From a Regulatory Litigator: Money Transmitter License for U.S. Crypto

If your business accepts and transmits convertible virtual currency on behalf of customers, federal law almost certainly treats you as a money transmitter, which triggers FinCEN registration and, in most states, a separate money transmitter license. Start now: map every customer fund flow, file FinCEN Form 107 within 180 days of crossing that threshold, and begin triaging which states demand a license before you take on customers there.

TL;DR:

  • Crypto businesses accepting and transmitting value substituting for currency automatically become money transmitters under federal law, requiring registration within 180 days regardless of transaction size.
  • State licensing requirements vary widely, often demanding bonds from $10,000 to over $1 million, along with ongoing financial, background, and compliance obligations.
  • An AML program must include a customer ID policy, ongoing risk scoring, transaction monitoring, and proper SAR and CTR processes to survive regulatory examinations.
  • Partnering with someone already licensed can accelerate market entry but requires thorough due diligence to ensure compliance and avoid future licensing roadblocks.
  • Most delays stem from incomplete filings, weak AML documentation, or misjudging state exemptions; early and parallel focus on financials and AML setup can significantly reduce licensing timelines.

Table of Contents

What Triggers a Money Transmitter License Crypto Requirement Federally?

FinCEN doesn’t care what you call your product. It cares what your product does. Under FinCEN’s guidance on convertible virtual currency business models, a business becomes a money transmitter when it accepts value that substitutes for currency and transmits that value to another person or location. That’s the whole test. Whether you’re running a centralized exchange, a peer-to-peer trading app, or a wallet with a “send” button, the acceptance-and-transmission pattern is what matters, not your token’s smart contract architecture or your marketing copy.

This activity-based approach means plenty of founders miss the trigger because they’re focused on the technology instead of the transaction. A DeFi front-end that never custodies funds might avoid it. A custodial wallet that lets users pay each other almost never does. The distinction lives in who holds the keys and who controls the transfer, not in whether the word “blockchain” appears in your pitch deck.

Once you’re classified as a money services business, you have to register. FinCEN requires every MSB to file FinCEN Form 107 within 180 days of the date your business began operating as an MSB. Registration isn’t optional paperwork you get to when convenient. Miss the window and you’re operating unregistered, which is its own violation independent of any underlying fraud or consumer harm. Renewal comes due every two years after that, and a compliance officer or authorized signer needs to own that calendar or it will slip.

Pro Tip: Set the 180-day and two-year renewal dates in your compliance calendar the same week you incorporate, not the week you launch. Founders consistently underestimate how fast “we’re still in beta” turns into “we’ve been an unregistered MSB for four months.”

Here’s the detail that catches early-stage teams off guard: there is no minimum transaction volume that exempts you. FinCEN has explicitly clarified that no dollar threshold applies to the money transmitter definition. A pilot program moving $40,000 a month faces the identical registration obligation as a platform moving $40 million. If you’re telling yourself you’ll deal with compliance “once you scale,” you’ve already misread the rule.

Registration is the doorway, not the destination. Once you’re an MSB, the Bank Secrecy Act obligations kick in immediately:

  • A written, board-approved AML program with a designated compliance officer
  • A Customer Identification Program (CIP) that verifies identity before or during onboarding
  • Ongoing transaction monitoring calibrated to your actual risk profile
  • Suspicious Activity Report (SAR) filings when transactions meet or suggest reportable criteria, along with Currency Transaction Report obligations where applicable (our SAR filing guide for crypto businesses covers the mechanics)
  • Five-year recordkeeping on transactions, customer identity, and program decisions
  • Independent testing of the AML program, typically annually

Examiners don’t grade on effort. They grade on documentation. A verbal commitment to “watch for suspicious activity” means nothing during an exam; a written program with escalation procedures, training logs, and audit trails is what keeps you off an enforcement docket.

How Do State Money Transmitter Laws Apply to Crypto?

Federal registration gets you through FinCEN’s door. It does nothing for the states, and that’s where most crypto founders underestimate the real cost of compliance. State money transmitter licensing sits on top of, not instead of, your FinCEN obligations, and most states now regulate crypto activity under their existing money transmission statutes. A handful carve out exceptions or issue separate virtual currency frameworks, but the default assumption should be that if you have customers in a state, that state wants a license.

