FinCEN Typology Reference

TFPFTerrorist financing covers the movement of funds to designated foreign terrorist organizations (ISIS, Hamas, Hizballah) and to state actors that sponsor or shelter them (Iran, and historically North Korea). FinCEN's advisories in this space typically follow a specific geopolitical trigger — a Treasury/OFAC designation, an escalation in a conflict zone, or a sanctions-evasion scheme uncovered through BSA data — and pair a narrative on the group's financing model with SAR key terms financial institutions should use when filing.

Mechanics

Common financing channels include front companies and trading networks (often layered through trade-based money laundering), exploitation of informal value transfer systems, digital-asset infrastructure used to move funds around sanctioned banking channels, and, for Iran specifically, "shadow banking" networks that mimic correspondent banking relationships using unlicensed money changers.

Red flags — as published in FIN-2026-Alert002

Fourteen indicators in three groups, supplementing (not replacing) those in the June 2025 Iran advisory. Unusually for a FinCEN product, each indicator carries a paired suggested control action. These are set out separately below rather than buried in the indicator text, since they read as de facto supervisory expectations. Note the source itself varies its phrasing — most read "consider," but one uses the stronger "should consider," flagged in gold below.

Regulatory history

Red flags: ISIS financing — as published in FIN-2025-A001

Eleven indicators covering both organizational ISIS financing and homegrown violent extremist (HVE) activity. FinCEN notes there are limited financial indicators unique to HVE activity, which is precisely why the behavioral-change indicators below matter.

Red flags: Iranian oil, shadow banking & procurement — as published in FIN-2025-A002

Fifteen indicators in three groups. Some carried forward from the rescinded 2018 advisory and remain valid. The 2026 IRGC alert supplements these rather than replacing them — both sets apply.

Red flags: Hamas financing — as published in FIN-2023-Alert006

Seven indicators, issued thirteen days after the October 7, 2023 attacks.

• A customer or counterparty transacts with OFAC-designated entities/individuals, or transactions contain a nexus to their listed identifiers — email, physical address, phone number, passport number, or virtual currency address
• Information in a transaction between customers indicates support for terrorist campaigns
• A customer transacts with an MSB or other institution — including one offering virtual currency services — operating in a higher-risk jurisdiction tied to Hamas activity, reasonably believed to have lax CDD, opaque ownership, or otherwise fail AML/CFT best practices
• Transactions originate with, are directed to, or involve shell corporations or general "trading companies" with a nexus to Iran or other Iran-supported groups such as Hizballah and PIJ
• A charitable organization or NPO solicits donations but shows no discernible charitable activity, or openly supports Hamas — sometimes via social media or encrypted apps, including in virtual currency
• A charity or NPO receives large donations from an unknown source over a short period, then sends significant wires or checks to other charities/NPOs — a pass-through pattern
• A customer transacts with known or suspected virtual currency addresses tied to terrorism or terrorist-financing donation campaigns

Red flags: Hizballah financing — as published in FIN-2024-Alert003

Seven indicators, in addition to those in FIN-2024-A001, all of which remain relevant.

Red flags: Iran-backed terrorist organizations — as published in FIN-2024-A001

Eight indicators — in addition to those in the 2018 Iran advisory and the October 2023 Hamas alert, all of which remain relevant.

• A customer or counterparty transacts with OFAC-designated entities/individuals, or transactions contain a nexus to their listed identifiers — email addresses, physical addresses, phone numbers, passport numbers, or CVC addresses
• A transaction or P2P transfer memo includes key terms known to be associated with terrorism or terrorist organizations
• A customer transacts with an MSB or other institution — including a VASP — operating in a jurisdiction known or high-risk for terrorist activity, reasonably believed to have lax customer identification, opaque ownership, or otherwise fail AML/CFT best practices
• Transactions originate with, are directed to, or involve front companies or general "trading companies" with unclear business purposes whose beneficial ownership suggests an Iran nexus — indicators: opaque ownership, obscurely named directing individuals/entities, or residential/co-located business addresses
• A customer that is or purports to be a charitable organization or NPO solicits donations but provides no discernible charitable services, or openly supports terrorist activity — sometimes soliciting via social media or encrypted apps, including in CVC
• A customer receives numerous small CVC payments from many wallets, then transfers to another wallet, particularly if logged in from an IP based in a jurisdiction known or high-risk for terrorist activity
• Money transfers to a high-risk jurisdiction inconsistent with the customer's stated occupation, with vague purposes such as "travel expenses," "charity," "aid," or "gifts"
• An account receives large payouts from social media fundraisers or crowdfunding platforms and is then accessed from an IP in a high-risk jurisdiction, particularly where the contributing social-media accounts contain content supportive of terrorist campaigns

An additional indicator worth flagging on its own: a U.S. or third-country incorporated company whose activities occur solely in high-risk jurisdictions with no relationship to its stated business purpose.

PFProliferation financing refers to funding the acquisition of weapons of mass destruction or their delivery systems; the adjacent typology of export-control evasion covers efforts to route controlled dual-use goods (electronics, machine tools, semiconductors) around U.S. and allied export licensing regimes. FinCEN's post-2022 output in this area is dominated by joint alerts issued with the Commerce Department's Bureau of Industry and Security (BIS) tracking Russian and, more recently, Iranian evasion networks.

Mechanics

Shell companies and freight-forwarder front companies in third countries (frequently in Central Asia, the Caucasus, Hong Kong, or the UAE) re-route restricted goods; payment is often structured through layered intermediary accounts or CVC to obscure the ultimate purchaser.

The two-key-term structure

FinCEN and BIS run two parallel SAR key terms, and choosing correctly matters: FIN-2022-RUSSIABIS for Russia-related evasion, and FIN-2023-GLOBALEXPORT for everything else. FinCEN's explicit instruction: where an institution suspects export-control evasion but is unsure whether it is Russia-related, it should use both codes.

Practitioner note, not from FinCEN: unlike the millions of SARs filed annually, every SAR bearing these key terms is reviewed by law enforcement. Filing institutions should anticipate follow-on investigative contact and potential grand jury subpoenas.

Red flags — as published in FIN-2023-NTC2

Thirteen indicators. These are in addition to the 22 indicators in the June 2022 Russia alert, which remain operative.

Disruptive technologies to scrutinise in commodity descriptions

The notice names six categories the Disruptive Technology Strike Force prioritises, which double as a checklist for reviewing payment memos and trade documentation:

• Advanced semiconductors — logic/AI chips, fabrication equipment, electronic design automation software, and novel materials for production below 14 nanometres
• Supercomputing hardware — including GPUs — and modelling/simulation software
• Quantum technologies
• Hypersonic technologies
• Military bioscience — e.g. human performance enhancements such as brain-computer interfaces
• Advanced aerospace technology

Regulatory history

Red flags: Russia/Belarus supplemental — as published in FIN-2023-Alert004

Nine additional indicators, read together with the 22 in FIN-2022-Alert003 — this alert doesn't replace them.

• Payments for defense or dual-use products from a company incorporated after February 24, 2022 (the invasion date) and based in a non-GECC country
• A new customer trading in products tied to the nine High Priority Items List HS codes (below), based in a non-GECC country and incorporated after February 24, 2022
• An existing customer who received none of the nine HS-code items before February 24, 2022, but is receiving them now
• An existing foreign customer who received some of the nine HS-code items before the invasion date and requested or received a significant increase in those same items afterward
• A customer lacks or refuses to provide details about end users, intended end-use, or company ownership
• Smaller-volume payments from the same end-user's foreign bank account to multiple, similar suppliers of dual-use products — deliberately staying under the radar rather than one large payment
• Parties listed as ultimate consignees or in the "consign to" field who don't typically consume or use commodities themselves — other financial institutions, mail centers, or logistics companies
• The customer significantly overpays relative to known market prices for a commodity
• The customer or its address resembles a party on the BIS Entity List, the OFAC SDN List, or State's Statutorily Debarred Parties List

The High Priority Items List

Nine HS codes developed with the EU, UK, and Japan by studying Russian weapons systems recovered on the Ukrainian battlefield — components found in the Kalibr and Kh-101 cruise missiles and the Orlan-10 UAV. A license is required for shipment of any of these to Russia, Belarus, Crimea, or Iran.

BIS identified three diversion-risk fact patterns among non-GECC importers: the company never received exports before the invasion; it received exports but none of the nine HS codes before the invasion; or it received the nine-code items before the invasion and saw a significant spike afterward.

Red flags: Russia/Belarus — as published in FIN-2022-Alert003

All 22 indicators from the foundational joint alert, still fully operative. FinCEN opens with the evasion logic: illicit actors deliberately target EAR99 items — low-tech consumer goods not on the Commerce Control List that normally need no licence — and engage complicit shippers or customs brokers to obscure the goods or their destination.

Commodities of concern (BIS, 2022 alert)

All require a BIS licence before export or reexport to Russia or Belarus. Useful as a screening list against payment memos and trade documentation.

BIS-identified transshipment points (non-exhaustive): Armenia, Brazil, China, Georgia, India, Israel, Kazakhstan, Kyrgyzstan, Mexico, Nicaragua, Serbia, Singapore, South Africa, Taiwan, Tajikistan, Turkey, United Arab Emirates, Uzbekistan. FinCEN notes controlled items may be legally exported to these jurisdictions as production inputs — it is onward export of the finished goods to Russia or Belarus that may be prohibited.

CORFinCEN treats corruption — bribery, misappropriation of state assets, and the laundering of proceeds by senior foreign political figures (PEPs) — as a distinct national-security priority, reflecting a 2021 White House national security memorandum. Advisories in this category name specific jurisdictions (Venezuela, Nicaragua, South Sudan) or specific asset classes favored by sanctioned elites (luxury real estate, high-value goods).

Mechanics

Proceeds typically move through shell companies and trust structures in secrecy jurisdictions, then into high-value, hard-to-trace assets — real estate (see Real Estate Laundering), art and antiquities, and luxury goods — often using professional intermediaries (lawyers, real estate agents, art dealers) as unwitting or complicit gatekeepers.

Sanctions evasion in commercial real estate

FinCEN's January 2023 alert is the most detailed treatment of how sanctioned elites exploit a specific asset class. The core insight is that CRE's legitimate features are the vulnerability: transactions almost always involve private companies or institutional investors, so trusts, shell companies, and pooled investment vehicles are standard on both sides — used for ordinary legal, tax, and liability reasons — with several layers of entities frequently involved and often domiciled offshore.

The threshold-gaming problem, stated plainly by FinCEN. Because a fund may have many investors, an individual's stake commonly falls below the CDD Rule's 25% beneficial ownership threshold and escapes screening entirely. FinCEN goes further: even where a bank lowers its threshold to 10% for high-risk customers, investors seeking to evade sanctions may lower their interest to just below that. And critically — such an investor may be a general partner with actual control of the fund while sitting under the bank's ownership threshold. Control and ownership come apart, and the rule only catches ownership.

Four typologies named: pooled investment vehicles including offshore funds; shell companies and trusts across multiple jurisdictions; third parties — relatives, friends, business associates — setting up the entities or holding assets in trust; and deliberately inconspicuous investments. On that last point FinCEN is emphatic: the properties need not be luxury or high-end, and can be multifamily housing, retail, office, industrial, or hotel. There are no central geographic hubs — evasion is as likely in small- and mid-size urban centres as in major cities.

Trust analysis point: where a sanctioned person was at any time the grantor/settlor, trust protector, trustee, or beneficiary, institutions should take particular care to confirm they hold no present, future, or contingent property interest (per 31 CFR §589.331).

Red flags — as published in FIN-2023-Alert002

• An offshore private investment vehicle used to purchase CRE that includes PEPs or other foreign nationals as investors — particularly family members or close associates of sanctioned Russian elites
• Customers decline to provide information when asked about ultimate beneficial owners or controllers of a legal entity or arrangement
• Multiple LLCs, corporations, partnerships, or trusts in a transaction with ties to sanctioned Russian elites, where the entities have slight name variations
• Legal entities or arrangements such as trusts used to purchase CRE involving friends, associates, family members, or others closely connected to sanctioned Russian elites
• Ownership of CRE through legal entities in multiple jurisdictions — often involving a trust based outside the U.S. — without a clear business purpose
• Transfers of assets from a PEP or Russian elite to a family member, business associate, or associated trust in close temporal proximity to a legal event such as an arrest or OFAC designation
• Legal instruments such as deeds of exclusion intended to transfer a CRE interest from a PEP or Russian elite to a family member, associate, or trust following such a legal event
• Private investment funds or companies submitting revised ownership disclosures showing sanctioned individuals or PEPs who previously owned more than 50% of a fund reducing their stake to under 50%
• There is limited discernible business value in the CRE investment, or it falls outside the client's normal business operations

Regulatory history

TCODRGTBML disguises the movement of illicit proceeds as legitimate international trade. FinCEN's foundational SAR-filing guidance on this typology dates to 2010, but it recurs constantly as an overlay technique inside cartel financing, terrorist financing, and sanctions-evasion cases.

Mechanics

The classic technique is over- or under-invoicing: goods are shipped with an invoice value that doesn't match their true worth, and the difference settles an unrelated debt. Related sub-techniques include multiple invoicing of the same shipment, phantom shipments with no goods at all, and misrepresenting the quantity or quality of goods. In the Mexico-U.S. corridor, TBML frequently intersects with funnel accounts and the Black Market Peso Exchange.

Red flags — as published in FIN-2010-A001

FinCEN developed these with the National Drug Intelligence Center and ICE's El Dorado Task Force. FinCEN's own caveat applies: no single indicator alone signals TBML, and each must be weighed against expected activity for that customer. These are strongest when seen alongside shipments of high-value merchandise (electronics, auto parts, precious metals and gems) into duty-free trade zones such as Panama's Colón Free Trade Zone.

Regulatory history

Note: Mexico's banking regulator responded by installing government overseers at the three institutions; FinCEN extended the orders' effective date twice (to September 4, 2025) citing "significant measures" by the Mexican government, illustrating how a §311-style action can function as diplomatic leverage as much as a laundering cutoff.

TCOStructuring is the practice of breaking a large cash transaction into smaller deposits, each below the $10,000 Currency Transaction Report (CTR) threshold, to avoid triggering federal reporting. FinCEN's 2009 advisory responded to law-enforcement reports that casino personnel were colluding with patrons to structure chip purchases and cash-outs.

Mechanics

A single depositor — or a network of "smurfs" acting on one organizer's behalf — makes a series of deposits at or under the reporting threshold across multiple branches, accounts, or days. FinCEN's own $5,000 threshold applies for the SAR obligation on structured transactions (lower than the $10,000 CTR trigger being evaded).

Illustrative scenarios — as published in FIN-2009-A003

• A premium player induces casino personnel to break up a transaction into multiple transactions to fall below the $10,000 CTR threshold
• A patron persuades casino personnel to alter or omit transaction or identification information on casino records (e.g. a player rating record)
• A cage cashier tells a player holding chips worth more than $10,000 that reducing the redemption amount to $10,000 or below will avoid reporting, and the player complies
• A patron obtains a pit boss's help coordinating buy-ins around the casino's gaming-day cutoff, splitting cash transactions across different gaming days

Penalties: up to $25,000/day for an inadequate BSA compliance program (a separate violation each day it continues); up to the greater of the transaction amount (capped at $100,000) or $25,000 per reporting violation; and up to the full amount of currency involved for structuring itself or assisting in it.

Regulatory history

TCODRGFinCEN's official definition: "An individual or business account in one geographic area that receives multiple cash deposits, often in amounts below the cash reporting threshold, and from which the funds are withdrawn in a different geographic area with little time elapsing between the deposits and withdrawals." FinCEN's 2014 update linked the pattern to Mexico-based drug trafficking proceeds moving north-to-south, following Mexico's 2010 restrictions on USD cash deposits at Mexican banks and exchange houses.

Mechanics

A colluding business owner opens an account at a bank or credit union with multi-state branch/shared-branching reach. Individuals acting for a criminal organization deposit narcotics cash at branches geographically distant from the account's home branch, each deposit kept below $10,000. An intermediary then wires or checks the funds to a U.S. or foreign business to purchase goods, which are shipped abroad and sold; the sale proceeds — now in local currency — flow back to the trafficking organization, laundered through TBML. A "peso broker" variant lets a cartel exchange U.S. cash for clean Mexican pesos entirely through apparently legitimate trade.

Red flags — as published in FIN-2014-A005

• An account opened in one state (typically along the Southwest border) receives multiple cash deposits under $10,000 by unidentified persons at branches outside the account's home geographic region — individual or business accounts alike
• For a business account, out-of-state deposits occur in a region where the business doesn't actually operate (e.g. a Southern California produce company's account receiving small cash deposits in Chicago, Indianapolis, and Minneapolis)
• Individuals opening or depositing to the account show no detailed knowledge of the account holder, its stated business, or the source of the cash — consistent with criminal organizations paying students, itinerant workers, or the underemployed to conduct funnel transactions
• Debits from a business account receiving out-of-state deposits don't match the stated business activity (e.g. a produce company's checks made payable to a leather-goods business, or wires to a Chinese textile manufacturer)
• Checks issued from the account show different handwriting on the payee/amount lines than the signature line — suggesting pre-signed blank checks handed to a criminal organization to complete
• Wire transfers or checks from the account are deposited into, or cleared through, a Mexican bank's U.S. correspondent account

Regulatory history

TCOTFFinCEN's definition: IVTS is "any system, mechanism, or network of people that receives money for the purpose of making the funds or an equivalent value payable to a third party in another geographic location, whether or not in the same form," generally operating outside the conventional banking system. Hawala, hundi, and similar networks are IVTS variants. IVTS is a type of money transmitter (a Money Services Business) and must register and comply with AML program, recordkeeping, and reporting obligations like any other MSB; FinCEN notes continuing indications that IVTS has been used to help fund attempted terrorist attacks, including against the U.S.

