Money Transmitter License Application Checklist

1

License perimeter and filing strategy

Which licenses you need, in which states, and which exemptions you can rely on.

15

2

Entity, ownership, and governance

Who owns, controls and manages the applicant — traced to natural persons.

28

3

NMLS and state submission package

The NMLS forms, state supplements and controls that keep the filing consistent.

11

4

Business plan and commercial model

What you sell, to whom, where, at what volume and price.

15

5

Flow of funds, transaction set, and settlement

Exactly how each transaction, dollar and record moves, including failures.

24

6

Financial condition, liquidity, and bonding

Capital, liquidity, permissible investments and surety bonding.

20

7

Banking, partners, and outsourced operations

The banks, processors and vendors you rely on, and how you oversee them.

16

8

BSA/AML and financial-crime program

The Bank Secrecy Act program: KYC, monitoring, SARs, CTRs and review.

26

9

Sanctions, fraud, and consumer protection

Sanctions, fraud controls and the disclosures consumers are owed.

19

10

Authorized agents, branches, and distribution

Authorized delegates, branches and partners who act under your license.

13

11

Technology architecture and cybersecurity

Systems, data protection and the security frameworks that may apply.

30

12

Business continuity, incident response, and resilience

Keeping the service running, and who you notify when it is not.

13

13

People, training, and internal controls

Staff, training, segregation of duties and internal audit.

13

14

Conditional product and corridor modules

Extra controls for cash, FX, wallets, cards, ACH, crypto and other products.

14

15

Approval, launch, and continuing supervision

What has to be true at launch, and every year after approval.

15

1.01

Activity classification

Determine exactly which activities involve receiving money or monetary value for transmission.

1.02

Product-by-product legal analysis

Analyze each product separately, including transfers, bill pay, stored value, wallets, FX, and virtual currency.

1.03

State-by-state licensing matrix

Map the activity, customer location, statutory definition, exemption, and applicable license type in every target jurisdiction.

1.04

Consumer versus business-use analysis

Test whether a state's coverage changes when transfers are solely for commercial purposes.

1.05

Sender and recipient location analysis

Identify which state has a licensing nexus at initiation, receipt, transmission, or payout.

1.06

Exemption analysis

Document any claimed agent-of-payee, payment processor, bank agent, closed-loop, or other exemption with its conditions.

1.07

Authorized-delegate alternative analysis

Determine whether operating under an existing licensee is legally and commercially viable.

1.08

Federal MSB classification

Determine FinCEN registration and Bank Secrecy Act obligations separately from state licensing.

1.09

Virtual currency classification

Assess custody, exchange, transfer, issuance, redemption, and state-specific digital asset rules separately.

1.10

International legal perimeter

Identify foreign licensing or local payout constraints when serving cross-border corridors.

1.11

Pre-filing regulator engagement

Arrange meetings or interpretive discussions where the target regulator invites or expects them.

1.12

State rollout schedule

Sequence filings according to readiness, banking, capital, bond capacity, and review time.

1.13

Application budget

Forecast state fees, NMLS charges, bonding premiums, audits, legal work, staff, and ongoing supervision.

1.14

Regulatory counsel memorandum

Preserve the reasoning behind license, exemption, and product perimeter decisions.

1.15

Prior-activity remediation analysis

Disclose and address any potential unlicensed operations or historical regulatory issues.

2.01

Applicant entity selection

Identify the exact legal entity that will receive funds, contract with customers, and hold each license.

2.02

Certificate or articles of formation

Provide certified formation records and amendments.

2.03

Operating agreement, bylaws, or partnership agreement

Show how the applicant is governed and controlled.

2.04

Certificate of good standing

Demonstrate current standing in the formation jurisdiction.

2.05

Foreign qualification

Register to do business in additional states where required.

2.06

Registered agent details

Match official state records and NMLS entries.

2.07

Trade name or DBA registrations

Register and disclose each name used with customers.

2.08

Employer Identification Number documentation

Identify the applicant for tax, bank, and regulatory records.

2.09

Board and member resolutions

Authorize the filing, signatories, capitalization, bank accounts, and policies.

2.10

Direct ownership chart

Identify every direct owner and percentage, totaling 100%.

