FinCEN Alert on Oil Smuggling Schemes on the U.S. Southwest Border Associated with Mexico-Based Cartels (FIN-2025-Alert002)

1

1. See 31 U.S.C. § 5312(a)(2); 31 CFR § 1010.100(t).
2. On May 1, 2025, OFAC sanctioned three Mexican nationals and two Mexico-based entities that are linked, directly or indirectly, to CJNG’s fuel theft and oil smuggling operations on the U.S. southwest border. See Treasury, “Treasury Targets Major Mexican Cartel Involved in Fentanyl Trafficking and Fuel Theft” (“OFAC May 2025 Designation”) (May 1, 2025).
3. Pemex is Mexico’s national, state-owned oil and natural gas company. Its operations include: crude production (i.e., drilling crude oil from reservoirs); refining crude oil into gasoline, diesel, and other fuel; and the storage and distribution of fuel across Mexico. Historically, Pemex held a monopoly on the Mexican oil and natural gas industry. After reforms to the energy sector in 2013, the Government of Mexico ended Pemex’s monopoly and began allowing private sector investment and competition in the industry. However, Pemex continues to play a significant role in the Mexican oil and natural gas industry. See generally U.S. Department of Commerce, International Trade Administration, “Mexico Country Commercial Guide – Oil and Gas” (Nov. 5, 2023); Pemex, About Pemex.
4. See DEA, “2024 National Drug Threat Assessment” (May 24, 2024), pp. 10 and 15. FIN-2025-Alert002 May 1, 2025 FinCEN Alert on Oil Smuggling Schemes on the U.S. Southwest Border Associated with Mexico-Based Cartels The U.S. Department of the Treasury’s (Treasury) Financial Crimes Enforcement Network (FinCEN), in coordination with Treasury’s Office of Foreign Assets Control (OFAC) and the U.S. Drug Enforcement Administration (DEA), Federal Bureau of Investigation (FBI), and Homeland Security Investigations (HSI), is issuing this Alert to urge financial institutions1 to be vigilant in detecting, identifying, and reporting suspicious activity connected to the smuggling of stolen crude oil from Mexico across the U.S. southwest border into the United States by the Jalisco New Generation Cartel (CJNG), Sinaloa Cartel, Gulf Cartel, and other Mexico-based transnational criminal organizations (TCOs) — frequently known as the “Cartels.” In recent years, fuel theft in Mexico, including crude oil smuggling, has become the most significant non-drug illicit revenue source for the Cartels and enables them to sustain their global criminal enterprises and drug trafficking operations into the United States. This Alert is being issued in coordination with an OFAC sanctions action.2 According to U.S. law enforcement authorities, the Cartels are using complicit Mexican brokers in the oil and natural gas industry to smuggle and sell crude oil stolen from Mexico’s state-owned energy company, Petróleos Mexicanos (Pemex),3 to complicit, small U.S.-based oil and natural gas companies (hereafter “U.S. importers”) operating near the U.S. southwest border. Through these schemes, the Cartels are stealing billions of dollars of crude oil from Pemex, fueling rampant violence and corruption across Mexico, and undercutting legitimate oil and natural gas companies in the United States.4

Suspicious Activity Report (SAR) Filing Request: FinCEN requests that financial institutions reference this Alert by including the key term “FIN-2025-OILSMUGGLING” in SAR field 2 (Filing Institution Note to FinCEN) and the narrative.

