FinCEN Alert on Money Laundering Activity Associated with Digital Asset Investment Scam Centers

1

1. See 31 U.S.C. § 5312(a)(2); 31 C.F.R. § 1010.100(t).
2. Digital asset investment scams are referred to by a range of descriptors including “cryptocurrency confidence scams,” and “relationship investment scams,” as well as “pig butchering.” See American Bankers Association, “Cryptocurrency Confidence Scams” (last accessed July 8, 2026); FINRA, “Relationship Investment Scams: What They Are and Tips to Avoid Them” (May 28, 2025); see also International Criminal Police Organization, “INTERPOL urges end to ‘Pig Butchering’ term, cites harm to online victims” (Dec. 17, 2024). FinCEN has elected to use the term “digital asset investment scam.”
3. Treasury, “2026 National Money Laundering Risk Assessment” (“2026 NMLRA”) (Mar. 2026).
4. See FinCEN, “Anti-Money Laundering and Countering the Financing of Terrorism National Priorities” (June 30, 2021).
5. See The White House, Executive Order on Combating Cybercrime, Fraud, and Predatory Schemes Against American Citizens, 91 Fed. Reg. 12051 (Mar. 6, 2026); The White House, “Fact Sheet: President Donald J. Trump Combats Cybercrime, Fraud, and Predatory Schemes Against American Citizens” (Mar. 6, 2026). FIN-2026-Alert005 September 3, 2026 FinCEN Alert on Money Laundering Activity Associated with Digital Asset Investment Scam Centers The U.S. Department of the Treasury’s (Treasury) Financial Crimes Enforcement Network (FinCEN) is issuing this Alert to urge financial institutions1 to be vigilant in detecting, identifying, and reporting suspicious activity connected to the operation of digital asset investment scam centers and the laundering of associated illicit proceeds. Transnational criminal organizations (TCOs)—predominantly in Southeast Asia—operate these scam centers, which target individuals, including numerous Americans, with digital asset investment scams and other fraud schemes.2 A vast illicit ecosystem, which includes online marketplaces for cybercrime and money laundering-related services and artificial intelligence￾supported software platforms, enables scam centers’ operations. Fraud continues to be one of the largest sources of illicit proceeds in the United States, according to Treasury’s 2026 National Money Laundering Risk Assessment.3 Fraud and cybercrime are two of FinCEN’s Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) National Priorities.4 On March 6, 2026, President Trump issued Executive Order 14390, Combating Cybercrime, Fraud, and Predatory Schemes Against American Citizens, declaring that it is the policy of the United States to protect Americans from, and harden our financial and digital systems against, these threats.5 Suspicious Activity Report (SAR) Filing Request: FinCEN requests that financial institutions reference this Alert in SAR field 2 (Filing Institution Note to FinCEN) and the narrative by including the key term “FIN-2026- SCAMCENTERS” and selecting “Fraud-Other” under SAR field 34(z) with the description “Scam Centers” in the text box.

FINCEN ALERT 2 This Alert builds on ongoing efforts by Treasury, the Department of Justice’s (DOJ) interagency Scam Center Strike Force, law enforcement, and other interagency partners to combat the threat of TCO-operated scam centers.6 This Alert supplements FinCEN’s September 2023 Alert that provided behavioral, financial, and technical red flags associated with digital asset investment scams.7 The information in this Alert is derived from FinCEN’s analysis of Bank Secrecy Act (BSA) reporting, blockchain data, open-source reporting, and information provided by law enforcement. The Growing Scam Center Threat Digital asset investment scams are often perpetrated by TCOs based in Southeast Asia and constitute one of the most significant fraud threats to Americans today. Scam center operators use a variety of fraud schemes—including investment, romance, and government impersonation scams—to induce victims to make payments. Scammers commonly initiate contact with victims through social media or text message, sometimes pretending to have mistyped a phone number.8 Investment scams frequently exploit enthusiasm around new technologies, such as digital assets and artificial intelligence, to sell victims on the prospect of outsized returns.9 Scammers may also repeatedly target the same victim with new scams, including “recovery scams” in which a scammer posing as a government agency, law firm, or business promises to help the victim recover funds lost to a prior scam.10 6. See, e.g., DOJ, U.S. Attorney’s Office for the District of Columbia, Press Release, “New Scam Center Strike Force Battles Southeast Asian Crypto Investment Fraud Targeting Americans” (Nov. 12, 2025); DOJ, U.S. Attorney’s Office for the District of Columbia, Press Release, “Scam Center Strike Force Announces Results of U.S. & Private Industry ‘Disruption Week’” (June 3, 2026); Treasury, Press Release, “Treasury Sanctions Southeast Asian Networks Targeting Americans with Cyber Scams” (Sept. 8, 2025); Treasury, Press Release, “Treasury Further Dismantles Overseas Scam Operations Targeting Americans” (June 23, 2026); DOJ, Press Release, “Coordinated Takedown of Scam Centers Leads to at Least 276 Arrests; Alleged Managers and Recruiters Charged in San Diego” (Apr. 29, 2026); U.S. Department of State (State), Press Release, “Reward Offer of Up to $10 Million for Information Leading to Financial Disruption of Tai Chang Scam Centers in Burma” (Apr. 23, 2026). 7. See FinCEN, FIN-2023-Alert005, “FinCEN Alert on Prevalent Virtual Currency Investment Scam Commonly Known as ‘Pig Butchering’” (“FinCEN Pig Butchering Alert”) (Sept. 8, 2023). 8. See FBI, “Cryptocurrency Investment Fraud” (last accessed July 8, 2026). 9. See U.S. Securities and Exchange Commission, “Artificial Intelligence (AI) and Investment Fraud: Investor Alert” (Jan. 25, 2024). 10. See Federal Trade Commission, “Refund and Recovery Scams” (Dec. 2023); FBI IC3, “FBI Warns of Scammers Impersonating the IC3” (Apr. 18, 2025); FBI IC3, “Fictitious Law Firms Targeting Cryptocurrency Scam Victims Combine Multiple Exploitation Tactics While Offering to Recover Funds” (Aug. 18, 2025).

