Yes, if the firm is covered by the FTC Safeguards Rule as check casher / wire transferor, it needs a written security program for customer information. Citation: 16 CFR Part 314 and 16 CFR 314.2(h)(2)(vi)-(vii).
Primary source: 16 CFR 314.2(h)(2)(vi)-(vii)
Does a check casher, wire transferor, or money transmitter need a WISP?
Details
cashes checks, wires money, transmits funds, or handles money-transfer transactions for consumers. Customer information lives in teller systems, ID scans, transaction logs, OFAC or fraud-screening tools, agent portals, receipts, SAR-supporting notes, and money-transmission platforms. The WISP should map agent locations and hosted provider access separately from headquarters systems. Transaction volume can push even small storefronts above 5,000 consumers. If the firm is below the threshold, 16 CFR 314.6 still does not remove security-program duties.
Primary source: 16 CFR 314.2(h)(2)(vi)-(vii).
Related obligations - not covered by this packet: money services businesses may have BSA/AML registration, reporting, agent-list, and AML-program duties. Policywright's WISP packet does not satisfy BSA/AML program requirements.
FAQ
Does a check casher, wire transferor, or money transmitter need a WISP?
Yes, if the firm is covered by the FTC Safeguards Rule as check casher / wire transferor, it needs a written security program for customer information. Citation: 16 CFR Part 314 and 16 CFR 314.2(h)(2)(vi)-(vii).
What is the data-flow issue for a check casher, wire transferor, or money transmitter?
Customer information lives in teller systems, ID scans, transaction logs, OFAC or fraud-screening tools, agent portals, receipts, SAR-supporting notes, and money-transmission platforms. The WISP should map agent locations and hosted provider access separately from headquarters systems.
Is this legal advice?
No. It is source-cited educational content for a template product, not legal advice.