Authorized Delegate Oversight for U.S. MSBs: FinCEN Agent-List Rules and State Licensing Controls

A U.S. money services business that operates through agents faces two separate sets of rules: FinCEN's federal agent-list and registration requirements under the Bank Secrecy Act, and — for state-licensed money transmitters — state authorized-delegate requirements that typically call for a written contract, a background investigation, and ongoing oversight. The two frameworks use overlapping language but arise from different law, and a principal that satisfies one has not automatically satisfied the other.

"Agent" is FinCEN's term. State money transmission statutes commonly use "authorized delegate," though some states use "agent" as well. The terms can describe the same operational relationship, but they come from different legal frameworks and should not be treated as interchangeable without checking the applicable law. This article keeps three distinct concepts separate throughout: (A) an agent for federal MSB/registration purposes, (B) an authorized delegate of a state-licensed money transmitter, and (C) the "agent of payee" exemption that exists in some states — a different concept entirely, covered in its own section below.

FinCEN Agent Rules vs. State Authorized-Delegate Rules

The rest of this article works through each row in depth.

What FinCEN Requires in an MSB Agent List

Under 31 CFR 1022.380(d), a money services business required to register with FinCEN must prepare and maintain a list of its agents. The list must be revised each January 1 for the immediately preceding 12-month period. It is not filed with the Form 107 registration — it must instead be maintained at the U.S. location reported on the registration form, and produced to FinCEN, an appropriate law enforcement agency, or the IRS's BSA examination function only upon request.

Each revision of the list must include, for every agent:

• the agent's name, including any trade or doing-business-as names;
• the agent's full address;
• the agent's telephone number;
• the type of service or services the agent provides (money orders, traveler's checks, check sales, check cashing, currency exchange, or money transmitting);
• a listing of the months in the preceding 12 months in which the agent's gross transaction amount from the principal's products or services exceeded $100,000, with this volume information current within 45 days of the list's due date;
• the name and address of any depository institution where the agent maintains a transaction account for funds tied to the principal's products or services;
• the year the agent first became an agent of the business; and
• the number of branches or subagents the agent has.

The original list and each revised list must be retained for five years from the due date for preparation of that list. FinCEN has, on at least one occasion, formally requested that all registered MSBs with agents provide their current agent lists under its existing authority in 31 CFR 1022.380(d) — a reminder that "maintain and produce on request" is a live obligation, not a dormant one, even though the list itself is not filed proactively.

Failure to comply with the registration and agent-list requirements of 31 CFR 1022.380 can result in a civil penalty of $5,000 per violation, with each day a violation continues treated as a separate violation. Separately, willful failure to comply with the underlying registration requirements of 31 U.S.C. 5330 can carry criminal exposure under 18 U.S.C. 1960 — a distinct, more serious statute, not a penalty that automatically attaches to every recordkeeping lapse. Which exposure applies to a given fact pattern depends on the specific violation and whether it was willful.

Does an MSB Agent Need Its Own FinCEN Registration?

Under 31 CFR 1022.380(a)(3), a person that is a money services business solely because it serves as an agent of another MSB is not required to register itself. FinCEN's own example is a supermarket that acts as an agent selling money orders for an issuer and performs no other MSB-type services — that supermarket does not need to register, even if it acts as an agent for more than one MSB at once (the regulation's own example notes the answer is the same whether the supermarket is an agent of a single money order issuer or of both a money order issuer and a money transmitter).

That exception has a clear limit. A business that engages in MSB activity both on its own behalf and as an agent for others must register. Using FinCEN's own extension of the example: if the same supermarket also cashed checks or exchanged currency — other than as an agent of another business — in amounts over $1,000 per person per day, it would need to register in its own right. Whether a given business is genuinely acting "solely as an agent," or is independently conducting MSB activity, is a facts-and-circumstances determination (31 CFR 1022.380(a)(4)).

This registration exception is narrower than it looks. It excuses an agent from filing its own Form 107 — it does not excuse the agent from BSA/AML program or suspicious-activity-reporting obligations that can apply to it independently. Those are separate questions, addressed below.