The variability between states is not a minor inconvenience. A 50-state review of cryptocurrency and blockchain regulation from the University of Pennsylvania documents just how inconsistent the state landscape actually is. Bond amounts differ by an order of magnitude between states. Net worth thresholds move depending on transaction volume projections. Some regulators respond to applications in weeks; others take the better part of a year. There is no single “crypto license” you file once and use everywhere, and any vendor who tells you otherwise is selling you something.

Typical state requirements you’ll encounter across most jurisdictions:

  • A surety bond, often ranging from $10,000 in smaller or lower-volume states to $1 million or more in states with higher transaction volume expectations
  • Minimum net worth requirements, frequently tied to transaction volume tiers
  • Audited financial statements, sometimes waived for very early-stage applicants in favor of reviewed financials
  • Background checks and fingerprinting for officers, directors, and any individual holding 10% or more equity
  • Ongoing examinations, call reports, and financial statement filings after licensure

Given that reality, you need a method for deciding where to file first rather than attempting all fifty states simultaneously, which is both financially unrealistic and operationally impossible for most early-stage teams.

A practical triage approach:

  1. Pull your current and projected customer geography. Where do your actual users live, not where you hope they’ll live in eighteen months?
  2. Identify states where your fiat on-ramp or off-ramp activity concentrates. States regulate the fiat touchpoint hardest, so if you’re moving dollars in and crypto out (or vice versa) for residents of a state, that state’s exposure is highest.
  3. Check your banking partner’s own licensing footprint and risk appetite. Some banks will only support your program in states where you’re already licensed, which can force your sequencing.
  4. Cross-reference against FinCEN’s MSB state selector and the state-by-state resources compiled by regulators, then rank states by combined customer volume and licensing difficulty.
  5. Front-load the states where your bond, net worth, and documentation requirements are lowest to build licensing momentum and revenue while harder applications process.

This is the point where a lot of founders discover a gap between what they assumed and what the law actually requires. If you’re unsure whether your specific product model crosses the state licensing line, our breakdown of the crypto licensing gap walks through the common edge cases, including P2P platforms and non-custodial wallets that founders frequently misclassify.

What Does the Application Process Actually Cost and Take?

Ask ten compliance consultants how long a money transmitter license takes and you’ll get ten different answers, mostly because the honest answer is “it depends on which state and how clean your application package is.” Some states process complete applications in 90 to 120 days. Others, particularly ones with a backlog or a more skeptical posture toward virtual currency, can run past a year. The single biggest lever you control is application completeness, since an incomplete package doesn’t get rejected outright. It gets set aside, and that queue can cost you months.

Your core document checklist, gathered before you file anywhere:

  1. Audited or reviewed financial statements covering at least the prior fiscal year
  2. Written AML policies and procedures, including your CIP, monitoring thresholds, and SAR escalation workflow
  3. A compliance officer resume or CV demonstrating relevant experience, since regulators scrutinize who’s actually running the program
  4. Bank reference letters confirming an active banking relationship (a genuine hurdle for crypto businesses, and one we cover in our crypto business bank account guide)
  5. Proof of surety bond placement or a binding quote ready to convert
  6. Organizational charts showing ownership structure down to beneficial owners
  7. Corporate formation documents, including articles of incorporation, bylaws, and good-standing certificates from your home state
  8. Fingerprint cards and background check authorizations for all officers, directors, and qualifying equity holders

Costs stack up fast, and founders consistently underbudget them. Surety bonds alone can range widely in annual premium depending on the bond size and your credit profile, with larger state bond requirements commanding significantly higher costs due to risk assessment. Add outside counsel fees for drafting and filing (often the largest single line item for a multi-state rollout), audit or review fees running from a few thousand to tens of thousands of dollars depending on your financial complexity, and compliance software subscriptions for KYC and transaction monitoring that typically run monthly per-check or per-user fees.

Pro Tip: Get your surety bond quotes and your audited financials moving in the same week you start your FinCEN registration. These two workstreams have the longest lead times of anything in the process, and running them sequentially instead of in parallel is the single most common reason licensing timelines blow past a year.

Vendor selection matters more than most founders expect going in. A bonding company unfamiliar with crypto risk profiles will either decline you or price the bond punitively. An auditor without prior crypto engagement experience will slow your financial statement timeline while they figure out how to treat digital asset custody on your balance sheet. Ask any vendor directly how many crypto MSB clients they’ve closed in the last year before you sign an engagement letter.

What AML and BSA Systems Do You Actually Need to Build?

