Podcast: Payments Pros – The Payments Law Podcast
Episode: State AML Enforcement: What Money Transmitters Need to Know About the RamadPay Consent Order
Host: Keith Barnett
Aired: August 26, 2026
Keith Barnett (00:04):
Welcome to another episode of Payments Pros, a Troutman Pepper Locke podcast, focusing on the highly regulated and ever-evolving payment processing industry. This podcast features insights from members of our fintech and payments practice, as well as guest commentary from business leaders and regulatory experts in the payments industry. My name is Keith Barnett and I am one of the hosts of the podcast. Before we jump into today’s episode, let me remind you to visit and subscribe to our blog, troutmanpepperfinancialservices.com, and don’t forget to check out our other podcasts on troutman.com/podcasts. We have episodes that focus on trends that drive enforcement activity, digital assets, consumer financial services, and more. Make sure to subscribe to hear the latest episodes.
(00:55):
Today, I want to talk about a consent order that was executed this past June of 2026 involving a money transmitter called RamadPay, which is a Minnesota-based money transmitter. This was a coordinated multi-state enforcement action brought jointly by the states of Colorado and Texas through their respective banking regulators. The violations at issue center on a few key areas, failure to timely file currency transaction reports, deficiencies in the company’s AML/CFT program, and alleged gaps in safeguarding consumer financial information. I want to talk to you about this order today because I think this order serves as a useful example of what regulators are focused on when they come in and examine a money transmitter, especially when we have the federal regulators that are less active than they used to be. So let’s get into this.
(01:51):
As I just mentioned, the states of Colorado and Texas jointly issued the consent order against RamadPay, and this started with a multi-state examination that kicked off around May 26, 2025. So it goes back over a year before the enforcement action or before the consent order. And as I mentioned, this exam was coordinated by regulators from both Colorado and Texas. The regulators issued their report of examination to RamadPay on October 23, 2025, so about five months after the examination started, and the consent order followed in June of 2026, which is about eight months later. So let’s walk through the key issues that were a part of the consent order.
(02:37):
So first, the report of examination cited three major categories of compliance failures. First, the report of examination cited to untimely Bank Secrecy Act-related filings. In particular, the states in the consent order stated that RamadPay failed to timely file currency transaction reports, or CTRs, as required by federal law, and they also allegedly failed to timely file reports of transportation of currency or monetary instruments, known as CMIRs, also as required by federal law. Second, the state regulators noted that there were deficiencies in the AML/CFT program. The examiners found issues with the company’s anti-money laundering and countering the financing of terrorism program, specifically around monitoring domestic agents and ensuring adequate independent reviews of the program. And under state money transmitter laws, keep in mind that the agents must comply with the state money transmitter laws in the same manner as licensed money transmitters, and the licensed money transmitters who engage these agents are deemed ultimately to be responsible for the activity of their agents or the activities of their agents. Third, the states noted that there were consumer data protection failures. Specifically, according to the consent order, the company had compliance issues related to safeguarding consumer financial information under the FTC’s Safeguards Rule. Specifically, the order cites a failure to adequately identify and manage devices and software systems. So here we have… There was a cybersecurity and data governance component to this as well. And something else to keep in mind, cybersecurity and data governance are a part of the compliance picture in state money transmitter examinations. It’s not just simply the BSA AML program and following that.
(04:49):
Another interesting issue, which is probably what led to the enforcement action, is that the order also references, “Past deficiencies identified in prior examinations as well as in a prior independent review.” That tells us that the issues raised in the consent order or the report of examination had been flagged before either by the state regulators and or the company that RamadPay hired to independently review its compliance with state and federal laws concerning money transmission. So this serves as a reminder that the regulators review and analyze recommendations from independent auditors and expect money transmitters to remedy the issues found by the independent auditors. And if those issues are not remedied, the money transmitter should have a good reason for not doing so to the satisfaction of the regulators. Otherwise, the issues discovered or flagged by the independent auditors may wind up in the consent order.
(05:59):
Next, I want to talk about what RamadPay must do going forward because this is instructive for other money transmitters and quite frankly, payment processors. So the consent order imposes a detailed set of corrective requirements. First, the money transmitter RamadPay must hire a compliance consultant within 90 days of the effective date of the order. And this person must be a qualified independent third-party compliance consultant. And the scope must include quarterly written reviews and verification of all corrective actions, quarterly reviews of RamadPay’s suspicious activity report processes with a particular focus on closed accounts, and quarterly independent testing of transaction data to verify the effectiveness of the company’s internal controls and data integrity systems.