Mechanics

A customer gives cash to a broker in one country; the broker instructs a counterpart broker elsewhere to pay the recipient in local currency, and the two brokers settle their mutual balance later, often through trade invoicing (overlapping with TBML).

Case examples — as published in FIN-2010-A011

• Abad's Carnival French Ice Cream (Brooklyn) was convicted of operating as a money transmitter without a state license; $22.2 million in structured deposits (kept below reporting thresholds) were consolidated into a central U.S. account, then $21.9 million was wired to accounts in 25 other countries, where recipient IVTS operators converted the funds to local currency for distribution
• Mauricio Alfanso Mazza-Alaluf was convicted of providing unlicensed IVTS services after physically carrying millions of dollars through LAX and depositing them in U.S. accounts to relay payments between Chilean businesses/individuals and U.S. customers

SAR filing instructions — as published in FIN-2010-A011

Check the appropriate SAR box for the suspicious activity type and note the abbreviation "IVTS" in the narrative, along with an explanation of why the institution knows, suspects, or has reason to suspect IVTS involvement.

Regulatory history

TCODRGBulk cash smuggling is the physical transport of large volumes of U.S. currency across borders — most prominently southbound into Mexico — to repatriate drug-trafficking proceeds outside the banking system entirely. FinCEN's 2025 alert tied this directly to Mexico-based cartels reacting to tightened Mexican banking restrictions on U.S. dollars.

Mechanics

Cash is concealed in vehicles, commercial cargo, or on couriers and moved across land borders or through ports, then reintroduced into the financial system abroad through complicit exchange houses or casas de cambio.

Red flags — as published in FIN-2025-Alert001

Ten indicators split between depository institutions and armored car services (ACSs) — the two points where this typology becomes visible.

Regulatory history

DRGTCOSHELLMSBCVCThe financial layer of the illicit fentanyl supply chain. Mexico-based TCOs — principally the Sinaloa Cartel and CJNG — buy precursor chemicals, pill presses, and die molds primarily from PRC-based suppliers, synthesise fentanyl in clandestine Mexican labs, and traffic it north. FinCEN's framing of why banks matter here is unusually direct: BSA reporting lets law enforcement "follow the money behind the illicit fentanyl supply chain… and ultimately aid in the effort to save American lives."

The supply-chain shift that created this typology

Before 2019, complicit PRC-based chemical and pharmaceutical companies shipped finished fentanyl directly to U.S. buyers or to Mexican networks. After the PRC scheduled all fentanyl-related substances as a class in May 2019, that direct trade fell sharply — and the market restructured around precursors instead. Mexico-based TCOs became the predominant traffickers, buying inputs rather than product. Many current PRC suppliers are the same firms that previously made fentanyl itself.

Mechanics

Procurement. TCOs buy direct from PRC suppliers or through chemical brokers — middlemen based in Mexico, the PRC, or elsewhere who represent multiple suppliers and multiple cartels, and whose function is precisely to obscure the diversion. Suppliers and brokers advertise openly in English on company websites, e-commerce marketplaces, social media, and the darknet, marketing precursors by CAS number for easy reference. Listings may tout "exit and entry customs clearance" — which FinCEN identifies as a euphemism for mislabelling shipments to evade customs and law enforcement.

Payment. Negotiated by email, phone, text, or encrypted messaging; paid in single or multiple transactions from Mexico or the U.S., often structured across multiple senders and beneficiaries. FinCEN makes an important point about scale: these payments are frequently low-dollar — but they convert into very large trafficking proceeds downstream. A monitoring programme calibrated only to large transfers will miss this entirely.

Three financial channels: shell and front companies posing as legitimate Chinese exporters or Mexican importers (and sometimes as textiles, food, or electronics businesses); money transfers through banks, MSBs, and online payment processors — much of it cleared in U.S. dollars through U.S. correspondent banks and U.S.-affiliated agents even when neither party is American; and virtual currency, increasingly, in bitcoin, ether, monero, and tether to supplier-affiliated wallets or secondary transmitters.

Red flags — as published in FIN-2024-A002

Fourteen indicators, in addition to those in the 2019 Fentanyl Advisory, which FinCEN states all remain relevant.

Regulatory history

CORTCOREReal property — especially luxury residential real estate purchased through legal entities — offers a stable store of value with historically thin beneficial-ownership disclosure. Real estate appreciates in value, "cleans" large sums in a single transaction, and shields gains from market instability and exchange-rate fluctuations. FinCEN's 2017 advisory extended SAR-filing expectations directly to real estate firms and professionals (who are BSA-defined financial institutions but exempted from mandatory program requirements), and later alerts named sanctioned Russian elites as specific purchasers of concern.

Mechanics

An all-cash purchase — nearly one in four residential sales nationally, roughly half in Miami-Dade circa 2015–16 — is made through an LLC, trust, or other opaque entity, severing the direct link between the beneficial owner and the property and avoiding the AML scrutiny that accompanies mortgage financing. FinCEN's GTOs (2016–17) required title insurers to report beneficial ownership on non-financed high-value residential purchases in seven major metro areas; as of May 2017, over 30% of GTO-reported transactions involved a beneficial owner or purchaser's representative previously named in an unrelated SAR.

Case studies — as published in FIN-2017-A003

• DOJ sought forfeiture of $1B+ in assets tied to the 1MDB Malaysian sovereign-wealth-fund theft, including ~$315M in luxury real estate (a hotel, homes, and a mansion in Beverly Hills; a home in LA; a condo, two apartments, and a penthouse in NYC; a London townhouse)
• OFAC designated then-Venezuelan VP Tareck El Aissami and frontman Samark Lopez Bello for narcotics trafficking, along with shell companies tied to Lopez Bello used to hold real estate
• Real estate agent Anthony Keslinke used straw buyers and altered records to buy Northern California real estate with cash (2011–2014), then resold at a gain — jailed and ordered to forfeit $3.8M plus $1.4M in restitution

Suspicious-transaction factors — as published in FIN-2017-A003

• The transaction lacks economic sense or an apparent lawful business purpose — generates little to no revenue, or proceeds with no regard to high fees or monetary penalties
• The purchase disregards the property's condition, location, assessed value, or sale price
• Funding far exceeds the purchaser's apparent wealth, comes from an unknown origin, or flows to/from unrelated individuals or companies
• The transaction is deliberately irregular — e.g. property purchased under an unrelated party's name, or records such as assessed value altered

SAR filing instruction

Key term "ADVISORY REAL ESTATE" in the SAR narrative and field 33(z) (Money Laundering – Other). Real estate professionals (brokers, escrow agents, title insurers) are not required to file but are encouraged to do so voluntarily and receive the same safe-harbor protection as mandatory filers.

Regulatory history

TCOCORCorrespondent banking lets a U.S. bank process transactions on behalf of a foreign bank that lacks direct access to the U.S. financial system. "Nested" (downstream) correspondent banking occurs when that foreign respondent bank, in turn, provides its own downstream customers — including other banks — access to the U.S. correspondent account without the U.S. bank ever knowing those downstream customers exist. Section 312 of the USA PATRIOT Act built enhanced due diligence (EDD) requirements around exactly this risk.

When EDD is statutorily required — per the Section 312 Fact Sheet

Section 312 requires enhanced due diligence for a correspondent account maintained for a foreign bank operating: (1) under an offshore license; (2) in a jurisdiction found non-cooperative with international AML principles; or (3) in a jurisdiction designated of primary money-laundering concern under §311. For such accounts, the U.S. institution must take reasonable steps to (1) conduct appropriate enhanced scrutiny, (2) determine whether the foreign bank itself offers correspondent accounts to other foreign banks — i.e. nested accounts — and identify and conduct additional due diligence on those downstream customers as appropriate, and (3) identify the owners of the foreign bank if its shares aren't publicly traded.

Mechanics

A U.S. bank opens a correspondent account for Foreign Bank A. Foreign Bank A then allows Foreign Banks B, C, and D — or even individual high-risk customers — to transact through that same account by "nesting" underneath it. The U.S. bank's due diligence covers Bank A, but has no visibility into who is actually moving money, defeating the purpose of screening and monitoring.

Regulatory history

TCODRGTreasury's 2026 National Money Laundering Risk Assessment (NMLRA) names CMLNs as "the dominant" professional money laundering service providers for drug trafficking organizations and other TCOs worldwide — not just a Mexico-cartel-specific tool but the leading horizontal, decentralized laundering infrastructure globally. CMLNs are "professional money launderers" (PMLs): third parties who launder for a fee rather than perpetrating the underlying crime themselves, drawing on sustained demand among PRC nationals for informal channels to move capital out of China.

Mechanics

CMLNs collect bulk cash from U.S.-based drug sales (often through funnel accounts), using U.S.-based Chinese nationals — sometimes unwittingly — to deposit cash of unknown origin into the U.S. financial system. They settle balances via mirror transfers, underground remittance, and trade-based money laundering, avoiding cross-border cash movement entirely, then repatriate value to China or launder it further through digital assets. Some networks operate CVC exchanges and marketplaces directly, blending traditional and crypto laundering rails.

Red flags — as published in FIN-2025-A003

FinCEN splits its indicators into two sets. Its standard caveat applies with unusual force here: many of these reference Chinese nationality or a Chinese passport, and FinCEN is explicit that no single red flag is determinative — surrounding facts, historical activity, prevailing business practice, and whether multiple flags co-occur all matter before concluding activity is suspicious.

Regulatory history

TCODRGTFFRDCORSHELLFuel smuggled from the U.S. into Mexico without paying Mexican import tax, then sold on the black market. FinCEN states that fiscal fuel theft and traditional fuel/oil theft together have become the most significant non-drug illicit revenue source for the Cartels — public reporting estimates a quarter to a third of all fuel sold in Mexico may be illicit. This typology carries an unusually broad priority tag set because CJNG and other cartels are now designated Foreign Terrorist Organizations, so material support exposure attaches.

Why the arbitrage exists

Mexico produces crude but can't refine enough of its own sour, heavy crude — it imports nearly 2 million barrels/day of refined fuel, over 70% of national consumption. Those imports carry a substantial excise tax (IEPS), making Mexican fuel far more expensive than U.S. fuel. A 2013 reform split permitting in two: SENER permits allow importing fuel but not selling it inside Mexico; CNE permits allow buying and selling inside Mexico but not importing. Companies generally hold one, not both. After 2019 rescinded and restricted many permits to prioritize Pemex, supply tightened and actors concentrated — producing exactly the price gap and bottleneck a black market fills.

Mechanics

Cartels use Mexican brokers holding CNE permits (not SENER) to buy fuel directly from complicit U.S. fuel traders — which is itself unlawful under Mexican law and is the structural tell. Those U.S. traders are typically otherwise-legitimate Texas companies with longstanding refinery relationships, concentrated around Houston, San Antonio, South Texas, and the Lower Rio Grande Valley. Fuel bought at a U.S. terminal for export is diverted through networks of U.S. and Mexican front and shell companies in oil/gas, freight, and logistics, then moved by tanker truck, railcar, and sometimes shadow-fleet vessels into Tamaulipas, Nuevo León, and Coahuila. Customs documents misclassify it as "waste oils," "lubricants," "additives," "petroleum residues," or "hazardous waste" — categories not subject to the import tax — aided by bribed customs and tax officials, or the fuel is concealed in nonstandard containers entirely.

Inside Mexico, brokers generate fraudulent invoices claiming purchase from SENER-permitted importers to launder the fuel's provenance, then sell to cartel-controlled front distributors who retail it through affiliated gas stations and unregulated roadside stops (cachimbas) — sometimes forcing legitimate distributors to buy under threat of violence.

Payment back to the U.S. runs through international wires and digital asset payments — particularly stablecoins — from Mexican brokers to complicit U.S. traders, often as many large non-descriptive payments per day, sometimes routed through pass-through shell companies in unrelated sectors or registered to residential addresses. Alternatively cartels pay U.S. traders directly via structured cash deposits of drug proceeds at border-area branches, a TBML variant. U.S. traders then launder receipts into luxury goods, real estate, and investment assets.

The corruption loop: FinCEN reports cartels use fuel profits to make cash payments to Mexican political campaigns and media outlets to elect officials who protect the trade, then use those officials to control administrative posts and access state contracts for further laundering.

Red flags — as published in FIN-2026-Alert003

Twenty-two indicators, building on (not replacing) the May 2025 Cartel Oil Smuggling Alert. FinCEN singles out one as the highest-value screen: assess whether oil and gas customers are receiving payments directly from Mexican companies without SENER permits — not customary practice in the legitimate trade, and therefore highly indicative. FinCEN suggests requesting export documentation and counterparty SENER-permit documentation, which may be attached to SAR filings.

Regulatory history

The predecessor scheme: northbound crude smuggling — FIN-2025-Alert002

The May 2025 alert addresses the mirror image of fiscal fuel theft: crude flowing north. Mexico can't refine enough of its own sour, heavy crude, so it exports unrefined crude to higher-capacity U.S. refineries and imports refined fuel back. Cartels exploit that legitimate flow by stealing crude from Pemex — bribing employees and officials, drilling illegal pipeline taps, hijacking tanker trucks — and smuggling it north through Mexican brokers, mislabelled as "waste oil" or other hazardous materials, to complicit small U.S. importers who sell it at a steep discount as WTI and other crude.

Once across, the crude goes to vacant lots fitted with mobile storage tanks before delivery to the importer. Trade documentation lists U.S. companies as importers and ultimate consignees to make the "waste oil" import look legitimate — some of those supposed consignees are registered to residential addresses. Law enforcement estimates U.S. importers can clear over $5 million profit per tanker shipment, with multiple tankers monthly. Proceeds return to Mexico via wires whose instructions falsely reference invoices for waste oil or hazardous materials.

Red flags: northbound crude smuggling — as published in FIN-2025-Alert002

Fourteen indicators. FinCEN's anti-de-risking caveat applies here too: "no customer type presents a single level of uniform risk" and these should not justify wholesale de-risking of the oil, gas, or freight industries.

FRDElder financial exploitation covers the illegal or improper use of an older adult's funds or assets, by a trusted caregiver, family member, or an outside scammer. FinCEN first issued SAR-filing guidance on this in 2011 and refreshed it substantially in 2022 as reported incidents and dollar losses climbed.

Mechanics

Two broad patterns recur: exploitation by someone in a position of trust (a caregiver or family member gradually draining accounts or misusing a power of attorney), and scams by outside actors (romance scams — see Romance & Investment Scams — grandparent scams, and government-imposter schemes) that persuade a victim to send money directly, typically routed onward through money mules.

Red flags — as published in FIN-2022-A002

FinCEN publishes twelve behavioral and twelve financial indicators, building on (not replacing) the 2011 advisory's list. FinCEN's caveat: no single red flag is determinative — weigh historical activity, prevailing business practice, and whether multiple flags co-occur. Note that victims may be perpetrators' unwitting money mules, and a customer may be a perpetrator, facilitator, or victim.

Regulatory history

FRDCYBBEC targets a financial institution's commercial customers; EAC targets an individual's personal accounts — both use a compromised or spoofed email account to induce a fraudulent but seemingly-legitimate wire transfer. Since 2013, FinCEN counted roughly 22,000 reported BEC/EAC cases totaling $3.1 billion (as of the 2016 advisory); FinCEN's 2019 update put cumulative possible losses since 2016 at over $9 billion and broadened the definition beyond wire transfers to include CVC payments, ACH transfers, and gift-card purchases, and beyond commercial victims to high-net-worth individuals and non-traditional entities (the 2019 advisory specifically flagged colleges and universities as emerging targets, given large tuition/endowment/grant flows).

Mechanics — three stages

(1) Criminals unlawfully access a victim's email via social engineering or intrusion, then mine it for information on the victim's financial institution, accounts, and contacts. (2) Using the compromised account — or a lookalike fake one — they email fraudulent wire instructions appearing to come from the victim. (3) They trick the victim's employee or financial institution into executing a wire transfer that appears legitimate but sends funds to a criminal-controlled account, often at a bank in Asia (China and Hong Kong are common destinations). BEC scenarios include impersonating the customer directly, impersonating an executive to mislead an employee into authorizing payment, or impersonating a supplier to redirect invoice payments to a new account. EAC scenarios extend the same technique to brokers, realtors/escrow companies, and attorneys handling client funds.