FINCEN ALERT 3 According to the Federal Bureau of Investigation (FBI) Internet Crime Complaint Center (IC3), reported U.S. victim losses from these digital asset investment scams have skyrocketed from $907 million in 2021 to $7.2 billion in 2025.11 The total annual revenue collected by Southeast Asian scam centers is estimated in the tens of billions of dollars.12 This growth is fueled in part by corrupt foreign officials who operate or facilitate networks of scam centers,13 as well as by TCOs’ adoption of artificial intelligence tools to scale and refine their fraud schemes.14 TCOs operate industrial-scale scam centers in Southeast Asia, primarily in Cambodia, Burma, and Laos.15 Criminal gangs have trafficked hundreds of thousands of people to these centers, where victims may have their passports taken to prevent them from leaving and are coerced into perpetrating online fraud.16 Escaped victims have reported being held captive until ransoms are paid by their families, beaten for failing to make quotas, and forced into commercial sex work.17 Recently, TCOs have expanded scam center operations beyond Southeast Asia, including to South Asia, Pacific Islands, Africa, the Middle East, and South America.18 The growth of cyber-enabled scams, including digital asset investment scams, has also driven the development of a broader ecosystem of ancillary services that facilitate scam operations. As described below, open-source reporting indicates that guarantee marketplaces serve as one of the primary venues for the sale of these ancillary services. 11. See FBI IC3, “Internet Crime Report 2022”; FBI IC3, “Internet Crime Report 2025.” FBI uses the term “cryptocurrency investment fraud” to describe the typology covered by this Alert. 12. See United Nations Office on Drugs and Crime (UNODC), “An Interconnected Criminal Ecosystem: Transnational Organized Crime Threat Assessment for South-East Asia” (July 2026) (“July 2026 UNODC Report”), at p. 4; UNODC, “Transnational Organized Crime and the Convergence of Cyber-Enabled Fraud, Underground Banking and Technological Innovation in Southeast Asia: A Shifting Threat Landscape” (“Oct. 2024 UNODC Report”) (Oct. 2024), at p. 38. 13. See, e.g., Treasury, Press Release, “Treasury Sanctions Cambodian Senator Kok An and Scam Center Network Defrauding Americans” (Apr. 23, 2026). 14. See July 2026 UNODC Report, supra note 12, at pp. 7–8, 100–101; U.S.-China Economic Security Review Commission (USCC), “Protecting Americans from China-Linked Scam Centers: An Update on Emerging Trends” (“Mar. 2026 USCC Report”) (Mar. 5, 2026), at pp. 3–4; INTERPOL, “Crime Trend Update: Human Trafficking-Fueled Scam Centres” (“June 2025 INTERPOL Report”) (June 30, 2025); Chainalysis, “The Chainalysis 2026 Crypto Crime Report” (“Chainalysis 2026 Crypto Crime Report”) (accessed Mar. 17, 2026), at pp. 28–30; see also FinCEN, FIN-2024-Alert004, “FinCEN Alert on Fraud Schemes Involving Deepfake Media Targeting Financial Institutions” (Nov. 13, 2024). 15. See 2026 NMLRA, supra note 3, at p. 6; Treasury, Press Release, “Treasury Sanctions Cambodian Senator Kok An and Scam Center Network Defrauding Americans” (Apr. 23, 2026); Treasury, Press Release, “Treasury Sanctions Burma Armed Group and Companies Linked to Organized Crime Targeting Americans” (Nov. 12, 2025); Treasury, Press Release, “U.S. and U.K. Take Largest Action Ever Targeting Cybercriminal Networks in Southeast Asia” (Oct. 14, 2025). 16. See United Nations Human Rights Office of the High Commissioner, “Online Scam Operations and Trafficking into Forced Criminality in Southeast Asia: Recommendations for a Human Rights Response” (Aug. 23, 2023), at pp. 7, 13– 15; State, “2025 Trafficking in Persons Report: Burma” (2025); State, “2025 Trafficking in Persons Report: Cambodia” (2025); State, “2025 Trafficking in Persons Report: Laos” (2025). 17. See July 2026 UNODC Report, supra note 12, at pp. 141–162. See also Treasury, Press Release, “Treasury Sanctions Southeast Asian Networks Targeting Americans with Cyber Scams” (Sept. 8, 2025). 18. See UNODC, “Inflection Point: Global Implications of Scam Centres, Underground Banking, and Illicit Online Marketplaces in Southeast Asia” (Apr. 2025) (“Apr. 2025 UNODC Report”), at pp. 8–10; June 2025 INTERPOL Report, supra note 14; Mar. 2026 USCC Report, supra note 14, at pp. 7–8.

