FIN-2026-Alert005: Money laundering associated with digital asset investment scam centers
Document text
Research, not advice. Part of the Bitcoin research archive (October 2026). Claims labelled unverified, contested or fringe are reported, not endorsed; statuses of bills and rules are as of the date checked. Government, court and patent records are public domain; the research notes are CC BY 4.0.
FIN-2026-Alert005 September 3, 2026
FinCEN Alert on Money Laundering Activity Associated
with Digital Asset Investment Scam Centers
The U.S. Department of the Treasury’s (Treasury) Financial
Suspicious Activity Report (SAR)
Crimes Enforcement Network (FinCEN) is issuing this Alert
Filing Request:
to urge financial institutions1 to be vigilant in detecting,
FinCEN requests that financial identifying, and reporting suspicious activity connected to
institutions reference this Alert in
the operation of digital asset investment scam centers and
SAR field 2 (Filing Institution Note
the laundering of associated illicit proceeds. Transnational
to FinCEN) and the narrative by
criminal organizations (TCOs)—predominantly in Southeast
including the key term “FIN-2026-
SCAMCENTERS” and selecting
Asia—operate these scam centers, which target individuals,
“Fraud-Other” under SAR field including numerous Americans, with digital asset investment
34(z) with the description “Scam scams and other fraud schemes.2 A vast illicit ecosystem,
Centers” in the text box. which includes online marketplaces for cybercrime and
money laundering-related services and artificial intelligence-
supported software platforms, enables scam centers’ operations.
Fraud continues to be one of the largest sources of illicit proceeds in the United States, according
to Treasury’s 2026 National Money Laundering Risk Assessment.3 Fraud and cybercrime are two
of FinCEN’s Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT)
National Priorities.4 On March 6, 2026, President Trump issued Executive Order 14390, Combating
Cybercrime, Fraud, and Predatory Schemes Against American Citizens, declaring that it is the policy of
the United States to protect Americans from, and harden our financial and digital systems against,
these threats.5
1. See 31 U.S.C. § 5312(a)(2); 31 C.F.R. § 1010.100(t).
2. Digital asset investment scams are referred to by a range of descriptors including “cryptocurrency confidence
scams,” and “relationship investment scams,” as well as “pig butchering.” See American Bankers Association,
“Cryptocurrency Confidence Scams” (last accessed July 8, 2026); FINRA, “Relationship Investment Scams: What They
Are and Tips to Avoid Them” (May 28, 2025); see also International Criminal Police Organization, “INTERPOL urges
end to ‘Pig Butchering’ term, cites harm to online victims” (Dec. 17, 2024). FinCEN has elected to use the term “digital
asset investment scam.”
3. Treasury, “2026 National Money Laundering Risk Assessment” (“2026 NMLRA”) (Mar. 2026).
4. See FinCEN, “Anti-Money Laundering and Countering the Financing of Terrorism National Priorities” (June 30, 2021).
5. See The White House, Executive Order on Combating Cybercrime, Fraud, and Predatory Schemes Against American
Citizens, 91 Fed. Reg. 12051 (Mar. 6, 2026); The White House, “Fact Sheet: President Donald J. Trump Combats
Cybercrime, Fraud, and Predatory Schemes Against American Citizens” (Mar. 6, 2026).
1
F I N C E N A L E R T
This Alert builds on ongoing efforts by Treasury, the Department of Justice’s (DOJ) interagency
Scam Center Strike Force, law enforcement, and other interagency partners to combat the threat of
TCO-operated scam centers.6 This Alert supplements FinCEN’s September 2023 Alert that provided
behavioral, financial, and technical red flags associated with digital asset investment scams.7
The information in this Alert is derived from FinCEN’s analysis of Bank Secrecy Act (BSA)
reporting, blockchain data, open-source reporting, and information provided by law enforcement.
The Growing Scam Center Threat
Digital asset investment scams are often perpetrated by TCOs based in Southeast Asia and constitute
one of the most significant fraud threats to Americans today. Scam center operators use a variety of
fraud schemes—including investment, romance, and government impersonation scams—to induce
victims to make payments. Scammers commonly initiate contact with victims through social media or
text message, sometimes pretending to have mistyped a phone number.8 Investment scams frequently
exploit enthusiasm around new technologies, such as digital assets and artificial intelligence, to sell
victims on the prospect of outsized returns.9 Scammers may also repeatedly target the same victim with
new scams, including “recovery scams” in which a scammer posing as a government agency, law firm,
or business promises to help the victim recover funds lost to a prior scam.10
6. See, e.g., DOJ, U.S. Attorney’s Office for the District of Columbia, Press Release, “New Scam Center Strike Force
Battles Southeast Asian Crypto Investment Fraud Targeting Americans” (Nov. 12, 2025); DOJ, U.S. Attorney’s Office
for the District of Columbia, Press Release, “Scam Center Strike Force Announces Results of U.S. & Private Industry
‘Disruption Week’” (June 3, 2026); Treasury, Press Release, “Treasury Sanctions Southeast Asian Networks Targeting
Americans with Cyber Scams” (Sept. 8, 2025); Treasury, Press Release, “Treasury Further Dismantles Overseas Scam
Operations Targeting Americans” (June 23, 2026); DOJ, Press Release, “Coordinated Takedown of Scam Centers Leads
to at Least 276 Arrests; Alleged Managers and Recruiters Charged in San Diego” (Apr. 29, 2026); U.S. Department of
State (State), Press Release, “Reward Offer of Up to $10 Million for Information Leading to Financial Disruption of Tai
Chang Scam Centers in Burma” (Apr. 23, 2026).
7. See FinCEN, FIN-2023-Alert005, “FinCEN Alert on Prevalent Virtual Currency Investment Scam Commonly Known
as ‘Pig Butchering’” (“FinCEN Pig Butchering Alert”) (Sept. 8, 2023).