Red flags — as published in FIN-2016-A003

• Emailed transaction instructions contain different language, timing, or amounts than previously verified authentic instructions
• Instructions originate from an email address closely resembling a known customer's — altered by adding, changing, or deleting one or more characters (e.g. john-doe@abc.com → john_doe@abc.com or john-doe@bcd.com)
• Instructions direct payment to a known beneficiary but with different account information than previously used
• Instructions direct a wire to a foreign account previously documented in customer complaints as a fraud destination
• Instructions direct payment to a beneficiary with no payment history or documented relationship, in an amount similar to or exceeding what the customer has historically paid other beneficiaries
• Instructions are marked "Urgent," "Secret," or "Confidential"
• Instructions are delivered in a way that gives the institution limited time to confirm authenticity
• Instructions come from an employee newly authorized on the account, or one who hasn't previously sent wire instructions
• A customer's employee relays instructions based solely on email from executives/attorneys but states they were unable to verify the request directly with them
• A customer requests additional payments immediately after a successful payment to a previously-unused account — consistent with a criminal probing how far a successful fraud can be pushed
• An incoming wire names a beneficiary who is not the account holder of record — visible to the receiving institution when a victim was tricked into paying a "new" account they believed belonged to a known supplier

Regulatory history

FRDCYB"Pig butchering" describes a long-con romance or friendship scam that culminates in the victim being persuaded to invest — usually in fraudulent virtual-currency platforms — with the scammer building trust over weeks or months before the ask. FinCEN's 2023 alert named the term directly, reflecting law enforcement's adoption of an originally Chinese-language slang term for the pattern.

Mechanics

Contact typically begins via social media, dating apps, or a "wrong number" text; the scammer cultivates a relationship, then introduces a purportedly lucrative investment opportunity on a fake trading platform — often operated through shell companies — that the victim can watch "grow" before being blocked from withdrawing.

Mechanics: the four phases

1. Contact. Text, social media DM, professional networking site, or dating app — typically framed as a wrong number or an attempt to reconnect with an old friend. The scammer may claim to be an investor or money manager and maintain a profile showcasing wealth. FinCEN notes plainly that a significant number of scammers are themselves victims of human and labour trafficking, coerced into the work (see SE Asia Scam Compounds).

2. The pitch. The victim is directed to fraudulent trading websites or apps the scammer controls — or to legitimate apps with third-party plugins that let the scammer falsify what the victim sees. Scammers may request remote access to the victim's device to open VASP accounts on their behalf, or walk them through purchases via screenshots. Newer variants use fake "play-to-earn" games. Victims are also directed to wire overseas, buy prepaid cards, or use virtual currency kiosks.

3. Fabricated returns. The platform displays extraordinary gains. Crucially, the scammer may permit a small withdrawal to cement confidence before urging larger investment. FinCEN documents victims liquidating tax-advantaged accounts and taking out HELOCs and second mortgages. Victims are sometimes encouraged to recruit friends and family.

4. The point of no return. When investment slows, tactics escalate — supposed losses the victim must cover, or, if they try to withdraw, demands for "taxes" or "early withdrawal fees." Once the victim can't or won't pay more, contact ceases entirely.

Red flags — as published in FIN-2023-Alert005

Sixteen indicators across behavioural, financial, and technical categories.

Regulatory history

FRDTreasury's 2026 NMLRA groups impersonation schemes — tech support scams, government/law-enforcement impersonation, and the increasingly prominent "gold bar courier" scam — under its broader confidence-scam category. These primarily originate from India-based call centers (tech support) or spoofed government caller-ID numbers, but rely on U.S.-based money mules to actually receive and launder funds. Roughly 98% of government-impersonation losses are reported by victims over 60.

Variant: Foreign/International Student Targeting

A distinct strand of this typology targets international students directly rather than the general public. The FBI and IC3 issued a public alert (May 2025, still active as of January 2026) on scammers impersonating U.S. or foreign government/immigration officials who contact students lawfully in the U.S. on F-1 visas — confirmed targets include nationals of the UAE, Saudi Arabia, Qatar, and Jordan — falsely claiming a visa-status violation and threatening deportation or prosecution unless the student pays an "immigration processing," "registration," or "legal" fee. In 2024, government-impersonation schemes overall (including this variant) cost the public $405M+ across 17,000+ complaints. Victims are directed to pay via CVC, prepaid/gift cards, or wire transfer.

Mechanics

Tech support scams open with a fake pop-up or unsolicited call claiming a computer problem, walking the victim through purchasing gift cards to "fix" it. Government impersonation scams spoof law-enforcement or agency caller ID, use an urgent tone to claim the victim's identity was used in a crime (or, in the student variant, that their visa status is invalid), and direct them to withdraw retirement savings and convert them to cash or gold bars for a courier — a money mule — to collect in person, or to wire/CVC payment directly. In 2024, victims reported 525 gold-bar-courier incidents to IC3 totaling $219M, averaging over $417,000 per victim.

Red flags

• An older customer making large, urgent withdrawals or asset liquidations shortly after describing a call from "the government" or "the bank's fraud department"
• Purchase of gold bars, precious metals, or large gift-card volumes inconsistent with the customer's ordinary pattern
• Customer describing a courier who will personally collect cash, gold, or other assets — a mule pickup, not a wire or bank channel
• An international student account holder making an urgent wire, CVC, or gift-card payment tied to a claimed "visa" or "immigration" fee, especially outside normal tuition/fee payment channels

Variant: Schemes impersonating FinCEN itself

FinCEN's December 2024 alert addresses scams that abuse its own name, insignia, and authorities. Three distinct typologies, all source-verified from FIN-2024-Alert005:

Fraudulent BOI forms and websites. Scammers contact companies by text, email, or U.S. Mail demanding a "filing fee" to submit beneficial ownership information — then never file, or falsely claim a fee exists at all. They use names close to "FinCEN" or invent agencies like a "United States Business Regulations Department" or "Annual Records Service," and send fictitious forms — secretary-of-state offices have reported a "Form 4022," a "Form 5102," a "2024 Beneficial Ownership Information Reporting Form," and an "Important Compliance Notice" — threatening fines and legal action. Payment is solicited by mailed check or money order, or via links, URLs, and QR codes to fraudulent domains.

Fraudulent MSB registration. Scammers register as MSBs with FinCEN using false information, then leverage their appearance on the public MSB Registrant Search Page to claim they are "vetted," "approved," or "licensed" by FinCEN. FinCEN states flatly that registration confers no approval of any kind, and FinCEN does not license MSBs to operate in the United States. These claims frequently support pig butchering schemes, where victims are told to buy virtual currency and send it to the fraudulent MSB. FinCEN's analysis found such registrants generally share street addresses, hold no state licences where they purport to operate, and don't comply with BSA reporting.

FinCEN imposter scams. Spoofed calls, texts, emails, and mail — often using stolen PII so the caller already knows the victim's name, SSN, and account numbers. Scammers demand payment for supposed AML/CFT violations or outstanding debts, supply fictitious documents purportedly from the FinCEN Director or Deputy Director, and threaten arrest or account seizure. A variant claims the victim is owed a Treasury grant but must first pay a release fee. In one recent scheme, scammers sent victims of their own investment fraud a fake "FinCEN Alert" via Telegram claiming accounts were frozen pending an AML/CFT investigation and demanding a "self-certification" fee as a percentage of investments.

FinCEN's own rebuttals, stated plainly in the alert: it does not have authority to freeze assets or block funds transfers; it does not offer grants or collect debts; it does not charge to file reports; it will never demand immediate payment by email, call, or text; and it never contacts the public to request payment. Between November 2023 and October 2024, the FTC logged 1,154 fraud reports mentioning "FinCEN" with over $69 million in reported losses.

Red flags: FinCEN-impersonation schemes — as published in FIN-2024-Alert005

Regulatory history

Note: the FBI/IC3 alert is a law-enforcement public safety announcement, not a FinCEN advisory — included here because it documents the identical government-impersonation mechanism against a named victim population, and financial institutions serving international student populations may want the specific red flag.

FRDTCOAdvance-fee scams tell victims they're entitled to a large sum — an inheritance, lottery win, or exclusive business deal — but must pay upfront "taxes" or "fees" to unlock it, sometimes in escalating rounds. A prominent and heavily cartel-linked variant targets U.S. owners of Mexican timeshares: CJNG, Cartel del Golfo, and the Sinaloa Cartel have run timeshare-fraud call centers for over a decade, with CJNG the dominant player. Between 2019 and 2024, roughly 6,000 U.S. victims reported about $350M in timeshare-fraud losses.

Mechanics

Cartel-run call centers obtain U.S. timeshare owners' information from complicit resort insiders, then contact victims posing as ready buyers, renters, or investors for a timeshare "exit" or resale, requesting upfront taxes or fees to expedite a sale that never happens. A common follow-up scam then has the same network pose as a U.S. law firm or government authority offering to recover the victim's lost funds — for another fee.

Mechanics: the Mexico timeshare scheme

Sourcing the targets. TCOs obtain U.S. timeshare owners' PII from complicit insiders at timeshare resorts — and FinCEN notes the price paid for a record corresponds to the value of that owner's timeshare interest. Scammers then call or email posing as U.S.-based brokers, attorneys, or sales representatives, sometimes impersonating well-known U.S. companies, using real or fabricated websites, business names, addresses, and trade-group registrations, and citing the victim's stolen property details to establish credibility.

Three pitch variants: exit/resale (a ready buyer at or above market), re-rent (a ready renter, often pegged to an upcoming holiday or tourism event near the property), and investment (the victim supposedly holds stock associated with the timeshare, brokered to ready investors). Each comes with fraudulent offer letters and high-pressure time-sensitivity, then a demand for upfront "taxes" (capital gains, income) and "fees" (closing costs, earnest money, escrow, transfer, maintenance, attorney's, title insurance) purportedly held in escrow pending completion.

The escalation. After initial payment, scammers usually don't disappear — they demand further sums, sometimes supplying a spoofed online bank dashboard showing a false escrow balance. Demands continue until the victim liquidates everything including retirement accounts, maxes out credit, or recognises the scam.

Re-victimisation. The same victims are targeted again, often for years. Scammers reappear impersonating U.S. law firms claiming the original fraudsters were charged and a settlement is owed — payable after "legal fees." Then they impersonate government authorities — including OFAC itself, Mexico's UIF, and INTERPOL — claiming the earlier payments were flagged as suspicious or blocked for money laundering or terrorism links, demanding more money to release funds and clear the victim's name, with threats of imprisonment.

Laundering path. Victims wire via U.S. correspondent banks to Mexican shell companies at banks or brokerage houses (casas de bolsa) — accounts typically opened in the preceding six months. Funds then move through further Mexican shells and trusts (fideicomisos) controlled via cartel members, family, or complicit accountants, before financing drug operations or buying luxury real estate and constructing new timeshare resorts to feed future fraud.

Red flags — as published in FIN-2024-NTC2

Regulatory history

FRDHealth care fraud advisories target schemes that bill federal and state programs (Medicare, Medicaid, and pandemic-era relief programs) for services never rendered, medically unnecessary, or billed at inflated rates. FinCEN's 2026 advisory is its most comprehensive treatment of the topic to date, following two COVID-19-specific advisories in 2021.

Mechanics

Shell medical billing companies, complicit or "captured" providers, and patient recruiters ("marketers") who pay kickbacks for beneficiary identifiers feed fraudulent claims through the system; proceeds are then laundered through shell company accounts.

Red flags — as published in FIN-2026-A001

Twenty-four indicators. FinCEN supplies the key detection insight up front: health care reimbursements follow standardized, predictable payment patterns, so deviations in volume, timing, or credit/debit behavior after enrollment or a change in ownership are especially indicative. Payments often carry the issuing MAC or state agency name in the payment field — FinCEN asks institutions to review whether customers receive MAC or state-agency payments at all, and assess consistency with the customer profile. The advisory includes a full appendix mapping every MAC jurisdiction by state.

Regulatory history

FRDThis typology cluster covers fraud against government relief and benefits programs — COVID-19 stimulus (EIP), unemployment insurance, the Employee Retention Credit, and, most recently, federal child nutrition and student aid programs. FinCEN issued a wave of COVID-specific advisories in 2020–2021 and has continued the pattern for subsequent benefit programs.

Mechanics

Fraud rings file claims using stolen or synthetic identities, sometimes at industrial scale across multiple states; proceeds are deposited into mule accounts, quickly withdrawn as cash, or converted to virtual currency.

Red flags — as published in FIN-2026-Alert001

Thirteen indicators from the Minnesota child nutrition alert. Although drawn from one state's scheme, they are written generically around "a company or NPO enrolled in a government benefit program" and transfer readily to other benefit-program fraud.

Regulatory history

FRDFinCEN's newest alert (issued this week, July 24, 2026) targets fraud against the Department of Education's Federal Student Aid (FSA) programs — which disburse $120B+ a year to ~13 million students. Issued jointly with ED's Inspector General and the FBI, it describes both foreign- and domestic-based fraud rings using stolen or purchased identities to enroll fake "students," collect refund disbursements, and in some cases lock real students out of oversubscribed open-enrollment classes.

Mechanics: three distinct schemes

Ghost students — a fraudster steals someone's PII (sometimes a minor's) to impersonate them as a legitimate enrollee, then uses AI chatbots or paid accomplices to complete just enough coursework (60% of the term is the refund threshold) to keep the refund flowing. The identity-theft victim usually has no idea until they're hit with surprise loan debt or aid ineligibility.

Straw students — a complicit individual sells their own real PII to a fraudster for a fee, is enrolled in their own name, does no coursework, and the organizer collects and keeps most of the refund.

Insider-assisted fraud — corrupt school staff recruit straw students, guarantee their acceptance, doctor academic records to preserve refund eligibility, and either steal the refund outright or take a cut.

Laundering follows a now-familiar pattern: money mules with no connection to the "student" receive refund ACH deposits (transaction references often read like "LCC REFUND John Doe"), then forward funds via P2P transfer, wire, or CVC purchase; foreign-based rings increasingly pay criminal brokers — advertised on the dark web or encrypted messaging apps — to open bank accounts on a "one-to-one" model (one account, one refund, one victim) specifically to defeat pattern detection.

Red flags — as published in FIN-2026-Alert004

Eight indicators. FinCEN's caveat applies: no single flag is determinative — weigh historical activity, prevailing business practice, and whether multiple related flags co-occur.

• A customer with no prior history or profile information consistent with school enrollment receives a student aid refund — especially where the recipient named in the transaction reference has no known connection to the customer — with funds then rapidly moved out via P2P or wire, converted to digital assets, or sent through online MSBs that typically process international transfers
• A customer uses student aid refund funds to quickly purchase digital assets, then rapidly transfers them to another wallet for no business or apparent lawful purpose
• Multiple unrelated students use the same account for student aid refund deposits
• An account receives multiple student aid refunds for no apparent lawful purpose, especially where the named recipients are unrelated individuals with no known connection to the customer, followed by rapid outbound P2P/wire, digital asset purchase, or online MSB activity
• A newly established account is funded solely by student aid refunds and shows no other financial activity, with funds then rapidly moved out
• A business account receives multiple student aid refunds — especially where named recipients have no known connection to the customer — then rapidly transfers funds to other business-entity accounts or online MSBs
• A customer receives multiple P2P or wire transfers from accounts that recently received student aid refunds, for no apparent lawful purpose
• Multiple accounts receiving student aid refunds are accessed from the same out-of-state or international IP address, or the same device
• Multiple accounts created online at one institution within a short window, each receiving a student aid refund on a strict one-to-one basis (one account, one refund), with funds rapidly moved out

Detection tip from the alert: intermediary-processed refunds typically arrive as ACH transfers whose transaction references include "refund" plus the institution's name or abbreviation — e.g. "Local Community College Refund," "LCC REFUND" — and sometimes the purported student's name ("LCC REFUND John Doe"). That name-versus-accountholder mismatch is the single most tractable screening signal in this typology.

Regulatory history

FRDTCOHTSHELLMSBA joint FinCEN/FDIC/OCC/NCUA advisory, issued in coordination with the IRS, addressing identity theft and off-the-books payroll schemes used to conceal employment of workers lacking authorization. FinCEN frames the financial-crime harms as: unfair advantage over compliant businesses, depressed wages, identity theft against authorized workers, and evasion of federal and state payroll taxes. The advisory is the first FinCEN issuance to treat ITIN use as a potential risk factor warranting enhanced due diligence, and it carries a multi-agency imprimatur that ordinary FinCEN advisories don't.

Editorial note: this article reports the advisory's published content and FinCEN's own caveats. The underlying immigration-enforcement policy is politically contested; the compliance obligations it creates for financial institutions are not, and that is what is summarized here.

Mechanics: two mechanisms

Identity theft. Workers obtain SSNs and other PII belonging to citizens and lawful permanent residents and submit it so Form I-9s appear legitimate — gaining employment, wages, health benefits, and (per BSA reporting) access to credit and auto loans. Identity theft victims can face higher taxes and denial of health, disability, and tuition benefits. Complicit employers sometimes assist in obtaining fraudulent documentation, which FinCEN notes can itself become a mechanism of exploitation and, at the extreme, forced labor (see Human Trafficking).

Payroll fraud via labor brokers. The structurally significant half. A complicit employer contracts a labor broker who sets up a shell company — directly or via a nominee — purporting to operate in agriculture, construction, domestic service, hospitality, or staffing. Per the IRS, these often carry generic names (ABC Construction, XYZ Logistics) that may match the broker's initials. The shell typically operates as an unregistered MSB providing off-the-books payroll services. Brokers may open the account with a foreign passport or ITIN listing themselves as "self-employed" or "laborer," and may use a Commercial Mail Receiving Agency instead of a real address to evade CIP requirements.