Federal Agent Status Does Not Resolve State Licensing

A conclusion that an entity is an "agent" for federal registration purposes says nothing about how a state treats that same relationship. Federal treatment does not determine:

• whether a given state's money transmission statute recognizes the arrangement at all;
• whether the delegate can operate in that state without its own license;
• whether the delegate must be reported to the state regulator;
• whether a written contract is required, and what it must contain;
• whether the principal must conduct a background investigation before appointing the delegate; or
• what state-specific disclosure or signage requirements apply at the delegate's location.

Each state's money transmitter licensing analysis has to be conducted on its own terms — a business that has resolved its federal FinCEN registration question has only answered one of the two questions this article addresses.

How the MTMA Model Law Approaches Authorized Delegates

The Money Transmission Modernization Act (MTMA) — CSBS's model law, not automatically the law of every state — defines an "authorized delegate" as a person a licensee designates to engage in money transmission on behalf of the licensee (Section 2.01(b)). As of September 3, 2026, CSBS states that 31 states have enacted the MTMA in whole or in part; adoption varies, and a state that has not adopted it (or has adopted only part of it) may impose different or additional requirements. Everything below describes the model law's Article VIII; whether it applies in a given form depends on that state's actual enactment.

Under Section 8.01(b), before a licensee is authorized to conduct business through an authorized delegate, the licensee must:

1. adopt, and update as necessary, written policies and procedures reasonably designed to ensure the authorized delegate complies with applicable state and federal law;
2. enter into a written contract meeting the requirements described below; and
3. conduct a reasonable risk-based background investigation sufficient to determine whether the delegate has complied, and is likely to comply, with applicable state and federal law.

An authorized delegate must operate in full compliance with the licensing act (Section 8.01(c)). The model law also prohibits an authorized delegate from using a subdelegate to conduct money transmission on the licensee's behalf (Section 8.01(g)), and it provides that if the licensee's own license is suspended, revoked, surrendered, or expired, the licensee must notify its delegates within five business days, and those delegates must immediately stop acting on its behalf (Section 8.01(e)).

What Should Be Reviewed Before Appointing an Authorized Delegate?

The model law's own requirement is a "reasonable risk-based background investigation sufficient for the licensee to determine whether the authorized delegate has complied and will likely comply with applicable state and federal law" — a standard, not a checklist. What that investigation actually covers is left to the licensee's judgment, calibrated to risk. In practice, and depending on the business, that risk-based assessment commonly extends to ownership and control of the prospective delegate, its regulatory and compliance history, financial condition, the nature of its existing business and customer base, its specific operating locations, and management experience. None of this specific list is itself a universal statutory requirement — it is a risk-based program built to satisfy the model law's "reasonable" and "sufficient" standard, scaled to the delegate's actual risk profile rather than applied as a fixed template.

What the Authorized-Delegate Agreement Needs to Address

What the MTMA model requires

CSBS's own Model Money Transmission Modernization Act, Section 8.01(d), sets out nine minimum provisions the written delegate contract must contain. The contract, signed by both the licensee and the delegate, must at minimum:

1. appoint the signer as the licensee's authorized delegate with authority to conduct money transmission on its behalf;
2. set out the nature and scope of the relationship and each party's respective rights and responsibilities;
3. require the delegate to fully comply with applicable state and federal law, including the licensing act, the Bank Secrecy Act, and the USA PATRIOT Act;
4. require the delegate to remit and handle money and monetary value on the contract's terms;
5. impose a trust on money and monetary value, net of fees, received for money transmission, for the licensee's benefit;
6. require the delegate to prepare and maintain records as the act, its implementing regulations, or the regulator reasonably requires;
7. include the delegate's acknowledgment that it consents to examination or investigation by the state regulator;
8. state that the licensee is subject to regulation, and that the regulator may suspend or revoke an authorized-delegate designation, or require the licensee to terminate one; and
9. include the delegate's acknowledgment that it has received the written policies and procedures required under item 1 of the pre-appointment requirements above.

State enactments can differ

This is the model law's own text — it is not simply a summary of what one or two states happen to require. But a model law is only a template until a legislature enacts it, and individual state statutes can modify, supplement, renumber, or in rare cases omit these provisions. Massachusetts and Minnesota, for example, enacted contract requirements that track this list closely. Before relying on any specific clause as mandatory in a given state, the enacted statute — not the model law — controls.

