I am struggling, can someone please very clearly define an ISO to me (without linking or referring the FFIEC Exam Manual, as this is not cutting it for me)? I have been searching threads and various other mediums trying to get a clear understanding but it seems as I am receiving, or at least interpreting, conflicting information.
We recently went through a BSA audit to which we got scrutiny on our PATMS (specifically mentioning our ISOs, when I do not believe we have any), leaving me thoroughly confused.
If a customer owns (not leases) an ATM, does that make them and ISO?
If a customer owns (not leases) multiple ATMs, does that make them and ISO?
If a customer owns multiple ATMs, leases them or sells them, does that make them an ISO? Regardless of who replenishes and maintenances?
Any other helpful information is welcome!
I'll add, this was a rough audit, very nit picky and stubborn auditors, many disputes required at attempted write-ups. I feel as if we had a new crew trying to prove themselves to the company, or something. Anyways, If someone can dumb this down for me, I would appreciate it!

im going to give this a try...
you have customers who own or operate the ATM within their establishment? Like a gas station or grocery store? if yes, then you would need to conduct due diligence to determine for example how they fund it and did they register it with the state, if required; etc.

FFIEC ~ "Where independent ATM ownership or operation is the customer’s core business, a company may own and deploy multiple ATMs that service thousands of consumers. Many operators of these independent ATMs are also considered Independent Sales Organizations (ISOs). An ISO is generally a person or entity that is (1) approved by, and under contract with, a sponsor bank to deploy and service independent ATMs and (2) under contract with an approved acquiring processor to route independent ATM transactions to Electronic Funds Transfer (EFT) networks for which the ISO has been registered by the sponsor bank."

Thank you! I appreciate the response.
I understand the due diligence required. As mentioned, I have also read FFIEC and am looking for a more clear understanding of an ISO outside of this....specifically the questions mentioned above.

Generally speaking, an ATM ISO (Independent Sales Organization) is a company who sells, services, and replenishes ATMs. They have a contract with a sponsoring bank for routing transactions. Those ATM ISOs can also have sub-ISOs who sell, service, and replenish machines on behalf of the main ISO. These ISOs can have a contract with a business to place a machine in their location where the business owner does nothing with the machine but the ISO pays them a small commission for the machine to be there. In other instances, the business owner may purchase the machine and opt to balance, service, and load the machine themselves. These businesses that operate "ATM servicing businesses" are generally considered ISOs. The business owner who has one machine in his watering hole is not.

In terms of money laundering, though, access to replenish the funds in the machine is the primary concern, regardless of who owns it. So, I don't spend a lot of time differentiating between who owns the machines but rather who has access to the canisters to balance and fill the machine. Of course, with an ATM servicing business, part of the due diligence includes getting a list of all machines and addresses as well as a copy of the contract with the sponsoring bank. For a business that has an ATM inside it, I ask the owner who has access to replenish the canisters. If it's the business, I require a separate ATM settlement account to be used solely for ATM settlement credits from the processor and cash withdrawals the fill the machine (refilling the machine from their till is not allowed - obviously, that opaqueness is where the money laundering concern comes in).

Hope that helps a little.

Thank you, this was my understanding of ISOs as well...good to know I was understanding correctly! Our auditors are requiring we differentiate so wanted to assure I had a solid understanding....they were all over the place in their discussions regarding ISOs....I'm not sure they even knew what they were talking about.

How often do you require the existing business owners that have privately owned ATMs in their gas stations to provide servicing contracts and reaffirm the locations of ATMs, etc? Or do you only require that level of due diligence at account opening?

We only require it at account opening.

account opening

I have a question on this topic...you all have said that the ISO will "have a contract with a sponsoring bank for routing transactions", what is a sponsoring bank?

If we open an account for an ISO and they will be getting the cash to replenish from us, are we the "sponsoring bank"?

What kind of "contract" are we talking about?

Is there different due diligence requirements for an ISO rather than an independent ATM owner/operator?

HELP! We actually have someone inquiring about opening an account and they are the ISO, but so far all we have had is the independent ATM owner/operator convenience stores, and I got a real good grasp on them.

We have business customers who have "Privately Owned ATMs (POA)". Annually, we do an onsite visit, along with a questionnaire. Where they have to answer a few questions about the ATM machine. When they first establish their POA they have to provide us a copy of their ATM processing agreement. There is no "service contract" but I'm wondering if the ATM processing agreement is the same thing? We've had the POA accounts for years.

We are in the process of acquiring a business customer...well a DBA...it is a local liquor store with a Privately Owned ATM. We have never had a customer with Privately Owned ATM, so I am just curious - what does your annual onsite visits consist of typically?

A picture of the outside of the establishment and a picture of the ATM.

What the heck does a picture of the ATM have to do with due diligence? What does that tell you? Not sure why this would trigger an annual on-sight visit myself.

If it is privately owned by the business owner, you want them to be depositing the ATM settlements at your bank and comparing that to the amount of cash they are withdrawing to stock the machine or if they are funding it through cash on hand, that those amounts seem reasonable compared to their other deposit activity to make sure they are not laundering money through it.

On top of the questionnaire that we fill out, which does include comparing the ATM settlements to the amount of cash the withdrawn, it shows that they do have an ATM at the location they told us they do. FI's do not have to do an onsite visit.