8. See FBI, “Cryptocurrency Investment Fraud” (last accessed July 8, 2026).
9. See U.S. Securities and Exchange Commission, “Artificial Intelligence (AI) and Investment Fraud: Investor Alert”
(Jan. 25, 2024).
10. See Federal Trade Commission, “Refund and Recovery Scams” (Dec. 2023); FBI IC3, “FBI Warns of Scammers
Impersonating the IC3” (Apr. 18, 2025); FBI IC3, “Fictitious Law Firms Targeting Cryptocurrency Scam Victims
Combine Multiple Exploitation Tactics While Offering to Recover Funds” (Aug. 18, 2025).
2
F I N C E N A L E R T
According to the Federal Bureau of Investigation (FBI) Internet Crime Complaint Center (IC3),
reported U.S. victim losses from these digital asset investment scams have skyrocketed from $907
million in 2021 to $7.2 billion in 2025.11 The total annual revenue collected by Southeast Asian scam
centers is estimated in the tens of billions of dollars.12 This growth is fueled in part by corrupt foreign
officials who operate or facilitate networks of scam centers,13 as well as by TCOs’ adoption of
artificial intelligence tools to scale and refine their fraud schemes.14
TCOs operate industrial-scale scam centers in Southeast Asia, primarily in Cambodia, Burma,
and Laos.15 Criminal gangs have trafficked hundreds of thousands of people to these centers,
where victims may have their passports taken to prevent them from leaving and are coerced into
perpetrating online fraud.16 Escaped victims have reported being held captive until ransoms are
paid by their families, beaten for failing to make quotas, and forced into commercial sex work.17
Recently, TCOs have expanded scam center operations beyond Southeast Asia, including to South
Asia, Pacific Islands, Africa, the Middle East, and South America.18
The growth of cyber-enabled scams, including digital asset investment scams, has also driven
the development of a broader ecosystem of ancillary services that facilitate scam operations. As
described below, open-source reporting indicates that guarantee marketplaces serve as one of the
primary venues for the sale of these ancillary services.
11. See FBI IC3, “Internet Crime Report 2022”; FBI IC3, “Internet Crime Report 2025.” FBI uses the term “cryptocurrency
investment fraud” to describe the typology covered by this Alert.
12. See United Nations Office on Drugs and Crime (UNODC), “An Interconnected Criminal Ecosystem: Transnational
Organized Crime Threat Assessment for South-East Asia” (July 2026) (“July 2026 UNODC Report”), at p. 4; UNODC,
“Transnational Organized Crime and the Convergence of Cyber-Enabled Fraud, Underground Banking and Technological
Innovation in Southeast Asia: A Shifting Threat Landscape” (“Oct. 2024 UNODC Report”) (Oct. 2024), at p. 38.
13. See, e.g., Treasury, Press Release, “Treasury Sanctions Cambodian Senator Kok An and Scam Center Network
Defrauding Americans” (Apr. 23, 2026).
14. See July 2026 UNODC Report, supra note 12, at pp. 7–8, 100–101; U.S.-China Economic Security Review Commission
(USCC), “Protecting Americans from China-Linked Scam Centers: An Update on Emerging Trends” (“Mar. 2026
USCC Report”) (Mar. 5, 2026), at pp. 3–4; INTERPOL, “Crime Trend Update: Human Trafficking-Fueled Scam
Centres” (“June 2025 INTERPOL Report”) (June 30, 2025); Chainalysis, “The Chainalysis 2026 Crypto Crime Report”
(“Chainalysis 2026 Crypto Crime Report”) (accessed Mar. 17, 2026), at pp. 28–30; see also FinCEN, FIN-2024-Alert004,
“FinCEN Alert on Fraud Schemes Involving Deepfake Media Targeting Financial Institutions” (Nov. 13, 2024).
15. See 2026 NMLRA, supra note 3, at p. 6; Treasury, Press Release, “Treasury Sanctions Cambodian Senator Kok An and
Scam Center Network Defrauding Americans” (Apr. 23, 2026); Treasury, Press Release, “Treasury Sanctions Burma
Armed Group and Companies Linked to Organized Crime Targeting Americans” (Nov. 12, 2025); Treasury, Press
Release, “U.S. and U.K. Take Largest Action Ever Targeting Cybercriminal Networks in Southeast Asia” (Oct. 14, 2025).
16. See United Nations Human Rights Office of the High Commissioner, “Online Scam Operations and Trafficking into
Forced Criminality in Southeast Asia: Recommendations for a Human Rights Response” (Aug. 23, 2023), at pp. 7, 13–
15; State, “2025 Trafficking in Persons Report: Burma” (2025); State, “2025 Trafficking in Persons Report: Cambodia”
(2025); State, “2025 Trafficking in Persons Report: Laos” (2025).
17. See July 2026 UNODC Report, supra note 12, at pp. 141–162. See also Treasury, Press Release, “Treasury Sanctions
Southeast Asian Networks Targeting Americans with Cyber Scams” (Sept. 8, 2025).
18. See UNODC, “Inflection Point: Global Implications of Scam Centres, Underground Banking, and Illicit Online
Marketplaces in Southeast Asia” (Apr. 2025) (“Apr. 2025 UNODC Report”), at pp. 8–10; June 2025 INTERPOL Report,
supra note 14; Mar. 2026 USCC Report, supra note 14, at pp. 7–8.
3
F I N C E N A L E R T
DOJ Scam Center Strike Force and Treasury Take Major Actions Against
Southeast Asian Scam Centers Targeting Americans19
On April 23, 2026, DOJ announced a series of coordinated actions by the Scam Center Strike
Force against Southeast Asian criminal organizations operating scam centers that have defrauded
Americans of billions of dollars.
The Scam Center Strike Force’s actions included criminal charges against two Chinese nationals
who managed a digital asset investment fraud compound in Burma and attempted to open another
compound in Cambodia, the seizure of a Telegram messaging app channel used to recruit human
trafficking victims to a scam compound in Cambodia in order to operate a law enforcement
impersonation scam, and the seizure of 503 fake investment websites, among other actions.