FINCEN ALERT 4 DOJ Scam Center Strike Force and Treasury Take Major Actions Against Southeast Asian Scam Centers Targeting Americans19 On April 23, 2026, DOJ announced a series of coordinated actions by the Scam Center Strike Force against Southeast Asian criminal organizations operating scam centers that have defrauded Americans of billions of dollars. The Scam Center Strike Force’s actions included criminal charges against two Chinese nationals who managed a digital asset investment fraud compound in Burma and attempted to open another compound in Cambodia, the seizure of a Telegram messaging app channel used to recruit human trafficking victims to a scam compound in Cambodia in order to operate a law enforcement impersonation scam, and the seizure of 503 fake investment websites, among other actions. In a coordinated interagency action, Treasury announced sanctions against Cambodian scam center operators20 concurrently with the U.S. Department of State announcing rewards for information leading to the seizure or recovery of proceeds related to the Tai Chang scam center in Burma.21 Guarantee Marketplaces Guarantee marketplaces are online marketplaces that typically operate as networks of Chinese￾language chat groups on the Telegram messaging platform. Guarantee marketplaces function as marketing venues and payment infrastructure for vendors, as well as act as trusted intermediaries between buyers and sellers of services. Guarantee marketplaces also typically hold a buyer’s payment in escrow until delivery of the agreed-upon good or service is confirmed.22 Guarantee marketplaces may also offer dispute resolution mechanisms and transaction insurance funded by vendor deposits. Because they leverage popular mobile phone platforms such as Telegram, along with features such as chat groups and bots, guarantee marketplaces are also highly convenient and scalable for illicit actors.23 Guarantee marketplaces are attractive to illicit actors seeking to avoid the formal financial system. In practice, prominent guarantee marketplaces cater heavily to gray- and black-market activity,24 although marketplaces may disclaim knowledge of and responsibility for their users’ activity.25 19. See DOJ, U.S. Attorney’s Office for the District of Columbia, Press Release, “Scam Center Strike Force Takes Major Actions Against Southeast Asian Scam Centers Targeting Americans” (Apr. 23, 2026). 20. See Treasury, Press Release, “Treasury Sanctions Cambodian Senator Kok An and Scam Center Network Defrauding Americans” (Apr. 23, 2026). 21. See State, Press Release, “Reward Offer of Up to $10 Million for Information Leading to Financial Disruption of Tai Chang Scam Centers in Burma” (Apr. 23, 2026). 22. See, e.g., DOJ, Press Release, “Justice Department Seizes Backend Infrastructure Used by the Huione Group for Money Laundering Services” (June 23, 2026). 23. See Apr. 2025 UNODC report, supra note 18, at p. 36. 24. See Chainalysis 2026 Crypto Crime Report, supra note 14, at pp. 11–12; RUSI, “Multi-Billion Dollar Guarantee Marketplaces Exploit Stablecoins for Scams,” by Tom Robinson (“RUSI Report”) (May 19, 2026); Apr. 2025 UNODC Report UNODC, supra note 18, at pp. 42–46. 25. See e.g., FinCEN, “Imposition of Special Measure Regarding Huione Group, as a Foreign Financial Institution of Primary Money Laundering Concern,” 90 Fed. Reg. 48295 (Oct. 16, 2025) (“Huione Final Rule”), at p. 48298; Oct. 2024 UNODC Report, supra note 12, at p. 81.

FINCEN ALERT 5 According to FinCEN analysis and open-source information, specialized illicit services available on guarantee marketplaces include money laundering services, online social media account creation and verification, social media targeting, and mass phishing services.26 Messaging platforms leveraged by guarantee marketplaces may remove content that is illegal under a particular jurisdiction’s laws or violates the platform’s terms of service. However, absent ongoing action by administrators, guarantee marketplaces can quickly reconstitute after takedowns simply by creating new chat groups and other online infrastructure.27 Scam center operators rely on professional money launderers (PMLs)—in particular, Chinese money laundering networks (CMLNs), which in turn exploit extensive gray-market funds transfer networks known as Chinese underground banking systems.28 By performing an intermediary function between these PMLs and scam center operators, guarantee marketplaces have enabled rapid growth and specialization in the multibillion-dollar Southeast Asian cybercrime ecosystem. In particular, guarantee marketplaces enable scam center operators to arrange transactions with CMLNs.29 FinCEN Actions Targeting Guarantee Marketplaces30 On October 14, 2025, FinCEN issued a final rule pursuant to Section 311 of the USA PATRIOT Act severing Cambodia-based Huione Group from the U.S. financial system. That rule prohibits covered financial institutions from opening or maintaining correspondent accounts for, or on behalf of, Huione Group. It also requires them to take reasonable steps to not process transactions for the correspondent account of a foreign banking institution in the United States if such a transaction involves Huione Group, preventing indirect access by Huione Group to the U.S. financial system. Huione Group’s extensive digital asset services and its online marketplace, Haowang Guarantee, had made Huione Group a “one stop shop” for criminals to launder digital assets obtained through illicit activities. Of the $4 billion worth of illicit proceeds Huione Group laundered between August 2021 and January 2025, FinCEN found that Huione Group laundered at least $300 million worth of digital assets from other cyber scams, including digital assets stemming from DPRK cyber heists and virtual currency investment scams. 26. See also Apr. 2025 UNODC Report, supra note 18, at pp. 10–11. 27. See Wired, “Telegram Purged Chinese Crypto Scam Markets—Then Watched as They Rebuilt,” by Andy Greenberg (June 23, 2025); Elliptic, “Elliptic data leads to the shutdown of the two largest online criminal marketplaces of all time” (May 14, 2025); Recorded Future, “Evolution of Chinese-Language Guarantee Telegram Marketplaces” (“Recorded Future Report”) (Apr. 22, 2026); RUSI Report, supra note 24. 28. Over the past decade, CMLNs have become the dominant PMLs for TCOs around the world. See NMLRA, supra note 3, pp. 25–27; FinCEN, FIN-2025-A003, “FinCEN Advisory on the Use of Chinese Money Laundering Networks by Mexico-Based Transnational Criminal Organizations to Launder Illicit Proceeds” (Aug. 28, 2025); FinCEN, Financial Trend Analysis, “Chinese Money Laundering Networks: 2020 - 2024 Threat Pattern & Trend Information” (Aug. 2025). 29. See Oct. 2024 UNODC Report, supra note 12, at pp. 65–67; Apr. 2025 UNODC Report, supra note 18, at pp. 42–46; Global China Pulse, “Moving Bricks: Money-Laundering Practices in the Online Scam Industry,” by Yanyu Chen (Sept. 24, 2024); Chainalysis 2026 Crypto Crime Report, supra note 14, pp. 9–13; Recorded Future Report, supra note 27. 30. See FinCEN, Press Release, “FinCEN Issues Final Rule Severing Huione Group from the U.S. Financial System” (Oct. 14, 2025).