Employers write checks to the shell for purported trade services (framing, drywall, stucco, masonry, painting). The broker cashes them in structured transactions through banks and check cashers or deposits them, takes a 4–10% fee, and pays workers via cash couriers, checks, or P2P platforms — repetitive transactions designed to fall below BSA reporting thresholds ("structuring" and "microstructuring"), often correlating to payroll cycles outside standard processing systems. Neither party withholds payroll taxes. Brokers may also buy a minimal workers' compensation policy covering a handful of nominal employees and "rent" or sell access to it to employers running hundreds of workers — insurance fraud on top of tax evasion.

FinCEN notes these schemes are often embedded in broader global laundering networks that insert cash into the U.S. financial system in small amounts across many cities, then collect checks from the involved businesses — and that brokers may use the same shell for DTO/TCO laundering.

Red flags — as published in FIN-2026-A002

Eighteen indicators in three groups, building on the 2023 Payroll Tax Fraud Notice. FinCEN's caveats are unusually emphatic here and worth reading as part of the guidance: no single red flag should be taken in isolation; "no customer type presents a single level of uniform risk"; and the indicators "do not convey or alter any independent regulatory obligations or supervisory expectations."

ITIN due diligence — what actually changed

Under CIP rules a bank must collect an identification number; for U.S. persons that means a TIN, which by cross-reference includes ITINs. ITINs are nine digits beginning with "9" with fourth/fifth digits in defined ranges (9XX-7X-XXXX), issued to resident and nonresident aliens ineligible for an SSN solely for federal tax purposes — they don't establish legal status, authorize work, or serve as identification outside the tax system. The advisory, per E.O. 14406, states the agencies "note that the use of an ITIN in lieu of an SSN or valid employment authorization document may be identified as a risk factor requiring enhanced due diligence," and expresses particular concern about ITIN use to obtain credit products or open depository accounts where legal presence isn't verified. The operative language is encouraged to consider as part of risk-based CDD, assessed "in light of the totality of other factors" — not a mandate to decline. Where a bank has risk-based concerns about SSN authenticity, FinCEN encourages verification against SSA records.

Regulatory history

FRDThis cluster covers fraud in loan origination and modification, and predatory "foreclosure rescue" scams that target homeowners in distress. FinCEN's guidance here dates to the 2008–2012 foreclosure crisis and remains the baseline SAR-filing framework for mortgage-related fraud typologies.

Mechanics — foreclosure rescue

Perpetrators contact financially distressed homeowners promising to negotiate a loan modification, insist on an advance fee (sometimes thousands of dollars), and caution the homeowner against discussing the arrangement with their lender "to avoid jeopardizing negotiations." The perpetrator never actually contacts the lender, and the loan proceeds to foreclosure. FinCEN's 2010 mortgage loan fraud report (analyzing 3,500+ SARs from 2004–2009) found perpetrators also use straw borrowers, deceive homeowners into signing over title while promising a leaseback, and run "equity skimming" via equity lines of credit or false quit-claim deeds.

Red flags — foreclosure rescue — as published in FIN-2010-A006

• Since most states criminalize advance mortgage-modification fees, schemes relabel the fee — "file review fee," "forensic review/audit fee," "attorney fee," "fraud detection fee," or "membership fee"
• Perpetrators style themselves as "associations," "counseling agencies," or non-profits to project legitimacy
• A notary public is used as an agent to deliver documents and collect the fee in cash, cashier's check, or personal check
• Advance-fee schemes are frequently bundled with debt-elimination, credit-card-debt, or refinance schemes
• Advertising (websites, mailings, TV/radio, roadside signs) offers free foreclosure help, loan modifications, short sales, "forensic audits," or credit/debt relief
• Multiple, structured, or sequential money orders are sent to a loan-modification/foreclosure-rescue business, sometimes with the perpetrator instructing the customer that structuring was "required"
• The trade name of an entity includes "foreclosure rescue"
• A false claim of being listed on official government-approved-counselor or HUD-approved-housing-counseling-agency rolls

Mechanics — HECM/reverse mortgage fraud

The FHA's Home Equity Conversion Mortgage (HECM) program lets seniors access home equity as a reverse mortgage; the housing-market downturn increased its attractiveness as a fraud target. FinCEN, working with HUD-OIG, identified a common "cross-selling" scheme: theft of a senior's HECM loan proceeds through the sale of other financial products in violation of HUD rules. Other patterns include theft by family members, loan officers, or appraisers, and use of unsuspecting seniors in property-flipping schemes — with the constant thread being that HECM proceeds are funneled to the perpetrator(s), sometimes via multiple complicit actors (loan officers, processors, appraisers, notaries).

Regulatory history

FRDThis scheme starts with stolen U.S. Mail — often checks pulled from residential mailboxes or blue collection boxes using stolen "arrow keys" — which are then altered (washed) or counterfeited and deposited or cashed. As of September 30, 2025, the federal government stopped issuing paper checks for most federal payments (Executive Order 14247), which the 2026 NMLRA expects to sharply cut government-check-related fraud going forward — though private check volume, already down to 3% of consumer payments in 2024 from 7% in 2016, remains a target.

Mechanics

The theft. Criminals target USPS blue collection boxes, unsecured residential mailboxes, and cluster box units at apartment complexes and commercial buildings — by forced entry, by "fishing devices" (makeshift adhesive-tipped tools that pull mail back out of a collection box), and increasingly with authentic or counterfeit USPS master keys known as Arrow Keys. A single Arrow Key opens every blue box and cluster unit in a geographic area, which is why FinCEN documents organised groups violently robbing mail carriers to obtain them, corrupt postal employees supplying them, and stolen keys being copied and sold on the dark web and encrypted platforms for convertible virtual currency.

The alteration. "Check washing" uses chemicals to strip the original ink so the payee can be replaced — and the amount is often increased at the same time, sometimes by hundreds or thousands of dollars. Washed checks may be copied and printed for later use or sold on to third-party fraudsters. Alternatively the check is counterfeited outright using the routing and account numbers from the stolen original.

The cash-out. Deposits go in person, through ATMs, or by remote deposit into accounts the criminals control — frequently opened specifically for the scheme — or through money mules using pre-existing accounts. Funds are then rapidly withdrawn via ATM or wired onward. FinCEN adds a grim detail about recruitment: mail-theft mules are generally younger and witting, but criminal organisations also prey on homeless individuals and people with addictions, giving them a small cut of the cashed checks.

The secondary harm. PII harvested from the same stolen mail feeds later identity-theft and credit-account fraud against the same victims.

Why business checks are prized: business accounts tend to be well funded, and it takes longer for the victim to notice.

Red flags — as published in FIN-2023-Alert003

Ten indicators developed with USPIS. FinCEN notes many overlap with general check fraud indicators.

• Non-characteristic large withdrawals on a customer's account via check to a new payee
• A customer complains that a check or checks were stolen from the mail and then deposited into an unknown account
• A customer complains that a check they mailed was never received by the intended recipient
• Checks used to withdraw funds appear to be of a noticeably different check stock than that used by the issuing bank or in the customer's known legitimate transactions
• An existing customer with no history of check deposits suddenly shows new check deposits followed by withdrawal or transfer of funds
• Non-characteristic, sudden, abnormal deposit of checks — often electronically — followed by rapid withdrawal or transfer
• Examination reveals faded handwriting underneath darker handwriting, indicating the original was overwritten — the direct physical signature of check washing
• Suspect accounts show indicators of other suspicious activity, such as pandemic-related fraud
• A new customer opens an account seemingly used only for check deposits, followed by frequent withdrawals and transfers
• A non-customer attempting to cash a large check or multiple large checks in person who, when questioned, gives an explanation that is suspicious or potentially indicative of money mule activity

Regulatory history

FRDStolen personal identifying information is used to file fraudulent tax returns claiming refunds, which are then directed to accounts controlled by the fraudster or a money mule. FinCEN issued back-to-back advisories in 2012 and 2013 as this pattern surged alongside the growth of direct-deposit refund distribution.

Mechanics

Fraudsters file early in the tax season — before the legitimate taxpayer files — using stolen Social Security numbers/TINs obtained via phishing or fraudulent tax-preparation businesses, and route refunds to prepaid cards, mule accounts, or accounts newly opened for this sole purpose. Schemes frequently exploit returns for the elderly, minors, prisoners, the disabled, or the recently deceased.

Red flags — as published in FIN-2012-A005

• Multiple direct-deposit tax refund payments, directed to different individuals, from Treasury or state/local revenue offices are made to a demand deposit or prepaid access account held in the name of a single accountholder
• A suspicious account is opened on behalf of individuals who are not present, with the fraudulent actor named as having signatory authority, and the account's only funding source is direct-deposited tax refunds
• One individual opens multiple prepaid card accounts in different names using valid TINs, mails the cards to the same address, then shortly after activation the account receives an ACH tax-refund credit followed quickly by ATM withdrawals or POS purchases
• A business or personal account processes third-party tax refund checks in a manner or volume inconsistent with its stated business model, or with no apparent lawful purpose
• A business account shows tax-refund-check activity inconsistent with normal practice — a large volume of Treasury/bank checks relative to other deposits (e.g. payroll), out-of-state customer addresses, sequential or near-sequential check numbers, repeated identical or near-identical dollar amounts, or withdrawal amounts not commensurate with deposited check amounts
• Multiple prepaid cards share the same physical address, phone number, email address, or IP address, with tax refunds as their primary or sole funding source (fraudsters may also request an address change on a "permanent" card shortly after opening a "temporary" one online)
• A check-cashing business account is opened and subsequently shows a high volume of tax refund checks issued to individuals nationwide
• An existing check-cashing service sees a sudden volume increase involving tax refund checks issued to individuals across the United States

Regulatory history

FRDMoney mules are the individuals who receive fraud proceeds into accounts they control and forward the funds on — usually overseas — keeping a cut for themselves. They are the connective layer underneath nearly every typology on this page: elder exploitation, BEC, romance scams, and pandemic fraud all rely on mules to actually move stolen money. FinCEN's advisory adopts the FBI's three-part typology: an unwitting mule is unaware they're part of a criminal scheme (motivated by trust in a romance, job, or proposition); a witting mule ignores obvious red flags or acts willfully blind (motivated by financial gain or unwillingness to acknowledge their role); a complicit mule is fully aware and motivated by financial gain or loyalty to the criminal group. DOJ, the FBI, and USPIS separately run an annual interagency "Money Mule Initiative."

Mechanics

A mule opens or uses a personal bank account to receive wires, checks, or unemployment-insurance-style deposits, then withdraws cash, buys money orders, or wires the funds onward to organizers — often abroad — retaining a percentage as compensation. Recruitment commonly happens through good-Samaritan, romance, or work-from-home schemes, where a "recruiter" under a false company or charity label offers home-based employment and then instructs the target to move funds "for the business."

Red flags — as published in FIN-2020-A003

• A customer's personal account starts receiving transactions inconsistent with their transactional history — overseas transactions, large CVC purchases, large fiat amounts — or a previously low-balance account suddenly sees activity
• When asked about the change, the customer declines to provide KYC documents or explain the source of funds, and may cite COVID-19, relief work, or a "work-from-home" opportunity
• A customer opens a new account in a business's name, and shortly after, someone (the accountholder or a third party) transfers the funds back out
• A customer opens accounts in their own name at multiple banks to receive money from various individuals or businesses, then moves it onward per a purported employer's instructions
• A customer's account receives multiple state unemployment-insurance payments within the same disbursement window, from one or several states
• An account receives UI payments for numerous employees, or the accountholder name doesn't match the ACH "remit to" name
• Deposited funds are quickly wired out to foreign accounts in jurisdictions known for weak AML controls
• The customer states that an individual they hadn't previously known — claiming to be a U.S. service member stationed abroad, a U.S. citizen working/traveling abroad, or a U.S. citizen quarantined abroad — asked them to send or receive funds through their personal account

Regulatory history

The primary federal enforcement response is the interagency Money Mule Initiative (DOJ, FBI, USPIS, Secret Service, and others), now in its fifth-plus annual cycle.

FRDDistinct from the broader pandemic benefits fraud cluster, this typology covers fraud specifically against SBA-guaranteed forgivable loan programs — the Paycheck Protection Program (PPP) and Economic Injury Disaster Loan (EIDL) program — which together generated one of the largest waves of federal fraud prosecutions in U.S. history, including fraud by the lender-side "fintech" companies that processed applications, not just borrowers.

Mechanics

Applicants submit fabricated payroll records, tax documents, or business formation paperwork for shell or nonexistent businesses to qualify for forgivable loans, then spend proceeds on personal luxury goods, real estate, or gambling rather than payroll. On the lender-service-provider side, fintech intermediaries have been prosecuted for knowingly processing loan applications containing fabricated documentation to inflate their own fee revenue.

SAR keywords — as published in FIN-2021-NTC1's government-program table

• PPP: keyword "Paycheck protection," cite "FIN-2021-NTC1" in field 2, select suspicious-activity field 34(z) (Fraud – Other)
• EIDL: keyword "Economic injury disaster," cite "COVID19 EIDL FUNDS FRAUD" in field 2, select field 34(z)

FinCEN explicitly discourages generalized key terms like "stimulus," "CARES Act," or "benefit" in favor of these program-specific ones, to speed identification of relevant SARs.

Red flags — editorial, not FinCEN-authored

• PPP/EIDL proceeds deposited into an account with no history of payroll disbursements, immediately spent on non-payroll items (real estate, vehicles, casino chips)
• Multiple related businesses or individuals applying for loans using similar or templated supporting documentation
• Loan proceeds forwarded to accounts unrelated to the borrowing entity shortly after disbursement

Regulatory history

PPP/EIDL-specific investigative and enforcement guidance was led primarily by the SBA Office of Inspector General and DOJ's National Center for Disaster Fraud, not a standalone FinCEN red-flag advisory. See Pandemic & Government Benefits Fraud for FinCEN's general pandemic-fraud typologies.

FRDPonzi schemes pay purported "returns" to earlier investors using money collected from newer investors, rather than from any genuine underlying investment activity. "Ponzi scheme" is one of the standard characterizations of suspicious activity financial institutions can select directly on the FinCEN SAR form. Treasury's assessment found investment advisers defrauding their own clients — "often following a Ponzi or Ponzi-like scheme" — to be the single most common illicit-activity type identified involving the sector, ahead of the sector's use for laundering foreign-corruption or sanctions-evasion proceeds.

Mechanics

A promoter — sometimes a registered investment adviser representative, sometimes entirely unregistered — solicits investor funds promising high, steady returns, then pays earlier investors from newer investors' principal rather than from any genuine trading or asset activity, funding further recruitment until new investment can no longer cover redemptions.

Case examples — from Treasury's 2024 Investment Adviser Risk Assessment

• Mark Scott, a former law-firm equity partner, was convicted for laundering ~$400 million in proceeds of the OneCoin pyramid-fraud scheme through fake private-equity "Fenero Funds" in the British Virgin Islands, telling banks the money came from wealthy European families; sentenced to 10 years in January 2024
• Jason Rhodes of Sentinel Growth Fund Management was sentenced to 48 months for defrauding 25+ investors of $25M+, using later investors' funds for Ponzi-style repayments to earlier ones
• A California-registered adviser was charged in 2019 with running a $7M Ponzi scheme against school-district and hospital employees, veterans, and neighbors, via fictitious "private placements" promising ~5% quarterly dividends

Red flags — editorial, consistent with SEC/Treasury case patterns

• Consistently high, stable returns regardless of market conditions, with vague or unverifiable descriptions of the underlying strategy
• Commingling of investor funds rather than segregated, individually tracked accounts
• New investor deposits used to fund distributions to earlier investors rather than any external trading or asset activity
• Promoter operating without required securities licenses, or continuing to solicit after license suspension/revocation

Regulatory history

Investment advisers are not currently BSA-defined financial institutions and have no independent SAR/CDD/CIP obligations. FinCEN's rule imposing AML/SAR-filing obligations directly on registered investment advisers (finalized 2024) has been postponed — the effective date moved from January 1, 2026 to January 1, 2028.

CYBFRDTreasury's 2026 NMLRA treats identity theft as the largest single driver of money-laundering-relevant BSA filings: FinCEN's own analysis found roughly 1.6 million reports — 42% of all reports filed by reporting institutions — tied to identity, representing $212 billion in suspicious activity. Stolen identities let criminals open accounts, maximize loan draws, divert government benefits, or file false tax returns (see Tax Refund Fraud), while increasingly sophisticated synthetic identities — sometimes AI-generated — are used to open accounts that pass automated verification entirely.

Mechanics

FinCEN's typology work describes two distinct laundering archetypes built on identity theft: money mules, who receive and forward stolen funds through ACH, wire, or CVC, standing between the predicate crime and its final destination; and straw buyers/borrowers, who knowingly let their name, SSN, or credit file be used to open a bank, credit card, auto loan, mortgage, or MSB account for someone else, letting criminals bypass identity-verification controls entirely with genuine (if borrowed) credentials.

Variant: counterfeit U.S. passport cards

FinCEN's 2024 notice with the State Department's Diplomatic Security Service documents a specific, wholly in-person scheme — unusual in a field increasingly dominated by remote fraud. Actors obtain a victim's PII from stolen U.S. Mail or the darknet, then produce a counterfeit passport card carrying the victim's real data with the impostor's photograph, and walk into a branch.