2.11

Indirect ownership chart

Trace upstream owners, controlling entities, and beneficial owners to natural persons.

2.12

Subsidiary and affiliate chart

Show group companies and the services, assets, or funding they provide.

2.13

Capitalization table

Document equity classes, voting rights, options, convertible instruments, and investor interests.

2.14

Source of startup capital

Substantiate where initial equity or contributed funds came from.

2.15

Management organizational chart

Show directors, officers, reporting lines, compliance, operations, finance, and internal audit.

2.16

Board and committee charters

Define oversight of risk, audit, cybersecurity, and compliance where the structure warrants it.

2.17

Delegation-of-authority matrix

Define who may approve payments, policy exceptions, vendors, filings, and financial commitments.

2.18

Fit-and-proper records

Gather resumes, employment history, qualifications, references, and experience for key personnel.

2.19

Individual NMLS MU2 filings

Obtain required attestations from direct owners, indirect owners, officers, and control persons.

2.20

Fingerprints and criminal background checks

Complete required FBI and state screening.

2.21

Credit reports and identity verification

Obtain required control-person authorizations through NMLS.

2.22

Foreign-residence investigative reports

Obtain third-party background reports where the state or multistate process requires them.

2.23

Personal financial statements

Provide statements for specified owners or officers when required by the state.

2.24

Litigation and regulatory-history disclosures

Explain lawsuits, bankruptcies, enforcement actions, denials, and adverse findings.

2.25

Qualified or responsible individual

Name an experienced person when a state requires a designated manager.

2.26

U.S. presence and location documentation

Support any office, employee, resident, or records-location condition imposed by a state.

2.27

Governance minutes and oversight calendar

Record approvals and periodic review of material risks and policies.

2.28

Succession and key-person coverage

Show who assumes critical duties if a senior officer or compliance leader leaves.

3.01

NMLS company account

Establish administrators and appropriate access for the applicant.

3.02

Company Form MU1

Complete legal, ownership, activity, address, bank, and disclosure information.

3.03

Branch Form MU3

File for locations where a jurisdiction requires branch registration.

3.04

State-specific supplements

Answer supplemental questions and provide jurisdiction-specific exhibits.

3.05

Application fee payment

Pay each regulator and NMLS fee as directed by the current checklist.

3.06

State business-plan addenda

Explain any jurisdiction-specific product, operating, or disclosure difference.

3.07

Document naming and upload map

Place each exhibit in the correct NMLS category and avoid inconsistent duplicates.

3.08

Regulatory question log

Assign owners, evidence, and response dates for examiner follow-up requests.

3.09

Attestation and consistency review

Reconcile the MU1, MU2s, business plan, flow of funds, contracts, and financials before submission.

3.10

Material-change controls during review

Track changes in owners, management, products, banking, and funding while applications are pending.

3.11

State approval conditions register

Capture restrictions or conditions imposed before launch.

4.01

Executive summary

Explain the applicant, customer problem, regulated activity, and proposed geographic footprint.

4.02

Corporate history

Describe formation, prior operations, acquisitions, and group relationships.

4.03

Product catalog

Define every service and distinguish live, planned, and excluded features.

4.04

Customer segments

Identify consumers, merchants, businesses, financial institutions, or other served populations.

4.05

Target states and countries

Show origin, transit, and destination markets for each product.

4.06

Distribution strategy

Describe app, web, API, branch, agent, white-label, and embedded channels.

4.07

Marketing plan

Explain acquisition channels, claims, affiliates, and customer onboarding.

4.08

Volume forecast

Project number of transactions and dollar throughput by product, corridor, and state.

4.09

Average and maximum ticket sizes

State expected values and limits, including exceptional transactions.

4.10

Fee schedule

Itemize customer charges, FX margin, partner charges, and revenue sharing.

4.11

Operating model

Explain who contracts with whom and who performs each regulated step.

4.12

Daily operating procedures

Show opening, processing, settlement, exception handling, and close-of-day activities.

4.13

Staffing plan

Size compliance, operations, engineering, finance, customer support, and audit against projected growth.

4.14

Launch and expansion milestones

Tie product activation to licenses, bank readiness, contracts, testing, and training.