FINCEN ALERT 2 In response to the growing national security threat of the Cartels, on January 20, 2025, President Trump declared a national emergency at the U.S. southwest border and issued Executive Order (E.O.) 14157 to authorize the designation of the Cartels and certain other organizations as Foreign Terrorist Organizations (FTOs).5 As part of the Trump Administration’s whole-of-government effort to defend the U.S. homeland and achieve the total elimination of the Cartels, Treasury, including FinCEN, is leveraging its authorities and resources to counter Cartel illicit revenue streams. Treasury’s efforts include implementing designations of eight foreign Cartels and criminal organizations as FTOs and Specially Designated Global Terrorists (SDGTs) and designating over 30 individuals and entities in four sanctions actions against Mexican Cartels since the President’s declaration.6

Treasury will continue to target the Cartels and their affiliates pursuant to both counternarcotics and counterterrorism sanctions authorities. This Alert is one of several recent advisory products FinCEN has issued to help financial institutions detect, identify, and prevent TCO-related revenue streams7 and is consistent with FinCEN’s National Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) Priorities, which identified drug trafficking organization activity, TCO activity, and corruption, as well as with Treasury’s 2024 National Illicit Finance Strategy.8 This Alert: (1) provides an overview of methodologies and financial typologies associated with the Cartels’ oil smuggling operations; (2) highlights red flag indicators; and (3) reminds financial institutions of their reporting requirements under the Bank Secrecy Act (BSA). The information contained in this Alert is derived from FinCEN’s analysis of open-source reporting, BSA reporting, and information from law enforcement partners. 5. See The White House, Proclamation Declaring a National Emergency at the Southern Border of the United States, 90 FR 8,327 (Jan. 20, 2025); The White House, “Fact Sheet: President Donald J. Trump Declares a National Emergency at the Southern Border” (Jan. 22, 2025); The White House, Executive Order on Designating Cartels and Other Organizations as Foreign Terrorist Organizations and Specially Designated Global Terrorists, 90 FR 8,439 (Jan. 20, 2025); see also U.S. Department of State (State), “Press Statement by Secretary of State Marco Rubio: Terrorist Designation of International Cartels” (Feb. 20, 2025); State, “Fact Sheet: Designation of International Cartels” (Feb. 20, 2025). 6. See OFAC, “International Cartels Designated as Foreign Terrorist Organizations and Specially Designated Global Terrorists” (Mar. 18, 2025). 7. For additional information on illicit revenue schemes associated with the Cartels in Mexico, see FinCEN, FIN￾2025-Alert001, FinCEN Alert on Bulk Cash Smuggling and Repatriation by Mexico-Based Transnational Criminal Organizations” (Mar. 31, 2025); FinCEN, FIN-2024-NTC2, “FinCEN, OFAC, and FBI Joint Notice on Timeshare Fraud Associated with Mexico-Based Transnational Criminal Organizations” (July 16, 2024); FinCEN, FIN-2024-A002, “Supplemental Advisory on the Procurement of Precursor Chemicals and Manufacturing Equipment Used for the Synthesis of Illicit Fentanyl and Other Synthetic Opioids” (June 20, 2024); FinCEN, FIN-2023-Alert001, “FinCEN Alert on Human Smuggling along the Southwest Border of the United States” (Jan. 13, 2023); FinCEN, FIN-2019-A006, “Advisory to Financial Institutions on Illicit Financial Schemes and Methods Related to the Trafficking of Fentanyl and Other Synthetic Opioids” (Aug. 21, 2019). 8. See FinCEN, “Anti-Money Laundering and Countering the Financing of Terrorism National Priorities” (June 30, 2021); Treasury, “2024 National Strategy for Combating Terrorist and Other Illicit Financing” (May 16, 2024).