Registering as an MSB is the easy part. Building an AML program that survives an examination is where most crypto compliance efforts actually fail, and it’s rarely because founders didn’t know they needed one. It’s because they built a program that looks good on paper and falls apart the first time an examiner asks to see actual transaction-level evidence.

Your program needs four pillars, and skipping any one of them is a documented path to an enforcement referral:

  • Customer Identification Program (CIP): Identity verification before or during onboarding, covering name, date of birth, address, and a government-issued ID number, with a documented risk-based approach to enhanced due diligence for higher-risk customers
  • Customer Due Diligence (CDD): Ongoing risk scoring that updates as customer behavior changes, not a one-time check at signup
  • Transaction monitoring: Rules and thresholds calibrated to your actual product, since a monitoring system built for a retail exchange won’t catch the right patterns on a P2P trading platform
  • SAR and CTR filing workflows: A documented escalation path from “flagged transaction” to “filed report,” with clear ownership and timing benchmarks

The Travel Rule adds another operational layer that catches crypto businesses off guard specifically because it wasn’t written with blockchain rails in mind. Transmittals over the regulatory threshold require sending specific originator and beneficiary information to the next financial institution in the chain, and crypto’s pseudo-anonymous transfer mechanics make that data-sharing genuinely harder to implement than it is in traditional wire transfers. Our Travel Rule breakdown covers exactly which data elements you need and which counterparties you owe them to.

Pro Tip: When you’re evaluating a KYC or monitoring vendor, ask them to walk through a live false-positive rate from an existing crypto client, not a demo environment. Vendors optimize demos for clean results. Your actual customer base will generate messier data, and you need to know how the tool performs on it before you’re locked into a contract.

On the vendor side, a lot of integration failures come down to founders treating KYC and monitoring tools as plug-and-play. They aren’t. You need a vendor that supports the specific chains and asset types you’re handling, provides audit-ready logs (not just dashboards), and can produce documentation formatted the way state and federal examiners expect to see it. A guide like Murphy’s Law’s crypto compliance resource can help you scope what “audit-ready” actually means before you sign a vendor contract, and background verification tools such as BSA identity verification and CIP guidance are worth reviewing when you’re designing the identity-verification layer specifically.

Weak AML controls surface in examinations in predictable ways: monitoring rules that never generate an alert (a red flag in itself), SAR files with no supporting analysis attached, or a compliance officer who can’t explain the logic behind a risk score. Fix those gaps before an examiner finds them, not after.

Should You License State by State or Use a Partner Model?

You don’t have to choose between full national licensing on day one and doing nothing. Several intermediate paths exist, each with real tradeoffs founders should weigh against their growth timeline and risk tolerance.

  • Phased state-by-state filing: License your highest-volume states first, launch there, and expand your licensed footprint as revenue justifies the bond and compliance overhead. This is the slowest path to national coverage but the lowest financial risk per state.
  • Partner or agent reliance: Operate as an agent of an already-licensed money transmitter, or route custody and transmission through a licensed partner. This can compress your time-to-market significantly, but it also means your compliance fate is tied to your partner’s registration status and program quality, so due diligence on that partner is non-negotiable.
  • Limited-availability pilot: Launch only in states with lower bonding thresholds or clearer regulatory pathways, and use that pilot to build the operational and financial track record larger states will want to see.

Each path trades speed against control. The agent model gets you to market fastest but leaves you dependent on someone else’s compliance program, which is exactly the vulnerability IC3’s guidance on verifying MSB registration status warns about: checking that a partner is registered is a first-pass filter, not a substitute for actually reviewing their AML practices.

The trigger to convert from a partner model to direct licensing usually shows up as one of three signals: your transaction volume through the partner starts generating friction or fee drag that direct licensing would eliminate, your partner’s risk appetite or pricing changes in a way that threatens your unit economics, or a state regulator specifically requires you to hold your own license rather than operate under someone else’s.

Before relying on any partner or custodian, verify:

  • Current FinCEN MSB registration status via the registrant search
  • State licenses actually held (not just claimed) in the states where you need coverage
  • Whether their AML program has faced any consent orders or enforcement actions
  • How they handle Travel Rule data sharing with you as a counterparty

How Is New York’s BitLicense Different From Other States?

New York doesn’t play by the same rules as everywhere else, and founders who treat it as just another state application are consistently blindsided by how much deeper the review goes. The NYDFS Virtual Currency Business Licensing framework, commonly known as the BitLicense, applies to any business conducting virtual currency activity involving New York or New York residents, regardless of where the company itself is headquartered.

