 the rule is still a proposal and no final date has been set. Three points matter most for money transmitters:

Firms that already run a documented risk assessment and a genuinely independent review will need little change. Firms whose compliance lead sits outside the United States should plan for the officer location point now (FinCEN fact sheet).

State: what the licence requires all year

State requirements differ, but they are converging. The Conference of State Bank Supervisors (CSBS) wrote the Money Transmission Modernization Act (MTMA) as a common standard. By August 2026, 23 states had adopted it in full and 8 in part (CSBS). The table shows the model law's standards; check each state's version before relying on a figure.

Two of these move with the business. The bond follows transaction volume, so a firm that grows in a state may need a bond rider before its next renewal. Permissible investments must cover customer obligations every day, not only on the quarter-end date the call report shows.

The MSB Call Report is filed through NMLS within 45 days of each quarter end: 14 November, 14 February, 15 May and 14 August (Georgia DBF). It carries the firm's balance sheet, transaction volumes by state and its permissible investments. Georgia charges USD 1,000 for each late report. A late or missing report also places an item on the licence in NMLS that can block renewal.

Licences renew in NMLS between 1 November and 31 December in most states. For the 2026 window, licensees must first complete updated disclosure questions and new employment reporting before NMLS will accept a renewal request (CSBS, 21 October 2026). Our NMLS renewal guide sets out the checklist step by step.

Examinations

State regulators examine licensees on a risk-based cycle, often every one to three years. For large firms the states coordinate. Under the "One Company, One Exam" approach launched in 2020, firms licensed in 40 or more states receive one examination led by a single state, with examiners drawn from several states (CSBS). Federally, the IRS examines money services businesses for Bank Secrecy Act compliance on FinCEN's behalf (31 C.F.R. 1010.810).

Examiners ask for the same core file every time: the written programme and risk assessment, the last independent review and the firm's response, training records, a sample of alerts and reports, agent oversight files, call reports and audited accounts. In June 2026 Texas and Colorado fined a money transmitter USD 200,000 after a multistate examination found late currency transaction reports, weak oversight of agents and inadequate independent reviews, and required yearly independent reviews from then on.

The yearly cycle, month by month

The full dated list for November 2026 to December 2027 is in our money transmitter compliance calendar. In summary:

Where programmes usually fail

• The review is not independent. The person who runs the programme, or reports to the person who does, cannot review it. FinCEN's guidance is explicit on this (FinCEN).
• The risk assessment is out of date. New products, corridors and customer types arrive faster than the document is revised.
• Agents are trusted, not tested. Agent oversight files show a contract and a training certificate, but no monitoring of the agent's own transactions.
• Reports are late. Currency transaction reports filed after 15 days and suspicious activity reports filed after 30 days are among the most common findings.
• The numbers do not agree. Call report figures that cannot be reconciled to the audited accounts invite questions in every state at once.
• The bond did not grow with the business. Volumes rose in a state, the bond formula moved, and no rider was filed.

How to run the cycle without gaps

Assign every obligation in the tables above to a named owner, with a date and the evidence that proves it was done. Keep one calendar for federal and state dates, and one file per state for bonds, net worth and permissible investments. Close independent review findings before the renewal window opens, so that the renewal attestations are true when they are signed.

Firms without the people to run this in-house can use outsourced BSA programme support, an independent AML review from a team that does not run the programme, and licence maintenance for renewals, call reports and state filings.