In a coordinated interagency action, Treasury announced sanctions against Cambodian scam center
operators20 concurrently with the U.S. Department of State announcing rewards for information
leading to the seizure or recovery of proceeds related to the Tai Chang scam center in Burma.21
Guarantee Marketplaces
Guarantee marketplaces are online marketplaces that typically operate as networks of Chinese-
language chat groups on the Telegram messaging platform. Guarantee marketplaces function as
marketing venues and payment infrastructure for vendors, as well as act as trusted intermediaries
between buyers and sellers of services. Guarantee marketplaces also typically hold a buyer’s
payment in escrow until delivery of the agreed-upon good or service is confirmed.22 Guarantee
marketplaces may also offer dispute resolution mechanisms and transaction insurance funded by
vendor deposits. Because they leverage popular mobile phone platforms such as Telegram, along
with features such as chat groups and bots, guarantee marketplaces are also highly convenient and
scalable for illicit actors.23
Guarantee marketplaces are attractive to illicit actors seeking to avoid the formal financial system.
In practice, prominent guarantee marketplaces cater heavily to gray- and black-market activity,24
although marketplaces may disclaim knowledge of and responsibility for their users’ activity.25
19. See DOJ, U.S. Attorney’s Office for the District of Columbia, Press Release, “Scam Center Strike Force Takes Major
Actions Against Southeast Asian Scam Centers Targeting Americans” (Apr. 23, 2026).
20. See Treasury, Press Release, “Treasury Sanctions Cambodian Senator Kok An and Scam Center Network Defrauding
Americans” (Apr. 23, 2026).
21. See State, Press Release, “Reward Offer of Up to $10 Million for Information Leading to Financial Disruption of Tai
Chang Scam Centers in Burma” (Apr. 23, 2026).
22. See, e.g., DOJ, Press Release, “Justice Department Seizes Backend Infrastructure Used by the Huione Group for Money
Laundering Services” (June 23, 2026).
23. See Apr. 2025 UNODC report, supra note 18, at p. 36.
24. See Chainalysis 2026 Crypto Crime Report, supra note 14, at pp. 11–12; RUSI, “Multi-Billion Dollar Guarantee
Marketplaces Exploit Stablecoins for Scams,” by Tom Robinson (“RUSI Report”) (May 19, 2026); Apr. 2025 UNODC
Report UNODC, supra note 18, at pp. 42–46.
25. See e.g., FinCEN, “Imposition of Special Measure Regarding Huione Group, as a Foreign Financial Institution of
Primary Money Laundering Concern,” 90 Fed. Reg. 48295 (Oct. 16, 2025) (“Huione Final Rule”), at p. 48298; Oct. 2024
UNODC Report, supra note 12, at p. 81.
4
F I N C E N A L E R T
According to FinCEN analysis and open-source information, specialized illicit services available on
guarantee marketplaces include money laundering services, online social media account creation and
verification, social media targeting, and mass phishing services.26 Messaging platforms leveraged
by guarantee marketplaces may remove content that is illegal under a particular jurisdiction’s laws
or violates the platform’s terms of service. However, absent ongoing action by administrators,
guarantee marketplaces can quickly reconstitute after takedowns simply by creating new chat groups
and other online infrastructure.27
Scam center operators rely on professional money launderers (PMLs)—in particular, Chinese money
laundering networks (CMLNs), which in turn exploit extensive gray-market funds transfer networks
known as Chinese underground banking systems.28 By performing an intermediary function
between these PMLs and scam center operators, guarantee marketplaces have enabled rapid growth
and specialization in the multibillion-dollar Southeast Asian cybercrime ecosystem. In particular,
guarantee marketplaces enable scam center operators to arrange transactions with CMLNs.29
FinCEN Actions Targeting Guarantee Marketplaces30
On October 14, 2025, FinCEN issued a final rule pursuant to Section 311 of the USA PATRIOT
Act severing Cambodia-based Huione Group from the U.S. financial system. That rule prohibits
covered financial institutions from opening or maintaining correspondent accounts for, or on behalf
of, Huione Group. It also requires them to take reasonable steps to not process transactions for the
correspondent account of a foreign banking institution in the United States if such a transaction
involves Huione Group, preventing indirect access by Huione Group to the U.S. financial system.
Huione Group’s extensive digital asset services and its online marketplace, Haowang Guarantee,
had made Huione Group a “one stop shop” for criminals to launder digital assets obtained through
illicit activities. Of the $4 billion worth of illicit proceeds Huione Group laundered between August
2021 and January 2025, FinCEN found that Huione Group laundered at least $300 million worth of
digital assets from other cyber scams, including digital assets stemming from DPRK cyber heists and
virtual currency investment scams.
26. See also Apr. 2025 UNODC Report, supra note 18, at pp. 10–11.
27. See Wired, “Telegram Purged Chinese Crypto Scam Markets—Then Watched as They Rebuilt,” by Andy Greenberg
(June 23, 2025); Elliptic, “Elliptic data leads to the shutdown of the two largest online criminal marketplaces of
all time” (May 14, 2025); Recorded Future, “Evolution of Chinese-Language Guarantee Telegram Marketplaces”
(“Recorded Future Report”) (Apr. 22, 2026); RUSI Report, supra note 24.
28. Over the past decade, CMLNs have become the dominant PMLs for TCOs around the world. See NMLRA, supra note
3, pp. 25–27; FinCEN, FIN-2025-A003, “FinCEN Advisory on the Use of Chinese Money Laundering Networks by
Mexico-Based Transnational Criminal Organizations to Launder Illicit Proceeds” (Aug. 28, 2025); FinCEN, Financial
Trend Analysis, “Chinese Money Laundering Networks: 2020 - 2024 Threat Pattern & Trend Information” (Aug. 2025).
