Is a cash-intensive business high risk? Not by type alone

A cash-intensive business is not automatically high risk. Restaurants, convenience stores, liquor stores and the other businesses the FFIEC manual lists handle a lot of currency, which makes illicit cash easier to blend in, so they are more exposed to money laundering than a business paid by card. But the federal banking agencies and FinCEN said in their July 2022 joint statement that no customer type presents a single level of uniform risk, and they listed cash-intensive businesses by name. What makes one high risk is what it does: cash out of line with its expected activity and its peers, deposits that look arranged, money moving to places that do not fit the business. The hard part for a BSA team is rating hundreds or thousands of cash businesses on those facts rather than on a category code. Botminds' Customer Risk Rating caps the points a customer's type can carry, tests every proposed High without them, and writes the facts that did move the rating into one cited sentence.

The three restaurants below are illustrative, and the sample figures come from a fictional institution, Norrell Federal Credit Union, as it runs through the solution. Rules and research are linked where they appear.

Is a cash-intensive business high risk?

Not by type. The FFIEC manual says the nature of these businesses "and the difficulty in identifying unusual activity may cause these businesses to be considered higher risk," but in the same section notes that "most of these businesses are conducting legitimate business" (FFIEC, Cash-Intensive Businesses). The 2022 joint statement then removed any doubt about whether "may" meant "must."

Not all customers of a particular type automatically represent a uniformly higher risk of money laundering, terrorist financing, or other illicit financial activity.

Joint Statement on the Risk-Based Approach to Assessing Customer Relationships and Conducting CDD, July 6, 2022

What does the 2022 joint statement say about customer types?

That risk lives in the relationship, not the label, and that banks should manage customers rather than drop categories. "The potential risk to a bank depends on the presence or absence of numerous factors, including facts and circumstances specific to the customer relationship," the agencies wrote, and they "continue to encourage banks to manage customer relationships and mitigate risks based on customer relationships, rather than decline to provide banking services to entire categories of customers" (2022 joint statement).

The statement, issued by the Federal Reserve, FDIC, FinCEN, NCUA and OCC, applies to every customer type in the FFIEC manual and names some: independent ATM operators, nonresident aliens, charities, professional service providers, "cash intensive businesses," nonbank financial institutions and politically exposed persons. It adds that the manual's sections on customer types are "not intended to signal that certain customer types should be considered uniformly higher risk." It changes no legal requirement, and it does not oblige a bank to drop practices it considers necessary to manage risk; it does mean a High rating that rests only on type is hard to defend.

What is a cash-intensive business?

A business that takes in a large share of its revenue in currency. The FFIEC glossary defines cash-intensive businesses as those "that tend to deal heavily in receipts of cash." Treasury's 2026 national money laundering risk assessment adds that whether a business is cash-intensive "depends on the type of goods and services it offers, the social customs of the city or region it operates in, and the policies or preferences of the business owner" (2026 NMLRA). That definition is itself an argument against rating by category: the same kind of business can be cash-heavy in one town and nearly cashless in another.

The risk is real. The NMLRA explains that criminals use these businesses "because it is easier to commingle illicit and legitimate cash transactions," sometimes owning one outright as a front, sometimes buying goods from one that "unwittingly or complicitly helps criminals launder their cash." Its September 2025 example is a Florida man who laundered through a grocery store and a restaurant and said he "would split it up and deposit the money in increments like $5,000 per day."

Cash intensive business examples, and why a list is not a rating

The FFIEC manual's examples are convenience stores, restaurants, retail stores, liquor stores, cigarette distributors, privately owned ATMs, vending machine operators and parking garages, and it says the list is not exhaustive. The NMLRA adds grocery stores, gas stations and general merchandise stores as places where cash is still used often. Many banks keep similar lists keyed to industry codes.

A list is a good place to start due diligence and a bad place to end a rating. It cannot tell a busy restaurant from a front, and it can miss risk entirely. FinCEN's order against TD Bank describes customers who said they were in the clothing or textile industries, "which are not known to be cash-intensive businesses," yet were among the bank's most active cash customers, and whose cash increased during the pandemic "when most cash-intensive businesses were conducting far lower levels of transactions" (FinCEN Consent Order 2024-02). The category was wrong in both directions; the activity was the signal.

How do banks assess cash-intensive businesses?

By the factors the FFIEC manual lists, applied to the business's own facts. When assessing cash-intensive businesses, it says banks "should direct their resources to those accounts that pose the greatest risk," and gives seven factors (FFIEC, Cash-Intensive Businesses).

