Red flags for cash-intensive businesses and payment processors

What supervisors and standard-setters expect

Most cash-intensive businesses are not themselves anti-money laundering reporting institutions, so duties come from three places: cash receipt reporting that applies to any trade or business, the due diligence of the banks holding their takings, and rules for the processors and carriers that move their money.

In the US, 31 CFR 1010.330 requires any person in a trade or business who receives more than $10,000 in currency, in one transaction or related transactions, to report it on Form 8300 within 15 days, verify the payer's identity and keep a copy for five years. Payments from the same payer within 24 hours are related, and the rule says a transaction may not be divided to avoid reporting. In the EU, Regulation 2024/1624 (Article 80) will cap cash payments for goods and services at €10,000, including linked operations, from 10 July 2027, and lets Member States set lower limits; Article 19(4) requires at least customer identification for cash transactions of €3,000 or more.

Supervisors expect banks to know the business. The US examiners' manual says a bank should understand a cash business's operations, intended account use, expected volumes and geography at opening, and test actual activity against it. Its example is a restaurant whose cash deposits exceed those of similar restaurants nearby. It notes that payment processors generally face no US anti-money laundering rules themselves, so banks must test the processor's merchant checks. The Dutch central bank, DNB, treats payment institutions as gatekeepers. It fined CCV Netherlands €2.65 million, published July 13, 2026, because merchant transactions were not fully fed into monitoring for over two years, profiles for about 4,200 merchants (roughly 8%) were not loaded for 23 months, and alerts were closed in bulk. DNB raised the €2.5 million base fine for earlier breaches, then reduced it for a recovery plan; the decision is not final. For physical cash, FinCEN assessed $37 million against Brink's on February 6, 2025 for moving hundreds of millions of dollars in bulk currency, including across the Southwest Border, without registering as a money services business, an effective program, or suspicious activity reports.

The page's red flags therefore map to defined duties. Takings out of line with local peers, or an unusual cash-to-card ratio, are what a bank's expected-activity comparison is built to catch. A website that does not match the payment descriptor is a merchant due diligence failure at the processor. Bulk cash shipments out of proportion to a customer's trade engage registration, program and reporting duties.

As of October 2026: Checked October 21, 2026. The DNB decision on CCV is not final and may be changed on objection or appeal; despite its title the page describes a transaction monitoring failure. The FinCEN Brink's release does not give the violation period or customer detail, which sit in the consent order that was not read. The FFIEC manual sections are older examiner guidance that were still live on the site but may predate later FinCEN changes. UK and Canadian cash-reporting rules, and FATF text, were not used here. EU Regulation 2024/1624 is not yet in application.