29. See Oct. 2024 UNODC Report, supra note 12, at pp. 65–67; Apr. 2025 UNODC Report, supra note 18, at pp. 42–46; Global
China Pulse, “Moving Bricks: Money-Laundering Practices in the Online Scam Industry,” by Yanyu Chen (Sept. 24,
2024); Chainalysis 2026 Crypto Crime Report, supra note 14, pp. 9–13; Recorded Future Report, supra note 27.
30. See FinCEN, Press Release, “FinCEN Issues Final Rule Severing Huione Group from the U.S. Financial System”
(Oct. 14, 2025).
5
F I N C E N A L E R T
The risks presented by Huione Group’s association with illicit actors and transactions linked to
illicit activity were compounded by either the absence of, or ineffective, AML/Know Your Customer
(KYC) policies and procedures among Huione Group’s components. In September 2024, Huione
Group launched a stablecoin, USDH, that it explicitly advertised as “unfreezable” and “not
restricted by traditional regulatory agencies.”31
On June 23, 2026, FinCEN issued a proposed rule to amend the October 2025 final rule to include
Cambodia-based H-Pay Service PLC (H-Pay) and other successor entities of Huione Group within
the scope of the October 2025 final rule. FinCEN assessed in its proposed rule that Huione Group
transitioned operations from Huione Pay PLC to H-Pay in an effort to evade public scrutiny and
circumvent the special measure imposed by the final rule.32
How Scam Center Operators Launder Scam Proceeds
According to FinCEN analysis, scam proceeds move from victims to scam center operators in
several broad stages:
1. Scammers extract payments from victims, often in the form of digital assets.
2. Illicitly obtained digital assets undergo on-chain laundering (i.e. blockchain transactions that
have the effect of obfuscating the connection between the illicit proceeds and their origin).
3. Money laundering operations convert proceeds into fiat currency and integrate them into the
traditional financial system.
Scam center operations frequently only handle communication with the victim. Operators
outsource creating the infrastructure necessary to move funds—including establishing financial
institution accounts and front companies—and the movement of funds to PMLs, relationships often
facilitated by guarantee marketplaces.
Stage One: Victim Payments
As noted above, scammers use a variety of ruses to sway victims into making payments, including
promising large returns on investments and pretending to be government officials. Regardless of
the underlying fraud scheme, scammers often induce victims to make payments in digital assets,
although payments in fiat currency are common and payments via precious metals have been
reported by law enforcement.
Most digital asset payments by victims to scam center operators originate from money services
businesses (MSBs) offering digital asset services, including digital asset kiosks, according to
31. See FinCEN, “Imposition of Special Measure Regarding Huione Group, as a Foreign Financial Institution of Primary
Money Laundering Concern,” 90 Fed. Reg. 48295 (Oct. 16, 2025).
32. See FinCEN, Notice of Proposed Rulemaking, “Definition of Huione Group, a Financial Institution Operating Outside
the United States of Primary Money Laundering Concern,” 91 Fed. Reg. 38340 (June 27, 2026). DOJ concurrently
announced the seizure of a cloud computing account used by subsidiaries of the Huione Group to host backend
infrastructure. See DOJ, Press Release, “Justice Department Seizes Backend Infrastructure Used by the Huione Group
for Money Laundering Services” (June 23, 2026).
6
F I N C E N A L E R T
FinCEN analysis and law enforcement information.33 Based on FinCEN’s analysis of BSA
reporting, scammers often instruct their victims to open accounts with MSBs offering digital asset
services to purchase specific types of digital assets. Then, the victim is told to send these funds to a
digital asset address controlled by the scammers.34
Another tactic used by scammers is directing victims to send fiat currency-denominated funds
through a wire transfer or Automated Clearing House transaction to another, fiat-denominated
financial account controlled by the scammer. To facilitate these fiat payments, scammers and
associated PMLs have created infrastructure in the United States, including bank accounts
controlled by the scammers and associated PMLs via money mules,35 as well as shell companies.36
Additionally, in some cases, scammers and associated PMLs have created fraudulent MSBs used to
collect victims’ funds. Scammers have been known to register these fraudulent MSBs with FinCEN
and use that self-registration to appear legitimate or otherwise gain credibility.37
After receiving fiat-denominated funds from victims, scammers and associated PMLs will often
convert those funds to digital assets.38 For example, the scammers and associated PMLs may
transfer those funds to an MSB or other financial institution offering fiat-to-digital asset swaps and
convert the proceeds to stablecoins for further laundering.39
Scammers are also known to ask victims to conduct fiat-denominated international bank transfers.
Although scam center operations are concentrated in Southeast Asia, data collected through
FinCEN’s Rapid Response Program (RRP)40 International Financial Fraud Kill Chain indicates
that bank accounts receiving proceeds from victims of cyber-enabled fraud are located in a wide
range of foreign jurisdictions. Because fraud proceeds are typically laundered through multiple
transactions, the jurisdiction of these initial transactions does not necessarily correspond to the
ultimate destination of the proceeds.
33. See FinCEN Pig Butchering Alert, supra note 7; FinCEN, FIN-2025-NTC1, “FinCEN Notice on the Use of Convertible
Virtual Currency Kiosks for Scam Payments and Other Illicit Activity” (“CVC Kiosk Notice”) (Aug. 4, 2025).
34. See FinCEN, Financial Trend Analysis, “Digital Asset Investment Scams: 2023-2025 Threat Pattern & Trend
Information” (“Digital Asset Investment Scams Financial Trend Analysis”) (Sep. 3, 2026)
35. A money mule is someone who transfers or moves illegally acquired money on behalf of someone else. See FBI,
“Money Mules” (last accessed May 18, 2026)
36. Shell companies are legal business entities that have no physical presence, have few or no employees, and generate
little to no independent economic value. See 2026 NMLRA, supra note 3, at p. 59.
37. See FinCEN, FIN-2024-Alert005, “FinCEN Alert on Fraud Schemes Abusing FinCEN’s Name, Insignia, and Authorities
for Financial Gain” (Dec. 18, 2024).
