Supervisory & Reporting Framework
Licensing does not end at issuance. MSB licensees are expected to maintain reporting discipline, respond to supervisory requests, and demonstrate that declared controls continue to operate in practice. This page sets out the supervisory logic commonly applied after authorization.
Supervisory model
Supervision is generally risk-based. Reporting intensity, review depth, and escalation frequency may vary depending on transaction volumes, corridor exposure, product model, ownership changes, complaint trends, and AML/CFT indicators.
Risk-based approach
Higher-risk business models typically attract more frequent evidence requests and deeper reviews.
Evidence over statements
Reviewers typically prioritize logs, reconciliations, case records, and management reporting over generic policy language.
Ongoing accountability
Licensees remain responsible for keeping governance, ownership, controls, and reporting current after issuance.
Supervision is not optional admin
A license that is issued but unsupported by ongoing reporting quickly turns into a liability. Silence, late filings, or poor-quality responses usually create more friction than the original application stage.
Periodic reporting and returns
Periodic returns are used to confirm that the business being operated matches the business that was licensed. Reporting should be internally reconcilable and consistent with management information.
Transaction volumes, customer activity levels, corridor concentration, settlement volumes, and operational trends.
Screening volumes, alerts generated, investigations opened, suspicious reporting counts, and training status.
Customer complaints, dispute trends, service failures, fraud events, and remediation outcomes.
Changes in directors, owners, compliance personnel, outsourcing arrangements, or material systems/process changes.
Data requests and thematic reviews
Not all supervisory engagement is scheduled. The authority may issue targeted information requests where a risk indicator, complaint pattern, or operational inconsistency appears. These reviews tend to focus on proof, not promises.
Common request themes
-
Funds flow validationEvidence of how customer funds are received, held, reconciled, and settled.
-
AML case samplingAlert logs, investigation notes, sanctions escalations, and reporting rationale.
-
Ownership or management changesUpdated control maps, appointment evidence, and governance approvals.
-
Customer harm signalsComplaint files, delay explanations, refund handling, and dispute remediation.
Weak response patterns
-
Late submissionResponses sent after deadlines without explanation or escalation notice.
-
Policy-only replyHigh-level narratives sent instead of logs, reports, and traceable evidence.
-
Conflicting versionsDifferent business descriptions submitted by different teams or agents.
-
Unclear ownershipNo accountable person identified for the response pack and supporting evidence.
Review readiness and inspection logic
Whether the review is desk-based or more intensive, readiness comes down to one thing: can the licensee retrieve and explain evidence quickly, coherently, and accurately.
Records retrievability
Files, logs, reconciliations, and governance records should be accessible without forensic archaeology.
Staff awareness
Relevant staff should understand the operating model, escalation routes, and control ownership.
Sample testing readiness
Licensees should be able to produce customer files, case records, and reconciliations for sampling on request.
Simple rule
If it takes too long to prove a control exists, supervisors usually assume the control is weak, informal, or inconsistently applied.
Escalation and administrative outcomes
Where deficiencies persist, escalation may move from information requests to conditions, restrictions, or more formal administrative action. The speed of escalation is often driven by severity, recurrence, and responsiveness.
Early-stage issues
Late returns, inconsistent reporting fields, missing annexes, or minor governance updates often begin as corrective follow-up matters if addressed promptly.
Serious concerns
Repeated non-response, scope drift, weak AML evidence, safeguarding failures, or misleading register-facing statements tend to create sharper supervisory consequences.
Best practice
Treat every supervisory request like a mini-due-diligence event: one named owner, one response pack, one evidence index, and one internally reconciled narrative.