FINCEN ALERT 6 The risks presented by Huione Group’s association with illicit actors and transactions linked to illicit activity were compounded by either the absence of, or ineffective, AML/Know Your Customer (KYC) policies and procedures among Huione Group’s components. In September 2024, Huione Group launched a stablecoin, USDH, that it explicitly advertised as “unfreezable” and “not restricted by traditional regulatory agencies.”31 On June 23, 2026, FinCEN issued a proposed rule to amend the October 2025 final rule to include Cambodia-based H-Pay Service PLC (H-Pay) and other successor entities of Huione Group within the scope of the October 2025 final rule. FinCEN assessed in its proposed rule that Huione Group transitioned operations from Huione Pay PLC to H-Pay in an effort to evade public scrutiny and circumvent the special measure imposed by the final rule.32 How Scam Center Operators Launder Scam Proceeds According to FinCEN analysis, scam proceeds move from victims to scam center operators in several broad stages:

1. Scammers extract payments from victims, often in the form of digital assets.
2. Illicitly obtained digital assets undergo on-chain laundering (i.e. blockchain transactions that have the effect of obfuscating the connection between the illicit proceeds and their origin).
3. Money laundering operations convert proceeds into fiat currency and integrate them into the traditional financial system. Scam center operations frequently only handle communication with the victim. Operators outsource creating the infrastructure necessary to move funds—including establishing financial institution accounts and front companies—and the movement of funds to PMLs, relationships often facilitated by guarantee marketplaces. Stage One: Victim Payments As noted above, scammers use a variety of ruses to sway victims into making payments, including promising large returns on investments and pretending to be government officials. Regardless of the underlying fraud scheme, scammers often induce victims to make payments in digital assets, although payments in fiat currency are common and payments via precious metals have been reported by law enforcement. Most digital asset payments by victims to scam center operators originate from money services businesses (MSBs) offering digital asset services, including digital asset kiosks, according to
4. See FinCEN, “Imposition of Special Measure Regarding Huione Group, as a Foreign Financial Institution of Primary Money Laundering Concern,” 90 Fed. Reg. 48295 (Oct. 16, 2025).
5. See FinCEN, Notice of Proposed Rulemaking, “Definition of Huione Group, a Financial Institution Operating Outside the United States of Primary Money Laundering Concern,” 91 Fed. Reg. 38340 (June 27, 2026). DOJ concurrently announced the seizure of a cloud computing account used by subsidiaries of the Huione Group to host backend infrastructure. See DOJ, Press Release, “Justice Department Seizes Backend Infrastructure Used by the Huione Group for Money Laundering Services” (June 23, 2026).

FINCEN ALERT 7 FinCEN analysis and law enforcement information.33 Based on FinCEN’s analysis of BSA reporting, scammers often instruct their victims to open accounts with MSBs offering digital asset services to purchase specific types of digital assets. Then, the victim is told to send these funds to a digital asset address controlled by the scammers.34 Another tactic used by scammers is directing victims to send fiat currency-denominated funds through a wire transfer or Automated Clearing House transaction to another, fiat-denominated financial account controlled by the scammer. To facilitate these fiat payments, scammers and associated PMLs have created infrastructure in the United States, including bank accounts controlled by the scammers and associated PMLs via money mules,35 as well as shell companies.36 Additionally, in some cases, scammers and associated PMLs have created fraudulent MSBs used to collect victims’ funds. Scammers have been known to register these fraudulent MSBs with FinCEN and use that self-registration to appear legitimate or otherwise gain credibility.37 After receiving fiat-denominated funds from victims, scammers and associated PMLs will often convert those funds to digital assets.38 For example, the scammers and associated PMLs may transfer those funds to an MSB or other financial institution offering fiat-to-digital asset swaps and convert the proceeds to stablecoins for further laundering.39 Scammers are also known to ask victims to conduct fiat-denominated international bank transfers. Although scam center operations are concentrated in Southeast Asia, data collected through FinCEN’s Rapid Response Program (RRP)40 International Financial Fraud Kill Chain indicates that bank accounts receiving proceeds from victims of cyber-enabled fraud are located in a wide range of foreign jurisdictions. Because fraud proceeds are typically laundered through multiple transactions, the jurisdiction of these initial transactions does not necessarily correspond to the ultimate destination of the proceeds. 33. See FinCEN Pig Butchering Alert, supra note 7; FinCEN, FIN-2025-NTC1, “FinCEN Notice on the Use of Convertible Virtual Currency Kiosks for Scam Payments and Other Illicit Activity” (“CVC Kiosk Notice”) (Aug. 4, 2025). 34. See FinCEN, Financial Trend Analysis, “Digital Asset Investment Scams: 2023-2025 Threat Pattern & Trend Information” (“Digital Asset Investment Scams Financial Trend Analysis”) (Sep. 3, 2026) 35. A money mule is someone who transfers or moves illegally acquired money on behalf of someone else. See FBI, “Money Mules” (last accessed May 18, 2026) 36. Shell companies are legal business entities that have no physical presence, have few or no employees, and generate little to no independent economic value. See 2026 NMLRA, supra note 3, at p. 59. 37. See FinCEN, FIN-2024-Alert005, “FinCEN Alert on Fraud Schemes Abusing FinCEN’s Name, Insignia, and Authorities for Financial Gain” (Dec. 18, 2024). 38. See Digital Asset Investment Scams Financial Trend Analysis, supra note 34. 39. See, e.g., DOJ, Press Release, “Five Men Plead Guilty for Their Roles in Global Digital Asset Investment Scam Conspiracy Resulting in Theft of More than $36.9 Million from Victims” (June 9, 2025). 40. RRP is a partnership between FinCEN, U.S. law enforcement, and foreign partners working together to help victims and their financial institutions recover stolen funds sent abroad as the result of cyber-enabled fraud.