38. See Digital Asset Investment Scams Financial Trend Analysis, supra note 34.
39. See, e.g., DOJ, Press Release, “Five Men Plead Guilty for Their Roles in Global Digital Asset Investment Scam
Conspiracy Resulting in Theft of More than $36.9 Million from Victims” (June 9, 2025).
40. RRP is a partnership between FinCEN, U.S. law enforcement, and foreign partners working together to help victims
and their financial institutions recover stolen funds sent abroad as the result of cyber-enabled fraud.
7
F I N C E N A L E R T
Figure 1: Initial Destination of ACH Transfers in RRP Cyber Scam Cases, Oct. 2024 – June 2026.41
Initial Destination of ACH Transfers in RRP
Region
Cyber Scam Cases
The Americas $113,157,126.32
Asia and Pacific $385,952,451.65
Europe $145,732,317.57
Middle East and North Africa $101,744,207.65
Sub-Saharan Africa $5,079,764.62
Figure 2: Initial Destination of ACH Transfers in RRP Cyber Scam Cases (by Region), Oct. 2024 – June 2026
According to law enforcement, scammers have also directed victims to purchase gold coins or bars.
Couriers working on behalf of the scammers and associated PMLs then pick up and transport the
gold. Scammers are also known to direct victims to purchase gift cards.42
Stage Two: On-Chain Laundering
When PMLs obtain digital assets from victims or as part of the laundering process, they use on-
chain techniques that obfuscate the illicit origin of the funds. These techniques include rapid
movement of funds through multiple digital asset addresses, comingling of funds in consolidation
wallets, use of mixers and tumblers, and swaps across multiple blockchains and digital assets.43
41. Hong Kong is grouped with the People’s Republic of China for purposes of this chart.
42. See U.S. Immigrations and Customs Enforcement, “Tackling the Rise in Gift Card Fraud” (last accessed July 17, 2026).
43. See Asia-Pacific Group on Money Laundering, “Cyber Scam Hubs and Human Trafficking” (May 2026), at pp. 29–30;
Financial Action Task Force (FATF), “Illicit Financial Flows from Cyber-Enabled Fraud” (2023), at p. 23.
8
F I N C E N A L E R T
According to law enforcement and FinCEN analysis of blockchain data, PMLs frequently use
decentralized finance (DeFi) protocols to transfer fraud proceeds across blockchains, such as
by swapping USDT tokens originating from scams from the Ethereum blockchain to the Tron
blockchain. PMLs also swap digital assets into stablecoins through DeFi protocols because
stablecoins can be easily used on guarantee marketplaces due to their widespread global
acceptance and perceived stability, among other reasons.44
Stage Three: Integration of Scam Proceeds into the Formal Financial System
PMLs integrate scam proceeds into the formal financial system through networks of money mules
and through stablecoin transfers to digital asset exchanges outside of the United States. Much of
this activity is facilitated by Chinese underground banking systems, which include peer-to-peer
exchangers45 and over-the-counter (OTC) brokers46 that operate outside of the formal financial
system and generally lack robust KYC and AML/CFT controls. Guarantee marketplaces connect
cybercriminal networks with these underground banking services.47 According to FinCEN
analysis, these services typically rely on the liquidity provided by large MSBs in the digital asset
sector to process transactions.48
Red Flag Indicators of Money Laundering Activity Related to
Digital Asset Investment Scam Centers
FinCEN has identified the following red flag indicators to help financial institutions detect,
prevent, and report potentially suspicious activity related to scam centers. Because no single red
flag is determinative of illicit or other suspicious activity, financial institutions should consider the
surrounding facts and circumstances, such as a customer’s historical financial activity, whether
the transactions are in line with prevailing business practices, and whether the customer exhibits
multiple related red flags, before determining if a transaction or attempted transaction is indicative
of money laundering activity associated with scam centers or is otherwise suspicious. In addition
to the red flags below, financial institutions should also be aware of the red flags discussed in
FinCEN’s 2023 alert on digital asset investment scams and 2025 alert on the use of digital asset
kiosks for scam payments.49
44. See Chainalysis 2026 Crypto Crime Report, supra note 14, at pp. 11–12; RUSI Report, supra note 24.
45. P2P exchangers are individuals or entities that offer to exchange fiat currencies for digital assets and typically operate
informally. See FinCEN, FIN-2019-A003, “Advisory on Illicit Activity Involving Convertible Virtual Currency”
(May 9, 2019).
46. For additional information on the use of OTC brokers by illicit actors, see 2026 NMLRA, supra note 3, at pp. 49–50.
47. See Oct. 2024 UNODC Report, supra note 12, at pp. 80–87.
48. Exchanges that offer trading services and pool customer deposits into an account hosted by a larger exchange
are referred to as “nested exchanges.” Nested exchanges may operate fully or partially within the infrastructure
of the host provider, rather than as a unique entity, potentially providing illicit actors with an additional layer of
obfuscation. See 2026 NMLRA, supra note 3, at p. 51.
49. See FinCEN Pig Butchering Alert, supra note 7; FinCEN CVC Kiosk Notice, supra note 33.
9
F I N C E N A L E R T
Red Flags Related to Victim Payments to Digital Asset Investment Scam Centers
A customer states that they were directed by a purported representative of law enforcement or
a government agency to make a payment using digital assets, to conduct an international wire
transfer, or to purchase precious metals or gift cards.
• Financial institutions may consider providing consumers information on scams.50
A customer states that a payment is intended to retain a law firm or other entity to recover
funds lost to fraud but lacks documentation demonstrating that the service is legitimate.
A customer withdraws funds from an investment or retirement account to purchase gold from a
precious metals dealer and indicates that they have been instructed to hand the gold to a courier.
Open-source information shows that an MSB receiving customer funds has claimed to be
“approved by FinCEN.”
Open-source information shows that a digital asset exchange receiving customer funds is
advertising services “with no KYC” or a lack of compliance measures.
