The layers
The foundation is the Bank Secrecy Act, which FinCEN, a bureau of the Treasury, implements through regulations, together with the USA PATRIOT Act amendments that added customer identification and broader program duties. Separate criminal statutes make laundering money and structuring transactions crimes in their own right, and the Anti Money Laundering Act of 2020 updated much of the framework. Banking agencies, the SEC and FINRA for securities firms, and state regulators each examine the businesses they supervise against these rules and their own. In New York, the Department of Financial Services adds requirements for transaction monitoring and sanctions filtering at the banks and money transmitters it regulates, including an annual compliance finding by the board or a senior officer. Sanctions programs run by OFAC sit alongside these rules and apply to all U.S. persons, not just financial firms.
Who is covered
Banks, broker-dealers, money services businesses, casinos, and several other kinds of financial businesses have defined duties. Whether a fintech or crypto company counts as a money transmitter depends on how funds move through its platform, and many states require their own licenses as well. Newer rules extending duties to investment advisers and to certain residential real estate transfers have been postponed or set aside in litigation, so their current status should be checked when you plan. Covered businesses generally need a written, risk-based program and must report certain cash transactions and suspicious activity. A program copied from a template rarely fits the business it is supposed to describe.
Mapping your obligations
When we first meet, we walk through the flow of funds in your business: who pays whom, who holds the money and for how long, and where it crosses borders. From that map we identify which federal rules apply directly, which obligations you take on by contract with a bank or processor, and which state licenses may be required. We review existing policies against what you actually do, because a gap between policy and practice is a frequent exam finding. If you are already under review, the order of work changes, and we start with whatever deadline the regulator or partner has set.