FINCEN ALERT 8 Figure 1: Initial Destination of ACH Transfers in RRP Cyber Scam Cases, Oct. 2024 – June 2026.41 Region Initial Destination of ACH Transfers in RRP Cyber Scam Cases The Americas $113,157,126.32 Asia and Pacific $385,952,451.65 Europe $145,732,317.57 Middle East and North Africa $101,744,207.65 Sub-Saharan Africa $5,079,764.62 Figure 2: Initial Destination of ACH Transfers in RRP Cyber Scam Cases (by Region), Oct. 2024 – June 2026 According to law enforcement, scammers have also directed victims to purchase gold coins or bars. Couriers working on behalf of the scammers and associated PMLs then pick up and transport the gold. Scammers are also known to direct victims to purchase gift cards.42 Stage Two: On-Chain Laundering When PMLs obtain digital assets from victims or as part of the laundering process, they use on￾chain techniques that obfuscate the illicit origin of the funds. These techniques include rapid movement of funds through multiple digital asset addresses, comingling of funds in consolidation wallets, use of mixers and tumblers, and swaps across multiple blockchains and digital assets.43 41. Hong Kong is grouped with the People’s Republic of China for purposes of this chart. 42. See U.S. Immigrations and Customs Enforcement, “Tackling the Rise in Gift Card Fraud” (last accessed July 17, 2026). 43. See Asia-Pacific Group on Money Laundering, “Cyber Scam Hubs and Human Trafficking” (May 2026), at pp. 29–30; Financial Action Task Force (FATF), “Illicit Financial Flows from Cyber-Enabled Fraud” (2023), at p. 23.

FINCEN ALERT 9 According to law enforcement and FinCEN analysis of blockchain data, PMLs frequently use decentralized finance (DeFi) protocols to transfer fraud proceeds across blockchains, such as by swapping USDT tokens originating from scams from the Ethereum blockchain to the Tron blockchain. PMLs also swap digital assets into stablecoins through DeFi protocols because stablecoins can be easily used on guarantee marketplaces due to their widespread global acceptance and perceived stability, among other reasons.44 Stage Three: Integration of Scam Proceeds into the Formal Financial System PMLs integrate scam proceeds into the formal financial system through networks of money mules and through stablecoin transfers to digital asset exchanges outside of the United States. Much of this activity is facilitated by Chinese underground banking systems, which include peer-to-peer exchangers45 and over-the-counter (OTC) brokers46 that operate outside of the formal financial system and generally lack robust KYC and AML/CFT controls. Guarantee marketplaces connect cybercriminal networks with these underground banking services.47 According to FinCEN analysis, these services typically rely on the liquidity provided by large MSBs in the digital asset sector to process transactions.48 Red Flag Indicators of Money Laundering Activity Related to Digital Asset Investment Scam Centers FinCEN has identified the following red flag indicators to help financial institutions detect, prevent, and report potentially suspicious activity related to scam centers. Because no single red flag is determinative of illicit or other suspicious activity, financial institutions should consider the surrounding facts and circumstances, such as a customer’s historical financial activity, whether the transactions are in line with prevailing business practices, and whether the customer exhibits multiple related red flags, before determining if a transaction or attempted transaction is indicative of money laundering activity associated with scam centers or is otherwise suspicious. In addition to the red flags below, financial institutions should also be aware of the red flags discussed in FinCEN’s 2023 alert on digital asset investment scams and 2025 alert on the use of digital asset kiosks for scam payments.49 44. See Chainalysis 2026 Crypto Crime Report, supra note 14, at pp. 11–12; RUSI Report, supra note 24. 45. P2P exchangers are individuals or entities that offer to exchange fiat currencies for digital assets and typically operate informally. See FinCEN, FIN-2019-A003, “Advisory on Illicit Activity Involving Convertible Virtual Currency” (May 9, 2019). 46. For additional information on the use of OTC brokers by illicit actors, see 2026 NMLRA, supra note 3, at pp. 49–50. 47. See Oct. 2024 UNODC Report, supra note 12, at pp. 80–87. 48. Exchanges that offer trading services and pool customer deposits into an account hosted by a larger exchange are referred to as “nested exchanges.” Nested exchanges may operate fully or partially within the infrastructure of the host provider, rather than as a unique entity, potentially providing illicit actors with an additional layer of obfuscation. See 2026 NMLRA, supra note 3, at p. 51. 49. See FinCEN Pig Butchering Alert, supra note 7; FinCEN CVC Kiosk Notice, supra note 33.