FINCEN ALERT 3 Cartel Oil Smuggling Schemes on the U.S. Southwest Border and Associated Financial Typologies Despite being a significant oil producer, Mexico does not have the capacity to refine the crude oil that Pemex produces into enough gasoline, diesel, and other fuel to meet the demands of Mexico’s economy. In particular, Pemex’s refineries are largely configured to refine sweet and light crude oil and do not have enough capacity to refine all of its drilled sour and heavy crude oil into gasoline, diesel, and other fuel.9 As a result, Mexico uses Pemex and other permitted Mexico-based oil and natural gas companies (including U.S. subsidiaries)10 to export primarily unrefined and partially refined sour and heavy crude oil to higher-capacity refineries in the United States and other countries and imports the refined gasoline, diesel, and other fuel back into Mexico.11 The Cartels exploit this flow of crude oil between Mexico and the United States by smuggling illicitly obtained sour and heavy crude oil from Pemex across the U.S. southwest border through Mexican brokers, often mislabeled as “waste oil” or other supposedly hazardous materials, to complicit U.S. importers who then sell the stolen crude oil at a steep discount on the U.S. and global energy markets before repatriating the significant illicit profits back to Mexico. According to law enforcement, U.S. importers complicit in these schemes often run otherwise legitimate business operations along the U.S. southwest border from the Lower Rio Grande Valley in Texas, the Eagle Ford Shale in South Texas, the Permian Basin in West Texas and southeastern New Mexico, and in the Houston and Dallas, Texas areas given the significant presence of the oil and natural gas industry in these areas and their proximity to Mexico.12 In other cases, the Cartels supply the stolen crude oil to complicit U.S. importers in other states. Throughout the scheme, the Cartels and their associates control and rely on complicit Mexican brokers and their networks of Mexican and U.S. companies, including front companies and shell companies,13 to serve as middlemen throughout the scheme. U.S. importers, in many cases, also use networks of companies, including front and shell companies, to receive the stolen crude oil from the Mexican brokers. Such Mexican and U.S. companies may appear to be involved in the oil and natural gas industry, the freight industry, or unrelated industries. 9. Crude oil can be refined into gasoline, diesel, other fuel, and other petroleum-based products. Types of crude oil are classified by sulfur content (higher sulfur sour or lower sulfur sweet crude) and by density (higher density heavy or lower density light crude). Sweet and light crude oil can be refined through simple distillation methods whereas sour and heavy crude oil require additional and more expensive refining processes. See U.S. Energy Information Administration (EIA), “Oil and Petroleum Products Explained” (June 20, 2024); see also EIA, “Crude Oil Inputs to Mexico’s Petroleum Refineries Continued to Decline in 2018” (June 25, 2019). 10. Mexico-based oil and natural gas companies must have a permit from the Government of Mexico to export crude oil to the United States and other jurisdictions. 11. See EIA, “U.S. Energy Trade with Mexico Involves Importing Crude Oil, Exporting Petroleum Products” (Apr. 22, 2019). 12. According to U.S. law enforcement, financial institutions that bank the U.S. importers can include small- to mid-sized and large banks and credit unions on the U.S. southwest border and around the country, especially those that specialize in financial services in the oil and natural gas industry and with correspondent banking relationships in Mexico. 13. Front companies are fully functioning companies, often having a physical location, with the characteristics of a legitimate business, and are used to comingle illicit proceeds with earnings from legitimate business operations. In contrast, shell companies are typically non-publicly traded corporations, limited liability companies, or other types of entities that have no physical presence beyond a mailing address, generate little to no independent economic value, and generally are created without disclosing their beneficial owners. See Treasury, “2024 National Money Laundering Risk Assessment” (Feb. 2024).

