USA PATRIOT ACT – 25 YEARS LATER – PART 3
The USA PATRIOT Act (Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism) Act of 2001 was signed into law on October 26, 2001 by President George W. Bush following the 9/11 attacks.
October 26, 2026 will mark the 25th anniversary since its passage. Our six-part series examines the impact on US financial regulation and advances in technology.
Part 3 – Money Services Businesses (MSBs): From Traditional Remittance Services to Foundational Regulated Path for FinTech Companies
The MSB Evolution Beyond Banks
Money services businesses (MSBs) traditionally served the un-banked and operated through an in-person agent-based model. While the MSB registration process went into effect in 1999, the USA PATRIOT Act expanded anti-money laundering (AML) program requirements to MSBs. Fast forward to 2026, the growth in MSB registrations and the diversification of their services demonstrate that MSBs are no longer primarily cash or agent-based models. Rather, they are app and platform-driven financial technology companies with a global presence, offer multiple financial services to consumers and businesses, and are leading the acceleration into a digital financial marketplace.
Fintech MSBs Break the Traditional Mold
The steady increase in MSB registrations with the Financial Crimes Enforcement Network (FinCEN) across jurisdictions signals more than regulatory expansion, rather it reflects normalization. MSBs are no longer fringe actors or compliance headaches. They are legitimate businesses, financial needle movers, serving unique transactional needs that banks may not offer, and are application or platform-first with minimal to no physical customer presence. The MSBs serve unique roles: digital wallets, stored value, domestic and international payments, foreign exchange, and crypto exchanges. Because of this, they have their own operational models, risk profiles, governance frameworks, and various regulators and supporting bank partners.
The events in the MSB space point toward reflection on both market demand and regulatory confidence [or risk]. This signals that MSBs are not peripheral but integral to the financial ecosystem. The future hinges on frameworks that recognize MSBs as distinct from banks such as tailoring compliance obligations to their transactional models while safeguarding against misuse. MSBs are poised to expand their role in financial inclusion, digital payments, and cross‑border remittances, not as shadows of banks, but as normalized enterprises with their own regulatory identities.
MSBs Mean Business: Charting the Course

Agent Model Evolution: Counters under Scrutiny
The foundational model of MSBs began with agent-based counters, with physical kiosks serving as the primary trail for cash in-and-out transactions. The evolution is best represented as a shift from dominant physical counters to a secondary but still critical role, shaped by enforcement actions that exposed systemic compliance gaps between 2001 and 2015.

De-Risking and its Multi-Decade Waves
De-risking has unfolded in waves and did not happen in a single moment. What started with 2005 OCC Guidance, OCC Bulletin 2005‑19a, as a call for banks to embrace a risk-based approach instead of cutting off entire categories of customers soon swelled into a global tide of account closures by 2014, driven by multi-million-dollar penalties and reputational fears. Legitimate remittance providers, charities, and foreign banks found themselves pushed to the margins, even as regulators warned that wholesale exits undermined transparency and inclusion.
Today, the Department of the Treasury’s strategy acknowledges that de‑risking persists but reframes the challenge: the goal is no longer to eliminate risk by retreat, but to manage it through stronger laws, consistent supervision, and modern tools like digital identity. In this way, the present strategy seeks to balance compliance integrity with financial access keeping MSBs, non-profit organizations, and foreign respondent banks inside the regulated system while protecting against illicit finance.

The 3-C Continuum: Counters, Cloud, Code
Long before the rise of smartphone apps and digital wallets, MSBs were defined by a structure rooted in eras of aggressive regulatory crackdowns. Now, we can map MSBs into a continuum of three (3) C’s: Counters, Cloud, and Code.
Counters: Before the USA PATRIOT Act, transactional paths were entirely physical and manual; a customer walked into a brick-and-mortar kiosk with cash, filed a paper remittance slip, paid a counter fee, and walked away with a printed money order. This agent‑based network faced increasing compliance scrutiny as enforcement actions exposed systemic gaps. The resulting regulatory pressure reshaped the market, especially for underserved and unbanked communities relying on cash corridors. While physical counters remain part of the ecosystem, their role has shifted from primary to secondary, serving as support channels within broader digital frameworks.
Cloud: As technology pivots, physical operations migrated upward into cloud-hosted digital screens and online wallets. Transactions shifted to mobile apps funded by linked debit cards or peer-to-peer bank transfers, radically streamlining the consumer interface. Compliance migrated from paper ledgers to digital architecture. Mobile apps, online wallets, and centralized payment application programming interfaces (APIs) replaced storefront agents. The MSB model evolved from physical distribution to cloud‑based transaction orchestration, embedding AML controls directly into software. What began as a regulatory correction became a technological transformation, turning compliance into a design principle.
Code: Today, the ecosystem has matured into fully automated software code, embedded finance APIs, and blockchain-based delivery rails. Yet, this digital shift conceals a lingering architecture: even though modern users interact with clean digital dashboards, the underlying engine remains a complex hybrid network where millions of transactions still rely fundamentally on commercial banking partners to clear and settle the cash reserves moving behind the code. Thus, 25 years later, access to banking partners still remains critical to the business continuity of an MSB.
MSB Journey from Kiosks to Virtual Currency
The definition and scope of MSBs has undergone a dramatic transformation in the last two decades, evolving from traditional cash-based intermediaries into digitally integrated financial platforms. The definition of “money transmission” was amended from stored value to prepaid access, which pulled prepaid instruments into AML oversight.
Shortly thereafter, FinCEN issued its March 18, 2013 Guidance on the Application of FinCEN’s Regulations to Persons Administering, Exchanging, or Using Virtual Currencies. Essentially, this brought an early nascent industry of virtual currency into the BSA’s MSB framework falling under money transmission.

