One $37 Million Fine Is 284 Years of Compliance Payroll. A $1,299-a-Month Platform for the MSBs the Bank Vendors Ignore.
FinCEN counts 28,456 principal MSBs plus an estimated 229,161 agents in the United States. Every principal must run a four-pillar anti-money-laundering program under the Bank Secrecy Act, and is on the hook for its agents' compliance too. Fines reach the tens of millions. But enterprise vendors like Verafin and NICE Actimize sell enterprise contracts to banks, so a storefront MSB whose owner is also the teller runs its AML program on a spreadsheet, a filing cabinet, and hope. Meanwhile the GENIUS Act just made stablecoin issuers BSA-obligated financial institutions, with deadlines landing in 2027.
The Problem
Picture a check cashing storefront in El Paso. It cashes payroll checks, sells money orders, wires money across the border, and handles a few hundred cash transactions a day. Under federal law, this shop is a money services business. It must maintain a written AML program with four pillars: policies and internal controls, a designated person running day-to-day BSA compliance, training for staff, and independent testing of the program (31 CFR 1022.210). It must file currency transaction reports for cash transactions over $10,000, aggregate same-day transactions toward that threshold, keep five years of records, and hand FinCEN or IRS examiners a complete agent list within 15 days of a request.
That is the same legal architecture that governs a regional bank, except the check casher has no compliance department, no general counsel, and no risk committee. The designated person is usually the owner, who is also the teller. The "independent testing" requirement gets satisfied by a consultant who shows up once a year or, in the more common outcome, does not get satisfied at all, which means the program exists mostly on paper until the day an examiner walks through the door.
Now look at who sells to this market. Verafin, which Nasdaq bought for $2.75 billion, leads with banks. NICE Actimize, doing roughly $453.5 million in annual revenue, is the default platform for Tier 1 and Tier 2 institutions. Every one of the seven credible incumbents sells quote-based enterprise contracts. Not one of them publishes pricing, and not one of them markets to a 13,000-store check cashing industry (trade-group figures from circa 2006-2012, the most recent public aggregate available). Only Alessa names MSBs, on a Microsoft Marketplace listing, while the rest of the industry barely acknowledges the mid-market MSB exists. The pattern is clear: the vendors' center of gravity is banks and fintechs, and no one has built the MSB regulatory package (four-pillar program builder, agent lists, FinCEN BSA E-Filing formats) as the product. Remarkable, given that this is the segment FinCEN fines when it wants to make an example.
And the stakes of getting this wrong are not theoretical. In February 2025, FinCEN fined Brink's Global Services USA $37 million for operating as an unregistered money transmitter with no effective AML program and zero SARs filed, despite moving hundreds of millions in bulk currency across the Southwest Border. In December 2025, FinCEN hit the crypto platform Paxful with a $3.5 million penalty for the same basic failures: failure to maintain its MSB registration, no real AML program, late and incomplete SARs. And in that same month, FinCEN launched a first-of-its-kind data-driven operation targeting more than 100 MSBs along the Southwest border, analyzing over one million CTRs and 87,000 SARs with new data-processing technology that turns the industry's filing history into a hunting ground.
Here is the arithmetic that makes this a startup idea. A designated BSA compliance officer costs, on a base-salary basis, roughly $92,250 to $134,500 nationally (Robert Half, 2026 guide), and AML-specific surveys put the range at $90,000 to $160,000. At a ~$100,000 base salary (the low-to-mid end of those published ranges) times a conventional 1.3x benefits-and-taxes loading (not a published benchmark), a small MSB is looking at roughly $130,000 a year for one person. Most MSBs cannot justify that hire, so they underinvest, they miss filings, and when FinCEN's data operation finds them (as it did with more than 100 MSBs along the Southwest border in December 2025), the fine is measured in millions, which closes the loop on why the spreadsheet was never a strategy. The entire industry is caught between a compliance cost it cannot afford and an enforcement penalty it cannot survive.
The Numbers
FinCEN's September 2025 Federal Register notice on the costs of AML/CFT compliance gives the definitive market census: 28,456 principal MSBs (a 2022-2024 year-end average, principals only) and an estimated 229,161 agent MSBs (FR Doc. 2025-18918). Divide one by the other and you get the industry's hidden structure: roughly 8 agents per principal. Each principal is independently and wholly responsible for its agents' AML compliance, and neither side can contract the liability away, which means the principal with eight agents is on the hook for eight storefronts' worth of compliance failures, because when one agent's teller skips the CTR aggregation on a structured cash drop, the principal's program is the one FinCEN grades.
