MSBs, PSPs, and E-commerce Platforms

Why MSBs, PSPs, and E-commerce Are High Risk

A money services business (MSB) is a non-bank financial firm that transmits money, exchanges currency, cashes checks, or sells money orders, traveler's checks, or prepaid access. A payment service provider (PSP) processes card and account-to-account payments for merchants, and e-commerce platforms combine marketplaces with embedded payment rails. All three move value quickly, frequently through agents, third parties, and cross-border corridors, which limits the originating institution's visibility into the ultimate customer.

Under the US Bank Secrecy Act, an MSB must register with the Financial Crimes Enforcement Network (FinCEN) within 180 days of being established, renew that registration every two years, and maintain a list of its agents. MSBs file a Currency Transaction Report (CTR) for cash transactions above USD 10,000 in a single day and a Suspicious Activity Report (SAR) at the MSB threshold of USD 2,000 (USD 5,000 where an issuer can identify a suspect). Money transmitters must also retain records for transmittals of USD 3,000 or more under the Recordkeeping and Travel Rule.

The CAMS exam frames these as Understanding the Risks and Methods of Financial Crime items (one of the four official domains). It is a 120-question, 3.5-hour proctored exam delivered at Pearson VUE or via online proctoring, with a passing score of 75 and no penalty for guessing. Expect to apply a control to a fact pattern rather than recite a definition.

Core Typologies and Red Flags

Launderers exploit MSB and PSP speed through a small set of repeatable methods. Knowing the indicator lets you pick the matching control on the exam.

Key behavioral flags: customers who decline to provide identification when a transaction crosses the USD 3,000 recordkeeping line, transfers structured to avoid the USD 10,000 CTR trigger, third parties who direct a customer's transactions, and outbound volume to jurisdictions on the FATF grey or black list. For PSPs, watch for transaction laundering (a merchant processing payments for an undisclosed second business) and merchants with mismatched MCC codes.

Agent Oversight, Nested Risk, and Controls

A principal MSB remains accountable for activity flowing through its agent network. Agent due diligence must verify the agent's licensing, screen its beneficial owners against sanctions lists, set transaction limits, and trigger periodic reviews. A bank that banks an MSB faces nested risk: the MSB's downstream agents and sub-agents become indirect customers the bank cannot see directly, so the bank applies enhanced due diligence (EDD) and may require visibility into the MSB's own program.

A risk-based program for these sectors layers the following:

• Customer due diligence (CDD) at onboarding, with EDD for high-volume or high-risk-corridor customers.
• Beneficial ownership collection for merchant and corporate customers under the US CDD Rule (the 25% ownership and one control-person standard).
• Sanctions screening of senders, beneficiaries, and counterparties in real time, including fuzzy matching for name variants.
• Transaction monitoring that aggregates across IDs, devices, and agents to catch structuring that a single-transaction view would miss.
• Travel Rule transmission of originator and beneficiary data on qualifying transfers.

Worked scenario: A money transmitter agent records nine USD 9,500 cash-to-wire transfers from different senders to the same beneficiary in two days. The CAMS-correct response is to aggregate the linked activity, recognize likely structuring and a funnel account, file a SAR, and review the agent for collusion — not to immediately terminate every customer at that branch. The best answer reflects proportionality and documented process.

Prepaid Access, Exam Pitfalls, and Distinctions

Prepaid access (stored-value and prepaid cards) deserves separate attention because it can be loaded with cash, carried across borders without triggering currency-reporting at the same way physical cash does, and reloaded anonymously below identification thresholds. A prepaid program provider and seller are themselves MSBs when they sell more than USD 1,000 in prepaid access to one person in one day, which obliges identification and record-keeping. Reloadable cards layered through many small top-ups, then drained to a single beneficiary, mirror the funnel-account pattern but on plastic rather than wire rails.

The CAMS exam likes to test three distinctions in this sector. First, the CTR threshold (above USD 10,000 in cash) versus the MSB SAR threshold (USD 2,000) versus the recordkeeping/Travel Rule threshold (USD 3,000) — candidates routinely confuse them. Second, the difference between terminating a relationship (de-risking) and filing a report while keeping the account open so law enforcement can observe the flow; the exam usually prefers monitoring and reporting over abrupt closure unless risk is unmanageable.

Third, tipping-off: once a SAR is filed or contemplated, staff must not reveal that fact to the customer, even when asked directly.

Common traps to avoid: assuming a customer who passes onboarding KYC needs no further monitoring; treating each agent or each card load in isolation when aggregation is required; and choosing the most punitive option when the fact pattern supports a proportionate, evidence-based control. A strong CAMS answer names the typology, applies the correct reporting trigger, preserves the tipping-off boundary, and scales the control to the residual risk rather than reaching for termination by default.

Keep a one-line note after each missed practice item recording the typology, the threshold, the obliged party, and the next control step — that habit converts a wrong answer into durable exam knowledge.