4.15

Assumptions and sensitivities

Show the effect of slower growth, partner failure, fraud, losses, and higher compliance costs.

5.01

End-to-end flow-of-funds diagrams

Map each product from the customer's first interaction to final beneficiary receipt.

5.02

Transaction set

List each distinct transaction scenario, including normal, reversal, failure, refund, and exception paths.

5.03

Legal entity role map

Identify the sender, applicant, bank, processor, agent, FX provider, payout partner, and recipient at every step.

5.04

Customer contract and title analysis

Explain when the applicant receives control of funds and when its transmission obligation ends.

5.05

Account-by-account ledger map

Identify which legal entity owns and operates each receiving, clearing, settlement, reserve, and operating account.

5.06

Timing and cut-off matrix

Specify acceptance, debit, settlement, payout, weekends, holidays, and funding delays.

5.07

Funding-method matrix

Cover cash, ACH, card, wire, checks, wallet balance, and digital assets actually offered.

5.08

Payment-rail map

Show ACH, Fedwire, RTP, FedNow, card networks, SWIFT, correspondent banks, or other relevant rails.

5.09

Payment-instruction workflow

Show authorization, validation, approvals, transmission, and acknowledgment.

5.10

FX conversion workflow

Identify rate provider, quote lock, conversion timing, spread, and gain or loss owner.

5.11

Prefunding model

Explain who prefunds which payout accounts and how balances are replenished.

5.12

Net settlement model

Document permitted netting, counterparty exposures, and gross underlying obligations.

5.13

Third-party settlement model

Explain exactly when partners move funds on the applicant's behalf.

5.14

Customer liability calculation

Calculate outstanding transmission liabilities by state, product, currency, and settlement status.

5.15

Permissible-investment calculation matrix

Match outstanding liabilities to qualifying assets and state-specific coverage rules.

5.16

Settlement and reimbursement procedures

Describe payments to payout partners, agents, and beneficiaries.

5.17

Reconciliation procedures

Reconcile bank statements, payment processor files, subledgers, customer balances, and general ledger.

5.18

Unmatched-item escalation

Set aging, investigation, write-off, and management approval thresholds.

5.19

Returned and rejected payment process

Resolve rejects, recalls, reversals, chargebacks, and wrong-account payments.

5.20

Refund and cancellation flow

Show who refunds, the funding source, timing, and ledger entries.

5.21

Lost or delayed funds procedure

Trace transactions, notify affected parties, and remediate failures.

5.22

Agent insolvency scenario

Show how customer obligations are satisfied if a delegate cannot remit collected money.

5.23

Counterparty insolvency scenario

Show exposure, recovery, and continuity plans for a failed bank or payout partner.

5.24

Illustrative transaction records

Prepare sample timestamps, IDs, entries, bank movements, and customer communications.

6.01

Audited applicant financial statements

Supply balance sheet, income statement, cash flows, notes, and auditor opinion where required.

6.02

Interim financial statements

Supply current applicant-level results after the latest audited period.

6.03

Opening balance sheet

Show startup capitalization and initial financial position where accepted.

6.04

Parent or controlling-entity financials

Provide separate group statements only where the state requires or accepts them.

6.05

Financial projections

Forecast income, cash flow, balance sheet, and regulatory capital for at least the required period.

6.06

Projection assumptions

Document volume, take rate, loss rate, staffing, technology, and licensing costs.

6.07

Tangible net worth analysis

Test applicant-level capital against each state's applicable minimum.

6.08

Capital contribution evidence

Produce bank statements, equity subscription records, and source-of-funds documents.

6.09

Liquidity policy

Define accessible funds needed to settle obligations and absorb stress.

6.10

Permissible-investments policy

Define eligible assets, valuation, concentration, custody, monitoring, and shortfall cure.

6.11

Outstanding liability methodology

Specify how unredeemed instruments and unsettled transmissions are measured.

6.12

Daily coverage report

Compare qualifying assets against outstanding transmission liabilities.

6.13

Surety bond application

Obtain underwriting approval, premium quote, indemnity terms, and state-approved bond form.

6.14

Electronic surety bonds

Arrange issuance and filing through NMLS where applicable.

6.15

Alternative security instrument

Seek regulator approval before using an allowed deposit or letter of credit instead of a bond.