FINCEN ALERT 10 Red Flags Related to Victim Payments to Digital Asset Investment Scam Centers A customer states that they were directed by a purported representative of law enforcement or a government agency to make a payment using digital assets, to conduct an international wire transfer, or to purchase precious metals or gift cards. • Financial institutions may consider providing consumers information on scams.50 A customer states that a payment is intended to retain a law firm or other entity to recover funds lost to fraud but lacks documentation demonstrating that the service is legitimate. A customer withdraws funds from an investment or retirement account to purchase gold from a precious metals dealer and indicates that they have been instructed to hand the gold to a courier. Open-source information shows that an MSB receiving customer funds has claimed to be “approved by FinCEN.” Open-source information shows that a digital asset exchange receiving customer funds is advertising services “with no KYC” or a lack of compliance measures. Red Flags Related to Guarantee Marketplaces A customer conducts transactions involving a digital asset token issued by or associated with a guarantee marketplace and fails to provide documentation regarding the source of funds. Open-source information indicates that a payment service provider operating a guarantee marketplace changed its name, branding, website, or other features of its public presentation in an apparent attempt to mask its association with a guarantee marketplace that has been subject to law enforcement action, takedowns by service providers, or negative news. A customer of a digital asset exchange transacts with an unattributed cluster of digital asset addresses, which blockchain analysis flags as sharing blockchain infrastructure with a known guarantee marketplace. Blockchain analysis indicates that a customer has transacted directly or indirectly with a digital asset address attributed to a guarantee marketplace and the transactions have no apparent economic, business, or lawful purpose. A payment service provider that offers digital asset exchange services appears to operate in Burma, Cambodia, or Laos, and appears to take measures to obfuscate its location or corporate structure. 50. See, e.g., ABA Foundation, “Crypto Investment Scams” (Sept. 11, 2024); Federal Trade Commission, “How to Avoid a Scam” (July 2023). When consumers are informed about specific types of scams and understand perpetrators’ tactics, they are more likely to recognize a scam and are less likely to engage with a perpetrator or lose money. See Board of Governors of the Federal Reserve System, Consumer Financial Protection Bureau, Federal Deposit Insurance Corporation, FinCEN, National Credit Union Administration, Office of the Comptroller of the Currency, State Financial Regulators, “Interagency Statement on Elder Financial Exploitation” (Dec. 2024), at p. 8.

FINCEN ALERT 11 Red Flags Related to Laundering Techniques Associated with Digital Asset Investment Scam Centers A customer of a digital asset exchange receives stablecoin transactions that originate from centralized digital asset exchanges that operate in the United States and undergo transaction patterns associated with on-chain laundering techniques. Open-source information indicates that a digital asset address used by a customer was posted on a messaging platform in proximity to Chinese-language terms related to money laundering. A customer of a DeFi service receives deposits from a wallet that aggregates suspected scam proceeds and uses the DeFi service to move the proceeds into a different digital asset or blockchain. A customer conducts substantial transactions using a stablecoin whose issuer advertises that it does not cooperate with law enforcement or that its stablecoin cannot be seized or frozen. A customer of a digital asset exchange appears to be using liquidity provided by the digital asset exchange to execute large numbers of offsetting transactions consistent with operation as an OTC broker or P2P exchanger. A customer receives stablecoin deposits from a DeFi service that lacks AML/CFT controls, converts the funds to fiat currency, and withdraws the proceeds. Financial institutions filing Suspicious Activity Reports (SARs) related to scam centers should reference this Alert in SAR field 2 (Filing Institution Note to FinCEN) and the narrative by including the key term “FIN-2026-SCAMCENTERS.” When submitting a report pursuant to this Alert, financial institutions should include any relevant technical cyber indicators related to cyber events and associated transactions within the available structured cyber event indicator fields on the SAR form or as part of the attachment field. Any data or information that helps identify the activity as suspicious can be included as an indicator. Examples include chat logs, phone numbers, and social media usernames used by the scammer; suspicious email addresses; type of virtual currency and digital assets involved; virtual currency and/or digital asset addresses and transaction hashes native to the blockchain(s) involved; apps used; and the URL, domain, and IP address of the service the victim was instructed to deposit into. Financial institutions should also include as much detail about the scam center activity as possible, including any suspected nexus to a politically exposed person, geographic region or location, or transnational criminal organization. Financial institutions should also include the names and identifying information of any service providers connected to the suspected scam center activity, such as providers of financial, internet, or corporate services. In addition to filing a SAR, financial institutions are encouraged to refer their customers who may be victims of cyber-enabled scams to the FBI’s IC3: https://www.ic3.gov/, and/or contact the nearest U.S. Secret Service field office (http://www.secretservice.gov/contact/field-offices).

FINCEN ALERT 12 Reminder of Relevant BSA Obligations and Tools for U.S. Financial Institutions Suspicious Activity Reporting Other Relevant BSA Reporting Suspicious Activity Reporting A financial institution is required to file a SAR if it knows, suspects, or has reason to suspect a transaction conducted or attempted by, at, or through the financial institution involves funds derived from illegal activity; is intended or conducted to disguise funds derived from illegal activity; is designed to evade regulations promulgated under the BSA; lacks a business or apparent lawful purpose; or involves the use of the financial institution to facilitate criminal activity.51 All statutorily defined financial institutions may voluntarily report suspicious transactions under the existing suspicious activity reporting safe harbor.52 When a financial institution files a SAR, it is required to maintain a copy of the SAR and the original or business record equivalent of any supporting documentation for a period of five years from the date of filing the SAR.53 Financial institutions must provide any requested documentation supporting the filing of a SAR upon request by FinCEN or an appropriate law enforcement or supervisory agency.54 When requested to provide supporting documentation, financial institutions should take special care to verify that a requestor of information is, in fact, a representative of FinCEN or an appropriate law enforcement or supervisory agency. A financial institution should incorporate procedures for such verification into its BSA compliance or AML program. These procedures may include, for example, independent employment verification with the requestor’s field office or face-to-face review of the requestor’s credentials. SAR Filing Instructions SARs, and compliance with other BSA requirements, are crucial to identifying and stopping scam center activity. FinCEN requests that financial institutions indicate a connection between the suspicious activity being reported and the activities highlighted in this Alert by including the key term “FIN-2026-SCAMCENTERS” in SAR field 2 (Filing Institution Note to FinCEN), as well as in the narrative and selecting “Fraud-Other” under SAR field 34(z) with the description “Scam Centers” in the text box. Financial institutions may highlight additional advisory, alert, or notice keywords in the narrative, if applicable. 51. See 31 C.F.R. §§ 1020.320, 1021.320, 1022.320, 1023.320, 1024.320, 1025.320, 1026.320, 1029.320, 1030.320. 52. See 31 U.S.C. § 5318(g)(3); see, e.g., 31 C.F.R. § 1020.320(f). Financial institutions may report suspicious transactions regardless of amount involved and still take advantage of the safe harbor. 53. See 31 C.F.R. §§ 1020.320(d), 1021.320(d), 1022.320(c), 1023.320(d), 1024.320(c), 1025.320(d), 1026.320(d), 1029.320(c), 1030.320(c). 54. Id.; see also FinCEN, FIN-2007-G003, “Suspicious Activity Report Supporting Documentation” (June 13, 2007).