FINCEN ALERT 4 Cartel Fuel Theft in Mexico Oil smuggling across the U.S. southwest border is a growing evolution of pervasive and broader fuel theft (huachicol) schemes in Mexico where thieves (huachicoleros) affiliated with the Cartels steal fuel, such as gasoline and diesel, from Pemex. These thieves then sell the stolen fuel on the Mexican black market through unregulated roadside fuel stops and Cartel-controlled gas stations.14 On September 10, 2024, OFAC, pursuant to E.O. 14059 “Imposing Sanctions on Foreign Persons Involved in the Global Illicit Drug Trade,” sanctioned nine Mexican nationals and 26 Mexico-based entities linked to a fuel theft network in Mexico affiliated with CJNG that has generated tens of millions of dollars in illicit revenue.15 OFAC undertook this action in coordination with the DEA and Mexico’s financial intelligence unit, La Unidad de Inteligencia Financiera (UIF). As noted in OFAC’s press release, huachicoleros steal fuel from Pemex through numerous means, including illegally drilling taps into fuel pipelines, stealing from refineries, and hijacking tanker trucks. They also use bribery and violence in support of these illicit activities. The stolen fuel is then sold on the black market in Mexico and Central America. In recent years, as the Cartels have become more involved in fuel theft, the Mexican government has reported billions of dollars in lost revenue due to huachicol. 16 Obtaining Crude Oil from Pemex The Cartels and their huachicoleros primarily obtain crude oil by bribing corrupt Pemex employees and local government officials, although they may use other tactics to steal crude oil from Pemex across Mexico, including by illegally drilling taps into oil pipelines, stealing from refineries, and threatening Pemex employees. These oil theft operations have resulted in violence and corruption across Mexico and in some cases catastrophic pipeline explosions due to illegal drilling taps.17 Smuggling of Stolen Crude Oil Through Mexican and U.S. Companies After illicitly obtaining the crude oil from Pemex, the Cartels transport it to storage tanks in Cartel￾controlled territories, several of which are located in distribution hubs for the Mexican oil and natural gas industry, such as Veracruz, Altamira, and Monterrey, before it is smuggled into the United States. The crude oil is usually transported on tanker trucks across the U.S. southwest border mislabeled as “waste oil” or other hazardous materials related to the oil and natural gas refining process to avoid scrutiny and evade taxes and regulations. 14. See, e.g., CBS News, “Bodies of 9 Men Found in Vehicles Near Fuel Pipeline in Mexico” (Jan. 10, 2024); Associated Press, “Gunmen Kill 5 People in an Apparent Dispute over Fuel Theft in Central Mexico, Police Say” (Nov. 5, 2023); The New York Times, “Death Toll in Mexico Blast Rises to 79; Leader Vows to Intensify Crackdown on Fuel Theft” (Jan. 19, 2019). 15. See Treasury, “Treasury Targets Key Funding Source of Deadly Fentanyl-Trafficking Cartel CJNG” (“OFAC Sept. 2024 Designation”) (Sept. 10, 2024); Treasury, “CJNG Fuel Theft Network” (Sept. 2024); Treasury, “CJNG Fuel Theft Network” (Sept. 2024); The White House, Executive Order on Imposing Sanctions on Foreign Persons Involved in the Global Illicit Drug Trade, 86 FR 71,549 (Dec. 15, 2021); see also Treasury, “Treasury Sanctions Individuals Linked to CJNG’s Arms Trafficking, Fuel Theft, and Money Laundering” (June 6, 2023); Treasury, “CJNG Illicit Networks” (June 2023). 16. See OFAC Sept. 2024 Designation, supra note 15. 17. See, e.g., NBC News, “28 Killed in Mexico Pipeline Explosion” (Dec. 19, 2010).

FINCEN ALERT 5 After crossing the U.S. southwest border, the stolen crude oil is delivered to vacant lots set up with mobile storage tanks that are operated by U.S. companies under the control of the Mexican brokers or the complicit U.S. importers before it is finally delivered to complicit U.S. importers and sold on the U.S. and global energy markets. In the trade documentation, the Mexican brokers and complicit U.S. importers may list these U.S. companies as the importers and buyers, with the complicit U.S. importers listed as the ultimate consignees18 to make the supposed import of waste oil or other hazardous materials appear legitimate. In other cases, the Mexican brokers and U.S. importers may list additional U.S. companies under their control as the ultimate consignees. Some of these supposed ultimate consignees may be registered to residential addresses despite claiming to be the destination for purchases of waste oil or other hazardous materials. Sale of Stolen Crude Oil in the United States and Foreign Jurisdictions Once the stolen crude oil is delivered, the U.S. importers invoice and sell it on behalf of the Cartels as West Texas Intermediate (WTI) crude oil19 and other types of crude oil at a steep discount to complicit third-party brokers in the United States and in foreign jurisdictions. The stolen crude oil is then sold and shipped to other oil and natural gas