(06:55):
So not only do you have the added expense of hiring this compliance consultant, but the compliance consultant’s engagement letter and findings must be submitted to the regulators. And that engagement would run for one year, but each state has the discretion to extend it to two years. This compliance consultant requirement also tells us that there must have been SAR related issues. So remember, if you are a financial institution that must file SARs, remember you are required to actively try to detect suspicious activities, investigate them, timely file a SAR if necessary, and have a sufficient number of personnel to monitor the transaction volume with the experience to know how and when to file a SAR. This also leads us to believe that there were internal control issues, but we don’t know quite what those were, nor do we know what the data integrity issues were. But this enforcement action is instructive on making sure that money transmitters follow the FTC’s Safeguards Rule.
(08:08):
Another part of the remedial requirements is the company must employ AML/CFT monitoring enhancements. And again, within 90 days, the company was required to review and adjust its AML/CFT monitoring systems to detect suspicious activity in a timely manner and also ensure that it has adequate personnel and resources to manage the volume and complexity of alerts. And the company was required to strengthen its due diligence procedures to reduce AML/CFT risk exposure.
(08:46):
Then next, we were talking about data integrity earlier, and again, within 90 days, the company was required to institute a more robust program to ensure that customer information was secure, complete, valid, and properly reflected in regulatory reporting. And that included controls that verify and collect consumer account data in accordance with the Know Your Customer guidelines under the Bank Secrecy Act. Now, this is key here for this particular money transmitter because they specialize in international money transmission between the US and countries in Africa.
(09:24):
The next requirement was an independent review. And more specifically, because RamadPay allegedly failed to address their past deficiencies, as I mentioned earlier, it must now have an independent review of its AML/CFT program at least annually in compliance with federal law. And the company must submit written progress reports to the participating states on a quarterly basis for at least one year, but it’s extendable up to two years by the states.
(09:54):
So those are the non-monetary penalties, but those will ultimately cost the company. And then finally, the actual monetary penalties. The company must pay a $200,000 administrative penalty split evenly between the states of Colorado and Texas. And if the company fails to pay, then the states of Colorado and Texas can go after any surety bond that the company maintains as a requirement as a licensed money transmitter. And also important that the order is treated as a disciplinary action and must be disclosed in the NMLS system. So it’s there for as long as NMLS is around, this penalty would be there.
(10:37):
This whole thing has a bunch of takeaways, but one additional takeaway is something that I focused a little bit earlier on the Safeguards Rule. So usually when we talk to you about these enforcement actions against money transmitters by the states, a lot of the narrative is focused on an alleged inadequate BSA/AML program. But here, the reason why I found this interesting is that it was instructive that this also included a statement about alleged failures under the Safeguards Rule. And so that just shows that the Safeguards Rule is now firmly in the regulatory crosshairs of the states for money transmitters. So make sure you do a thorough inventory of your devices and software systems as a result.
(11:25):
All right, well, that’s it for today. Thank you to the audience for listening to today’s episode. Don’t forget to visit our blog, troutmanfinancialservices.com, and subscribe so you can get the latest updates. Please make sure to also subscribe to this podcast via Apple Podcasts or whatever platform you use. We look forward to the next time.
Copyright, Troutman Pepper Locke LLP. These recorded materials are designed for educational purposes only. This podcast is not legal advice and does not create an attorney-client relationship. The views and opinions expressed in this podcast are solely those of the individual participants. Troutman does not make any representations or warranties, express or implied, regarding the contents of this podcast. Information on previous case results does not guarantee a similar future result. Users of this podcast may save and use the podcast only for personal or other non-commercial, educational purposes. No other use, including, without limitation, reproduction, retransmission or editing of this podcast may be made without the prior written permission of Troutman Pepper Locke. If you have any questions, please contact us at troutman.com.
DISCLAIMER: This transcript was generated using artificial intelligence technology and may contain inaccuracies or errors. The transcript is provided “as is,” with no warranty as to the accuracy or reliability. Please listen to the podcast for complete and accurate content. You may contact us to ask questions or to provide feedback if you believe that something is inaccurately transcribed.