FINCEN ALERT 13 Financial institutions should select SAR Field 34(z) (Fraud – Other) and include the term “Scam Centers” in the text box, as well as any other applicable check box. Financial institutions also should select all other relevant suspicious activity fields, such as those in SAR fields 36 (Money Laundering) and 38 (Other Suspicious Activities), if applicable. Financial institutions should include all available information relating to the account(s) and location(s) involved in the reported activity, identifying information and descriptions of any legal entities or arrangements involved and associated beneficial owners, and any information about related persons or entities involved in the activity. Financial institutions also should provide all available information regarding other domestic and foreign financial institutions involved in the activity; where appropriate, financial institutions should consider filing a SAR jointly on shared suspicious activity.55 Financial institutions are required to file complete and accurate reports that incorporate all relevant information available. In situations involving violations requiring immediate attention, such as ongoing money laundering schemes, a financial institution should also immediately notify, by telephone, an appropriate law enforcement authority, in addition to filing a timely SAR.56 Immediate notification to law enforcement is especially important in situations involving suspected terrorist activity, as terrorists and terrorist organizations often rely on the international financial system to acquire funding to sustain and finance their operations and engage in acts of terrorism. Financial institutions wanting to report suspicious transactions that may potentially relate to terrorist activity should call the Financial Institutions Toll-Free Hotline at (866) 556-3974 (7 days a week, 24 hours a day).57 Other Relevant BSA Reporting Requirements Financial institutions and other entities or persons may also have other relevant BSA reporting requirements to provide information in connection with the subject of this Alert. These include obligations related to the Currency Transaction Report (CTR),58 Report of Cash Payments 55. See 31 C.F.R. §§ 1020.320(e)(1)(ii)(A)(2)(i), 1021.320(e)(1)(ii)(A)(2), 1022.320(d)(1)(ii)(A)(2), 1023.320(e)(1)(ii)(A)(2)(i), 1024.320(a)(3), 1024.320(d)(1)(ii)(A)(2), 1025.320(a)(3)(ii), 1025.320(e)(1)(ii)(A)(2), 1026.320(e)(1)(ii)(A)(2)(i), 1029.320(a) (3), 1029.320(d)(1)(ii)(A)(2), 1030.320(a)(3), 1030.320(d)(1)(ii)(A)(2). 56. See, e.g., 31 C.F.R. §§ 1020.320(b)(3), 1022.320(b)(3), 1023.320(b)(3). 57. The purpose of the hotline is to expedite the delivery of this information to law enforcement. Financial institutions should immediately report any imminent threat to appropriate law enforcement officials. In considering whether particular activity may relate to terrorist or terrorist financing activity, FinCEN reminds financial institutions that State designated certain Cartels as FTOs and SDGTs. 58. A report of each deposit, withdrawal, exchange of currency, or other payment or transfer, by, through, or to a financial institution that involves a transaction in currency of more than $10,000. Multiple transactions may be aggregated when determining whether the reporting threshold has been met. See 31 C.F.R. §§ 1010.310–13, 1020.310– 13, 1021.310–13, 1022.310–13, 1023.310–13, 1024.310–13, 1026.310–13.

FINCEN ALERT 14 Over $10,000 Received in a Trade or Business (Form 8300),59 Report of Foreign Bank and Financial Accounts (FBAR),60 Report of International Transportation of Currency or Monetary Instruments (CMIR),61 Registration of Money Services Business (RMSB),62 and Designation of Exempt Person (DOEP).63 Form 8300 Filing Instructions When filing a Form 8300 involving a suspicious transaction relevant to this supplemental Alert, FinCEN requests that the filer selects Box 1b (“suspicious transaction”) and includes the key term “FIN-2026-SCAMCENTERS” in the “Comments” section of the report. Due Diligence Banks, brokers or dealers in securities, mutual funds, and futures commission merchants and introducing brokers in commodities (FCM/IBs) are required to have appropriate risk￾based procedures for conducting ongoing customer due diligence that include, but are not limited to: (i) understanding the nature and purpose of customer relationships for the purpose of developing a customer risk profile; and (ii) conducting ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information.64 Covered financial institutions are required to identify and verify the identity of beneficial owners of legal entity customers, subject to certain exclusions and exemptions.65 Among other things, this facilitates the identification of legal entities that may be owned or controlled by foreign politically exposed persons (PEPs). Senior foreign political figures and due diligence obligations for private banking accounts In addition to these due diligence obligations, under section 312 of the USA PATRIOT Act (31 U.S.C. § 5318(i)) and its implementing regulations, covered financial institutions must implement due diligence programs for private banking accounts held for non-U.S. persons that 59. A report filed by a trade or business that receives currency in excess of $10,000 in one transaction or two or more related transactions. The transactions are required to be reported on a joint FinCEN/Internal Revenue Service form when not otherwise required to be reported on a CTR. See 31 C.F.R. §§ 1010.330–31. A Form 8300 also may be filed voluntarily for any suspicious transaction, even if the total amount does not exceed $10,000. 60. A report filed by a U.S. person that has a financial interest in, or signature or other authority over, foreign financial accounts with an aggregate value exceeding $10,000 at any time during the calendar year. See 31 C.F.R. §§ 1010.350,1010.360(c); FinCEN Form 114. 61. A form filed to report the transportation of more than $10,000 in currency or other monetary instruments into or out of the United States. See 31 C.F.R. § 1010.340. 62. A form filed to register a money services business (MSB) with FinCEN, or to renew such a registration. See 31 C.F.R. § 1022.380. 63. A report filed by banks to exempt certain customers from currency transaction reporting requirements. See 31 C.F.R. § 1020.315. 64. See 31 C.F.R. §§ 1020.210(a)(2)(v), 1023.210(b)(5), 1024.210(b)(6), 1026.210(b)(5). 65. See 31 C.F.R. §§ 1010.230, 1010.605(e)(1) (defining “covered financial institution”).