companies and refineries in Texas and the rest of the United States, as well as in Japan, India, Africa, and other foreign jurisdictions — most of whom are likely unaware of the illegitimate source of the crude oil. According to law enforcement estimates, the U.S. importers can make more than five million U.S. dollars in profit for each oil tanker shipment of crude oil from the United States to foreign jurisdictions, with multiple tankers en route every month. Repatriating the Stolen Crude Oil Profits to the Cartels Through Wire Transfers and False Invoices After selling the stolen crude oil on the U.S. and global energy markets, the U.S. importers receive domestic and international wire transfers from the third-party brokers, including wires routed through multiple accounts and jurisdictions, as payment for the stolen crude oil. The U.S. importers then send wire transfers to the U.S. and Mexican companies controlled by the Mexican brokers who then pay the Cartels their share of the illicit profits. As part of the scheme, the wire instructions fraudulently claim that U.S. importers are sending payments for invoices associated with the import of waste oil or other hazardous materials to obfuscate the oil smuggling scheme. However, based on their transaction activity, customer profile, and online activity, the U.S. importers do not appear to be in the business of processing waste oil and other hazardous materials and instead appear to be in the business of only buying and selling crude oil.20 18. An ultimate consignee is “[t]he person, party, or designee that is located abroad and actually receives the export shipment. This party may be the end user or the Foreign Principals Party in Interest (FPPI).” 15 CFR § 30.1(c). 19. For the spot price of WTI crude oil, see EIA, “Petroleum & Other Liquids” (“WTI Spot Price”). 20. Companies that handle, transport, or process waste oil or other hazardous waste should be registered with the U.S. Environmental Protection Agency (EPA). Financial institutions can use the EPA’s Enforcement and Compliance History Online (ECHO) search tool to verify if their customers are listed. For detailed searches, see EPA, “Facility Search – Enforcement and Compliance Data.”

FINCEN ALERT 6 Figure 1. General Depiction of Cartel Oil Smuggling Operation on U.S. Southwest Border Treasury Sanctions Key CJNG-linked Network Involved in Fentanyl Trafficking, Fuel Theft, and Oil Smuggling on the U.S. Southwest Border Building on its prior sanctions action from September 2024, on May 1, 2025, OFAC sanctioned additional Mexican individuals and companies pursuant to E.O. 14059 and E.O. 13224 “Blocking Property and Prohibiting Transactions With Persons Who Commit, Threaten to Commit, or Support Terrorism” that are linked, directly or indirectly, to CJNG’s fuel theft and oil smuggling operations on the U.S. southwest border. This network generates hundreds of millions of dollars annually, benefitting CJNG, through a slew of criminal activities, including fentanyl trafficking, fuel theft, and smuggling stolen crude oil from Mexico across the southwest border. OFAC designated Cesar Morfin Morfin (a.k.a. Primito), a CJNG leader profiting from fuel theft, pursuant to E.O. 14059 and E.O. 13224. Primito is the CJNG cell leader for Tamaulipas, Mexico. Primito previously led a faction of the sanctioned Gulf Cartel and transformed it into a CJNG faction due to his close association with sanctioned CJNG leader Ruben Oseguera Cervantes (a.k.a. “El Mencho”). Primito is involved in the transportation, importation, and distribution of narcotics, including fentanyl, heroin,

FINCEN ALERT 7 methamphetamine, cocaine, and marijuana, into the United States. He has also been known to import fentanyl and methamphetamine precursor chemicals sourced from China. Primito’s luxurious lifestyle has included ownership of exotic animals and dozens of luxury vehicles. Recently, Primito and his network have refocused their criminal enterprise around stolen fuel-related activities, specifically the smuggling of crude oil into the United States given its high profit margins. Primito acquires stolen crude from various sources, including co-opted Pemex employees and other CJNG members. Given his control over port of entry bridges between the Tamaulipas and Texas border regions, Primito also charges fees to any trucks moving crude into the United States via these routes. His subordinates and associates assist him in falsifying official customs documents to aid in the cross-border smuggling of stolen crude oil. Additionally, Primito’s subordinates operate front companies on his behalf, some of which are used to sell stolen fuel to retail gas stations. OFAC also sanctioned two of Primito’s brothers and business associates (Alvaro Noe Morfin Morfin and Remigio Morfin Morfin) pursuant to E.O. 14059 and two hazardous materials transportation companies (SLA. Servicios Logisticos Ambientales, S.A. de C.V. and Grupo Jala Logistica, S.A. de C.V.) pursuant to E.O. 14059 and E.O. 13224 that are linked to