Filing volumes are enormous. In FY2024, FinCEN received 4.7 million SARs and 20.5 million CTRs; depository institutions filed 2.6 million of the SARs (FinCEN Year in Review FY2024). That leaves roughly 2.1 million non-bank SARs, and MSBs (principally money transmitters) are widely understood to be the largest non-bank filer group, though FinCEN has not published an MSB-specific total. One regulatory nuance matters enormously for product design: check cashers are the one MSB type not required to file SARs. The controlling regulation, 31 CFR 1022.320(a)(1), imposes the $2,000 SAR duty on money transmitters, dealers in foreign exchange, money order issuers/sellers/redeemers, traveler's check issuers/sellers/redeemers, prepaid access providers and sellers, and USPS, but not on check cashers. Currency exchangers, by contrast, file SARs at the $2,000 threshold like money transmitters. All MSBs, check cashers included, are expressly required to file CTRs (31 CFR 1010.311), which means the compliance burden for the check-cashing segment is CTRs plus the four pillars plus agent oversight. A platform that tries to sell SAR tooling to a check casher is selling a product the customer is legally exempt from using. Get the segmentation right or lose the deal.
TAM math, built only on the verified principal-MSB count:
| Scenario | Principal MSBs | Attach Rate | Customers | Annual ACV | Annual TAM |
|---|---|---|---|---|---|
| Conservative | 28,456 | 3% | 854 | $11,748 | $10.0M |
| Base case | 28,456 | 5% | 1,423 | $11,748 | $16.7M |
| Optimistic | 28,456 | 10% | 2,846 | $11,748 | $33.4M |
Scenarios are illustrative judgments, not benchmarks. The $11,748 blended ACV assumes roughly 60% of customers on the $1,299/month transmitter tier and 40% on the $499/month check-casher tier; the actual tier mix is unmeasured (see Limitations). The $1,299/month price point is this article's estimate: no incumbent found publishes pricing.
Two expansion wedges sit outside this table. The first is the 229,161 agents: a lightweight agent-facing module (training records, incident reporting, transaction-log exports to the principal) at even $49 a month would add roughly $6.7M in annual revenue at an illustrative 5% attach rate. That module turns the platform into the industry's agent-oversight standard, a defensible position no bank vendor is pursuing. Second, the GENIUS Act: stablecoin issuers became BSA "financial institutions" on July 18, 2025 (P.L. 119-27), the April 8, 2026 FinCEN/OFAC proposed rule sets a $5,000 SAR threshold for permitted payment stablecoin issuers, and the issuance prohibition bites on January 18, 2027 at the latest (or 120 days after final rules, whichever comes first). The OCC has already conditionally approved five national trust bank charters for crypto firms (Circle, Ripple, BitGo, Fidelity Digital Assets, Paxos, December 12, 2025; Circle's final approval followed in July 2026), and every one of those issuers needs an AML program even though none of them is a bank. The price is set against the $125K-plus fully-loaded officer it shrinks, not against Verafin's enterprise contracts.