Five vs. Four: The AML Asymmetry Between Banks and MSBs
Under the USA PATRIOT Act, banks and MSBs were treated the same on customer identification requirements. At the time, MSBs were considered fragmented, smaller operations. Notably, when FinCEN put forth and later finalized the Customer Due Diligence Rule (CDD Rule), MSBs were not classified as a covered institution. Now, with technology companies shaping finance and using the MSB regulatory path, customer identification requirements do not fall under Section 326 of the USA PATRIOT Act, rather remain limited as part of complying with Travel Rule requirements.
Banks operate under a five‑pillar AML framework that evolved from the USA PATRIOT Act and FinCEN’s implementing regulations. AML programs must include internal controls, a designated compliance officer, ongoing employee training, independent testing, and, since May 11, 2018, customer due diligence. This addition formalized the expectation that banks identify and verify customers at onboarding, understand the nature and purpose of customer relationships, and determine the beneficial ownership of legal entities. The CDD Rule transformed AML compliance from a transactional safeguard into a continuous relationship‑based obligation.
MSBs, while also required to maintain AML programs, operate under only four pillars: internal controls, a compliance officer, training, and independent review. They are not subject to Section 326 of the USA PATRIOT Act and thus have no statutory Customer Identification Program (“CIP”) or CDD requirement. Instead, MSBs rely on transaction‑based identification rules embedded in the BSA, mainly the Travel Rule, which mandates sender and receiver information for transfers of $3,000 or more, and the Recordkeeping Rule, which requires identification for certain instruments like money orders of $2,000 or more.
The Digital Wild West Meets MSB BSA Compliance Requirements
Virtual currency and digital tokens were considered technological sandbox outside the reach of regulatory regimes in finance. Developers believed that because their protocols did not use physical greenbacks, mint coins, or rely on traditional clearing banks, the BSA and USA PATRIOT Act did not apply. They were viewed as open-source software, not financial institutions. This was shattered on March 18, 2013.
The Application of FinCEN’s Regulations to Persons Administering, Exchanging, or Using Virtual Currencies (FinCEN Guidance 2013-G001) was issued refusing technological vocabulary to obscure financial reality. FinCEN recognized that virtual currency could easily bypass the traditional financial perimeter if left unmonitored. The guidance became the defining pivot of the technology integration era, demonstrating how an agency could use an old legal framework to regulate an entirely new asset class.

MSBs Continue to Maneuver State-Level Licensing
MSB regulation in the US has evolved into a layered system of federal and state oversight distinct from other regulatory regimes globally. The USA PATRIOT Act and FinCEN established nationwide coverage, ensuring AML and compliance standards apply across all US soil. These developments illustrate how federal and state regulators have been progressively closing gaps in coverage, signaling that the PATRIOT Act’s vision of comprehensive oversight has largely been realized, while states continue to innovate at the frontier of financial compliance.
Federal Baseline: The USA PATRIOT Act and the BSA established a uniform baseline. FinCEN oversight applies nationwide, ensuring AML/CTF obligations for all MSBs. Exceptions are narrowly tailored and only provide federal coverage, whereas states may take a different position.
State Convergence: By 2025, nearly every state has reinforced federal intent with its own licensing regime. Montana stands alone as the outlier. This shows how states have largely aligned with federal coverage, strengthening compliance expectations.
More Bespoke Approach: New York, California, and Louisiana have gone further, introducing virtual currency‑specific regimes. These frameworks impose unique requirements for MSBs, signaling that while federal law covers the basics, states are innovating with respect to virtual currency.
Beyond the USA PATRIOT Act: The Challenge of Full Harmonization
In 2021, the Model Money Transmission Modernization Act (MTMA), was introduced by the Conference of State Bank Supervisors (CSBS), which aims to harmonize the fragmented state licensing regime for money transmitters.
Early adopters included the state of North Dakota and Iowa in 2023. While many states have embraced the model, key jurisdictions like New York, California, and Texas continue to maintain bespoke rules, leaving MSBs to navigate a two‑tier system. As a result, MSBs, banks and fintechs, have adapted to utilizing multiple methods to execute their business models. Some regulated, some bank-backed, some relying on third-parties, creating a multi-dimensional operating model.

415.352.1060 2193 Fillmore Street, Suite 1
San Francisco, CA 94115

RISK | STRATEGY | CYBER COMPLIANCE MANAGEMENT
© 2026 Stratis Advisory LLC. All Rights Reserved.
Terms of Use | Privacy Policy