CJNG fuel theft.21 Red Flag Indicators of Cartel Oil Smuggling Schemes on the U.S. Southwest Border FinCEN, in consultation with law enforcement, has identified the following red flag indicators to help detect, prevent, and report potentially suspicious activity related to Cartel oil smuggling schemes on the U.S. southwest border. As no single red flag is determinative of illicit or suspicious activity, before determining if a behavior or transaction is suspicious or otherwise indicative of connection to illicit oil smuggling or is otherwise suspicious, financial institutions should conduct an appropriate review of the relevant activity, including whether the customer exhibits multiple red flag indicators. In conducting such a review, financial institutions may consider as one factor a customer’s historical financial activity and whether the transactions are in line with prevailing business practices.22 A customer is a small U.S.-based oil and natural gas company, importing company, or freight company operating in states on the U.S. southwest border with transactional activity and profit margins that exceed the typical business profile of similar companies in their industries. 21. See OFAC May 2025 Designation, supra note 2; The White House, Executive Order on Imposing Sanctions on Foreign Persons Involved in the Global Illicit Drug Trade, 86 FR 71,549 (Dec. 15, 2021); The White House, Executive Order on Blocking Property and Prohibiting Transactions With Persons Who Commit, Threaten To Commit, or Support Terrorism, 66 FR 49,079 (Sept. 23, 2001). 22. FinCEN reminds financial institutions that no customer type presents a single level of uniform risk or a particular risk profile related to money laundering, terrorist financing, or other illicit financial activity. The illicit finance risks highlighted in this Alert should not be used as the basis for wholesale or indiscriminate de-risking of customers involved in the U.S. and Mexican oil and natural gas or freight industries. See Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation, FinCEN, National Credit Union Administration, Office of the Comptroller of the Currency, “Joint Statement on the Risk-Based Approach to Assessing Customer Relationships and Conducting Customer Due Diligence” (July 6, 2022).

FINCEN ALERT 8 A customer is a small U.S.-based oil and natural gas company that is selling WTI crude oil and other types of crude oil for significantly less than the market rate.23 A customer is a small U.S.-based oil and natural gas company that is selling millions of dollars of crude oil per month but has no online presence or is using a basic website that appears designed to closely resemble major U.S. oil and natural gas companies’ websites in order to make their significant crude oil sales appear legitimate. A customer is a small U.S.-based oil and natural gas company that has a website indicating it is only a buyer or seller of crude oil, but the company is sending wire transfers to Mexican or U.S. companies for purchases of purported waste oil or other hazardous materials. A customer is a small U.S.-based oil and natural gas company that is suddenly purchasing waste oil or other hazardous materials from a singular or small number of Mexican and U.S. companies. A customer is a small U.S.-based oil and natural gas company that is sending wire transfers to Mexican or U.S. companies for waste oil or other hazardous materials without possessing the appropriate registrations with the U.S. Environmental Protection Agency (EPA).24 A customer is a small U.S.-based oil and natural gas company that is sending wire transfers for waste oil or other hazardous materials to Mexican or U.S. companies that do not appear to be related to the oil and natural gas industry. A customer is a small U.S.-based oil and natural gas company that has a sudden and significant volume of transactional activity with one or a small number of Mexican or U.S. companies that have little to no online presence and displays other indicators of illicit shell company activity. A customer is a small U.S.-based oil and natural gas company that is receiving domestic and international wire transfers for invoices related to the sale of crude oil but sending wire transfers to Mexican or U.S. companies for invoices for the purchase of waste oil or other hazardous materials. A customer is a U.S. importing company that is receiving wire transfers from U.S.-based oil and natural gas companies and sending wire transfers to Mexican companies for invoices involving the U.S. importing company’s purchases of waste oil or other hazardous materials, despite the U.S. importing company lacking appropriate registrations from the EPA.25 A customer is a U.S. importing company that is receiving wire transfers from a small U.S.- based oil and natural gas company for the sale of waste oil or other hazardous materials and then wiring those funds to a singular or small number of companies in Mexico. 23. See EIA, WTI Spot Price, supra note 19. 24. See supra note 20. 25. Id.