Existing Players and Their Gaps
| Vendor | What They Do | The Gap |
|---|---|---|
| Verafin (Nasdaq) | Enterprise anti-financial-crime cloud platform. Acquired for $2.75B cash (announced Nov 19, 2020). Over 2,000 financial institutions at acquisition; Nasdaq cited a $13B addressable market (bank-centric financial-crime software, a different market than the MSB-only TAM above). | Bank-first positioning, enterprise contracts, no public pricing. The 28,456 principal MSBs are not in its go-to-market. |
| NICE Actimize | Established enterprise full-stack financial-crime platform. Acquired by NICE in 2007 for ~$280M. 2024 revenue ~$453.5M. | The default for Tier 1 and Tier 2 institutions. A check casher is not calling NICE, and NICE is not calling the check casher. |
| ComplyAdvantage | AI/NLP screening data (sanctions, watchlists, PEPs, adverse media). $50M Series C (July 2020) plus $20M extended round from Goldman Sachs (2021). | Screening data, not a BSA program suite. A sanctions-screening feed does not file a CTR, run training, or produce an agent list on 15 days' notice. |
| Alessa (CaseWare) | End-to-end AML platform explicitly marketed to banks, MSBs, fintechs, casinos, and insurance. Claims 70-100% auto-population of SAR/STR/CTR reports; 20+ countries. | The only incumbent that names MSBs as a target segment. Also the closest direct competitor. No public pricing; positioning skews toward its bank and casino base. |
| Unit21 | AI-native fraud and AML detection with regulatory filing. 180+ customers across 90+ countries; 1.5M alerts processed by AI agents. | Fintech and mid-market focus (credit unions, community banks). MSB-specific workflows (agent oversight, GTO thresholds, money-service activity flags) are not the product's center of gravity. |
| Hummingbird | AML investigations CRM. $30M Series B (Dec 2021); $41.8M total raised. | Investigations and case management layer, not transaction monitoring or filing. Solves one pillar fragment, not the program. |
| Flagright | AI-native financial-crime platform. $12.5M Series A (June 2026); ~$19.6M total raised; 100+ banks and fintechs. | Banks and fintechs again. Deployable in ~2 weeks, which is the right velocity, but the MSB regulatory package (four-pillar program builder, agent lists, FinCEN BSA E-Filing formats) is not its thesis. |
Look at the pattern: everyone sells to banks and fintechs, and the one vendor that names MSBs does not publish pricing or self-serve, while the industry's own trade group, FiSCA, represents a check cashing market where nine national companies control under 35% of storefronts (trade-group figures from circa 2006-2012, the most recent public aggregate available), which means the long tail is thousands of independents with no enterprise sales relationship and no compliance department. Nobody lost this market on features. They lost it by never calling the customer.
The Solution
A BSA/AML compliance platform built specifically for MSBs, organized around the four pillars rather than bolted onto bank workflows:
1. Four-pillar program builder. Instead of a blank AML policy template, the platform generates the customer's written program from their actual business profile: activity types, transaction volumes, geographic footprint, agent network. It assigns the designated compliance person, schedules the training curriculum for tellers and agents, and books the independent testing cycle. The output is a living program document that updates when the business changes, not a PDF that dies in a drawer. This matters because FinCEN's 2026 program-reform proposal would add a mandatory risk-assessment process and a U.S.-based compliance officer requirement for MSBs, and the platform becomes the risk assessment the moment that rule finalizes.
2. Transaction monitoring tuned to MSB thresholds. $2,000 SAR triggers for money transmitters (with the 31 CFR 1022.320 clearance-record exception at $5,000), $10,000 CTR triggers with same-day aggregation (31 CFR 1010.311), and the Southwest-border Geographic Targeting Order, reissued effective September 3, 2026 through March 1, 2027, lowers the cash-reporting threshold to $1,000 (covering $1,000-$10,000 transactions) in covered Texas and New Mexico ZIP codes. A bank platform does not know about GTO zones, yet for MSBs on the border that is the filing rule that matters, and missing it is the kind of technical violation an examiner finds in ten minutes while the owner is still looking for the filing cabinet.
3. Filing-ready SAR and CTR preparation. The platform drafts the SAR narrative from the alert record, assembles the CTR from aggregated transactions, and exports file-ready submissions for FinCEN's BSA E-Filing system. For the SAR-exempt segment (check cashers only), the product leads with CTR automation and pillar management instead, since that is the actual legal burden they carry. Currency exchangers file SARs at the $2,000 threshold like money transmitters, so they get the full monitoring module; selling a currency exchanger a SAR-free tier would be the malpractice, not the other way around.
4. Agent oversight module. The principal's three duties (identify agent owners, continually evaluate agent operations, evaluate agents' controls) plus the statutory agent list, updated annually per the FIN-2016-G001 standard and producible within the 15-day window. With roughly 8 agents per principal on average, most principals are tracking this in email threads and filing cabinets (illustrative, but ask any examiner), which is why one platform, one list, and one click (the examiner gets the list before the coffee cools) is the entire value proposition of the module.
5. Permitted-payment-stablecoin-issuer (PPSI) module for the stablecoin wave. Permitted payment stablecoin issuers face a distinct rulebook: $5,000 SAR threshold on primary-market activity, CTRs, Recordkeeping and Travel Rule obligations, ongoing customer due diligence, and the token freeze/seize capability. A module that maps the bank-grade obligations onto a crypto-native issuer is a greenfield product, and nobody has built it because the proposed rule is only six months old. That timing is exactly when a startup wants to arrive.
