Red flags for money services businesses and remitters

What supervisors and standard-setters expect

Money services businesses fall under the same Bank Secrecy Act framework as banks, with rules tuned to high-volume, low-value, often walk-in business. In the US, every money services business must keep a written, effective anti-money laundering program that is commensurate with the risks of its location, size and services. It must cover verifying customer identification, filing reports, keeping records and responding to law enforcement.

The thresholds are lower than at banks. A money services business must file a Suspicious Activity Report on a transaction of at least $2,000, against $5,000 for banks, within 30 calendar days of first detection. When several businesses handle one transaction, only one report is required, provided it contains all the relevant facts. For transmittals of $3,000 or more, the business must keep the transmittor's name and address, the amount, the execution date, the payment instructions and the identity of the recipient's financial institution.

The UK uses a different structure with the same logic. A person must not act as a money service business unless on the appropriate register. Customer due diligence applies when a business relationship starts, on any occasional transfer of funds above £800, on other occasional transactions of £12,000 or more, and whenever money laundering is suspected, including where operations appear to be linked.

These duties explain why certain red flags matter. Hawala, flying money and cuckoo smurfing indicators involve many small or linked transfers, so the linked-transaction wording and the low $2,000 reporting line are the relevant tests. Mule indicators raise whether activity fits what the customer is known to do. Currency exchange abuse indicators go to identification and record-keeping at the counter.

Canada shows the cost of missing the basics. FINTRAC imposed a $693,742.50 penalty on an Edmonton money services business, operating as Necosmart, on March 27, 2026, and announced it on May 14, 2026. A compliance examination found it failed to submit suspicious transaction reports on multiple occasions, keep current written policies approved by a senior officer, apply enhanced measures to high-risk clients, assess and document its risk, and keep sufficient identity and transaction information for virtual currency exchange tickets. These are the program, reporting and record-keeping duties every supervisor tests first.

As of October 2026: US regulation texts were read on the eCFR in October 2026. The eCFR page for 31 CFR 1010.410 carries a note that a September 2024 amendment was delayed to January 1, 2028; what it changes was not examined, so the $3,000 figure is the text in force today and may change. UK thresholds are from regulation 27 as shown on legislation.gov.uk, which lists an amendment effective June 30, 2026; the UK registration point is from regulation 56 (checked on the same site). FINTRAC's release does not say whether the Necosmart penalty was appealed. US registration with FinCEN (31 CFR 1022.380) also applies but is not detailed here.