Putting the rules into practice
A written policy does not verify a customer or resolve a suspicious transaction. People, software, and service providers have to carry it out. They need clear responsibilities and records that show what happened.
In a growing company, those arrangements change. A new product introduces a different risk. A vendor turns out to have a limitation. A review identifies a weakness that was missed. Management has to respond and make the process stronger.
That does not mean legal obligations begin only when a founder understands them. Businesses are responsible for meeting their duties. It does mean that an honest assessment should examine the actual process rather than assume that writing a policy and operating it are the same task.
A warning sign needs an answer
A payment from a name that differs from the customer's name deserves attention. There may be an innocent explanation. There may also be fraud, identity theft, or an attempt to move someone else's money.
The right response depends on the information available and the obligations that apply. Who sent the payment? What documents were reviewed? Who made the decision? Was the explanation consistent with the records? A company needs a process for asking those questions and deciding when to stop a transaction.
I do not see uncertainty as permission to ignore a warning. I see it as a reason to investigate the warning properly. Labeling a transaction suspicious is the beginning of that work.
Different failures mean different things
Fraud, account takeover, identity theft, and money laundering are not interchangeable descriptions. They can overlap, but understanding one does not automatically establish another.
The same care is needed when examining a company. A weak control, a missed alert, and a deliberate agreement to assist crime are different facts. Each may have serious consequences. They should be assessed under the legal standard that actually applies.
Federal money-laundering offenses have defined elements, and the required knowledge or intent depends on the charge. A fair inquiry has to connect evidence to those elements. A negative description of the business cannot do that work on its own.
Look at the information available then
After an investigation, people may be able to see a customer's complete scheme. A company processing a transaction may have seen only a portion of it. That difference does not excuse ignoring information it had a duty to review. It does matter when deciding what its leaders knew.
The record should include the warnings, the advice sought, the tools in use, the roles of vendors, and the decisions made after a concern was raised. It should include facts that weaken an accusation as well as facts that support it.
A later improvement can show that a company learned from a problem. It can also raise questions about why the earlier control was inadequate. Both possibilities deserve examination. The improvement alone does not answer every question about earlier knowledge or purpose.
A growing business has to grow its controls
A small company cannot use its size as a permanent excuse. As products, transaction volumes, and risks change, its compliance program has to keep up. Outside advice can help, but hiring an adviser does not transfer management's responsibility to that person.
FinCEN's guidance for money services businesses recognizes the importance of a program suited to the risks of the business. That requires more than copying another company's manual. It requires understanding the services being offered and checking whether the controls work in practice.
As a founder, I want clear expectations and honest feedback. I also accept that responding to them is part of the job. Building something new requires the discipline to improve it before a weakness becomes a larger failure.
Looking carefully at the work people actually did
I left law school to build a company, but I did not leave behind respect for evidence or the need to understand rules. The work has made me more aware of how much depends on the quality of a decision and the record behind it.
I want actual wrongdoing investigated. Customers deserve protection, and companies that handle money should expect scrutiny. I also want that scrutiny to distinguish a person trying to correct a problem from a person choosing to help someone commit a crime.
That distinction cannot be settled by a slogan about innovation or by suspicion of an unfamiliar industry. It takes patient work with the facts. Anyone asking a founder to be accountable should be willing to do that work too.
