How FinCEN and BSA rules reach American ATM route operators

What to take away

How the Bank Secrecy Act reaches an independent ATM deployer

The Bank Secrecy Act began in 1970 as a recordkeeping and reporting statute aimed at cash moving through banks. Congress later extended it to non-bank financial institutions, including money services businesses. FinCEN writes the rules and enforces them.

The Bank Secrecy Act framework is the reason an ATM route in Texas or Florida is not just a vending operation.

An independent ATM deployer owns or operates ATMs and dispenses currency. That activity fits the MSB definition of a money transmitter or currency dealer or exchanger in most cases. FinCEN has treated ATM operators as MSBs since the 1990s.

A route with five machines in Arizona and a route with 500 machines in New York both fall under the same rule structure.

Your bank or processor may already ask for BSA documents. That is not a courtesy. Banks must apply customer due diligence to MSB accounts and often treat ATM route operators as higher risk. If you cannot show an AML program, the bank can close the account or freeze deposits.

The practical reach is broad. BSA obligations attach to the entity that owns the ATMs, the entity that services them, and sometimes the entity that owns the cash inside them. If you operate through a management company, map which entity does what before an examiner asks.

State law adds layers. Texas, Florida, and New York have their own money transmission regimes that can apply to ATM deployers. Start with the federal baseline, then check the state Licences and compliance rules for each state where you place machines.

FinCEN MSB registration and what changes once you are registered

FinCEN MSB registration is filed on Form 107. You register the legal entity that owns or controls the ATMs. Registration is not a license and does not replace state money transmitter licensing, but it is a federal requirement for most independent ATM deployers.

You must register within 180 days of the date you begin operating as an MSB. After that, renew every two years by December 31 of the renewal year. The registration is tied to the entity and to its locations. If you move the principal place of business or change ownership, update the filing.

Once registered, several things change:

Registration also affects your bank relationships. A registered MSB is expected to have policies, a compliance officer, and independent review. Banks use the registration number and the AML program as part of their risk assessment. Missing registration is a quick way to lose processing.

Some operators ask whether a single ATM at one location is enough to trigger registration. FinCEN has generally treated the activity, not the count, as the test. A single machine that dispenses currency and charges a fee can be MSB activity. The safer course is to register and keep the program simple.

Building a written AML program sized to an ATM route

A written AML program for an ATM route does not need to be a bank-sized manual. It needs to cover four things: policies, a compliance officer, training, and independent review. FinCEN expects the program to be risk-based and in writing.

Start with a short risk assessment. Identify the cash volume per machine, the locations, the customer base, and the states you operate in. A route in Las Vegas or Miami with high tourist cash flow carries different risk than a route of office-building machines in suburban Georgia. Document that reasoning.

Name a compliance officer. In a small route business this is often the owner. The person needs authority to act and enough time to review alerts. Write the name and duties into the program.

Set transaction monitoring rules. For ATMs, monitoring usually means watching for unusual withdrawal patterns, repeated high-value deposits, and machines that suddenly run far above their historical volume. Your processor or vault provider may supply reports. If not, build a simple weekly review using your compliance checklist.

Train staff who handle cash, vaults, or customer inquiries. Training can be a short annual session with a signed log. Cover red flags, how to report internally, and what not to tell a customer. Keep the records.

Independent review can be done by an outside consultant or a qualified person who does not run the route. The review tests whether the program is followed. A one-page report each year is enough for many small deployers. The point is to show you checked.

Use a checklist to keep the program current:

Suspicious Activity Report filing: thresholds, timing and narrative

Suspicious Activity Report filing is a core MSB duty. For money services businesses, the threshold is generally $2,000 in funds or other assets involved in the suspicious transaction. The duty applies when you know, suspect, or have reason to suspect the transaction involves illegal activity or is designed to evade reporting.

Timing matters. File within 30 calendar days of detecting the suspicious activity. If you cannot identify a suspect, you may take up to 60 days. Keep a copy of every SAR and the supporting documentation for five years from the filing date.

Do not tell the customer. The prohibition on disclosure is strict and applies to the fact that a SAR was filed. Train anyone who talks to merchants or customers to route questions to the compliance officer.