Most of those factors are facts the bank already holds, which is the argument for reading them, not the industry code. The manual's own restaurant example is about comparison: a laundering restaurant's deposits "do not, on the surface, appear unusual because the business is legitimately a cash-generating entity. However, the volume of currency in a restaurant used to launder money will most likely be higher in comparison with similar restaurants in the area."

One business type, three ratings

The three restaurants at the top of this page share an industry code and get three different tiers, because the facts that matter differ. The first behaves as its profile predicts. The second has not changed its cash at all, but has a new owner and a new flow of wires to a listed jurisdiction. The third has cash rising well beyond both its profile and its likely peers, and a deposit pattern FinCEN has described for years.

FinCEN's funnel-account advisory describes the deposit pattern in the third restaurant: an account "receives multiple cash deposits of less than $10,000 by unidentified persons at branches outside of the geographic region where the account is domiciled," and for business accounts "the debits do not appear to be related to the stated business activity of the account holder" (FinCEN FIN-2014-A005). No industry code captures that; branch data does. Geography as a rating factor is covered in HIDTA and HIFCA areas in a customer risk rating.

Are all MSBs high risk?

No, by the same logic, though they carry specific expectations. The 2022 joint statement covers "nonbank financial institutions," and the FFIEC manual notes that existing guidance sets particular due diligence expectations for money services businesses, citing the 2005 interagency interpretive guidance on providing banking services to them (FFIEC, CDD overview). Those expectations are about what the bank must know, such as registration and licensing, not an instruction to rate every MSB High.

Concentration is the risk worth watching. The Treasury Inspector General found that the primary cause of City National Bank of New Jersey's 2019 failure was a strategy that sharply increased transaction activity by bringing in many more money services business customers, pursued without the policies, procedures, risk management or BSA controls that activity called for (Treasury OIG, OIG-20-039). The failure was the absence of controls for a book the bank chose to grow, not the customers' type.

The nightly type test: concentration shown, type alone never enough

What over-rating costs: research on lost access

Rating a whole category High is not a free precaution. It moves investigators' time to customers who do not need it, and it tends to end relationships. FinCEN's April 2026 program proposal, still a proposal, says FinCEN "encourages financial institutions to manage customer relationships on a case-by-case basis," without "broad de-risking that can result in debanking that may increase the use of financial services that exist outside of the regulated financial system and complicate efforts to detect and deter illicit finance" (91 FR 18704).

Research measures the effect at scale. The Bank for International Settlements found that "the number of correspondent banks fell by 20% between 2011 and 2018," and that jurisdictions with a longer history of AML/CFT deficiencies "lost 25 percentage points more" correspondent relationships than average (BIS Quarterly Review, March 2020). A study of an anti-money laundering policy in Colombia found that the resulting loss of deposits hit lending even in areas with little drug trafficking, and that "small firms that rely on credit from affected banks experience a negative shock to investment, sales, size, and profitability" (Slutzky, Villamizar-Villegas and Williams). The pattern is the same at customer level: a cash business rated High for its type and then exited loses its bank, and the bank loses visibility of the cash.

Customer Risk Rating's answer is arithmetic, not exhortation: type is capped, a move into High must rest on another family of facts, and the nightly test shows the BSA Officer the concentration by type with the type-alone count beside it. The full scoring method is in customer risk rating methodology: factors, weights and written reasons; to run the type test on your own book, start from Customer Risk Rating.

Questions people ask

What businesses are high risk for AML?

No business type is high risk by definition; the 2022 joint statement says no customer type presents a single level of uniform risk. The FFIEC manual has sections on types that often need more due diligence, such as cash-intensive businesses, money services businesses, nonresident aliens and politically exposed persons, but a high rating should rest on the customer's own facts.

Do cash-intensive businesses need enhanced due diligence?

Not all of them. The FFIEC manual expects banks to understand each business's operations, expected activity and geography at account opening and to monitor it, and suggests stronger measures, such as on-site visits or interviews with management, for those "deemed to be particularly higher risk."

Can a cash-intensive business be exempt from CTRs?

Some can, under the bank's Phase II exemption rules for non-listed businesses, but certain kinds of business are ineligible. GAO reported in 2024 that many banks file few exemptions because they find them time-consuming and many business customers do not qualify. An exemption changes reporting, not the customer's risk rating.

Is a cash-intensive business the same as a high-risk business?

No. Cash-intensive describes how a business is paid; high risk describes the bank's assessment of that particular customer. A restaurant whose cash matches its profile and its peers can be low risk; a clothing wholesaler with unexplained cash can be high risk.

Should banks decline cash-intensive businesses?

The agencies say banks that manage the risks "are neither prohibited nor discouraged from providing banking services to customers of any specific class or type," and encourage managing relationships rather than declining whole categories. Whether to bank a given customer remains each bank's decision.