6.16

Bond resizing process

Recalculate required security when volumes or statutory formulas change.

6.17

Banking and counterparty concentration limits

Control exposure to individual financial institutions and payout networks.

6.18

Stress-test scenarios

Model bank loss, payout delays, fraud spikes, liquidity runs, and settlement disruptions.

6.19

Accounting policies

Define revenue recognition, customer liabilities, FX positions, reserves, losses, and intercompany items.

6.20

Independent financial audit plan

Arrange recurring audited statements and regulatory submission deadlines where required.

7.01

Operating bank account

Hold the applicant's corporate expenses and fee revenue.

7.02

Customer or clearing bank accounts

Identify accounts used to receive and transmit customer funds.

7.03

Bank acknowledgment of MSB use

Obtain an explicit account-purpose letter where a state, such as Texas, requests it.

7.04

Bank due diligence package

Supply licenses, registration, ownership, AML program, transaction forecasts, and corridors.

7.05

Sponsor-bank or program agreement

Define each bank's role, oversight, permitted activity, and termination rights.

7.06

ACH origination agreement

Establish originator responsibilities, returns, unauthorized debits, and reserves if ACH is used.

7.07

Wire and real-time payment agreements

Document access, cutoffs, limits, security, and error handling for selected rails.

7.08

Card acquiring or processing agreement

Address settlement, chargebacks, merchant category, reserves, and card-data obligations if cards are used.

7.09

Payout or correspondent agreements

Define recipient delivery, funding, FX, screening, reporting, and loss allocation.

7.10

FX or liquidity-provider agreements

Specify execution, pricing, prefunding, netting, and counterparty risk.

7.11

Technology-vendor agreements

Define service levels, security duties, audit rights, data use, and transition support.

7.12

Outsourcing register

Identify material outsourced functions and who remains accountable for each.

7.13

Third-party risk policy

Govern due diligence, approval, monitoring, subcontracting, concentration, and exit.

7.14

Partner oversight evidence

Record reviews of financial condition, controls, service levels, incidents, and complaints.

7.15

Foreign-partner compliance assessment

Review local permissions and operational capability in each payout corridor.

7.16

Termination and transition plan

Preserve customer service and funds delivery when a material partner exits.

8.01

Written BSA/AML program

Establish risk-based policies, controls, a designated officer, training, and independent review.

8.02

BSA/AML compliance officer appointment

Document authority, experience, resources, and access to management.

8.03

Enterprise financial-crime risk assessment

Assess products, customers, entities, geography, delivery channels, and volume.

8.04

Risk appetite statement

State prohibited customers, countries, use cases, and transactions.

8.05

Customer identification and verification procedures

Define the risk-based identity data collected and verified for each product.

8.06

Business customer due diligence

Verify entity existence, ownership, control, purpose, and expected activity as appropriate.

8.07

Beneficial-owner identification process

Identify and verify relevant owners or controllers under applicable legal and partner requirements.

8.08

Enhanced due diligence

Escalate higher-risk customers, politically exposed persons, complex ownership, and high-risk corridors.

8.09

Onboarding and rejection criteria

Document decisions, exceptions, periodic refresh, and account closure.

8.10

Transaction monitoring methodology

Set scenarios and thresholds for structuring, velocity, layering, fraud, and anomalous behavior.

8.11

Alert investigation procedures

Record disposition, escalation, supporting evidence, and reviewer independence.

8.12

Suspicious Activity Report (SAR) process

Determine when a SAR is required, file it, preserve confidentiality, and track continuing activity.

8.13

Currency Transaction Report (CTR) process

Aggregate and report qualifying cash transactions when the business handles reportable currency.

8.14

Funds-transfer recordkeeping and travel-rule controls

Capture and transmit required information for covered transmittals.

8.15

Currency and monetary-instrument recordkeeping

Retain applicable data for cash-based services.

8.16

Prepaid-access controls

Apply specialized identification, retention, and program rules if that product is offered.

8.17

Information-sharing request procedure

Process lawful requests, subpoenas, and applicable FinCEN information-sharing notices.

8.18

Record-retention schedule

Apply BSA and state retention periods to customer, transaction, investigative, and filing records.