FINCEN ALERT 15 are designed to detect and report any known or suspected money laundering or suspicious activity conducted through or involving such accounts.66 Covered financial institutions must establish risk-based controls and procedures for ascertaining the identities of nominal and beneficial owners of such accounts and ascertaining whether any of these owners are senior foreign political figures, and for conducting enhanced scrutiny on accounts held by senior foreign political figures that is reasonably designed to detect and report transactions that may involve the proceeds of foreign corruption.67 AML/CFT program and correspondent account due diligence requirements Financial institutions are reminded of AML/CFT program requirements,68 and covered financial institutions are reminded of correspondent account due diligence requirements under Section 312 of the USA PATRIOT Act (31 U.S.C. § 5318(i)) and implementing regulations.69 As described in FinCEN Interpretive Release 2004-1, the AML/CFT program of a money services business (MSB) must include risk-based policies, procedures, and controls designed to identify and minimize risks associated with foreign agents and counterparties.70 Information Sharing Information sharing between and among financial institutions is critical to identifying, reporting, and preventing illicit activity, including fraud and scams. Under the safe harbor from liability provided by section 314(b) of the USA PATRIOT Act, financial institutions may share information with other eligible financial institutions regarding activities that may involve possible terrorist activity or money laundering, including information about fraud and other specified unlawful activities.71 FinCEN strongly encourages financial institutions to participate in this voluntary program as information sharing between and among financial institutions can assist financial institutions in managing illicit financing risks and can ultimately provide the government with highly useful information to identify and prevent financial crime. Given the transnational nature of illicit activity, FinCEN encourages U.S. financial institutions to use, and expand, their processes to collect and share information with foreign financial institutions to further investigations involving cross-border activity.72 66. See 31 C.F.R. § 1010.620. The definition of “covered financial institution” is found in 31 C.F.R. § 1010.605(e)(1). The definition of “private banking account” is found in 31 C.F.R. § 1010.605(m). The definition of “non-U.S. person” is found in 31 C.F.R. § 1010.605(h). 67. See 31 C.F.R. § 1010.620(c). 68. See 31 C.F.R. §§ 1010.210, 1020.210, 1021.210, 1022.210, 1023.210, 1024.210, 1025.210, 1026.210, 1027.210, 1028.210, 1029.210, 1030.210. 69. See 31 C.F.R. § 1010.610. 70. See FinCEN, Interpretive Release 2004-1, Anti-Money Laundering Program Requirements for Money Services Businesses with Respect to Foreign Agents or Foreign Counterparties, 69 FR 74,439 (Dec. 14, 2004); see also FinCEN, FIN-2016-G001, “Guidance on Existing AML Program Rule Compliance Obligations for MSB Principals with Respect to Agent Monitoring” (Mar. 11, 2016). 71. See 31 C.F.R. § 1010.540; see also FinCEN, “Section 314(b) Fact Sheet” (June 12, 2026). 72. See FinCEN, FIN-2025-G001, “Cross-Border Information Sharing by Financial Institutions and SAR Confidentiality” (Sept. 5, 2025).

FINCEN ALERT 16 The section 314(b) program provides financial institutions with the flexibility and connectivity needed to counter threats and prevent illicit actors from exploiting gaps between institutions. Among other things, information sharing pursuant to section 314(b) allows financial institutions to respond to threats—activities a financial institution suspects may involve possible terrorist activity or money laundering, such as fraud and other criminal activity—that are carried out by repeat actors moving across financial institutions to evade detection. For additional information, see FinCEN’s Section 314(b) Fact Sheet. FinCEN’s Whistleblower Program FinCEN maintains a whistleblower incentive program for violations of the BSA and certain national security laws such as the International Emergency Economic Powers Act (IEEPA). Individuals located in the United States or abroad who provide information may be eligible for awards if the information they provide leads to a successful enforcement action that results in monetary penalties exceeding $1,000,000 and the statutory requirements in 31 U.S.C. § 5323 are otherwise met. Under 31 U.S.C. § 5323, there are certain confidentiality protections to individuals submitting information as well as certain protections from retaliation by employers. Individuals may also choose to submit information anonymously to FinCEN, including through an attorney. FinCEN is currently accepting whistleblower tips and encourages those with knowledge of potential violations to contact FinCEN. To learn more about FinCEN’s Whistleblower Program, visit https://www.fincen.gov/whistleblower-program. For Further Information FinCEN’s website at www.fincen.gov contains information on how to register for FinCEN Updates. Questions or comments regarding the contents of this Alert should be addressed to the FinCEN Regulatory Support Section by submitting an inquiry at www.fincen.gov/contact. The mission of the Financial Crimes Enforcement Network is to safeguard the financial system from illicit use, counter money laundering and the financing of terrorism, and promote national security through strategic use of financial authorities and the collection, analysis, and dissemination of financial intelligence.