FINCEN ALERT 9 A customer claims to be a U.S.-based company involved in the import of waste oil or other hazardous materials, but upon further review, appears to be a shell company of a Mexican company. A customer is a U.S. company that is the ultimate consignee of purchases of waste oil or other hazardous materials but is registered to a residential address. A customer is a small U.S.-based oil and natural gas company, importing company, or freight company operating on the U.S. southwest border that is transacting with Mexican and U.S. companies and their beneficial owners associated with Cartel-related activity based on open￾source reporting in Mexico, indictments, and OFAC designations and/or press releases. Increasing Information Sharing Relating to Oil Smuggling Schemes on the U.S. Southwest Border Information sharing among financial institutions is critical to identifying, reporting, and preventing the Cartels from smuggling stolen crude oil across the U.S. southwest border or other specified unlawful activities that apply to a money laundering offense. U.S. financial institutions and associations of U.S. financial institutions sharing information under the safe harbor authorized by section 314(b) of the USA PATRIOT Act are reminded that they may share information with each other regarding individuals, entities, organizations, and countries for purposes of identifying, and, where appropriate, reporting activities that may involve possible terrorist activity or money laundering.26 FinCEN strongly encourages such voluntary information sharing as it relates to money laundering or possible terrorist financing in connection with the Cartels smuggling stolen crude oil across the U.S. southwest border or other specified unlawful activities. Given the transnational nature of illicit activity related to the Cartels smuggling stolen oil from Mexico into the United States for sale on the U.S. and global energy markets, FinCEN also encourages U.S. financial institutions to continue to use, and potentially expand, their existing processes to collect and share information with foreign financial institutions in furtherance of investigations that involve cross￾border activity.27 FinCEN also reminds U.S. financial institutions that the sharing of underlying account or transaction information does not violate Suspicious Activity Report (SAR) confidentiality restrictions in the BSA and FinCEN’s regulations unless such sharing would potentially reveal the existence of a SAR.28 26. See FinCEN, “Section 314(b) Fact Sheet” (Dec. 2020); 31 CFR § 1010.540. 27. See, e.g., FinCEN, “Prepared Remarks of FinCEN Director Andrea Gacki During the SIFMA AML Conference” (May 6, 2024). 28. See, e.g., 31 CFR § 1020.320(e) (noting that the prohibition from disclosing SARs, or any information that would reveal the existence of a SAR, explicitly does not include “[t]he underlying facts, transactions, and documents upon which a SAR is based…”). The final rule on the Confidentiality of Suspicious Activity Reports stated that “[d]ocuments that may identify suspicious activity but that do not reveal whether a SAR exists (e.g., a document memorializing a customer transaction, such as an account statement indicating a cash deposit or a record of a funds transfer), should be treated as falling within the underlying facts, transactions, and documents upon which a SAR may be based, and should not be afforded confidentiality.” See FinCEN, Confidentiality of Suspicious Activity Reports, 75 FR 75,595 (Dec. 3, 2010).

