An MSB is a regulated non-bank financial business, such as a money transmitter, currency exchanger, or check casher, that is itself subject to AML rules and registration or licensing. For a bank, MSBs are a classic higher-risk customer segment, because they pool third-party money flows.
What is an MSB, in plain English?
A Money Services Business is a regulated non-bank that provides financial services like money transmission, currency exchange, or check cashing. Crucially, an MSB is not just a bank customer; it is itself subject to AML rules and to registration or licensing requirements, so it runs its own compliance program.
From a bank's perspective, MSBs are a classic higher-risk customer segment. The reason is structural: an MSB pools money flows from many third parties the bank never sees directly. When a bank banks an MSB, it is indirectly exposed to all of that MSB's underlying customers, whose risk it can only see through the MSB's own controls.
That is why servicing an MSB calls for enhanced due diligence on the MSB's own AML program, not just standard onboarding. The bank has to understand how well the MSB screens and monitors its own customers, because those controls are effectively the bank's first line of visibility into the pooled flows.
Common types of MSB
Type | What they do and why it is higher risk |
Money transmitters | Move funds for third parties, pooling many senders and receivers the bank never sees. |
Currency exchangers | Convert cash between currencies, a classic placement channel for illicit cash. |
Check cashers | Turn instruments into cash quickly, which can obscure the origin of funds. |
Prepaid and remittance providers | Handle stored value and cross-border transfers that concentrate third-party risk. |
What it looks like in practice
In practice
A bank's risk committee gets nervous about the MSB customers on its books and proposes dropping the entire category to be safe. It feels like a clean way to cut exposure, and the operational burden of monitoring MSBs is real.
But a blanket exit pushes those flows into less-supervised channels and draws its own supervisory criticism. Instead the bank does the harder, correct thing: it assesses each MSB individually, applies enhanced due diligence to the MSB's own AML program, and keeps the well-controlled ones while exiting only the genuinely unmanageable. It judges the specific business, not the label on the industry.
Why de-risking is the wrong reflex
The known pitfall with MSBs is blanket de-risking: dropping the entire category to avoid the compliance work. It is tempting because the enhanced due diligence is genuinely more effort, but supervisors expect a risk-based look at the individual MSB rather than a wholesale exit. Judge the specific business in front of you, not the label on the industry.
There are two problems with de-risking a whole segment. First, it does not remove the risk from the system; it just pushes legitimate MSB flows into channels with less oversight, which is worse for everyone. Second, it draws its own regulatory criticism, because indiscriminately cutting off a lawful, needed sector runs against the supervisory expectation of a risk-based approach. The right answer is to do the enhanced due diligence, keep the MSBs you can manage, and exit only the ones whose specific risk you genuinely cannot.
What to watch for
- Weak MSB program. An MSB that cannot evidence real screening and monitoring is importing all its pooled risk into your bank.
- Blanket de-risking. Exiting the whole category to dodge the work is a supervisory red flag, not a safe default.
- Unregistered operator. An MSB that is not properly registered or licensed is a serious problem before you even reach its controls.
- Opaque underlying flows. If you cannot understand the MSB's customer base and typical flows, you cannot assess the risk you are taking on.
- Nested relationships. An MSB serving other MSBs multiplies the layers of third-party risk you cannot see directly.
Quick questions
What businesses count as MSBs?
Regulated non-banks like money transmitters, currency exchangers, and check cashers, along with prepaid and remittance providers. The common thread is that they provide financial services and are themselves subject to AML rules and registration.
Why are MSBs considered higher risk?
Because they pool money flows from many third parties a bank never sees directly. Banking an MSB means indirect exposure to all of its underlying customers, visible only through the MSB's own controls.
What is enhanced due diligence for an MSB?
Going beyond standard onboarding to assess the MSB's own AML program: how it registers, screens, monitors, and reports. Those controls are effectively the bank's first line of sight into the pooled flows.
Why is de-risking a whole MSB category discouraged?
Because it pushes legitimate flows into less-supervised channels and draws supervisory criticism. Regulators expect a risk-based look at the individual MSB, not a wholesale exit from the sector.
Is an MSB regulated itself, or just the bank?
Both. The MSB is a regulated entity with its own AML obligations and registration or licensing, and the bank that services it carries its own duty to conduct enhanced due diligence on the relationship.
Can a bank keep any MSB customers safely?
Yes. A well-controlled MSB with a demonstrable AML program can be a manageable, legitimate customer. The point is to judge each one on its specific risk rather than exiting the whole segment.
Go deeper
- FFIEC BSA/AML Examination Manual ↗ — The manual US examiners use to assess BSA and AML programs.
- FATF ↗ — The global standard-setter for AML, counter-terrorist-financing, and counter-proliferation. Recommendations, guidance, and jurisdiction lists.