8.19

BSA e-filing access and controls

Assign authorized filers, test workflow, and preserve acknowledgment records.

8.20

Case management and audit trail

Preserve who reviewed alerts, what they decided, and why.

8.21

AML management reporting

Report alerts, SARs, overdue cases, typologies, and control failures to leadership.

8.22

Independent AML review

Have a qualified independent party test program design and actual performance.

8.23

Remediation tracking

Log findings, accountable owners, deadlines, and evidence of closure.

8.24

AML training curriculum

Train relevant staff and agents on risks, red flags, escalation, and recordkeeping.

8.25

FinCEN MSB registration

File and maintain federal registration if required, independently of state licensing.

8.26

FinCEN agent list

Maintain the federally required agent information when applicable.

9.01

OFAC sanctions compliance program

Apply management commitment, risk assessment, controls, testing, and training.

9.02

Sanctions screening rules

Define customer, beneficial owner, counterparty, recipient, and transaction screening points.

9.03

Match investigation playbook

Document false-positive clearance, escalation, blocking, rejection, and reporting decisions.

9.04

Sanctions list update controls

Keep screening data current and test that updates reach all relevant systems.

9.05

Geographic restrictions

Prevent prohibited jurisdictions or customers from entering unsupported corridors.

9.06

Fraud risk assessment

Identify account takeover, identity fraud, mule activity, scams, and payment reversals.

9.07

Fraud detection rules

Set velocity, device, behavioral, beneficiary, and transaction anomaly controls.

9.08

Customer authentication policy

Define login, step-up verification, high-risk changes, and payment authorization.

9.09

Transaction limits policy

Set per-transaction, daily, monthly, and corridor limits with exception controls.

9.10

Consumer receipt templates

Show applicable transfer amount, fees, exchange rate, payout, timing, and regulator notices.

9.11

Remittance prepayment disclosures

Provide applicable disclosures before a covered international consumer transfer is paid.

9.12

Remittance cancellation procedure

Support qualifying cancellation and refund rights for covered transfers.

9.13

Remittance error-resolution procedure

Investigate covered error notices and provide required responses and remedies.

9.14

State complaint notices

Include required state regulator contact and complaint language where applicable.

9.15

Customer complaint policy

Log, triage, investigate, resolve, and trend complaints.

9.16

Refund and escheatment policy

Handle undelivered funds, stale instruments, and unclaimed property as applicable.

9.17

Advertising and website review

Check license claims, fee claims, speed claims, and partner representations.

9.18

Terms of service and privacy notices

Explain customer rights, transfers, disclosures, data handling, and liability allocation.

9.19

Language and translation controls

Ensure translated disclosures and support processes match actual offerings.

10.01

Authorized-delegate model

State exactly which activities third parties perform under the applicant's license.

10.02

Agent selection policy

Screen ownership, financial condition, criminal history, licensing, and competence.

10.03

Agent agreement template

Define permitted services, oversight, remittance, records, training, and termination.

10.04

Agent onboarding checklist

Approve locations, staff, systems, banking, and consumer notices before activation.

10.05

Agent AML training

Train delegates on customer identification, cash controls, red flags, and escalation.

10.06

Agent transaction monitoring

Detect suspicious patterns and unusual branch or delegate activity.

10.07

Agent audit and field-visit plan

Inspect cash handling, receipts, logs, funds settlement, and compliance.

10.08

Agent settlement and collateral policy

Set remittance deadlines, credit limits, reserves, and shortfall procedures.

10.09

Agent complaint and incident escalation

Require prompt reporting to the principal licensee.

10.10

Agent termination process

Revoke access, recover funds, preserve records, and notify regulators when required.

10.11

NMLS authorized-agent reporting

Submit and maintain locations through UAAR where the state participates.

10.12

Branch and location inventory

Record company offices, staffed premises, and location-specific licensing obligations.

10.13

White-label and referral-role analysis

Determine whether a partner is an agent, marketer, service provider, or separately regulated transmitter.

11.01

System architecture diagram

Map apps, APIs, ledger, databases, vendors, banks, and payment connections.

11.02

Data-flow diagram

Track customer information and payment data across systems and jurisdictions.