FinCEN Requires Risk-Based Monitoring of MSB Agents

The background investigation and contract requirements above apply at onboarding. FinCEN's own guidance goes further, and applies independently of whatever any state requires. In FIN-2016-G001, Guidance on Existing AML Program Rule Compliance Obligations for MSB Principals with Respect to Agent Monitoring (March 11, 2016), FinCEN states that the Bank Secrecy Act requires all MSBs — both principals and their agents — to establish and maintain an effective written AML program, and that an MSB principal's own AML program must include risk-based agent-monitoring policies and procedures.

FinCEN's guidance specifies that, when monitoring their agents, principals must at minimum:

• identify the owners of the MSB's agents;
• evaluate, on an ongoing basis, the operations of the agents, with the capability to spot variations in those operations;
• evaluate the agent's implementation of, and adherence to, its own AML policies, procedures, and internal controls;
• implement corrective action when the principal becomes aware of weaknesses or deficiencies; and
• provide for independent testing, keyed to the risk the agent's products and services present, to confirm there are no material weaknesses.

This applies to domestic and foreign agents alike, and it is a distinct obligation from the recordkeeping-focused agent list discussed above — an agent list that is accurate on paper is not the same thing as a monitoring program that actually evaluates what an agent is doing. FinCEN's guidance also makes clear that a contract cannot reassign this responsibility away: neither the principal nor the agent can avoid liability for a failure to maintain an effective AML program by pointing to a contract that purports to assign that responsibility to the other party. Whatever monitoring controls a principal builds should connect directly to this framework — an inventory of delegates that is technically accurate but disconnected from actual, ongoing evaluation of each agent's operations satisfies a recordkeeping obligation without satisfying this one. A BSA/AML compliance program built for a principal with an agent network needs to be scaled to that network specifically, not written as though all activity occurred at the principal's own locations.

Who Owns BSA/AML Compliance When Activity Runs Through Agents?

Putting the pieces above together: FinCEN registration exemption and BSA/AML program responsibility are separate questions. An agent that does not have to file its own Form 107 because it acts solely as another MSB's agent can still carry independent BSA obligations, including its own AML program and, as discussed next, its own suspicious-activity-reporting responsibility. The principal, in turn, cannot discharge its own agent-monitoring obligation simply by requiring the agent to sign a policy-compliance acknowledgment — FinCEN's guidance requires actual, ongoing evaluation, not just a contractual promise.

Agent activity and SAR escalation

FinCEN's Fact Sheet on the MSB Suspicious Activity Reporting Rule places the SAR-filing obligation on each money services business involved in a reportable transaction — and it states specifically that an agent of an MSB is itself an MSB for purposes of the SAR rule, even where that same agent is not required to separately register under 31 CFR 1022.380. To avoid duplicate filings on the same transaction, FinCEN's rule is designed so that only one report needs to be filed where the principal and agent are reporting the same facts — but the Fact Sheet also notes that filing of multiple reports by a principal and its agent can be justified where the two reports contain different facts. In practice, this means a principal's escalation framework needs a defined path for agent-generated red flags to reach a filing decision, and a clear understanding — worked out with the agent, and documented — of which entity files in a given scenario, rather than an assumption that the registered principal alone carries the obligation. The specifics of drafting a SAR narrative are outside the scope of this article.

Where NMLS Authorized-Agent Reporting Fits

Participating states use NMLS's Uniform Authorized Agent Reporting (UAAR) functionality to collect authorized-agent/delegate information from licensees. Reporting cadence, applicable fees, and the exact information required are state-specific — though the MTMA model law itself contemplates quarterly delegate reporting (Section 7.03), which is the provision states have used to implement UAAR. New York's Department of Financial Services, for example, confirms it uses NMLS's UAAR functionality to fulfill its own agent-reporting requirements for licensed money transmitters.

NMLS itself is not a regulator and does not decide whether a given relationship is a lawful authorized-delegate arrangement — it is the reporting mechanism a state has adopted to standardize how that information reaches it. Where a state directs a licensee to use UAAR, submitting the required information through NMLS is that state's reporting mechanism; it does not replace the underlying background-investigation, contract, and monitoring obligations described above, and not every state's approach through UAAR is identical.