Why passport cards specifically: FinCEN is explicit that they are chosen because they are a less familiar form of government ID — reducing the chance branch staff spot a fake — and are significantly cheaper to counterfeit than passport books.

Tradecraft: actors avoid the branch the victim actually uses, to evade staff who might recognise them. If asked for a second ID they may present a counterfeit credit card in the victim's name — usually also fake and tied to no account. DSS reports they commonly work in pairs, with a handler feeding answers by earpiece from a vehicle outside when the impostor can't answer identity questions.

Three transaction plays once past the branch's controls: (1) probe the account — ask about balances and withdrawal limits — then withdraw cash below the CTR threshold, buy cashier's checks or money orders, or send wires, repeating at other branches to stay under reporting thresholds; (2) cash stolen or forged checks against the account; (3) open a new joint account in person with a second actor as co-owner, move the victim's funds into it, then wire onward to accounts the conspirators fully control.

Red flags — as published in FIN-2024-NTC1

Seventeen indicators across technical, behavioural, and financial categories. The technical set is unusually concrete for a FinCEN product — these are physical inspection tests a teller can perform at the counter.

Regulatory history

CYBRansomware encrypts a victim's systems or data and demands payment — almost always in convertible virtual currency — for restoration or to prevent public release of stolen data. FinCEN's 2021 advisory updated and replaced an October 2020 version following the May 2021 Colonial Pipeline attack, and is supported by three Financial Trend Analyses quantifying ransomware-related BSA filings.

Mechanics

Attackers gain network access (often via phishing, exploited RDP endpoints, or "drive-by" malware), deploy encryption malware, and demand payment to a CVC address — increasingly with "double extortion," exfiltrating data first and threatening publication. Payments typically flow: victim → depository institution → CVC exchange → attacker's CVC address, then through mixers, tumblers, and chain-hopping to launder and cash out, often via foreign exchanges with weak AML/CFT controls. Digital forensic incident response (DFIR) firms and cyber insurance companies (CICs) sometimes directly facilitate payment on the victim's behalf — potentially triggering their own MSB registration obligations. FinCEN named ransomware-as-a-service (RaaS), fileless ransomware, and "big game hunting" of large enterprises as growing trends, and flagged rising use of anonymity-enhanced cryptocurrencies (AECs) such as Monero.

Red flags — as published in FIN-2021-A004

Twelve indicators. No single flag is determinative; financial institutions should weigh the surrounding facts and circumstances.

• IT enterprise activity connected to ransomware cyber indicators or known threat actors, evident in system logs, network traffic, or file information
• A customer discloses, at account opening or in other interactions, that a payment is in response to a ransomware incident
• A customer's CVC address, or an address it transacts with, is connected to known ransomware variants, payments, or related activity
• An irregular transaction between an organization — especially one in a high-risk sector (government, financial, education, healthcare) — and a DFIR firm or CIC known to facilitate ransomware payments
• A DFIR or CIC customer receives funds from a counterparty and shortly after sends an equivalent amount to a CVC exchange
• A customer shows limited CVC knowledge at onboarding yet inquires about or purchases CVC — particularly in large amounts or as a rush request — possibly indicating it is a ransomware victim
• A customer with no or limited CVC transaction history sends a large CVC transaction outside its normal business practices
• An unregistered customer appears to use a CVC exchange's liquidity to execute large numbers of offsetting transactions between CVCs, suggesting unregistered MSB activity
• A customer uses a foreign-located CVC exchanger in a high-risk jurisdiction with inadequate AML/CFT regulation for CVC entities
• A customer receives CVC from an external wallet and immediately initiates multiple rapid trades among CVCs — especially AECs — with no apparent purpose, followed by an off-platform transaction
• A customer initiates a transfer of funds involving a mixing service
• A customer uses an encrypted network (e.g., the onion router/Tor) or an unidentified web portal to communicate with the recipient of a CVC transaction

Regulatory history

CYBFRDCVCCVC — Bitcoin and similar digital assets convertible to fiat currency — recurs as the payment rail across nearly every modern typology on this page: ransomware, pig-butchering scams, and sanctions evasion all lean on it. FinCEN's foundational 2019 advisory addressed peer-to-peer exchangers, mixers, and CVC kiosks as distinct risk points; the 2025 kiosk-specific notice responded to a rise in scam payments funneled through physical CVC ATMs.

Mechanics

Illicit actors use CVC for its pseudonymity and speed of cross-border movement, layering funds through mixing services, chain-hopping between different cryptocurrencies, and cashing out through exchangers with weak KYC or physical kiosks that accept cash for CVC with minimal identification.

Red flags — CVC kiosks, as published in FIN-2025-NTC1

Fifteen indicators, split by who is looking — kiosk operators, other financial institutions, and banks assessing kiosk-operator customers. That three-audience structure is unusual and useful: the same typology looks different from each vantage point.

Regulatory history

Victim recovery: FinCEN's Rapid Response Program (RRP) works with law enforcement to freeze and interdict stolen funds — mostly CVC and wire transfers tied to cyber-enabled fraud — before they leave the traceable financial system. Since 2025, the RRP has interdicted $268M+, bringing its cumulative total to $1.8B+ recovered on behalf of victims.

FinCEN Enforcement Actions

• The world's largest virtual currency exchange (Nov. 2023) — $3.4B civil money penalty, the largest FinCEN settlement in Treasury Department history, for willfully operating as an unregistered MSB and failing to maintain an effective AML program while serving 1M+ U.S. customers (2017–2023); five-year monitorship and complete exit from the U.S. market required. Part of a $4B+ combined DOJ/FinCEN/OFAC/CFTC resolution.
• A Seychelles-registered cryptocurrency derivatives exchange (2021) — consent order resolving willful failures to implement a Customer Identification Program, an AML program, and to file SARs, alongside a parallel CFTC resolution.

CYBDRGFinCEN defines darknet marketplaces as websites available only in anonymized overlay networks (the Tor network is the primary example) requiring specific software to access, some requiring additional vetting. They frequently offer illicit goods and services with CVC as a payment method — sometimes the sole one. CVC use tied to darknet market activity may indicate drug purchases or sales, child exploitation, cybercrime, or other criminal activity. Entities that facilitate CVC transmission on these platforms are required to register as MSBs with FinCEN.

Case study — as published in FIN-2019-A003

AlphaBay / Alexandre Cazes: in July 2017, a multinational law-enforcement effort dismantled AlphaBay, then the largest criminal darknet market, with Thai authorities arresting creator/administrator Alexandre Cazes (a.k.a. Alpha02) on U.S. charges including conspiracy to commit identity theft, narcotics distribution, and money laundering. AlphaBay operated as a Tor hidden service and was used by hundreds of thousands of people over two years to buy and sell fentanyl, heroin, and other illicit products, largely in bitcoin, monero, and ether — approximately 200,000 users, 40,000 vendors, 250,000 listings, and $1 billion+ in CVC transactions between 2015 and 2017.

Red flags — as published in FIN-2019-A003

• A customer conducts transactions with CVC addresses that have been linked to darknet marketplaces
• A customer's CVC address appears on public forums associated with illegal activity
• A customer's transactions are initiated from IP addresses associated with Tor
• Blockchain analytics indicate the wallet transferring CVC to the exchange has a suspicious transaction history or known-illicit connections
• A transaction makes use of mixing and tumbling services, suggesting intent to obscure the transaction trail

Regulatory history

FIN-2019-A003's other typologies (unregistered P2P exchangers, unregistered foreign-located MSBs, CVC kiosks) are cross-referenced elsewhere on this page; the ransomware advisory (FIN-2021-A004) and the 2026 NMLRA both treat darknet markets as a related cybercrime-adjacent typology. Enforcement here has run heavily through OFAC designations and DOJ takedowns alongside BSA advisories.

CYBHTFinancially motivated sextortion coerces victims — increasingly minors and teens, especially boys aged 14–17 — into sending explicit images, then extorts them for money under threat of releasing the material. Between October 2021 and March 2023, the FBI and DHS received 13,000+ reports involving 12,600+ victims and linked to at least 20 suicides. Perpetrators are frequently based in West Africa and Southeast Asia.

Mechanics

A perpetrator poses as a peer using a stolen profile photo, builds trust (sometimes sending explicit images first), then either extracts explicit content from the victim or takes over their account to extort the victim's contacts too. Payment is demanded via P2P platforms (Apple Pay, Cash App, Zelle) or gift cards; U.S.-based money launderers collect the funds, keep a cut (commonly ~20%), convert the remainder to CVC, and send it to overseas organizers.

Red flags — as published in FIN-2025-NTC2

Nine indicators split into victim-side and mule-side sets. FinCEN's "Jurisdictions of Concern" — the top locations of subjects in sextortion-related BSA reporting, in rank order — are: Côte d'Ivoire, the United States, the Philippines, Monaco, Burkina Faso, the Dominican Republic, Kenya, Benin, and Nigeria.

Regulatory history

FRDCYBGenerative-AI "deepfakes" — synthetic audio, video, or images impersonating a real person — are increasingly used to defeat identity-verification controls at account opening or to authorize fraudulent transactions by mimicking a customer's or executive's voice or likeness. FinCEN's 2024 alert was among the first from a U.S. regulator to name this typology directly.

Mechanics

Criminals use GenAI to lower the cost, time, and resources needed to defeat identity verification. Two distinct uses appear in BSA data. First, fraudulent identity documents — altering an authentic source image or generating a synthetic one, then combining it with stolen or entirely fabricated PII to build a synthetic identity. Accounts opened this way receive and launder proceeds of other schemes: check fraud, credit card fraud, authorized push payment fraud, loan fraud, unemployment fraud — and in some cases serve as funnel accounts. Second, social engineering — deepfake voice or video impersonating an executive (an evolution of BEC) or a family member in an emergency scheme, a pattern that targets older victims specifically.

DHS's framing, quoted in the alert, is worth keeping in mind: the threat comes "not from the technology used to create it, but from people's natural inclination to believe what they see" — deepfakes need not be advanced or especially believable to work.

Red flags — as published in FIN-2024-Alert004

Nine indicators. FinCEN's standard caveat applies: no single flag is necessarily indicative, and surrounding facts and circumstances govern.

Detection and mitigation guidance

FinCEN notes institutions most often catch deepfake documents by re-reviewing account-opening documents after the fact, or through enhanced due diligence triggered by unrelated suspicious activity — rarely at the point of onboarding. Additional scrutiny is warranted where there are inconsistencies among multiple submitted documents, an inability to satisfactorily authenticate identity or source of income, or mismatches between the document and the rest of the customer profile.

Recommended controls: multifactor authentication, particularly phishing-resistant MFA, and live verification checks prompting audio or video confirmation. FinCEN's reasoning is that even where an actor can respond to live prompts or generate synthetic responses, the responses may reveal inconsistencies — which is precisely why deepfake users try to avoid live checks, making the avoidance itself the signal.

Regulatory history

HTHuman trafficking (compelled labor or commercial sex through force, fraud, or coercion) and human smuggling (facilitating unauthorized border crossing, generally consensual) are distinct crimes with overlapping financial footprints. FinCEN's 2014 guidance was the first to separate financial red flags for each; a 2026 notice extended coverage to the 2026 FIFA World Cup given historical spikes in trafficking risk around major sporting events.

Mechanics

Smuggling proceeds typically move as structured cash payments to smuggling-network facilitators, often through informal remittance channels (see Hawala/IVTS); trafficking proceeds can appear as suspiciously regular deposits inconsistent with a legitimate business (nail salons, massage parlors, agricultural labor contractors) that in fact functions as a front.

Red flags — as published in FIN-2026-NTC1

Ten indicators from the most recent trafficking issuance. FinCEN is explicit that the transactional and behavioral red flags in the 2014 and 2020 advisories remain valid and should be applied alongside these. FinCEN also stresses that customer-facing staff training matters disproportionately here: a trafficking victim may have no contact with anyone outside their trafficker except when visiting a financial institution.

Regulatory history

HTTCOFinCEN draws a legal line between this typology and human trafficking that governs how each is reported: smuggling is transporting unauthorized persons into or within the U.S., harboring them, or encouraging entry, knowingly or in reckless disregard of illegal status (8 U.S.C. §1324) — generally a transaction the migrant consents to and pays for. Trafficking requires force, fraud, or coercion (or a minor for sex trafficking). A smuggling case can become a trafficking case once inside the U.S. if the migrant can't pay and is coerced into labor or sex work instead.

Scale and mechanics

Border Patrol encounters at the southwest border rose from under 500,000 in FY2020 to 2.3 million in FY2022. Smuggling generates an estimated $2–6 billion annually along the SW border alone, with per-migrant fees from hundreds of dollars to over $10,000 — about two-thirds of migrants transiting Mexico hire a guide, per FATF. Networks divide into specialized roles (travel arrangements, lodging, border crossing) and typically pay a "protection tax" to whichever TCO controls the territory, sometimes escalating to direct TCO operational control (MS-13 and the 18th Street Gang have run smuggling operations directly).

Two operational phases: solicitation — smugglers pose as travel agencies or work recruiters, typically sharing the migrant's national or ethnic origin to build trust, increasingly via social media; and transportation — coordinated over encrypted platforms, sometimes recruiting unaffiliated U.S.-based truck drivers specifically because they have no knowledge of the network's structure, insulating the organizers from the border-crossing leg's arrest risk.

Three payment structures: full payment in advance; partial payment with the balance due on arrival; or full payment by relatives only after successful arrival. Migrants unable to pay may enter work agreements with smugglers — precisely the point at which smuggling can convert into trafficking.

Laundering channels: primarily cash — bulk cash smuggling and cash purchases of real estate and businesses; funnel accounts at institutions with branches on both sides of the border, receiving smuggling fees disguised as family remittances; and increasingly mobile payment apps and P2P networks to collect fees directly from migrants.

Red flags — as published in FIN-2023-Alert001

Eight indicators, building on the 2014 and 2020 human trafficking advisories.

• Multiple wires, cash deposits, or P2P payments from different geographic originators across the U.S. or Mexico/Central America, converging on one beneficiary on or around the SW border with no apparent business purpose
• Deposits by multiple individuals in multiple locations into a single account not affiliated with the account holder's area of residence or work, with no apparent business purpose
• Unexplained currency deposits followed by rapid wires to high-migrant-flow countries (Mexico, Central America), inconsistent with expected customer activity
• Frequent exchange of small-denomination for larger-denomination bills by a customer not in a cash-intensive industry
• Multiple customers wiring the same beneficiary — who is not a relative and may be in the sender's home country — inconsistent with the customer's stated occupation
• A customer making significantly greater deposits, including cash, than peers in similar professions
• Cash deposits inconsistent with the customer's line of business
• Extensive use of cash to purchase assets such as real estate

Financial Trend Analysis — FinCEN, August 13, 2026

FinCEN's most recent analysis of BSA data — 67,540 reports filed between 2023 and 2025 — found financial institutions flagged nearly $5 billion in suspicious activity potentially linked to human smuggling over that three-year span. Reports peaked in 2024, then fell 62% in 2025; the U.S. ranked first for subject locations by country, followed by Mexico, Guatemala, Honduras, and Colombia. MSBs filed about 97% of the reports, most commonly citing transactions outside a customer's usual pattern, money sent along common migration routes, and suspected structuring — with 59% of MSB reports citing no verifiable familial connection between originator and beneficiary as the basis for filing. Depository institutions filed only 3% of reports but accounted for 61% of the total dollar value ($3B+), flagging structuring, funnel accounts, and travel agencies — ranging from sham operations to legitimate businesses potentially facilitating smuggling unwittingly — as their most common typologies.

Regulatory history

HTFinCEN's 2021 notice calls attention to a sharp rise in online child sexual exploitation (OCSE) — including the funding, production, and distribution of child sexual abuse material (CSAM) — and to the growing role of convertible virtual currency (CVC) in related payments. A distinct 2024 Financial Trend Analysis quantified this activity using BSA data covering January 2020–December 2021.

What the notice documents

FinCEN attributes the pandemic-era rise to increased unsupervised child internet use, more offenders online during travel restrictions, and wider availability of CVC and anonymizing tools. FinCEN's SAR review found a 147% increase in OCSE-related filings between 2017 and 2020, including a 17% year-over-year increase in 2020. CVC is increasingly the payment method of choice for offenders paying for access to CSAM-hosting sites, and facilitators have also been observed using third-party payment processors to obscure illicit file-sharing and streaming activity.

Financially motivated sextortion of minors — a related but financially distinct scheme where the minor is coerced into paying rather than merely victimized — is covered in its own article; see Financial Sextortion.

SAR filing instructions — as published in FIN-2021-NTC3

• Reference the notice using key term "OCSE-FIN-2021-NTC3" in SAR field 2 and the narrative
• Select SAR field 38(z) (Other) and include "OCSE" in the text box
• Include relevant technical/cyber indicators in the narrative where known (e.g. IP addresses, timestamps, CVC addresses) — these materially aid law enforcement investigations

Regulatory history

TCOFinCEN treats wildlife trafficking and four related environmental crimes as transnational-organized-crime-adjacent typologies: they are low-risk, high-reward (limited enforcement, high demand, comparatively light penalties), frequently involve transnational organized crime and corruption, and commonly co-occur with money laundering, bribery, forgery, tax evasion, and human or drug trafficking. FinCEN cites wildlife trafficking's estimated $7–23 billion/year in illicit proceeds — roughly a quarter of the legal wildlife trade's value.