Revenue Model
| Revenue Stream | Price | Notes |
|---|---|---|
| Core SaaS (money transmitters) | $1,299/mo | Full platform: program builder, monitoring, SAR/CTR prep, training, testing schedule. |
| Core SaaS (check cashers) | $499/mo | CTR automation + four-pillar management + recordkeeping. No SAR module: check cashers are the one MSB type exempt from SAR filing. Priced to match the thinner burden and thinner margins. |
| Core SaaS (currency exchangers) | $799/mo | Full monitoring including SAR prep (dealers in foreign exchange carry the $2,000 SAR duty), CTR automation, four-pillar management. |
| Agent oversight add-on | $199/mo per 25 agents | Principal-side module; scales with network size. Roughly 8 agents per principal on average, so most customers pay the first tier. At typical attach this adds ~$2,388/yr per customer, roughly 20% upside to the tabled ACV. |
| Agent-facing module | $49/mo per agent | Training records, incident logging, transaction exports. Expansion revenue from the 229,161-agent base. |
| PPSI module | $2,999/mo | Stablecoin-issuer rulebook: $5K SAR threshold, CDD, Travel Rule, freeze capability workflows. Premium because the customers are venture-funded issuers, not storefronts. |
| Onboarding and program setup | $3,000-$10,000 one-time | Historical record migration, agent-list compilation, initial risk assessment, first independent test. Priced by location and agent count. |
| Independent testing service | $5,000-$15,000/yr | The fourth pillar, delivered as a service: annual independent program review by a contracted BSA examiner network. Recurring, high-margin, and the part customers fear most. |
Unit economics (estimated): blended ACV of roughly $11,700 across tiers, assuming about 60% of customers on the $1,299 transmitter tier and 40% on the $499 check-casher tier (the currency-exchanger tier and the actual mix are unmeasured; see Limitations). Blended gross margin runs ~65-75% at full testing attach: SaaS at ~85%, the $5,000-$15,000/yr independent-testing service delivered through contractors at ~50%. The ~80-85% figure applies to pure-SaaS customers only (the 80% lower bound is the margin used in the break-even math below). One legal boundary the pricing must respect: software cannot be the designated person. A human must hold the role. The platform's value is eliminating the need for that person to be a full-time, $130K specialist, not eliminating the person.
Acquisition math (illustrative): CAC via FiSCA and state MSB association conferences (~$4-5K fully loaded per close at 40 closes/yr), post-examination remediation demand (examiners direct MSBs to fix deficient programs but cannot recommend a vendor), and the GENIUS Act issuer pipeline. LTV/CAC runs ~11x on the transmitter tier (~$50K contribution-LTV against ~$4.3K CAC) and ~4x on the $499 tier at 30% assumed churn (~$16K contribution-LTV). Compliance software is sticky because the transaction history and the program record become the customer's system of record for examiner visits, and switching means rebuilding five years of filing history. Expect 4- to 5-year customer lifetimes on transmitter tiers (an assumption) and ~3.3-year life at 30% churn (an assumption) on the $499 check-casher tier, which is what makes the conference-circuit CAC pay back even when the initial sale took three meetings and a trade-show booth to close.
Break-even (estimated): at ~$133.3K/month burn ($1.6M seed over 12 months), break-even needs roughly 130-210 customers depending on tier mix ($1,039/month contribution per $1,299 customer at 80% margin; $636-$734/month at the $11,748 blended ACV and its 65-75% margin). Reaching that from first revenue (month 12) inside an 18-month runway is not credible. Honest break-even is 30-36 months unless post-launch burn drops (engineering ramps down, support scales sub-linearly).