Red Flags Related to Guarantee Marketplaces
A customer conducts transactions involving a digital asset token issued by or associated with
a guarantee marketplace and fails to provide documentation regarding the source of funds.
Open-source information indicates that a payment service provider operating a guarantee
marketplace changed its name, branding, website, or other features of its public presentation
in an apparent attempt to mask its association with a guarantee marketplace that has been
subject to law enforcement action, takedowns by service providers, or negative news.
A customer of a digital asset exchange transacts with an unattributed cluster of digital asset
addresses, which blockchain analysis flags as sharing blockchain infrastructure with a known
guarantee marketplace.
Blockchain analysis indicates that a customer has transacted directly or indirectly with a
digital asset address attributed to a guarantee marketplace and the transactions have no
apparent economic, business, or lawful purpose.
A payment service provider that offers digital asset exchange services appears to operate
in Burma, Cambodia, or Laos, and appears to take measures to obfuscate its location or
corporate structure.
50. See, e.g., ABA Foundation, “Crypto Investment Scams” (Sept. 11, 2024); Federal Trade Commission, “How to Avoid a
Scam” (July 2023). When consumers are informed about specific types of scams and understand perpetrators’ tactics,
they are more likely to recognize a scam and are less likely to engage with a perpetrator or lose money.
See Board of Governors of the Federal Reserve System, Consumer Financial Protection Bureau, Federal Deposit
Insurance Corporation, FinCEN, National Credit Union Administration, Office of the Comptroller of the Currency,
State Financial Regulators, “Interagency Statement on Elder Financial Exploitation” (Dec. 2024), at p. 8.
10
F I N C E N A L E R T
Red Flags Related to Laundering Techniques Associated with Digital Asset Investment Scam Centers
A customer of a digital asset exchange receives stablecoin transactions that originate from
centralized digital asset exchanges that operate in the United States and undergo transaction
patterns associated with on-chain laundering techniques.
Open-source information indicates that a digital asset address used by a customer was posted on
a messaging platform in proximity to Chinese-language terms related to money laundering.
A customer of a DeFi service receives deposits from a wallet that aggregates suspected
scam proceeds and uses the DeFi service to move the proceeds into a different digital asset
or blockchain.
A customer conducts substantial transactions using a stablecoin whose issuer advertises that it
does not cooperate with law enforcement or that its stablecoin cannot be seized or frozen.
A customer of a digital asset exchange appears to be using liquidity provided by the digital
asset exchange to execute large numbers of offsetting transactions consistent with operation as
an OTC broker or P2P exchanger.
A customer receives stablecoin deposits from a DeFi service that lacks AML/CFT controls,
converts the funds to fiat currency, and withdraws the proceeds.
Financial institutions filing Suspicious Activity Reports (SARs) related to scam centers should
reference this Alert in SAR field 2 (Filing Institution Note to FinCEN) and the narrative by
including the key term “FIN-2026-SCAMCENTERS.”
When submitting a report pursuant to this Alert, financial institutions should include any relevant
technical cyber indicators related to cyber events and associated transactions within the available
structured cyber event indicator fields on the SAR form or as part of the attachment field. Any
data or information that helps identify the activity as suspicious can be included as an indicator.
Examples include chat logs, phone numbers, and social media usernames used by the scammer;
suspicious email addresses; type of virtual currency and digital assets involved; virtual currency
and/or digital asset addresses and transaction hashes native to the blockchain(s) involved; apps
used; and the URL, domain, and IP address of the service the victim was instructed to deposit into.
Financial institutions should also include as much detail about the scam center activity as possible,
including any suspected nexus to a politically exposed person, geographic region or location, or
transnational criminal organization. Financial institutions should also include the names and
identifying information of any service providers connected to the suspected scam center activity,
such as providers of financial, internet, or corporate services.
In addition to filing a SAR, financial institutions are encouraged to refer their customers who may
be victims of cyber-enabled scams to the FBI’s IC3: https://www.ic3.gov/, and/or contact the nearest
U.S. Secret Service field office (http://www.secretservice.gov/contact/field-offices).
11
F I N C E N A L E R T
Reminder of Relevant BSA Obligations and Tools
for U.S. Financial Institutions
Suspicious Activity Reporting
Other Relevant BSA Reporting
Suspicious Activity Reporting
A financial institution is required to file a SAR if it knows, suspects, or has reason to suspect a
transaction conducted or attempted by, at, or through the financial institution involves funds
derived from illegal activity; is intended or conducted to disguise funds derived from illegal activity;
is designed to evade regulations promulgated under the BSA; lacks a business or apparent lawful
purpose; or involves the use of the financial institution to facilitate criminal activity.51 All statutorily
defined financial institutions may voluntarily report suspicious transactions under the existing
suspicious activity reporting safe harbor.52
When a financial institution files a SAR, it is required to maintain a copy of the SAR and the original
or business record equivalent of any supporting documentation for a period of five years from
the date of filing the SAR.53 Financial institutions must provide any requested documentation
supporting the filing of a SAR upon request by FinCEN or an appropriate law enforcement or
supervisory agency.54 When requested to provide supporting documentation, financial institutions
should take special care to verify that a requestor of information is, in fact, a representative of
FinCEN or an appropriate law enforcement or supervisory agency. A financial institution should
incorporate procedures for such verification into its BSA compliance or AML program. These
procedures may include, for example, independent employment verification with the requestor’s
field office or face-to-face review of the requestor’s credentials.
SAR Filing Instructions
SARs, and compliance with other BSA requirements, are crucial to identifying and stopping scam
center activity. FinCEN requests that financial institutions indicate a connection between the
suspicious activity being reported and the activities highlighted in this Alert by including the key
term “FIN-2026-SCAMCENTERS” in SAR field 2 (Filing Institution Note to FinCEN), as well as
in the narrative and selecting “Fraud-Other” under SAR field 34(z) with the description “Scam
Centers” in the text box. Financial institutions may highlight additional advisory, alert, or notice
keywords in the narrative, if applicable.