The five categories — per FIN-2021-NTC4's appendix

• Wildlife trafficking — poaching and illegal trade in protected species, parts, and products (ivory, big cats, reptiles, turtles among the most commonly referenced in SAR data)
• Illegal logging — commingled with legal timber trade; may involve corporate structures and shell companies across jurisdictions to move proceeds through the international financial system
• Illegal fishing — unreported or unregulated fishing activity laundered through seafood trading businesses
• Illegal mining — often commingled with legal mining trade; involves corporate structures and shell companies, providing both a proceeds source and a laundering channel for proceeds of other crimes
• Waste and hazardous substances trafficking — illicit disposal or cross-border movement of waste and hazardous materials

Proceeds from these crimes are laundered through front companies (import/export, timber, or seafood trading firms) using over/under-invoicing techniques seen in TBML.

SAR filing instructions — as published in FIN-2021-NTC4

• Reference the notice using key term "FIN-2021-NTC4" in SAR field 2 and the narrative
• Select SAR field 38(z) (Other) and include the most relevant keyword — "wildlife trafficking," "illegal logging," "illegal fishing," "illegal mining," or "waste trafficking" — noting all that apply if multiple offenses are involved
• Provide all available details on how the wildlife product, plant, or waste was solicited, acquired, stored, transported, financed, and paid for
• §314(b) information sharing is encouraged for suspected environmental-crime offenses

Regulatory history

HTFRDTCOA distinct and rapidly growing typology sits at the intersection of human trafficking and romance/investment scams: large, often walled compounds — concentrated in Cambodia, and also found in Myanmar and Laos — where trafficked workers are held under threat of violence and forced to run online fraud schemes against victims worldwide. Treasury estimated Americans lost over $10 billion to Southeast Asia-based scams in 2024 alone.

FinCEN's Huione Group action — as published in the §311 final rule

On October 16, 2025, FinCEN finalized a rule under §311 of the USA PATRIOT Act finding Huione Group — a Phnom Penh, Cambodia-based financial services conglomerate — to be a foreign financial institution of primary money laundering concern, and imposed the fifth special measure: covered U.S. financial institutions are prohibited from opening or maintaining a correspondent account for, or on behalf of, Huione Group (effective November 17, 2025). FinCEN found Huione Group serves as a critical laundering node both for DPRK cyber-heist proceeds and for Southeast Asia-based TCOs running CVC investment ("pig butchering") scams, operating through components including Haowang Guarantee, Huione Pay PLC, and Huione Crypto that together form a self-contained exchange/payment/marketplace ecosystem. FinCEN assessed Huione Group laundered at least $4 billion in illicit proceeds between August 2021 and January 2025.

Mechanics

Organized crime groups recruit workers abroad with fake job offers, then confiscate passports and hold them in guarded compounds under threat of violence, isolation, arbitrary fines, and threats of sexual exploitation. Workers are forced to run pig-butchering and other online scams against victims globally; proceeds are laundered through shell companies, CVC, and Chinese underground banking networks — including marketplace vendors that openly advertise fiat-to-crypto-and-back laundering services — before flowing back to compound operators.

Regulatory history

TCOCASINOCasinos are treated as financial institutions under the BSA. FinCEN's earliest sector-specific red-flag guidance (2008) and the 2009 structuring advisory remain the foundational texts, describing how patrons and, at times, complicit personnel use chip purchases and redemptions to structure or launder funds. FinCEN drew the 2008 guidance's examples from actual SARs, examiner observations, and law-enforcement experience.

Red flags — as published in FIN-2008-G007

Regulatory history

FinCEN Enforcement Actions

• Trump Taj Mahal Casino Resort (March 2015) — $10M civil money penalty, the largest ever against a casino at the time, for willful and repeated BSA violations dating to 2003: an ineffective AML program, unreported suspicious transactions, and CTR/recordkeeping failures that persisted through two prior examination cycles without remediation. FinCEN had separately fined the same casino $477,700 in 1998.

TCOMSBMoney transmitters, currency exchangers, check cashers, and issuers/sellers of traveler's checks, money orders, or stored value face heightened AML obligations given their cash-intensive, often cross-border business. FinCEN's 2012 advisory addressed a specific gap: following a July 2011 final rule amending the MSB definition at 31 CFR §1010.100(ff), a person can qualify as an MSB based on its activities within the United States even if none of its agents, agencies, branches, or offices are physically located here — closing a loophole that let internet- and technology-enabled foreign money transmitters operate in the U.S. market without registering.

What changed — as published in FIN-2012-A001

• To qualify as an MSB, a person — wherever located — must do business wholly or in substantial part within the United States in one of the seven capacities listed at 31 CFR §1010.100(ff)(1)–(7); a relevant factor is whether the foreign-located person provides services to U.S.-located customers
• Foreign-located MSBs are BSA financial institutions and, for their U.S. activities, must comply with recordkeeping, reporting, and AML program requirements, and must register with FinCEN
• They face the same civil/criminal penalties for BSA violations as domestically-located MSBs
• The final rule requires each foreign-located MSB to appoint a U.S.-resident agent for service of legal process
• Effective September 19, 2011 (registration/agent-appointment requirements followed once the revised registration form was released in March 2012)

Financial institutions that provide banking services to MSBs should file a SAR if they become aware a customer is operating as an unregistered or unlicensed MSB, and may find FinCEN's 2005 Interagency Guidance and the IVTS advisory (FIN-2010-A011) useful for determining whether a customer is operating as an unregistered money transmitter.

Regulatory history

FinCEN Enforcement Actions

• A global money-transfer company (Jan. 2017) — $184M civil money penalty (fully credited against a $586M DOJ/FTC forfeiture) for willfully failing to maintain an effective AML program prior to 2012 and failing to file timely SARs, including agent complicity in wire-fraud schemes against consumers.
• A U.S. money-transfer company (Nov. 2012) — $100M forfeiture under a DOJ deferred prosecution agreement for failing to discipline agents who colluded with fraudsters despite repeated internal warnings. FinCEN later assessed a $1M individual penalty against that company's former Chief Compliance Officer — the first time FinCEN sought a personal penalty against an AML compliance officer — settled in 2017 for $250,000 and a three-year industry injunction.
• A money-transfer company (2008) — $12M penalty and DOJ deferred prosecution agreement for failing to maintain an effective AML program as a money transmitter.

—Unlike most entries on this page, this is compliance-enabling guidance rather than a fraud typology: FinCEN's 2014 guidance tells banks how they *can* serve state-licensed marijuana businesses despite marijuana remaining federally illegal under the Controlled Substances Act. Paired with DOJ's now-rescinded 2013 "Cole Memo" enforcement priorities, it created the practical framework that makes cannabis banking possible at all, and it remains in effect even though the Cole Memo itself was rescinded in January 2018.

The eight Cole Memo priorities — as published in FIN-2014-G001

Preventing: (1) distribution to minors; (2) revenue flowing to criminal enterprises, gangs, and cartels; (3) diversion from legal to illegal states; (4) state-authorized activity as cover for other drug trafficking/illegal activity; (5) violence and firearms in cultivation/distribution; (6) drugged driving and other adverse public-health effects; (7) growing on public lands; (8) possession or use on federal property.

Mechanics

Because marijuana remains federally illegal, financial transactions involving a marijuana-related business technically involve proceeds of illegal activity — so FinCEN created three specific SAR categories to let banks report on these customers routinely rather than exit the relationship entirely: Marijuana Limited (customer appears compliant with state law and implicates no Cole priority), Marijuana Priority (due diligence surfaces a red flag or possible Cole-priority/state-law violation), and Marijuana Termination (the bank exits the relationship for BSA reasons, with the narrative stating the basis; FinCEN urges §314(b) sharing to alert a second institution the business may move to). Banks do not need to treat every cannabis dollar as inherently suspicious — the guidance instead calibrates ongoing due diligence and continuing-activity SAR filings.

Red flags to distinguish Priority SARs — as published in FIN-2014-G001

Regulatory history

Note: because this guidance is designed to enable legitimate banking access rather than flag typical criminal typologies, there is no equivalent "notable prosecutions" list — the relevant enforcement risk runs against banks that fail to file the required Marijuana-category SARs, not against compliant cannabis businesses themselves.

BANKBanks sit at the center of every typology on this page — they're where illicit funds ultimately have to land, move, or exit the traceable financial system. Unlike the narrower vulnerabilities elsewhere on this page, "Banks" as a risk category is really about program adequacy: does the institution's AML program actually scale to its transaction volume, and does it act on what its own systems already flag? The single largest FinCEN enforcement action in history answers that question the hard way.

Why it's exploited

A bank with an under-resourced, static, or willfully under-tuned transaction-monitoring program can let enormous volumes of suspicious activity pass entirely unmonitored — not through some novel evasion technique, but simply because the bank stopped updating its detection scenarios as its business and risk profile changed.

The program requirements — as set out in the FFIEC Manual

Every bank's BSA/AML compliance program must be written, board-approved, and — critically — commensurate with the bank's own ML/TF risk profile. The Manual requires the program to provide for: (1) a system of internal controls to assure ongoing compliance; (2) independent testing, by bank personnel or an outside party; (3) designation of an individual responsible for day-to-day compliance (the BSA compliance officer); and (4) training for appropriate personnel — plus risk-based CIP, CDD, and beneficial-ownership procedures. Examiners are told that written policies alone are not sufficient: practices have to correspond with them in fact.

Institutional red flags examiners look for

• Transaction-monitoring scenarios that haven't been updated or revalidated despite material growth in transaction volume or new product lines
• A BSA Officer function without the authority, staffing, or budget commensurate with the institution's risk profile — the Manual assigns ultimate responsibility for internal controls to the board of directors acting through senior management
• A persistent backlog of unresolved or unreviewed alerts, particularly when the backlog itself doesn't trigger an internal escalation
• Independent testing that doesn't evaluate whether prior violations and deficiencies were actually remediated, not merely represented as complete

FinCEN Enforcement Actions

• A Canadian-headquartered financial institution (Oct. 2024) — $1.3B FinCEN civil money penalty, the largest ever against a depository institution, part of a $3B+ total resolution with DOJ/OCC/Federal Reserve. From 2018–2024, 92% of that institution's U.S. transaction volume (~$18.3 trillion) went effectively unmonitored because scenarios were left static; the bank facilitated $400M+ in cash transactions for a convicted narcotics-money launderer without limiting his activity. Four-year independent monitorship imposed.
• Shinhan Bank America (2023) — $15M penalty for willfully disregarding known AML program deficiencies dating to 2015, including failure to timely report suspicious transactions.
• USAA Federal Savings Bank (2022) — $140M combined penalty ($80M FinCEN + $60M OCC) for failing to scale its AML program as its customer base and revenue grew, missing two remediation deadlines over four years.
• Capital One (2021) — see Cash-Intensive Businesses: $390M penalty tied to its Check Cashing Group, acquired via a 2006 bank purchase and shut down in 2014 after facilitating $160M+ in transactions for a customer later convicted of money laundering.
• A large U.S. bank holding company (2018) — ~$600M combined DOJ/FinCEN resolution for capping the number of alerts its transaction-monitoring software could generate, suppressing suspicious-activity review; a former risk officer was individually penalized $450,000 in a related 2020 action — one of the only times FinCEN has penalized an individual bank officer personally.
• A U.S. bank (March 2010) — $110M penalty (deemed satisfied by a matching DOJ forfeiture), the largest FinCEN action to that date, for AML program failures spanning correspondent banking, remote deposit capture, and — most notably — failing to control $378.4B in transfers connected to Mexican/Colombian casas de cambio, including $10B in bulk cash repatriated from Mexico between 2004–2007.
• American Express Bank International (Aug. 2007) — $20M penalty (with a separate $5M penalty against its MSB affiliate, American Express Travel Related Services), an early example of FinCEN pairing bank-level and MSB-level penalties against affiliated entities of the same institution.
• United Bank for Africa, NY Branch (2008) — $15M combined FinCEN/OCC penalty for correspondent-banking program failures persisting despite a prior 2007 cease-and-desist order.

BD-IABroker-dealers have been BSA-covered financial institutions for years, but investment advisers are a newer and still-unsettled frontier: FinCEN finalized a rule in 2024 imposing AML/CFT program and SAR-filing obligations directly on registered investment advisers (RIAs) and exempt reporting advisers, but the effective date has since been postponed from January 1, 2026 to January 1, 2028. Until then, advisers sit largely outside direct BSA program requirements even though — as the Ponzi & Investment Adviser Fraud article shows — this is exactly the professional layer through which affinity fraud, Ponzi schemes, and "ramp-and-dump" securities fraud routinely run.

Why it's exploited — as documented in Treasury's IA Risk Assessment

Treasury's risk assessment identifies the core problem as a lack of comprehensive, uniform AML/CFT obligations: investment advisers are not "financial institutions" under the BSA, so — short of a bank or broker-dealer affiliation — they carry no AML program, CDD, CIP, or independent SAR-filing duty. A related vulnerability is that the AML/CFT-obligated entity in the chain (a custodian bank or broker-dealer) often has no direct relationship with the adviser's underlying client, while the adviser who does have that relationship has no duty to look for or report illicit activity. The assessment separately flags nominee arrangements and layered LLC/trust structures that can make it impossible for anyone in the chain to identify the ultimate beneficial owner.

Case patterns identified — as documented in Treasury's IA Risk Assessment

• Private funds used to pool and launder illicit proceeds tied to foreign corruption, fraud, and tax evasion — Treasury cites cases moving criminal proceeds from the Black Market Peso Exchange, an international pyramid-fraud scheme (OneCoin), and foreign bribery schemes through adviser-formed funds
• Wealthy Russian individuals and their proxies using advisers and offshore wealth-management structures to invest in U.S. companies, particularly technology firms, while obscuring beneficial ownership
• Foreign state actors, notably the PRC and Russia, using private funds — especially venture capital vehicles — as a route to equity stakes in U.S. companies developing critical or emerging technologies
• Advisers defrauding their own clients through Ponzi or Ponzi-like schemes, the most common illicit-activity pattern Treasury identified among IA-related SARs and federal criminal cases

Related typologies

Ponzi & Investment Adviser Fraud is the primary typology exploiting this vulnerability; also see the "ramp-and-dump" securities fraud pattern (China-affiliated VIE stocks pumped via social media, then dumped) that the 2026 NMLRA flags as a fast-growing variant — IC3 logged a 300% year-over-year increase in complaints in H1 2025.

FinCEN Enforcement Actions

• Global broker-dealer (March 6, 2026) — $80M civil money penalty, the largest BSA enforcement action ever against a broker-dealer, for willful failure to implement an effective AML program from 2018–2024, coordinated with parallel SEC and FINRA settlements ($20M each, credited against the FinCEN penalty).
• Canaccord Genuity LLC (2026) — civil money penalty and disgorgement exceeding $1.2M combined for failing to detect shell-company red flags (see Shell Companies) in a customer relationship.

Every control described elsewhere on this page assumes the people operating it are acting in good faith. Complicit insiders — bank employees, school financial-aid staff, timeshare-resort employees, casino agents, notaries — are the recurring exception, and the 2026 NMLRA treats insider complicity as its own distinct vulnerability rather than folding it into any single typology. FinCEN's most recent explicit statement on the pattern comes from the CMLN advisory (FIN-2025-A003), which warns that Chinese money laundering networks "may recruit financial institution employees to act as complicit insiders or infiltrate and place CMLN members within a financial institution to assist in CMLN operations."

Recurring patterns across this wiki

• A bank manager or teller disabling account alerts or approving transactions outside normal authority (see BEC, check fraud cases)
• School financial-aid or admissions staff recruiting straw students and doctoring academic records (see Federal Student Aid Fraud)
• Timeshare resort employees selling U.S. owner contact information to cartel-run call centers (see Advance-Fee & Timeshare Fraud)
• A registered casino agent operating an unlicensed money-transmitting side business for high-roller patrons (see Casinos)
• A recruited or infiltrated financial institution employee facilitating account opening or transaction processing for a laundering network (see Chinese Money Laundering Networks)

Red flags

• An employee whose personal financial activity is inconsistent with their salary, especially cash-heavy
• Unusual overrides, waived documentation requirements, or disabled account-monitoring alerts traceable to a specific staff member — the FFIEC Manual assigns the board and senior management ultimate responsibility for internal controls that would catch this
• An employee consistently handling the same small set of external accounts or customers outside normal rotation

FinCEN Enforcement Actions: Individual Accountability

FinCEN has, on rare occasion, penalized individual compliance and risk officers personally rather than only the institution — a notable escalation from institution-level penalties:

• A former Chief Compliance Officer at a U.S. money-transfer company — the first individual ever penalized personally by FinCEN for AML program mismanagement; initially assessed $1M, ultimately settled for $250,000 plus a three-year industry injunction (2017), after that company itself had already forfeited $100M for agent-complicit fraud (2012).
• A former risk officer at a large U.S. bank holding company — individually penalized $450,000 (2020) in connection with the bank's "alert-capping" scheme that suppressed suspicious-activity monitoring output; one of the only cases where FinCEN has penalized someone other than an AML/BSA officer specifically.