Startup Costs
| Category | Cost | Notes |
|---|---|---|
| Engineering (4 engineers, 12 months) | $780K | Monitoring engine, BSA E-Filing format exports, program-builder rules engine, agent module. The E-Filing format knowledge is the scarce skill. |
| BSA/AML domain expert (compliance officer hire) | $150K | Ex-MSB compliance officer or former IRS SB/SE examiner. Designs the four-pillar workflows; non-negotiable for credibility. |
| Outside legal review (BSA counsel) | $120K | Reviews the program-builder outputs, filing-drafting logic, and the disclaimers. The software drafts filings; a lawyer keeps the liability framing honest. |
| Design and product (1 designer, 9 months) | $130K | The customer is a teller-manager, not a bank analyst. If the alert queue needs training to read, the product fails. |
| Infrastructure and screening data | $110K | Cloud, data pipeline, sanctions/PEP data. Commercial redistribution licenses for screening data run $30-50K+/yr minimums alone. |
| SOC 2 Type II | $70K | A platform holding customer transaction records and drafting BSA filings will be asked for it. Budget it now, not after the first enterprise conversation. |
| Go-to-market (conferences, associations, content) | $115K | FiSCA conferences, state MSB association events, examiner-facing content, plus $25K to recruit and vet the contracted-examiner network behind the testing service. Enterprise-style field sales are the wrong motion; this is conference-and-referral sales. |
| E&O insurance | $40K | A product that drafts legal filings carries real errors-and-omissions exposure. Size it for a compliance product, not a to-do app. |
| Operating buffer (6 months) | $70K | Misc, overruns, the things nobody budgets. |
| Total (estimated) | $1.6M | Seed round. 12-month runway to first revenue at the stated burn. Reaching ~45 customers by month 18 (the pace implied by an 18-month cash-out) requires ~8 closes/month from launch, which is aggressive for a 3-meeting sales cycle. Size the seed at ~$3M for a 24-month cushion at the stated burn, or commit to a post-launch burn cut to ~$70K/mo (engineering ramps down, support scales sub-linearly) for the $1.6-1.8M seed to stretch. |
This is honest software economics: no factory, no inventory, no $280K CNC machine. The hard part is not the code. It is the regulatory knowledge embedded in the code, which is why the domain expert and the BSA counsel are line items instead of afterthoughts. A generic RegTech team that has never read a FinCEN examination manual will build the wrong product, beautifully.
Why Now
Start with the enforcement drumbeat: it targets exactly the spreadsheet MSB, and none of it existed in 2022. In February 2025, FinCEN fined Brink's $37 million for operating as an unregistered money transmitter with no AML program and zero SARs. In December 2025 came the Paxful penalty ($3.5 million) and the first-of-its-kind data-driven operation against more than 100 MSBs along the Southwest border, running over one million CTRs and 87,000 SARs through new data-processing technology to find non-compliant firms. The reissued border GTO (September 3, 2026 through March 1, 2027) lowers the cash-reporting threshold to $1,000 in covered Texas and New Mexico ZIP codes. For border-region MSBs, spreadsheet compliance is now detectable; the question is whether the pilot expands nationally, which is the risk every other principal should be pricing in. This leg does not depend on any rulemaking outcome.
Layer on the 2026 program-reform proposal: it would raise the floor, if it survives. FinCEN's proposed AML/CFT program reform, which expressly covers MSBs, would mandate a formal risk-assessment process and a U.S.-based compliance officer, with a 12-month implementation period after any final rule. Finalization timing and final scope are still open (the 2026 program-reform proposal fully superseded the July 2024 NPRM, so inevitability is the wrong assumption), but a vendor that ships the risk-assessment deliverable now has it in market before the phase-in clock starts. One honest caveat: if the burden-reduction agenda wins and the risk-assessment requirement dies in the rulemaking, this leg dies with it. The enforcement drumbeat and the data-driven surveillance are the legs that do not depend on the rulemaking outcome.
FinCEN's posture is two-sided, and both sides sell the product. On the relief side: joint SAR FAQs on October 8, 2025 aimed at reducing needless compliance spend, and a first-ever survey of AML compliance costs launched September 30, 2025, explicitly to shape deregulatory proposals. On the enforcement side, the Brink's and Paxful fines and the border sweep show the stick is real. The message to an MSB owner is coherent: the government is telling you to spend less on low-value compliance and more on the compliance that matters. A platform that automates the former and enforces the latter is exactly what both messages point to.
Then the GENIUS Act, which created a new obligated industry, except the buyers are not who you think. Signed July 18, 2025, it made permitted payment stablecoin issuers BSA financial institutions with AML/CFT and sanctions programs and token freeze capability. The April 8, 2026 FinCEN/OFAC proposal set the $5,000 SAR threshold and the rest of the rulebook; the issuance prohibition bites January 18, 2027 at the latest (or 120 days after final rules, whichever comes first). That is a statutory prohibition less than three months out, with the compliance rulebook still only proposed, meaning issuers face a hard deadline before the final requirements are even settled. One caveat: the five conditional OCC charter holders (Circle, Ripple, BitGo, Fidelity Digital Assets, Paxos, December 12, 2025; Circle's final approval followed in July 2026) are venture-funded trust banks that will build in-house programs. They are a premium enterprise sale, not a self-serve one, and the demand evidence is the proposed rulebook, not demonstrated buyer behavior. As of October 2026, none of the seven incumbents profiled in this article markets a PPSI-specific compliance package, though enterprise vendors are already positioning on the 2026 program-reform risk-assessment requirement, so that window is narrowing.