51. See 31 C.F.R. §§ 1020.320, 1021.320, 1022.320, 1023.320, 1024.320, 1025.320, 1026.320, 1029.320, 1030.320.
52. See 31 U.S.C. § 5318(g)(3); see, e.g., 31 C.F.R. § 1020.320(f). Financial institutions may report suspicious transactions
regardless of amount involved and still take advantage of the safe harbor.
53. See 31 C.F.R. §§ 1020.320(d), 1021.320(d), 1022.320(c), 1023.320(d), 1024.320(c), 1025.320(d), 1026.320(d), 1029.320(c),
1030.320(c).
54. Id.; see also FinCEN, FIN-2007-G003, “Suspicious Activity Report Supporting Documentation” (June 13, 2007).
12
F I N C E N A L E R T
Financial institutions should select SAR Field 34(z) (Fraud – Other) and include the term “Scam
Centers” in the text box, as well as any other applicable check box. Financial institutions also should
select all other relevant suspicious activity fields, such as those in SAR fields 36 (Money Laundering)
and 38 (Other Suspicious Activities), if applicable.
Financial institutions should include all available information relating to the account(s) and
location(s) involved in the reported activity, identifying information and descriptions of any legal
entities or arrangements involved and associated beneficial owners, and any information about
related persons or entities involved in the activity. Financial institutions also should provide all
available information regarding other domestic and foreign financial institutions involved in the
activity; where appropriate, financial institutions should consider filing a SAR jointly on shared
suspicious activity.55
Financial institutions are required to file complete and accurate reports that incorporate all
relevant information available. In situations involving violations requiring immediate attention,
such as ongoing money laundering schemes, a financial institution should also immediately
notify, by telephone, an appropriate law enforcement authority, in addition to filing a timely
SAR.56 Immediate notification to law enforcement is especially important in situations
involving suspected terrorist activity, as terrorists and terrorist organizations often rely on the
international financial system to acquire funding to sustain and finance their operations and
engage in acts of terrorism.
Financial institutions wanting to report suspicious transactions that may potentially relate to
terrorist activity should call the Financial Institutions Toll-Free Hotline at (866) 556-3974
(7 days a week, 24 hours a day).57
Other Relevant BSA Reporting Requirements
Financial institutions and other entities or persons may also have other relevant BSA reporting
requirements to provide information in connection with the subject of this Alert. These include
obligations related to the Currency Transaction Report (CTR),58 Report of Cash Payments
55. See 31 C.F.R. §§ 1020.320(e)(1)(ii)(A)(2)(i), 1021.320(e)(1)(ii)(A)(2), 1022.320(d)(1)(ii)(A)(2), 1023.320(e)(1)(ii)(A)(2)(i),
1024.320(a)(3), 1024.320(d)(1)(ii)(A)(2), 1025.320(a)(3)(ii), 1025.320(e)(1)(ii)(A)(2), 1026.320(e)(1)(ii)(A)(2)(i), 1029.320(a)
(3), 1029.320(d)(1)(ii)(A)(2), 1030.320(a)(3), 1030.320(d)(1)(ii)(A)(2).
56. See, e.g., 31 C.F.R. §§ 1020.320(b)(3), 1022.320(b)(3), 1023.320(b)(3).
57. The purpose of the hotline is to expedite the delivery of this information to law enforcement. Financial institutions
should immediately report any imminent threat to appropriate law enforcement officials. In considering whether
particular activity may relate to terrorist or terrorist financing activity, FinCEN reminds financial institutions that
State designated certain Cartels as FTOs and SDGTs.
58. A report of each deposit, withdrawal, exchange of currency, or other payment or transfer, by, through, or to a
financial institution that involves a transaction in currency of more than $10,000. Multiple transactions may be
aggregated when determining whether the reporting threshold has been met. See 31 C.F.R. §§ 1010.310–13, 1020.310–
13, 1021.310–13, 1022.310–13, 1023.310–13, 1024.310–13, 1026.310–13.
13
F I N C E N A L E R T
Over $10,000 Received in a Trade or Business (Form 8300),59 Report of Foreign Bank and
Financial Accounts (FBAR),60 Report of International Transportation of Currency or Monetary
Instruments (CMIR),61 Registration of Money Services Business (RMSB),62 and Designation of
Exempt Person (DOEP).63
Form 8300 Filing Instructions
When filing a Form 8300 involving a suspicious transaction relevant to this supplemental Alert,
FinCEN requests that the filer selects Box 1b (“suspicious transaction”) and includes the key
term “FIN-2026-SCAMCENTERS” in the “Comments” section of the report.
Due Diligence
Banks, brokers or dealers in securities, mutual funds, and futures commission merchants
and introducing brokers in commodities (FCM/IBs) are required to have appropriate risk-
based procedures for conducting ongoing customer due diligence that include, but are not
limited to: (i) understanding the nature and purpose of customer relationships for the purpose
of developing a customer risk profile; and (ii) conducting ongoing monitoring to identify
and report suspicious transactions and, on a risk basis, to maintain and update customer
information.64 Covered financial institutions are required to identify and verify the identity
of beneficial owners of legal entity customers, subject to certain exclusions and exemptions.65
Among other things, this facilitates the identification of legal entities that may be owned or
controlled by foreign politically exposed persons (PEPs).
Senior foreign political figures and due diligence obligations for
private banking accounts
In addition to these due diligence obligations, under section 312 of the USA PATRIOT Act
(31 U.S.C. § 5318(i)) and its implementing regulations, covered financial institutions must
implement due diligence programs for private banking accounts held for non-U.S. persons that
59. A report filed by a trade or business that receives currency in excess of $10,000 in one transaction or two or more
related transactions. The transactions are required to be reported on a joint FinCEN/Internal Revenue Service form
when not otherwise required to be reported on a CTR. See 31 C.F.R. §§ 1010.330–31. A Form 8300 also may be filed
voluntarily for any suspicious transaction, even if the total amount does not exceed $10,000.