11.03

Hosting infrastructure inventory

Identify cloud regions, environments, providers, and critical dependencies.

11.04

Asset inventory

Track endpoints, servers, applications, cloud services, repositories, and data stores.

11.05

Information security program

Assign governance, risk assessment, technical safeguards, monitoring, and review.

11.06

Cybersecurity risk assessment

Evaluate threats and controls against the actual technology and business model.

11.07

Data classification and handling policy

Define sensitive data, access rules, encryption, retention, and deletion.

11.08

Identity and access management

Apply least privilege, joiner/mover/leaver controls, and periodic access review.

11.09

Multifactor authentication

Protect privileged access and other sensitive functions under applicable requirements.

11.10

Privileged-access management

Control and record administrator use and emergency access.

11.11

Encryption and key management

Protect data in transit and at rest with controlled key ownership and rotation.

11.12

Secure software development lifecycle

Include design review, threat modeling, testing, approval, and deployment controls.

11.13

Code review and automated code testing

Detect defects and unsafe changes before production releases.

11.14

Software composition analysis

Identify vulnerable third-party packages and open-source components.

11.15

Penetration testing

Test exposed applications, APIs, and infrastructure using a risk-based scope.

11.16

Vulnerability scanning and remediation

Find weaknesses, prioritize fixes, and verify closure.

11.17

Configuration and patch management

Keep systems supported, hardened, and updated.

11.18

Change management

Approve and document production changes, rollback plans, and segregation of duties.

11.19

Environment segregation

Separate production from development, testing, and administrative systems.

11.20

Logging and audit trails

Record access, account changes, payment events, security events, and investigations.

11.21

Security monitoring and alerting

Detect suspicious system behavior and assign response ownership.

11.22

Network security controls

Segment systems, protect endpoints, manage firewalls, and monitor traffic.

11.23

Cloud-security review

Test provider configuration, permissions, storage exposure, and shared-responsibility boundaries.

11.24

API security controls

Authenticate clients, rate-limit requests, validate input, and protect credentials.

11.25

Payment data security assessment

Apply PCI DSS when the applicant stores, processes, or transmits cardholder data.

11.26

Independent IT or security assessment

Obtain outside review when a state, bank, contract, or risk profile calls for it.

11.27

SOC 2 or similar assurance report

Consider third-party assurance when requested by partners; it is not a universal MTL prerequisite.

11.28

FTC Safeguards Rule applicability assessment

Determine whether the applicant falls under this federal customer-information rule.

11.29

New York cybersecurity applicability assessment

Apply 23 NYCRR Part 500 if covered, including its exemption analysis.

11.30

FISMA applicability assessment

Address FISMA only if operating a covered federal system or contract; it is not the ordinary MTL audit.

12.01

Business continuity plan

Define critical services, alternate processes, personnel, and dependencies.

12.02

Disaster recovery plan

Set restoration steps, recovery time objectives, and recovery point objectives.

12.03

Backup policy

Protect and regularly test recoverability of ledgers, transaction records, and configurations.

12.04

Business impact analysis

Rank the consequences of outages across payment, compliance, and customer functions.

12.05

Cyber incident response plan

Define detection, containment, investigation, recovery, and evidence preservation.

12.06

Regulatory incident-notification matrix

Map event types and deadlines for each state and applicable federal regime.

12.07

Bank and partner incident-notification matrix

Meet contractual notices in addition to regulatory notices.

12.08

Customer breach-notification process

Determine affected persons, applicable state law, content, and delivery timing.

12.09

Fraud and financial-loss escalation

Set authorities and immediate actions for theft, compromise, or settlement loss.

12.10

Crisis communications plan

Assign spokespeople and approved communications for regulators, banks, agents, and customers.

12.11

Tabletop exercises

Rehearse cyberattack, cloud outage, bank failure, and payout disruption scenarios.

12.12

Continuity test results

Keep evidence that plans and backups work and that gaps were fixed.

12.13

Critical-vendor contingency plan

Identify substitutes, data export, and transition steps for a failed provider.

13.01

Employee handbook

Cover conduct, confidentiality, conflicts, security, and reporting channels.

13.02

New-employee onboarding manual

Explain role-specific system access, controls, and required training.