2022 was too early; 2030 is too late. In 2022 there was no GENIUS Act, no $37 million Brink's precedent, no border data operation, no mandatory risk-assessment proposal. By 2030 the program-reform rulemaking will be resolved one way or the other: either the rule is final and phased in, with examiners standardized around whatever vendors answered it first, or the burden-reduction agenda killed it. Either way, the PPSI greenfield will have incumbents. The window is the rulebooks being proposed-but-not-final: obligations visible, vendor positions unsettled. That is a condition that exists in 2026 and will not exist in 2030.
Original Analysis: The Penalty-to-Payroll Ratio and the Filing Burden Bounds
Here is the calculation nobody in the RegTech industry has published, because the industry sells to banks and has never needed to do MSB math.
The penalty-to-payroll ratio. FinCEN fined Brink's $37 million for BSA failures. A fully-loaded BSA compliance officer costs roughly $130,000 a year (a ~$100,000 base salary, the low-to-mid end of published ranges for the role, times a conventional 1.3x benefits-and-taxes loading, not a published benchmark). Divide: $37,000,000 / $130,000 = 284.6 years. One enforcement action equals 284 years of compliance payroll. The Paxful case is the small-MSB version: $3.5 million / $130,000 = 26.9 years of compliance payroll for a single penalty. These ratios are the entire sales pitch in two numbers, because the fine for getting it wrong is measured in decades of the salary that would have prevented it. That division is the opener of the sales call; the closer is proving the product survives contact with a teller-manager.
The agent-density number. 229,161 agents / 28,456 principals = 8.05 agents per principal. This is the industry's operational reality in one division. Every principal's AML program must cover roughly eight agent relationships, each independently liable, each requiring owner identification, operational evaluation, and control assessment. The agent list must be producible to FinCEN or the IRS within 15 days. At 8 agents per principal, the list is small enough to manage in a spreadsheet and large enough to go stale in one, which is the exact shape of a problem that software eats for breakfast.
The filing-burden bounds. FinCEN's FY2024 figures give 4.7 million SARs, of which 2.6 million came from depository institutions (ABA Banking Journal). The residual, roughly 2.1 million SARs, is the absolute ceiling for all non-bank filers combined. Spread evenly across the 28,456 principal MSBs, that ceiling is about 74 SARs per principal per year. The true number is unknowable from published data (FinCEN has not released an MSB-specific SAR total), and the actual per-filer load is higher, because SAR-obligated MSBs are a subset of principals (check cashers are exempt; currency exchangers carry the same $2,000 SAR duty as money transmitters) and non-MSB NBFIs file some of the 2.1 million too. But the bound is useful: it tells a founder that the average MSB's SAR operation is measured in dozens of filings a year, not thousands. That is a workload one part-time person can handle with automation, and it is also a workload that will bury the same person without it, because each SAR carries a 30-day filing deadline, a narrative requirement, and a five-year retention obligation. The product's monitoring module does not need to scale to bank volumes. It needs to be ruthlessly reliable at dozens of filings a year, which is a much cheaper engineering problem than anyone in enterprise RegTech is solving.
The TAM derivation, stated plainly. The $33.4M optimistic TAM is 10% of 28,456 principals at an $11,748 blended annual ACV (roughly 60% on the $1,299 transmitter tier, 40% on the $499 check-casher tier, a product hypothesis, not a measured split). It is not a global vanity number. It excludes the 229,161 agents, excludes stablecoin issuers, and excludes any jurisdiction outside the United States. Every expansion wedge (agents at $49/month, PPSI module at $2,999/month) is upside on top of a base case that assumes 90% of the obligated market never buys. The honest read: this is a $10M-to-$33M core market with tens of millions in agent-module upside at realistic attach rates, plus the GENIUS Act optionality, and the whole thing is derived from one FinCEN census number and one pricing judgment.
Risks and Challenges
Alessa already names MSBs. The one incumbent with MSB positioning could launch a mid-market tier and compress the window. Mitigation: Alessa's DNA is enterprise deployment (cloud or on-premise, 20+ countries), so a $499/month self-serve check-casher tier would require a different sales motion, support model, and pricing psychology, which means competing on velocity (deploy in days, not quarters) and on the agent-oversight and GTO-threshold features it does not lead with.