60. A report filed by a U.S. person that has a financial interest in, or signature or other authority over, foreign financial
accounts with an aggregate value exceeding $10,000 at any time during the calendar year. See 31 C.F.R. §§
1010.350,1010.360(c); FinCEN Form 114.
61. A form filed to report the transportation of more than $10,000 in currency or other monetary instruments into or out
of the United States. See 31 C.F.R. § 1010.340.
62. A form filed to register a money services business (MSB) with FinCEN, or to renew such a registration. See 31 C.F.R. §
1022.380.
63. A report filed by banks to exempt certain customers from currency transaction reporting requirements. See 31 C.F.R.
§ 1020.315.
64. See 31 C.F.R. §§ 1020.210(a)(2)(v), 1023.210(b)(5), 1024.210(b)(6), 1026.210(b)(5).
65. See 31 C.F.R. §§ 1010.230, 1010.605(e)(1) (defining “covered financial institution”).
14
F I N C E N A L E R T
are designed to detect and report any known or suspected money laundering or suspicious
activity conducted through or involving such accounts.66 Covered financial institutions must
establish risk-based controls and procedures for ascertaining the identities of nominal and
beneficial owners of such accounts and ascertaining whether any of these owners are senior
foreign political figures, and for conducting enhanced scrutiny on accounts held by senior
foreign political figures that is reasonably designed to detect and report transactions that may
involve the proceeds of foreign corruption.67
AML/CFT program and correspondent account due diligence requirements
Financial institutions are reminded of AML/CFT program requirements,68 and covered
financial institutions are reminded of correspondent account due diligence requirements under
Section 312 of the USA PATRIOT Act (31 U.S.C. § 5318(i)) and implementing regulations.69 As
described in FinCEN Interpretive Release 2004-1, the AML/CFT program of a money services
business (MSB) must include risk-based policies, procedures, and controls designed to identify
and minimize risks associated with foreign agents and counterparties.70
Information Sharing
Information sharing between and among financial institutions is critical to identifying,
reporting, and preventing illicit activity, including fraud and scams. Under the safe harbor
from liability provided by section 314(b) of the USA PATRIOT Act, financial institutions may
share information with other eligible financial institutions regarding activities that may involve
possible terrorist activity or money laundering, including information about fraud and other
specified unlawful activities.71 FinCEN strongly encourages financial institutions to participate
in this voluntary program as information sharing between and among financial institutions can
assist financial institutions in managing illicit financing risks and can ultimately provide the
government with highly useful information to identify and prevent financial crime. Given the
transnational nature of illicit activity, FinCEN encourages U.S. financial institutions to use, and
expand, their processes to collect and share information with foreign financial institutions to
further investigations involving cross-border activity.72
66. See 31 C.F.R. § 1010.620. The definition of “covered financial institution” is found in 31 C.F.R. § 1010.605(e)(1). The
definition of “private banking account” is found in 31 C.F.R. § 1010.605(m). The definition of “non-U.S. person” is
found in 31 C.F.R. § 1010.605(h).
67. See 31 C.F.R. § 1010.620(c).
68. See 31 C.F.R. §§ 1010.210, 1020.210, 1021.210, 1022.210, 1023.210, 1024.210, 1025.210, 1026.210, 1027.210, 1028.210,
1029.210, 1030.210.
69. See 31 C.F.R. § 1010.610.
70. See FinCEN, Interpretive Release 2004-1, Anti-Money Laundering Program Requirements for Money Services
Businesses with Respect to Foreign Agents or Foreign Counterparties, 69 FR 74,439 (Dec. 14, 2004); see also FinCEN,
FIN-2016-G001, “Guidance on Existing AML Program Rule Compliance Obligations for MSB Principals with Respect
to Agent Monitoring” (Mar. 11, 2016).
71. See 31 C.F.R. § 1010.540; see also FinCEN, “Section 314(b) Fact Sheet” (June 12, 2026).
72. See FinCEN, FIN-2025-G001, “Cross-Border Information Sharing by Financial Institutions and SAR Confidentiality”
(Sept. 5, 2025).
15
F I N C E N A L E R T
The section 314(b) program provides financial institutions with the flexibility and connectivity
needed to counter threats and prevent illicit actors from exploiting gaps between institutions.
Among other things, information sharing pursuant to section 314(b) allows financial institutions
to respond to threats—activities a financial institution suspects may involve possible terrorist
activity or money laundering, such as fraud and other criminal activity—that are carried out by
repeat actors moving across financial institutions to evade detection.
For additional information, see FinCEN’s Section 314(b) Fact Sheet.
FinCEN’s Whistleblower Program
FinCEN maintains a whistleblower incentive program for violations of the BSA and certain
national security laws such as the International Emergency Economic Powers Act (IEEPA).
Individuals located in the United States or abroad who provide information may be eligible
for awards if the information they provide leads to a successful enforcement action that results
in monetary penalties exceeding $1,000,000 and the statutory requirements in 31 U.S.C. § 5323
are otherwise met. Under 31 U.S.C. § 5323, there are certain confidentiality protections to
individuals submitting information as well as certain protections from retaliation by employers.
Individuals may also choose to submit information anonymously to FinCEN, including
through an attorney. FinCEN is currently accepting whistleblower tips and encourages those
with knowledge of potential violations to contact FinCEN. To learn more about FinCEN’s
Whistleblower Program, visit https://www.fincen.gov/whistleblower-program.
For Further Information
FinCEN’s website at www.fincen.gov contains information on how to register for FinCEN Updates.
Questions or comments regarding the contents of this Alert should be addressed to the FinCEN
Regulatory Support Section by submitting an inquiry at www.fincen.gov/contact.
The mission of the Financial Crimes Enforcement Network is to safeguard
the financial system from illicit use, counter money laundering and
the financing of terrorism, and promote national security through
strategic use of financial authorities and the collection, analysis, and
dissemination of financial intelligence.
16