GATEKEEPER"PEP" is industry shorthand, not a defined BSA term — FinCEN's regulations don't define it. The actual regulatory term is senior foreign political figure (SFPF), a narrower subset of PEP defined at 31 CFR §1010.605(p): a current or former senior official in a foreign government's executive, legislative, administrative, military, or judicial branch; a senior official of a major foreign political party; a senior executive of a foreign government-owned commercial enterprise; an entity formed by or for such a person's benefit; their immediate family; or a known close associate. Section 312 of the USA PATRIOT Act requires enhanced due diligence specifically for SFPF-held private banking accounts (31 CFR §1010.620). Broader "bank-identified PEPs" — the FFIEC's term for anyone a bank chooses to treat as a PEP — are subject only to general risk-based CDD, with no PEP-specific BSA regulation and no FinCEN-defined red-flag list of their own; examiners are explicitly reminded no customer type is automatically higher-risk.

Why it's exploited

An SFPF or PEP relationship gives a corrupt official's family member or associate ordinary-looking banking access; the illicit nature of the funds only becomes apparent when the customer's actual government salary is compared against the scale of assets moving through the account — exactly the mismatch central to every corruption case in this wiki. FIN-2018-A003 documents three typologies specifically: misappropriation of state assets (e.g. falsified national-security disbursement orders funneled through shell entities), use of shell companies to obscure ownership, and exploitation of real estate's opacity and value-laundering properties.

Red flags — as published in FIN-2018-A003

• Use of third parties in a transaction where that is unusual for the customer or business type
• Use of third parties that appears designed to shield the identity of a PEP
• Use of family members or close associates as the legal/registered owners of accounts or entities on a PEP's behalf
• Use of corporate vehicles (shell companies, LLCs, trusts) to obscure beneficial ownership
• Engagement with designated non-financial businesses and professions (DNFBPs — real estate agents, precious-metals dealers, attorneys, accountants, company formation agents) that would not normally cater to foreign or high-value clients

FinCEN notes it will update these red flags and typologies as investigation of PEP-facilitator methodologies continues, and explicitly cautions against wholesale or indiscriminate de-risking of PEPs as a class — the bulk are dedicated public servants.

Risk factors for bank-identified PEPs generally — per the FFIEC manual (not red flags; risk-profile inputs)

• Type of products/services used, and volume/nature of transactions
• Geographies associated with the customer's activity and domicile
• The customer's official government responsibilities and level of authority/influence over government activities or officials
• The customer's access to significant government assets or funds

Nonresident alien (NRA) and foreign-individual accounts pose an examiner-recognized risk not because foreign customers are inherently suspect, but because U.S. institutions have structurally weaker tools to verify foreign identity documents, foreign income sources, and foreign tax status than they do for domestic customers. This is a customer-type risk category distinct from any single typology — it recurs as an underlying vulnerability inside student aid fraud "fraudulent accounts" schemes and foreign-student impersonation scams alike. An NRA is defined as a non-U.S. citizen who is not a lawful permanent resident and does not meet the IRS's substantial-presence test, or who has not been issued a green card; the Manual notes NRA deposits in the U.S. banking system have been estimated at hundreds of billions to roughly $1 trillion.

Risk factors — as published in the FFIEC Manual

• Banks may find it more difficult to verify and authenticate an NRA accountholder's identification, source of funds, and source of wealth
• The NRA's home country may heighten account risk depending on that country's secrecy laws
• Because the NRA is expected to reside outside the United States, funds transfers or the use of foreign ATMs may be more frequent
• BSA/AML risk may be further heightened if the NRA is also a politically exposed person — see PEPs

Factors banks are told to weigh in risk-rating an NRA account — as published in the FFIEC Manual

• Accountholder's home country
• Types of products and services used
• Forms of identification
• Source of wealth and funds
• Unusual account activity

Foreign identity documents that cannot be independently verified, and multiple NRA accounts opened in a short window using similar or templated documentation, remain the practical tells examiners look for on top of these Manual-listed factors — consistent with the criminal-broker "one-to-one" account-opening scheme documented in Student Aid Fraud.

Charities and nonprofits combine three features that make them a distinct examiner-recognized risk category: they often move funds internationally (including to higher-risk jurisdictions) for legitimate humanitarian reasons, they're subject to lighter public financial-disclosure requirements than commercial entities, and donor funds can be diverted or the organization itself can be a knowing front — all without the underlying charitable mission necessarily being fake. This sits adjacent to, but distinct from, terrorist financing typologies, which is the primary predicate risk this vulnerability enables. The FFIEC Manual is explicit that no specific customer type automatically presents higher risk, and that Treasury's 2018 National Terrorist Financing Risk Assessment does not view the charitable sector as a whole as presenting a uniform or unacceptably high risk of ML/TF or sanctions exploitation — banks that reasonably manage the risk are neither prohibited nor discouraged from banking charities and NPOs.

Risk factors — as published in the FFIEC Manual

• The risk to a bank depends on the facts and circumstances specific to the relationship — transaction volume, type of activity, and geographic locations — not the charity/NPO customer type itself
• U.S. charities operating and funding solely domestic recipients generally present lower ML/TF risk
• U.S. charities that operate abroad, fund overseas affiliates, or have affiliated organizations in conflict regions can face potentially higher ML/TF risk

Information the Manual says helps a bank understand the relationship — as published in the FFIEC Manual

• Purpose and nature of the charity/NPO, including mission, stated objectives, and programs
• Geographic locations served, particularly higher-risk areas where terrorist groups are most active
• State incorporation/registration and IRS tax-exempt status, including required regulatory filings
• General information about donor base, funding sources, and fundraising methods
• General information about beneficiaries and disbursement criteria, including any intermediaries involved
• Affiliation with other charities, NPOs, governments, or groups

Within that framing, the practical tells examiners still watch for include a charity's stated program activity bearing no relationship to its actual international wire pattern, cash donations disproportionate to its public visibility or donor base, and overlapping board members, addresses, or accounts across nominally unrelated nonprofits.

Independently owned (non-bank) ATMs are typically serviced with cash the operator sources and loads themselves, then reimbursed by the ATM network — a structure that lets an operator introduce illicit cash into the "load" and have it reimbursed as clean funds through ordinary network settlement. FFIEC treats independent ATM owner/operators as a distinct customer-risk category given how little visibility a bank has into where the cash loaded into a given machine actually came from — though the Manual is explicit that no specific customer type automatically presents higher risk, and that banks reasonably managing the relationship are neither prohibited nor discouraged from banking these customers. FinCEN separately concluded in 2007 that a nonbank ATM owner/operator offering only balance inquiries and cash withdrawals on a depository institution's own customer accounts is not itself an MSB, so most independent ATM operators fall outside AML-program requirements entirely.

Risk factors — as published in the FFIEC Manual

• Operators who fund ATM replenishment solely with cash withdrawn from their own bank account pose relatively lower risk, since the bank knows the cash source and can compare cash usage to EFT settlements
• Operators who replenish ATMs from other or unknown cash sources may present higher risk, since the source of that cash is difficult for the bank to verify
• Commingling cash from illicit and legitimate sources in the ATM can make all transactions in the operator's account appear legitimate, with "clean" ACH settlement funds flowing back to the operator
• Many states do not register, monitor, or examine independent ATM owner/operators, and — outside the MSB-status determination above — they are generally not required to have AML compliance programs

Information the Manual says helps a bank understand the relationship — as published in the FFIEC Manual

• Organizational structure, including key principals and management
• ATM currency-servicing arrangements, contracts, and responsibilities
• Source of funds if the bank account is not used to replenish the ATM
• Locations where owned or operated ATMs are placed
• Expected versus actual ATM activity levels, including currency transactions

Within that framing, the practical tells remain cash-reimbursement requests inconsistent with a machine's location, foot traffic, or historical withdrawal volume, and operators controlling an unusually large machine network relative to the scale of their apparent business — particularly where those machines sit in cash-intensive corridors already elevated by the Cash-Intensive Businesses risk factors.

CASHLegitimate cash-heavy businesses — restaurants, car washes, laundromats, nail salons, convenience stores — provide natural cover for laundering because their real revenue is genuinely hard to verify. Layering illicit cash into a business's reported receipts ("commingling") lets launderers deposit money that never has to answer to a wire transfer's paper trail. The Manual lists convenience stores, restaurants, retail stores, liquor stores, cigarette distributors, privately owned ATMs, vending-machine operators, and parking garages as common examples.

Mechanics — as described in the FFIEC Manual

A launderer buys or already controls a cash-intensive business, then deposits illicit cash alongside legitimate daily receipts; the deposits don't, on the surface, appear unusual because the business is legitimately cash-generating, but the volume of currency will most likely run higher than comparable businesses of the same type in the area. This overlaps heavily with bulk cash smuggling and the fronts used in human trafficking cases (massage parlors, agricultural labor contractors).

Risk factors banks are told to weigh — as published in the FFIEC Manual

• Purpose of the account
• Volume, frequency, and nature of currency transactions
• Customer history, including length of relationship and CTR/SAR filings
• Primary business activity, products, and services offered
• Business or business structure
• Geographic locations and jurisdictions of operations
• Availability of information and the business's cooperation in providing it

Within that framing, cash deposits inconsistent with a business's apparent customer volume, staffing, or hours remain the core practical tell, together with revenue that runs disproportionately high relative to industry norms for the stated business type.

FinCEN Enforcement Actions

• Capital One (2021) — $390M penalty tied to its bank-owned Check Cashing Group, which served cash-intensive check-cashing businesses (including some linked to organized crime) from 2008–2014 without adequate SAR/CTR filing, continuing service to a customer even after learning of his pending criminal charges.
• Brink's Global Services USA (Feb. 2025) — consent order addressing BSA compliance gaps in the armored-transport/cash-logistics business, a sector that sits directly at the intersection of bulk cash handling and institutional cash-intensive risk.

PREPAIDPrepaid access is FinCEN's regulatory term for funds paid in advance and retrievable later through a card, code, or similar electronic vehicle. Banks often participate as the issuing bank while relying on third parties — program managers, distributors, marketers, and processors — to run the program day to day; some non-bank sellers/providers of prepaid access are themselves regulated as MSBs. Separately, gift cards specifically are the payment method of choice for lower-sophistication scams because they're anonymous, instantly liquid in the scammer's hands, and require no bank account — a victim buys a card at any retailer and reads the code over the phone. They recur constantly across this wiki's fraud articles: tech support scams close almost every call this way.

Risk factors — as published in the FFIEC Manual

• Higher risk is associated with an anonymous holder, or a holder/purchaser who provides fictitious information
• Higher risk is also associated with cash access (especially internationally) and the volume/velocity of funds that can be loaded or transacted
• Funds may be transferred to or from an unknown third party, and cardholder identity verification may be done entirely remotely through third-party program managers, processors, or distributors
• Prepaid access can be used internationally, avoiding border restrictions and reporting requirements applicable to cash and monetary instruments
• Specific holder activity may be difficult to determine when reviewed through a pooled account, since underlying data may be held by third parties separate from the issuing bank

Product-feature mitigants — as published in the FFIEC Manual

• Limits or prohibitions on cash loads, access, or redemption, particularly where holder information is not on file
• Load/reload velocity limits and controls on the number of cards one individual can purchase
• Maximum dollar thresholds on ATM and point-of-sale transactions, with velocity limits on each
• Limits or prohibitions on certain merchant types and on geographic usage outside the United States

Gift-card scam mechanics — editorial, distinct from the Manual's program-risk content above

A scammer directs a victim to purchase gift cards (Apple, Google Play, Target, Amazon, etc.) at a retail store, then read the redemption codes over the phone or send photos of them. The scammer or an associate immediately drains or resells the card codes, often through online marketplaces, converting them to cash or CVC before the victim or retailer can react. FinCEN's Elder Financial Exploitation advisory (FIN-2022-A002) separately lists "an older customer purchases large numbers of gift cards or prepaid access cards" as a financial red flag of elder scams — see Elder Financial Exploitation.

P2PZelle, Cash App, Venmo, and Apple Pay move money instantly between individuals with minimal friction — exactly the property that makes them attractive for legitimate use and for laundering alike. Because transfers settle near-instantly and mimic ordinary peer transactions (splitting a bill, paying a friend back), P2P platforms are now a default settlement rail for financial sextortion, money mule payouts, and student aid fraud refund laundering.

Mechanics

A victim or a compromised account sends P2P funds to a mule-controlled account; the mule immediately forwards the balance onward (often converting to CVC) before the sending institution or victim can dispute the transaction — P2P transfers generally lack the same reversibility as ACH or card transactions.

Red flags

• An account receiving numerous P2P transfers from unrelated senders with no apparent personal or business connection
• P2P receipts immediately converted to CVC or forwarded to another account with no dwell time
• A pattern of P2P payments matching a known extortion or scam cadence (e.g., escalating amounts to a single recipient)

MOMoney orders offer many of cash's advantages — no bank account required, purchasable at post offices, retailers, and MSBs — with a veneer of an official instrument. They remain a persistent, lower-tech laundering channel, particularly for structuring (buying multiple money orders just under reporting thresholds) and for older victims accustomed to paying by mail.

Why the instrument persists

Money orders sit in an awkward regulatory position: they are prefunded and therefore cannot bounce, they require no bank account, they are sold at post offices, retailers, and MSBs with minimal friction, and they carry the visual authority of an official instrument. That combination makes them attractive both to the legitimately unbanked and to launderers, which is why they have never fully disappeared despite the shift to electronic payments.

Regulatory thresholds — as set out in 31 CFR §1010.415 and the FFIEC Manual

A bank may not issue or sell a money order (or other covered monetary instrument) for $3,000 or more in currency unless it records the purchaser's identity — the $3,000 MSB recordkeeping threshold most structuring around money orders is calibrated to, rather than the $10,000 CTR threshold. The FFIEC Manual notes that customers have been known to purchase monetary instruments in amounts below $3,000 specifically to avoid providing identification, then deposit those instruments to circumvent CTR filing. USPS separately applies its own $3,000 daily purchase limit per customer and a $1,000 domestic per-order cap, so structuring patterns tend to cluster just under $3,000 and across multiple retail locations.

Policy elements the Manual says banks should define — as published in the FFIEC Manual

• Acceptable and unacceptable monetary-instrument transactions, including noncustomer transactions, blank payees, unsigned instruments, and identification requirements for structured transactions
• The purchase of multiple sequentially numbered monetary instruments for the same payee, which the Manual flags by name as a pattern to define policy around
• Procedures for reviewing unusual or suspicious activity and elevating concerns to management
• Criteria for closing relationships with noncustomers consistently or egregiously involved in suspicious activity

Practical red flags built on the above

• Sequential or same-day purchases of multiple money orders just under the $3,000 MSB recordkeeping threshold, or under the $10,000 CTR threshold in aggregate
• Sequentially numbered money orders — indicating single-transaction purchase — later deposited by unrelated parties or at geographically distant locations
• A single payee or remitter name appearing across money orders bought at different locations by different individuals, the classic smurfing signature
• Money orders deposited with the payee line blank, incomplete, or completed in different handwriting from the purchaser's
• Elderly customers purchasing money orders in response to a phone instruction, especially for "fees," "taxes," "bail," or prize claims (see Elder Financial Exploitation)
• A business account receiving recurring third-party money order deposits inconsistent with its stated customer base
• Money orders purchased in one jurisdiction and consistently negotiated in another with no apparent connection to either party
• A customer purchasing money orders immediately after a cash deposit or withdrawal of a similar aggregate value — a conversion pattern with no economic rationale

INSLife insurance and annuity products offer a distinctive laundering path: a launderer overfunds a policy (paying more in premium than needed, often in cash or structured deposits), then surrenders it early or borrows against the cash value, receiving a "clean" check from a reputable insurer. Insurance products are also a direct fraud target in their own right — staged accidents, fabricated claims, and elder-targeted annuity churning. FinCEN regulations impose AML program and SAR obligations on insurance companies (not independently on brokers/agents) for a limited set of covered products: permanent life insurance (other than group life), any annuity contract (other than a group annuity), and any other insurance product with cash-value or investment features.

Red flags — as published in the FFIEC Manual

• Currency used to purchase one or more life insurance policies, subsequently canceled quickly ("early surrender") for a penalty, with the insurer refunding the money by check
• Submission of inflated or false claims to an insurance carrier — even on a policy without cash value or investment features — to recover part or all of the originally invested payments
• Borrowing against the cash surrender value of a permanent life insurance policy
• Selling units in investment-linked products such as annuities
• Using proceeds from an early policy surrender to purchase other financial assets
• Buying policies that allow transfer of beneficial interests without the issuer's knowledge or consent (e.g., secondhand endowment and bearer insurance policies)
• Purchasing insurance products through unusual methods such as currency or currency equivalents
• Buying products with termination features without concern for the product's investment performance

SHELLFinCEN's definition: non-publicly-traded corporations, LLCs, and trusts that typically have no physical presence beyond a mailing address and generate little to no independent economic value. A shell company is the single most common laundering vehicle on this entire page: it appears inside TBML, CMLN, student aid fraud, health care fraud (nominee-owned DME companies), and correspondent banking schemes alike. As of 2004, GAO counted ~8.9 million corporations and ~3.8 million LLCs registered nationwide (more new LLCs formed that year — 1,068,989 — than corporations, 869,693), and most states don't require disclosure of ownership information at formation or afterward.