A useful narrative answers who, what, when, where, and why. For an ATM route, that might mean a machine that dispensed far more cash than usual, a merchant who repeatedly deposits large sums of small bills, or a pattern of withdrawals just under a reporting threshold. Write plainly and include account numbers, machine IDs, dates, and amounts.

You can file SARs through the BSA E-Filing System. FinCEN publishes Bank Secrecy Act filing information that lists the forms MSBs and money transmitters must use. Check it before you file so you use the correct form and fields.

Some activity is not a SAR but still needs a record. A single large cash deposit at your bank may trigger a currency transaction report by the bank, not by you. Know which filing belongs to whom so you do not miss your own duty.

Recordkeeping and currency transaction duties on cash-heavy routes

Recordkeeping obligations under 31 CFR Part 1022 cover the records an MSB must make and keep. The eCFR text of 31 CFR Part 1022 sets out the rules for money services businesses, including ATM operators. The part covers records to be made, records to be retained, and the retention period.

For ATM operators, the practical records include machine transaction logs, cash loading and unloading records, vault reports, and settlement records with your processor or bank. Keep them for five years. Store them so you can retrieve them by machine and by date.

Currency transaction reporting is usually the bank's duty when you deposit cash. But your deposits can trigger bank questions, and structured deposits can become a problem for you. If you split deposits to stay under $10,000, that can be structuring. Do not do it, and train staff not to do it.

Cash-heavy routes need tight controls. Reconcile each machine daily or weekly, depending on volume. Track cash from the vault to the machine and back. If your business keeps a simple ledger to track cash flow, you already have most of the records an examiner will ask for.

Use the Daily operating checklist to capture loading, reconciliation, and deposit steps. Signed logs are stronger evidence than memory. They also help you spot a machine that is being used for illegal activity.

If you use a third-party vault or armored carrier, get their records too. Your BSA duty does not transfer to the vendor. You still need to show you monitored the cash.

Beneficial ownership information reporting for the route entity

Beneficial ownership information reporting is a separate FinCEN requirement for many small companies, including route-operator entities. The Beneficial Ownership Information Reporting page explains who must file, what counts as a beneficial owner, and the deadlines.

A beneficial owner is generally a person who owns or controls at least 25 percent of the entity or exercises substantial control. For a family-owned ATM route, that may be one or two people. For a route held in a trust or through a holding company, the analysis is more involved.

Reporting companies file the identity of the entity and its beneficial owners, with identifying details. Updates are required when information changes. Many small entities qualify for exemptions, but the exemptions are specific. Do not assume your route company is exempt without checking.

This filing is separate from MSB registration. Registering as an MSB does not satisfy the beneficial ownership rule, and filing beneficial ownership does not satisfy MSB registration. Keep both current.

If you operate through several entities for different state licenses, each reporting company may have its own filing duty. Map the ownership chart once, then update it when ownership changes. Your accountant or attorney can help with the first filing.

Examinations, advisories and the cost of getting BSA wrong

FinCEN does not examine every small MSB each year, but it can request records and refer matters to other agencies. Your bank will also examine you indirectly through its own BSA program. A weak AML program can lead to account closure, which shuts down the route.

FinCEN publishes alerts, advisories, notices, bulletins and fact sheets that describe AML expectations for cash-intensive businesses. Read the ones that touch your locations and customer base. They are short and they tell you what examiners look for.

Penalties for BSA failures can be civil or criminal. They can include fines per violation, and in serious cases, prison time. Even a small route can face enforcement if it ignores SAR duties or helps move illicit cash. The safe from theft practices that protect your machines also reduce the chance that criminals use your route for laundering.

Advisories also flag regional risks. Routes in Texas, Arizona, and California near the southwest border see different patterns than routes in Illinois or New York. Use the advisories to adjust your monitoring, not to profile customers.

A route of 40 machines in Florida deposits $9,000 in cash each week. The owner splits deposits into $4,500 twice a week to avoid attention. The bank notices and files a SAR on the owner.

The owner now faces a structuring investigation, a possible account closure, and a damaged banking relationship. The fix is simple: deposit the full amount, keep the records, and let the bank file any currency transaction report it needs.

Common questions