The application asks for financial disclosures, AML and cybersecurity program documentation, and business plan detail well beyond what most other states require. NYDFS examiners dig into your actual transaction monitoring logic, not just whether a policy document exists, and they expect a level of cybersecurity program maturity (incident response plans, penetration testing history) that smaller state regulators often don’t ask about at all.

Other states carry their own quirks worth flagging before you assume uniform treatment:

  • Some states evaluate crypto businesses case by case rather than through a dedicated virtual currency statute, which means your structure and specific activity can determine whether you need a license at all, or whether you fall outside the definition entirely
  • A handful of states have issued crypto-specific exemptions or safe harbors for narrow activity types, so a blanket assumption that “every state requires a license” can cause you to over-file and waste capital

Practical BitLicense prep:

  • Budget for a longer timeline than any other state, often exceeding a year for a complete review
  • Prepare deeper AML documentation than your baseline program, including specific transaction monitoring rule logic
  • Expect multiple rounds of follow-up questions rather than a single review cycle

What Are the Most Common Licensing Mistakes Founders Make?

Delays and enforcement referrals both trace back to a small, repeatable set of mistakes. Recognizing them early saves months.

  • Filing with incomplete financials. Submitting unaudited or informally prepared statements when a state requires audited ones doesn’t just slow the review, it often triggers a full restart of the review clock.
  • Weak or templated AML programs. A policy document copied from a template without customization to your actual product and risk profile reads as exactly that to an examiner, and it invites deeper scrutiny across your whole application.
  • Incomplete background materials. Missing fingerprint cards or incomplete disclosure on an officer’s prior regulatory history is one of the most common reasons applications stall in review.
  • Wrong assumptions about state coverage. Assuming a state exempts crypto activity without confirming it in writing, or assuming your non-custodial model exempts you when your actual fund flow says otherwise.

Enforcement examiners look for the same red flags across nearly every case: monitoring systems generating zero alerts over long periods, SAR filings without supporting analysis, and compliance officers who can’t walk through the reasoning behind a specific risk determination.

Pro Tip: If you discover a compliance gap during self-review, get counsel involved before you decide whether to voluntarily disclose it to a regulator. The difference between a proactively disclosed and remediated gap and one a regulator finds first is often the difference between a corrective action plan and a formal enforcement referral.

Why Work With a Crypto Regulatory Litigator on Licensing?

Liam Murphy, Esq., founder of Murphy’s Law, built his litigation background at Paul Hastings, Selendy Gay, and McKool Smith before focusing his practice on crypto. He has litigated matters involving Celsius, Terraform Labs, and BitMEX, giving him direct exposure to how regulators and courts actually treat crypto businesses when things go wrong, not just how the statutes read on paper.

That distinction matters for licensing work specifically. A firm that has defended enforcement actions knows exactly which documentation gaps examiners flag first, because they’ve seen the consequences of those gaps play out in real proceedings. Murphy’s Law supports crypto businesses through licensing counsel, AML program drafting tailored to actual product mechanics rather than generic templates, assembly of the bond and financial documentation packages states demand, and defense when a regulatory inquiry or examination turns adversarial.

Engage outside counsel specifically when you’re pursuing a New York BitLicense or a complex multi-state rollout, when you’ve received any form of regulatory inquiry, or when a self-review has surfaced a material AML gap you’re unsure how to remediate. Waiting until a regulator contacts you first is the most expensive way to get legal help. If you’re already facing an inquiry, our guide on how to respond to a crypto regulatory inquiry outlines the first moves that protect your position.

What Should You Do in the Next 30 to 90 Days?

Turn this into a working plan with owners and deadlines, not a someday list.

  1. Days 1 to 30: Map every customer fund flow in your product to determine your MSB status definitively. If confirmed, file FinCEN Form 107 immediately, and assign a named compliance lead with authority to build the program, not just a title.
  2. Days 1 to 30: Request surety bond quotes from at least two bonding companies with prior crypto MSB experience, since pricing and appetite vary widely by carrier.
  3. Days 30 to 60: Draft your written AML program, including CIP, monitoring thresholds, and SAR workflow, calibrated to your actual product rather than a generic template.
  4. Days 30 to 90: Assemble audited or interim financial statements, and open the state licensing applications in your two or three highest-priority states based on customer concentration.
  5. Days 60 to 90: Open or formalize banking relationships with institutions that have documented crypto risk appetite, since this frequently becomes the bottleneck that stalls licensing progress.
  6. Ongoing: Escalate to counsel the moment you find a documentation gap, receive a regulatory inquiry, or need to evaluate whether a partner or agent model fits your growth timeline better than direct licensing.

