BSA / AML

Also called Bank Secrecy Act, anti-money laundering, AML program

The federal anti-money-laundering framework that reaches merchants indirectly, through the obligations it puts on banks and acquirers.

What it is

The Bank Secrecy Act and the anti-money-laundering rules built on it require financial institutions to know their customers, monitor for suspicious activity, and report it. FinCEN administers the framework. Most small merchants never interact with it directly, and yet nearly every uncomfortable question they get asked in payments traces back to it. The transmission path runs downhill. The sponsor bank has statutory obligations. It imposes them on the acquirer by contract. The acquirer imposes them on the ISO or agent. The ISO asks the merchant for documents. By the time it reaches a business owner in Fort Myers it looks like paperwork invented by a salesperson, and it is not. For payments companies themselves, classification matters. A traditional ISO or sales agent that never takes possession or control of merchant funds generally falls within FinCEN's payment processor exemption from money transmitter status, described in administrative ruling FIN-2014-R009. That exemption is conditional, with a multi-part test covering clearance and settlement through BSA-regulated institutions, a formal agreement, service to the seller of goods or services, and bona fide sale transactions. Regardless of registration status, an ISO in practice inherits contractual AML obligations from its sponsor: customer identification on the merchant and beneficial owners, site inspection or equivalent, sanctions screening, MATCH inquiry, website review, TIN matching, expected volume setting, and ongoing monitoring for transaction laundering and out-of-scope processing.

Why it matters to your business

When your processor asks for your beneficial owners, an invoice supporting an unusual transaction, or an explanation of why your volume tripled, that is not suspicion. It is a bank obligation flowing downhill, and treating it as an insult delays your money. Answer it in writing, keep a copy, and move on. If you are ever asked to run someone else's transactions through your merchant account, even as a favour to a business partner who cannot get approved, that is the precise activity this framework exists to catch. It is transaction laundering and it ends accounts and careers. This is education, not legal advice. BSA and AML questions about your own obligations belong with an attorney.

Where it gets contested

The persistent criticism is that AML compliance produces enormous documentation and comparatively little enforcement value, while pushing entire lawful industries out of the banking system. De-risking is the industry term for a bank exiting a category wholesale rather than underwriting it individually, and cannabis-adjacent businesses, money services businesses and some international-facing merchants live inside that outcome. The fintech middleware failures of 2024 and 2025 sharpened the argument in the other direction. The Federal Reserve issued an enforcement action against Evolve Bank and Trust in June 2024 citing anti-money-laundering, risk management and consumer compliance deficiencies, in the same period as the Synapse collapse that froze roughly 200 million dollars of end-user money. That episode is the strongest available evidence that the obligations are not theatre. The unresolved question for small operators is proportionality. There is no scaled program for a two-person ISO, so the practical standard is whatever the sponsor bank requires, which varies widely and is not published.

How to check it yourself

Ask your processor who their sponsor bank is and keep the answer on file. If your funding is ever interrupted, knowing the bank behind your account is the first piece of information any advisor will ask you for.

Receipts

Claims above that are checkable, with where to check them. Published so you do not have to take anyone's word for it.

FinCEN administrative ruling on the payment processor exemption and its four-part conditions
fincen.gov ↗
FinCEN is the bureau administering the Bank Secrecy Act framework
fincen.gov ↗
The Federal Reserve issued an enforcement action against Evolve Bank and Trust in June 2024 citing AML, risk management and consumer compliance deficiencies
en.wikipedia.org ↗
Visa requires members to ensure third party agents comply with anti-money-laundering, sanctions and consumer protection law
usa.visa.com ↗