Second problem: the customer may not be able to pay. Check cashing is a fragmented, thin-margin industry; Marketdata put U.S. check cashing revenue at $1.32 billion in 2020, down 22% year over year. A $1,299/month contract is real money for a storefront doing a few hundred transactions a day. Mitigation: segment the pricing. The $499 check-casher tier matches the actual legal burden (CTRs plus the four pillars, no SAR module for check cashers; currency exchangers get SAR tooling at the $799 tier). Sell the $1,299 tier to money transmitters, where SAR obligations and agent networks make the ROI obvious, and let the PPSI module carry the premium while the tail converts slowly.
FinCEN's deregulatory posture could shrink the mandate. The cost-of-compliance survey, the SAR relief FAQs, and the "significant or systemic failure" enforcement standard in the program-reform proposal all point toward a lighter touch. Mitigation: the relief targets low-value activity, not the core obligations. The four pillars are statutory. Registration is statutory. And the enforcement actions (Brink's, Paxful, the border sweep) are happening under the same leadership that is talking about burden reduction. The product automates whatever the floor turns out to be.
Founder-market fit is brutally hard to hire. The product requires someone who has run an MSB compliance program or examined one, and that talent pool is small while the big vendors already employ most of it. Mitigation: hire the domain expert as employee number three or four, not as an advisor. A former IRS SB/SE examiner or an ex-FiSCA compliance officer with equity will out-build a consulting engagement every time, and the credibility with customers is worth more than the salary line.
Then the liability surface: the software drafts legal filings. A malformed SAR or a missed CTR aggregation is the customer's legal exposure, but the customer will blame the tool. Mitigation: outside BSA counsel reviews the filing logic before launch, every draft is presented as a draft requiring human review and sign-off, and the E&O insurance is sized for a compliance product, not a to-do app.
FinCEN BSA E-Filing formats change. The platform's filing exports depend on FinCEN's submission schemas, and a format change breaks the pipeline until it is updated. Mitigation: this is an argument for the product, not against it. When FinCEN changes a schema, 28,456 principals need the update at once. A SaaS platform ships it in a week. A spreadsheet shop discovers it at the next examination, which is the worst possible time to learn.
Strongest Counterargument
Here is the most serious objection: the mid-market MSB does not want software; it wants the problem to go away, and it will choose the cheapest way to make the problem go away, which is a ~$5,000-a-year consultant (an assumption) and a prayer. The check cashing industry is fragmented, cash-constrained, and culturally skeptical of technology vendors. Nine national companies control under 35% of storefronts (trade-group figures from circa 2006-2012, the most recent public aggregate), which means the market is thousands of independents whose owner is also the teller, and that owner did not open a check cashing store because they love dashboards. Enterprise vendors ignore this segment not because they are blind but because they ran the math: the unquantified fear is that the CAC on a thousand tiny storefronts exceeds the lifetime value of $499/month contracts at ~30% annual churn (both assumptions). The "mid-market gap" might be a graveyard of failed RegTech startups that discovered the gap was actually a moat protecting nobody.
This deserves a serious answer. First, the CAC objection assumes enterprise-style field sales; the actual acquisition channels (FiSCA conferences, state MSB associations, post-examination remediation demand when an examiner tells an MSB to fix its program or else) are concentrated and cheap relative to the contract values: at ~$4K CAC against ~$16K contribution-LTV on the $499 tier, the math clears 3x, so the real risk is sales velocity, not unit economics. Second, churn is the real risk, and the honest answer is that the product must be sticky through the filing history: once five years of CTRs, training records, and program documents live in the platform, leaving means rebuilding the examiner-ready record from scratch. Third, the GENIUS Act changes the customer mix: the PPSI module sells $2,999/month to venture-funded stablecoin issuers with no storefronts and no technology skepticism, and those contracts subsidize the long, slow work of converting the check-cashing tail.
But the counterargument's core stands: this is a grinding, unsexy, conference-circuit business. Product-led growth need not apply. If you need venture-scale returns in five years, build something else. If you want a durable $10M-$30M ARR business with ~75% blended gross margins and customers who renew because the alternative is a fine measured in years or decades of the payroll that would have prevented it, this is it, and you should know which game you are playing before you start.