Mechanics — nominee services

Agents/nominee incorporation services (NIS) organize entities in any state and can preserve a client's anonymity through nominee officers/directors (public-record placeholders), nominee stockholders (privacy maintained via an irrevocable proxy agreement), and a nominee bank signatory (a fiduciary — e.g. a lawyer or accountant — who opens accounts and relays beneficial-owner instructions to the bank without disclosing their identity). Many states allow corporations, partnerships, and trusts to own and manage LLCs, letting an individual layer ownership until the relationships among individuals and companies become nearly indiscernible even when an owner is known.

Red flags — as published in FIN-2006-G014

• Inability to obtain information identifying the originator or beneficiary of a wire transfer — via internet search, commercial database, or direct inquiry to the foreign correspondent bank
• A foreign correspondent bank exceeds its client profile's anticipated wire volume, or a company shows sporadic activity inconsistent with normal business patterns
• Payments have no stated purpose, don't reference goods or services, or cite only a contract/invoice number
• A company's goods or services don't match the profile previously provided to the institution
• Transacting businesses share the same address, list only a registered agent's address, or show other address inconsistencies
• An unusually large number and variety of beneficiaries receive wire transfers from one company
• Frequent involvement of beneficiaries in high-risk, offshore financial centers
• Multiple high-value payments or transfers between shell companies with no apparent legitimate business purpose

SAR narratives involving suspected shell-company misuse should use the term "shell" and identify originators, beneficiaries, shell entities, and any registered agents or third parties involved.

FinCEN Enforcement Actions

• Canaccord Genuity LLC (2026-01) — penalty and disgorgement for failing to detect red flags that a customer entity ("ONPH") had the appearance of a shell company, despite indicators available in the firm's own account records.

SHELLUnlike a pure shell (which does nothing), a front company conducts some genuine business — enough to look legitimate — while its primary purpose is laundering or facilitating illicit activity. This distinction matters operationally: fronts have real invoices, real shipments, and sometimes real employees, making them harder to flag on activity alone. The FFIEC manual's Trade Finance Activities section notes an applicant's true identity may be disguised via "shell companies or offshore front companies," reducing transparency and increasing money-laundering/terrorist-financing risk. The export-control evasion cases in this wiki almost all run through front companies (electronics distributors, freight forwarders) rather than pure shells.

Red flags — as published in FIN-2025-A002 and FIN-2022-Alert003/FIN-2023-NTC2

• Transactions originate with or are directed to general trading companies, suspected front companies, or entities with an Iran nexus — indicators include opaque ownership structures, individuals/entities with obscure names directing the company, or business addresses that are residential or co-located with other companies, especially previously sanctioned ones (FIN-2025-A002)
• A customer declares a business purpose inconsistent with other available information — particularly if trade data shows a history of facilitating shipments to and from Iran, or the customer transacts predominantly with technology companies or chemical suppliers (FIN-2025-A002)
• Multiple companies incorporated around the same time share counterparties, addresses, owners, or name similarities and show similar transaction profiles, often with little to no web presence and large recurring transactions (FIN-2025-A002)
• A company based in the Middle East with Iran links or front-company indicators receives payments primarily from petroleum companies and pays out primarily to Hong Kong/China electronics companies (FIN-2025-A002)
• A newly incorporated company, based in a non-GECC country, makes payments for defense or dual-use products (FIN-2022-Alert003/FIN-2023-NTC2)
• A new customer trades in products tied to the nine High Priority Items List HS codes with no clear commercial rationale (FIN-2022-Alert003/FIN-2023-NTC2)

Trusts add a further layer of separation between a beneficial owner and their assets — a trustee holds legal title, and depending on the trust's structure and jurisdiction, the actual beneficiary can be extremely difficult for a financial institution to identify. This matters most where real estate or corruption proceeds are placed into a trust-owned property or investment vehicle specifically to defeat beneficial-ownership due diligence. For CIP purposes, the Manual treats the trust itself as the bank's customer, but risk-based procedures may still require gathering information on the settlor, grantor, trustee, or others with authority to direct the trustee.

Circumstances warranting enhanced due diligence — as published in the FFIEC Manual

• Bank is entering into a relationship with a new customer
• Account principals or beneficiaries reside in a foreign jurisdiction, or the trust or its funding mechanisms are established offshore
• Assets or transactions are atypical for the type and character of the customer, or for the bank
• International funds transfers are conducted, particularly through offshore funding sources
• Accounts are funded with easily transportable assets such as gemstones, precious metals, coins, artwork, rare stamps, or negotiable instruments
• Accounts or relationships are maintained in which the identities of the principals, beneficiaries, or sources of funds are unknown or cannot easily be determined
• Accounts benefit charitable organizations or NGOs that may be used as a conduit for illegal activities (see Charities & NPOs)
• Account assets include private investment companies (PICs) or asset protection trusts (APTs) — a special form of irrevocable trust typically settled offshore to preserve wealth against creditors
• Interest on lawyers' trust accounts (IOLTA) holding and processing significant dollar amounts (see Attorneys)
• Politically exposed persons are parties to any accounts or transactions (see PEPs)

GATEKEEPERAttorneys occupy a uniquely privileged position: client trust accounts (IOLTA accounts) can move large sums with a professional's imprimatur, and attorney-client privilege can complicate law enforcement's ability to see through the relationship. Unlike banks, attorneys are not themselves BSA-covered financial institutions in most contexts, which is precisely why they're identified as a gatekeeper vulnerability rather than a typology in their own right — the 2017 FinCEN advisory extending SAR-filing expectations to real estate professionals was a direct response to this gap. The FFIEC Manual describes a professional service provider as an intermediary between its client and the bank — an attorney may perform services for a client or arrange services on the client's behalf, such as settling real estate transactions, transferring assets, managing client monies, or handling trust arrangements. A typical IOLTA account holds funds for a lawyer's various clients and functions as a standard bank account, with the interest earned ceded to the state bar association or another public-interest entity.

Risk factors — as published in the FFIEC Manual

• Unlike an escrow account set up for an individual client, a professional service provider account allows ongoing business transactions with multiple clients — the bank generally has no direct relationship with or knowledge of the account's beneficial owners, who may be a constantly changing group of individuals and entities
• As with any account presenting third-party risk, the bank could be more vulnerable to potential abuse, including laundering illicit currency, structuring currency deposits and withdrawals, or opening a third-party account for the primary purpose of masking the underlying client's identity
• Professional service providers cannot be exempted from currency transaction reporting requirements

Within that framing, the practical tells remain an attorney trust account receiving large, unexplained third-party deposits unrelated to any identifiable client matter, real estate or corporate closings structured specifically to avoid a bank's own beneficial-ownership diligence, and an attorney serving as registered agent or nominee for an unusually large number of shell entities.

GATEKEEPERAccountants and tax preparers can lend legitimacy to fraudulent business records, prepare fabricated financial statements to support fraudulent loan or grant applications, or actively originate the fraud themselves — publicly reported cases have involved schemes filing thousands of false returns and seeking well over $100M in fraudulent tax credits. The FFIEC Manual separately treats accountants, alongside lawyers and investment brokers, as "professional service providers" when they hold client-pooled accounts at a bank — intermediary accounts the bank generally cannot see through to the underlying client.

The gatekeeper problem

Accountants and tax preparers are not BSA-covered financial institutions, so they carry no independent SAR obligation — yet they produce the documents on which lenders, insurers, and government programmes rely. That asymmetry is the vulnerability: a fabricated financial statement or a falsified return carries a professional's implicit endorsement into a process that has no way to test it.

Three distinct roles recur across the typologies in this reference. Unwitting — the preparer accepts client-supplied figures without scrutiny. Reckless — the preparer sees implausible figures and files anyway, common in the ERC and pandemic-credit cases. Complicit or originating — the preparer designs and drives the scheme, as in the $170M COVID-19 tax credit case involving 1,900+ false returns, and in the fiscal fuel theft OFAC designation of an accountant described as the architect of a cartel's shell-company and customs-document apparatus.

Bank-account intermediary risk factors — as published in the FFIEC Manual

• Unlike an escrow account for an individual client, a professional service provider account allows ongoing transactions with multiple clients whose identities the bank generally has no direct visibility into
• Potential abuse includes laundering illicit currency, structuring currency deposits and withdrawals, or opening a third-party account for the primary purpose of masking the underlying client's identity

Tax/benefits-fraud red flags — from the DOJ/IRS case record, not the FFIEC source above

• A preparer whose clients show implausibly similar or templated financial statements, income figures, or deduction patterns
• Refunds or programme reimbursements routed to accounts controlled by the preparer rather than the client
• Fees charged as a percentage of a refund or claim rather than a flat professional fee — a recurring indicator across benefits-fraud cases and generally prohibited for federal tax return preparation
• A preparer associated with a volume of client filings disproportionate to a practice of that size
• Client entities sharing a preparer, a registered agent, and a common address — see Shell Companies
• A preparer or accountant serving as nominee officer, registered agent, or signatory on client entity accounts
• Amended returns or restated financials filed shortly after a lending or programme decision that depended on the original figures
• Reluctance to provide workpapers, source documents, or engagement letters supporting statements already relied upon by a lender

GATEKEEPERTPPPThird-party payment processors (TPPPs) aggregate payment processing for many merchants under a single relationship with a bank, meaning the bank itself may never see the individual merchants generating the risk. FinCEN's 2012 advisory addressed exactly this blind spot: a single TPPP relationship can quietly onboard fraudulent or high-risk merchants — including health care fraud shell billing companies and student aid fraud criminal brokers — that would never individually pass a bank's own underwriting. TPPPs process credit card payments, ACH debits, and remotely created checks (RCCs)/"demand drafts" on behalf of merchant clients, sometimes via deposit accounts opened in the merchant's own name. Telemarketing, internet sales, and RCC-related merchants carry a comparatively higher fraud/illegal-activity profile.

Red flags — as published in FIN-2012-A010

• Fraud: high numbers of consumer complaints and/or unusually high return or chargeback rates suggest a merchant is engaged in unfair or deceptive practices, including unauthorized RCCs/ACH debits
• Accounts at multiple institutions: the processor maintains accounts at more than one institution, or moves between institutions quickly — often to stay ahead of a bank recognizing suspicious activity and terminating the relationship; watch for "check consolidation accounts" used to obscure true return/error rates
• Money laundering: the processor is used to mask illegal transactions, or to place illegal funds via ACH credits originating from foreign sources
• Enhanced risk relationships: foreign-located processors serving telemarketers, online businesses, and other merchants
• Solicitation of distressed banks: the processor targets financially troubled or under-resourced community banks — sometimes even offering to buy the bank's stock — to secure a willing relationship for high-risk merchants
• Elevated unauthorized-return rate: the processor's aggregate return rate looks normal, but the rate spikes when calculated per individual originator/merchant rather than across the whole book

SAR filing instruction

Check the appropriate suspicious-activity-type box and include the term "Payment Processor" in both the narrative and subject-occupation portions of the SAR.

Regulatory history

HVGGold, gemstones, and jewelry hold value densely, cross borders with far less scrutiny than cash, and can be liquidated globally with minimal documentation — dealers in precious metals, stones, or jewels are themselves defined as BSA-covered "financial institutions" once certain purchase/sale thresholds are met (over $50,000 purchased and $50,000 sold in covered goods in the prior calendar/tax year, for retailers specifically). The "gold bar courier" variant of impersonation scams — where elderly victims are talked into converting savings to physical gold for a mule to collect — is the most visible current example, but PMSJ dealing is also a classic vehicle for corruption and cartel proceeds.

Foreign-supplier risk factors — as published in FIN-2008-G003

• Whether the supplier's jurisdiction requires AML policies/procedures/internal controls, "know your customer" measures, suspicious- or large-cash-transaction reporting, pre-transaction reporting of suspected ML/TF, procedures for refusing/terminating suspect transactions, or a designated compliance officer
• Whether the jurisdiction requires industry membership, registration, or licensing, or has a central AML supervisory agency for the sector
• The dealer's own history and trust with the supplier — longevity alone isn't sufficient; it should be paired with actual knowledge of the supplier's lawful practices and AML compliance

Red flags for identifying a suspicious transaction — as published in FIN-2008-G003

• Unusual payment methods — large cash amounts, multiple or sequentially numbered money orders, traveler's checks, or cashier's checks, or third-party payments
• The customer or supplier is unwilling to provide complete and accurate contact information
• The customer or supplier attempts to maintain an unusual degree of secrecy
• The transaction is unusual for that particular customer/supplier or type of customer/supplier
• The transaction doesn't accord with established industry norms

Dealers aren't obligated — or encouraged — to automatically refuse or terminate a transaction just because it raises suspicion; the guidance calls for procedures to identify and reasonably mitigate the risk instead. PMSJ dealers aren't currently required to file SARs but are encouraged to do so voluntarily.

FinCEN Enforcement Actions

• A&S World Trading (d/b/a Fine Fragrance) — $275,000 penalty, FinCEN's first enforcement action for violating a Geographic Targeting Order (GTO); the firm failed to report $2M+ in high-risk currency transactions in the Los Angeles Fashion District, an area subject to heightened BSA reporting requirements for trade businesses given its history of TBML and precious-goods laundering.

HVGHigh-value art sits outside most of the BSA's core coverage — dealers aren't traditionally treated as financial institutions the way banks or PMSJ dealers are — while individual works can be worth tens of millions and change hands with limited standardized provenance or beneficial-ownership disclosure. Section 6110(a) of the AML Act of 2020 amended the BSA's "financial institution" definition to include persons "engaged in the trade of antiquities" and directed FinCEN to issue implementing regulations; FinCEN's March 2021 notice announced this effort and reminded institutions of existing SAR obligations while rulemaking was pending.

Crime categories — as published in FIN-2021-NTC2

Crimes relating to antiquities and art may include looting or theft, illicit excavation of archaeological items, smuggling, and the sale of stolen or counterfeit objects — as well as money laundering and sanctions violations. FinCEN notes links to transnational criminal networks, international terrorism, and the persecution of individuals or groups on cultural grounds.

SAR filing instructions — as published in FIN-2021-NTC2

• Reference "FIN-2021-NTC2" in SAR field 2 and the narrative; select field 36(z) (Money Laundering – Other) and note whether the activity relates to "Antiquities," "Art," or both
• Provide available details identifying the object(s) connected to the transaction, and any other related or proposed transactions
• Include names, identifiers, IP addresses, emails, and phone numbers for the actual purchasers/sellers and their intermediaries or agents
• Provide the volume and dollar amount of transactions involving the dealer, and any beneficial owner(s) of entities (e.g. shell companies) involved
• For stolen items, give a detailed description and note whether photographs are available

Red flags — editorial, not FinCEN-authored

• High-value art purchases paid via wire transfer from an account with no clear connection to art collecting or the buyer's known wealth profile
• Repeated private sales (versus auction/dealer-brokered) with limited documentation of provenance or true beneficial buyer
• Use of freeports or bonded storage facilities specifically to avoid import/export scrutiny

Regulatory history

HVGWatches, vehicles, yachts, and consumer electronics serve two laundering functions at once: they store value in an easily resold, portable form, and — as with high-end electronics — they can themselves be the export-controlled commodity at the center of a sanctions-evasion scheme. Fraud proceeds across nearly every typology in this wiki eventually surface as luxury purchases (watches, cars, real estate) — it's one of the most consistent "lifestyle" tells in federal fraud and money-laundering cases generally. FinCEN's dedicated luxury-goods alert (March 2022) defines luxury goods as high-end watches, luxury vehicles, yachts and planes, high-end apparel, high-end alcohol, and jewelry — issued alongside a matching Commerce Department export ban and OFAC's expanded Russia/Belarus sanctions program.

Select red flags — other high-value assets — as published in FIN-2022-Alert002

• The sudden transfer, including through sales, of ownership in high-value assets and goods by sanctioned Russian elites and their proxies
• The involvement of legal entities, such as shell companies, with a nexus to sanctioned Russian elites and their proxies, falsely posing as well-known entities and operating in jurisdictions other than that entity's actual jurisdiction and business sphere
• The involvement of a common set of financial institutions, individuals, or addresses to facilitate luxury goods-related transactions with a nexus to sanctioned Russian elites and their proxies
• The involvement of law firms based in global and offshore financial centers historically specializing in Russian clientele or transactions associated with sanctioned Russian elites and their proxies
• The involvement of transportation service companies owned by or with a nexus to sanctioned Russian elites and their proxies, potentially used to transport luxury goods and obfuscate their movement

Select red flags — precious metals, stones & jewelry (PMSJ) — as published in FIN-2022-Alert002

• Transactions involving PMSJ trading companies, particularly in Asia, and firms with a nexus to sanctioned Russian elites and their proxies
• High-value or frequent transactions involving mining operations with opaque and complex corporate structures owned or controlled by sanctioned Russian elites or their proxies

Outside that sanctions-specific scope, luxury purchases funded by wire transfers with no correlation to the purchaser's known income, and high-end electronics purchases inconsistent with a buyer's stated business (especially when destined for export), remain the general practical tells for the broader typology described above.