13.03

Role descriptions and competency matrix

Match named personnel to compliance and operational responsibilities.

13.04

Background-screening policy

Screen staff in sensitive financial and technical roles as appropriate.

13.05

Code of conduct and ethics policy

Address conflicts, gifts, fraud, misuse of funds, and escalation.

13.06

Whistleblower and issue-escalation channel

Permit staff to report control failures without suppressing evidence.

13.07

Segregation-of-duties matrix

Separate initiation, approval, release, reconciliation, and exception resolution.

13.08

Dual-control policy

Require independent approval for high-risk payments and privileged changes.

13.09

Training calendar

Schedule BSA/AML, OFAC, fraud, privacy, security, consumer rights, and agent training.

13.10

Training completion records

Retain attendance, testing, follow-up, and policy acknowledgments.

13.11

Quality-assurance plan

Sample onboarding, monitoring, transaction processing, disclosures, and complaints.

13.12

Internal audit plan

Review high-risk functions independently and track corrective actions.

13.13

Records-management manual

Specify retention, legal holds, access, destruction, and regulator retrieval.

14.01

Cash operations module

Add cash custody, physical security, teller balancing, aggregation, and CTR controls if handling currency.

14.02

Cross-border remittance module

Add Regulation E disclosures, delivery tracking, errors, cancellations, and foreign partner oversight where applicable.

14.03

Foreign exchange module

Add pricing, rate-lock, market exposure, trade confirmation, and currency settlement controls.

14.04

Stored-value or wallet module

Add balance ledgers, issuance, redemption, dormant balances, and safeguards for outstanding value.

14.05

Prepaid-access module

Add product structure, distribution, customer data, limits, and specialized BSA obligations.

14.06

Card-funded transfer module

Add network rules, chargebacks, PCI scope, dispute handling, and reserves.

14.07

ACH-funded transfer module

Add authorization records, NACHA compliance, return controls, and prefunding risk.

14.08

Merchant or marketplace module

Add payment-processor exemption analysis, seller contracts, split settlement, and platform controls.

14.09

Cryptocurrency module

Add wallet architecture, keys, custody, blockchain monitoring, on-chain/off-chain flow, and token-specific risk.

14.10

Stablecoin module

Add issuer/redemption reliance, reserves analysis, settlement finality, wallet screening, and chain risk.

14.11

Kiosk or ATM module

Add site controls, cash servicing, location registrations, ID verification, and device security.

14.12

Bill-pay module

Add payee onboarding, due-date representations, failed delivery, and consumer notices.

14.13

Money-order or check module

Add instrument inventory, issuance, redemption, lost-item controls, and outstanding liability calculation.

14.14

Foreign affiliate module

Add intercompany services, transfer pricing, data transfer, and host-country licensing analysis.

15.01

License approval verification

Confirm the exact entity, states, products, effective dates, and conditions approved.

15.02

No-activity-before-approval control

Prevent regulated activity in each state until its license or valid exemption is effective.

15.03

Launch-readiness sign-off

Verify bank accounts, bond, capital, contracts, systems, staff, and consumer disclosures.

15.04

Regulatory reporting calendar

Track state periodic reports, NMLS MSB Call Reports, financial statements, and examinations.

15.05

Annual license renewal

Submit state and NMLS renewals and fees on schedule.

15.06

FinCEN registration renewal

Renew federal MSB registration when due if applicable.

15.07

Ongoing net worth monitoring

Detect and cure any capital shortfall promptly.

15.08

Ongoing bond maintenance

Renew security and adjust coverage when obligations grow.

15.09

Ongoing permissible-investment monitoring

Maintain required coverage of outstanding transmission liabilities.

15.10

Authorized-agent list maintenance

Update federal and state lists under applicable reporting rules.

15.11

Change-of-control approval process

Obtain prior approval or notice before ownership changes where required.

15.12

Material-change notification process

Update regulators about products, leadership, locations, banking, and other reportable changes.

15.13

Regulatory examination playbook

Preserve accessible records, owners, evidence, and response procedures.

15.14

Complaint and enforcement trend review

Use customer and regulator feedback to correct systemic defects.

15.15

Annual policy and risk assessment refresh

Reassess the business as new products, volumes, and corridors emerge.