Two State Examples Worth Understanding

New York. Money transmitters must be licensed under Article 13-B of the New York Banking Law. New York's own statute (Banking Law § 641(1)) draws exactly the distinction this article emphasizes: no person may conduct the licensed business "as an agent, except as an agent of a licensee or as agent of a payee" — naming both the licensee-agent relationship and a separate payee-agent concept in the same sentence. A licensed money transmitter may operate through agents; those agents are not separately licensed by DFS when acting within that agency, but the licensee must report them, and DFS uses NMLS's UAAR functionality for that reporting.

California. California's Money Transmission Act defines an "agent" of a licensee (Financial Code § 2003(b)) as a person not itself licensed that provides money transmission on the licensee's behalf, with the licensee becoming liable for the transmission once the agent receives the funds — and the statute's own agent provisions (Financial Code §§ 2060–2061) govern that relationship. This is a distinct concept from California's separate "agent of payee" exemption (Financial Code § 2010(l)). Where the statutory requirements are satisfied — a pre-existing written agreement between the payee and the agent, the payee holding the agent out as accepting payment on its behalf, and payment to the agent treated as extinguishing the payor's obligation directly — a payment arrangement may fall within the agent-of-payee exemption without a separate money transmitter license for that activity; applicability is fact-specific and self-executing, meaning a business does not need DFPI's prior sign-off to rely on it, but that also means the business bears the risk if its own facts turn out not to satisfy the statute. This exemption should never be confused with a licensee appointing its own authorized delegate under the MTA's agent provisions — the two serve entirely different purposes and carry entirely different consequences.

When an Agent Relationship Ends

Ending an authorized-delegate relationship is not simply a matter of stopping payments. Depending on the applicable state statute, termination can require formal notice to the state regulator, an update to the NMLS UAAR record, resolution of any funds the delegate still holds in trust for the principal, and retention of the records generated during the relationship. The MTMA model law gives the regulator its own authority to order a licensee to terminate a delegate designation, separate from any decision the licensee makes on its own, and requires the licensee to notify affected delegates within five business days of its own license being suspended, revoked, surrendered, or expired. Where a specific state or the model law imposes a defined notice period or procedure, that requirement should be sourced to the actual statute rather than assumed to be universal.

A Practical Authorized-Delegate Oversight Lifecycle

1. Classification — determine whether the relationship is a federal MSB agent, a state authorized delegate, both, or neither.
2. Due diligence — conduct the risk-based background investigation the applicable state law requires.
3. Approval — make an internal decision against defined criteria before onboarding.
4. Written contract — execute an agreement meeting the applicable state's minimum contract requirements.
5. State/NMLS reporting — report the delegate where the relevant state requires UAAR or other reporting.
6. Implementation/training — confirm the delegate's staff understand the policies they are contractually bound to follow.
7. Risk-based monitoring — evaluate ownership, operations, and policy adherence on an ongoing basis, per FinCEN's agent-monitoring guidance.
8. FinCEN agent-list maintenance — revise the agent list every January 1 and retain it for five years.
9. Escalation/remediation — resolve findings through a defined process, up to termination.
10. Termination — close out funds, records, and reporting consistent with applicable state requirements.

What an MSB Should Be Able to Produce During an Examination

• current and prior FinCEN agent lists (five years' retention);
• signed written delegate/agent agreements for each active relationship;
• documentation of the pre-appointment background investigation;
• state appointment and NMLS UAAR reporting records;
• evidence of ongoing agent monitoring under the FinCEN framework above;
• AML/SAR escalation records where agent-generated activity was involved; and
• records of any remediation or termination actions taken.

Depending on the applicable law and the specific business model, examiners may also expect additional records tailored to that business.

Frequently Asked Questions

Can the same business act as an agent for more than one MSB?

‍Yes, without needing to register itself, as long as it is solely acting as an agent in each relationship and is not independently conducting MSB activity on its own behalf. FinCEN's own registration example confirms this applies whether the agent works for one principal or several.

Does an agent's exemption from separate FinCEN registration also exempt it from AML or SAR obligations?

‍No. The registration exception under 31 CFR 1022.380(a)(3) only excuses an agent from filing its own Form 107. FinCEN's guidance makes clear that both principals and agents independently carry BSA/AML program obligations, and that an agent is itself treated as an MSB for suspicious-activity-reporting purposes even where it isn't separately registered. Registration status and BSA/AML or SAR responsibility are separate legal questions, and a contract between principal and agent cannot reassign either party's underlying obligation.