Limitations
FinCEN has not published an MSB-specific SAR total for 2023 or 2024, so the 2.1-million non-bank SAR residual is a ceiling, not an MSB figure, and the "74 SARs per principal" bound is arithmetic on unverified ground. No incumbent vendor publishes pricing, so the $1,299/month ACV and the entire "enterprise contracts versus MSB spreadsheets" framing rest on positioning evidence and salary benchmarks, not on a citable price comparison. No current public aggregate breaks the 28,456 principal MSBs into money transmitters versus check cashers versus currency exchangers, so the segmentation between the $1,299 and $499 tiers is a product hypothesis, not a measured split. The $130,000 fully-loaded officer cost assumes a ~$100K base salary (low-to-mid end of published ranges) times a conventional 1.3x benefits multiplier that no source publishes for this role. The $37M penalty was assessed against Brink's Global Services, a large armored-car money transmitter moving hundreds of millions in bulk currency, not a small storefront MSB, so the penalty-to-payroll ratio is illustrative and a typical small-MSB penalty would be far smaller (Paxful's $3.5M is the closer comp). The GENIUS Act's PPSI rules are still a proposed rule (April 8, 2026); the final rule could change the $5,000 SAR threshold, the compliance officer requirement, or the effective date. The attach rates in the TAM table (3%, 5%, 10%) are judgments, not benchmarks.
What You Can Do
If you run an MSB: audit your four pillars this quarter. Can you produce your written program, your designated person's training record, and your agent list within 15 days of an examiner's request? If the answer involves a filing cabinet, you are the customer. Check whether your locations fall inside the reissued Southwest-border GTO zones (Texas and New Mexico ZIP codes, $1,000-$10,000 CTR threshold through March 1, 2027). And if you are a money transmitter, verify your SAR pipeline against the 30-day filing clock; FinCEN's December 2025 border operation proved the agency is now running data analytics across your filings.
If you are building this company: start with the CTR engine and the agent-oversight module for check cashers, because that segment (the one SAR-exempt MSB type) has the simplest product to ship. Your first ten customers come from the FiSCA conference circuit and from post-examination remediation demand, not from ads. Hire the ex-examiner before the second engineer. And build the PPSI module in parallel with the GENIUS Act rulemaking: the January 18, 2027 date is a hard backstop (the prohibition bites on that date at the latest, or 120 days after final rules, whichever comes first), the issuers are funded, and as of October 2026 none of the seven incumbents profiled here markets a PPSI-specific package.
If you are an investor: underwrite to the $499 check-casher tier's churn, not the $2,999 PPSI tier's glamour. The base case is a $10M-$33M core market; the upside case needs the agent module and the stablecoin wave to both land. The comparable is not a bank RegTech exit (Verafin's $2.75B). It is a vertical-SaaS compounder with ~75% blended gross margins and regulatory tailwinds. Price the seed accordingly, and check the churn assumptions twice.
Related Startup Ideas
Textile EPR Compliance SaaS for Mid-Market Apparel Brands (Free Startup Idea #130): the same playbook in a different regulatory regime. California's textile EPR deadline passed July 1, 2026 with $10,000-a-day fines, and mid-market brands face it with the same spreadsheet-and-hope stack that MSBs use for BSA compliance.
Surplus Lines Filing Compliance SaaS: another state-by-state filing burden where the obligated population is fragmented, the incumbents sell to enterprises, and the penalty for getting it wrong dwarfs the cost of the software.
Data Broker Drop Compliance SaaS: compliance automation for the long tail of companies caught by a new regulatory regime, built for the businesses too small for enterprise vendors and too exposed to ignore the law.
The Bottom Line
FinCEN has 28,456 principal MSBs and an estimated 229,161 agents under its jurisdiction, requires every principal to run a four-pillar AML program (and holds it liable for its agents'), and is now enforcing with data-driven operations and multi-million-dollar fines. The enterprise RegTech industry sells to banks and has left the mid-market MSB to spreadsheets. The GENIUS Act adds stablecoin issuers to the obligated list with a January 2027 deadline. A platform that automates CTRs, drafts SARs, manages the four pillars, tracks the agent network, and ships a PPSI module for the stablecoin wave can take 3 to 10% of the principal-MSB base and build a $10M-to-$33M core business, with upside from the 229,161-agent base (~$6.7M annually at an illustrative 5% attach on a $49/month module) and the GENIUS Act issuer wave. The fine for getting compliance wrong is measured in decades or centuries of the payroll that would have prevented it. That is the pitch, the market, and the math, and the grind is real, so go in with eyes open.