Where Can You Verify Registration and Licensing Requirements?

Start with the primary sources regulators themselves publish, not third-party summaries that go stale. FinCEN’s CVC guidance document and its MSB registration page are the two documents to reread before every major compliance decision. For New York specifically, NYDFS maintains its Virtual Currency Business Licensing page directly. The 50-state review from the University of Pennsylvania is the most useful academic survey for state-by-state comparison work.

Before relying on any partner or vendor’s claimed registration status, run it through FinCEN’s MSB registrant search yourself. For deeper compliance program templates and structured guidance, Murphy’s Law maintains a crypto compliance guide built specifically for founders navigating this exact process.

The Real Gap in Most Compliance Advice

Most guidance on this topic reads like a law school outline: accurate, thorough, and useless the moment you actually try to file something. The gap isn’t knowledge of the rules. It’s sequencing. Founders know they need FinCEN registration and probably a state license somewhere. What they don’t know is which task blocks which other task, and that’s where months get lost.

Crypto licensing and compliance sequence

The conventional advice treats federal registration and state licensing as a checklist to work through in order. In practice, they need to run in parallel from week one, because your bond quotes, your audited financials, and your AML program draft all have long lead times that don’t care about your filing sequence. Waiting to start state applications until federal registration clears is the single most common unforced delay I see in this space.

Prioritize the AML program draft and the financial documentation before anything else. Everything downstream, licensing, banking, even fundraising due diligence, depends on those two artifacts being real and specific to your product, not templated.

— Mark

Get Licensing Counsel That’s Actually Litigated Crypto Cases

Murphy’s Law is the alternative to generic compliance consultants for crypto founders navigating money transmitter licensing: instead of a templated policy binder, you get counsel that has defended real enforcement actions involving Celsius, Terraform Labs, and BitMEX, and knows exactly what examiners flag first.

Murphyslawcrypto

That courtroom experience shapes how the firm builds AML programs and assembles licensing packages. Documentation gets drafted to survive an actual examination, not just to check a box on an application form. Whether you need help sequencing FinCEN registration against a multi-state licensing rollout, drafting an AML program tailored to your specific product, or responding to a regulatory inquiry that’s already landed, Murphy’s Law works with founders at every stage of that process. If you’re ready to move past the planning stage, start with the firm’s crypto compliance consulting services to get a licensing and AML roadmap built around your actual business model, not a generic template.

Sources

FAQ

How Much Does It Cost to Get a Money Transmitter License?

Costs vary widely by state, but expect surety bond premiums ranging from a few thousand dollars annually to well into six figures for the largest state bond requirements, plus counsel fees, audit costs, and compliance software subscriptions that together often represent the largest expense category for a multi-state rollout.

How Hard Is It to Get a Money Transmitter License for a Crypto Business?

It’s genuinely difficult for most crypto businesses because state requirements vary widely and processing times can run from 90 days to over a year, especially for states like New York that demand deeper AML and cybersecurity documentation than a typical state application.

Which US State Is Considered Crypto-Friendly for Licensing?

No state is exempt from the general expectation that crypto businesses need licensing, but states vary significantly in bond size, net worth thresholds, and review speed. Check current requirements directly with each state regulator rather than relying on reputation alone, since frameworks change frequently.

Can the FBI Track Cryptocurrency Transactions?

Yes. Law enforcement, including the FBI, regularly traces blockchain transactions using forensic tools, and IC3 guidance confirms that registered MSBs with proper AML and recordkeeping controls are a key part of how illicit transaction chains get identified and disrupted.

Do I Need Both Federal MSB Registration and a State License?

In most cases, yes. FinCEN’s MSB registration is a federal requirement, and it does not substitute for the state money transmitter license that most states separately require for crypto activity involving their residents.

Want Liam to Fight For You?

Experience fighting billion dollar frauds.
Contact Liam Murphy
Envelope Linkedin X-twitter Youtube

Copyright © 2025 Murphyʼs Law – Crypto Law Firm

Contact Liam Murphy

Fill out the form below, and we will be in touch shortly.
Tell us Who You Are
How Can We Help?