FINCEN ALERT 10 Reminder of Relevant BSA Obligations and Tools for U.S. Financial Institutions Suspicious Activity Reporting Other Relevant BSA Reporting Suspicious Activity Reporting A financial institution is required to file a SAR if it knows, suspects, or has reason to suspect a transaction conducted or attempted by, at, or through the financial institution involves funds derived from illegal activity; is intended or conducted to disguise funds derived from illegal activity; is designed to evade regulations promulgated under the BSA; lacks a business or apparent lawful purpose; or involves the use of the financial institution to facilitate criminal activity.29 All statutorily defined financial institutions may voluntarily report suspicious transactions under the existing suspicious activity reporting safe harbor.30 FinCEN encourages financial institutions to file voluntary SARs on suspicious activity below the relevant monetary threshold and reminds financial institutions that any SAR notification or filing—including a voluntary filing—is afforded protection from liability.31 When a financial institution files a SAR, it is required to maintain a copy of the SAR and the original or business record equivalent of any supporting documentation for a period of five years from the date of filing the SAR.32 Financial institutions must provide any requested documentation supporting the filing of a SAR upon request by FinCEN or an appropriate law enforcement or supervisory agency.33 When requested to provide supporting documentation, financial institutions should take special care to verify that a requestor of information is, in fact, a representative of FinCEN or an appropriate law enforcement or supervisory agency. A financial institution should incorporate procedures for such verification into its BSA compliance or AML program. These procedures may include, for example, independent employment verification with the requestor’s field office or face-to-face review of the requestor’s credentials. SAR Filing Instructions SARs, and compliance with other BSA requirements, are crucial to identifying and stopping Cartel oil smuggling schemes on the U.S. southwest border. FinCEN requests that financial 29. See 31 CFR §§ 1020.320, 1021.320, 1022.320, 1023.320, 1024.320, 1025.320, 1026.320, 1029.320, 1030.320. 30. See 31 U.S.C. § 5318(g)(3). Financial institutions may report suspicious transactions regardless of amount involved and still take advantage of the safe harbor. 31. See, e.g., 31 CFR § 1020.320(f) (“A bank, and any director, officer, employee, or agent of any bank, that makes a voluntary disclosure of any possible violation of law or regulation to a government agency or makes a disclosure pursuant to this section or any other authority, including a disclosure made jointly with another institution, shall be protected from liability to any person for any such disclosure, or for failure to provide notice of such disclosure to any person identified in the disclosure, or both, to the full extent provided by 31 U.S.C. § 5318(g)(3).”) 32. See 31 CFR §§ 1020.320(d), 1021.320(d), 1022.320(c), 1023.320(d), 1024.320(c), 1025.320(d), 1026.320(d), 1029.320(d), 1030.320(d). 33. Id.; see also FinCEN, “Suspicious Activity Report Supporting Documentation” (June 13, 2007).

FINCEN ALERT 11 institutions indicate a connection between the suspicious activity being reported and the activities highlighted in this Alert by including the key term “FIN-2025-OILSMUGGLING” in SAR field 2 (Filing Institution Note to FinCEN), as well as in the narrative. Financial institutions may highlight additional advisory, alert, or notice keywords in the narrative, if applicable. Financial institutions should include all available information relating to the account(s) and location(s) involved in the reported activity, identifying information and descriptions of any legal entities or arrangements involved and associated beneficial owners, and any information about related persons or entities involved in the activity. Financial institutions also should provide all available information regarding other domestic and foreign financial institutions involved in the activity; where appropriate, financial institutions should consider filing a SAR jointly on shared suspicious activity.34 Financial institutions are required to file complete and accurate reports that incorporate all relevant information available. In situations involving violations requiring immediate attention, such as ongoing money laundering schemes, a financial institution should also immediately notify, by telephone, an appropriate law enforcement authority, in addition to filing a timely SAR.35 Immediate notification to law enforcement is especially important in situations involving suspected terrorist activity, as terrorists and terrorist organizations often rely on the international financial system to acquire funding to sustain and finance their operations and engage in acts of terrorism. Financial institutions wanting to report suspicious transactions that may potentially relate to terrorist activity should call the Financial Institutions Toll-Free Hotline at (866) 556-3974 (7 days a week, 24 hours a day).36 Other Relevant BSA Reporting Requirements Financial institutions and other entities or persons may also have other relevant BSA reporting requirements to provide information in connection with the subject of this Alert. These include obligations related to the Currency Transaction Report (CTR),37 Report of Cash Payments Over $10,000 Received in a Trade or Business (Form 8300),38 Report of Foreign Bank and 34. See 31 CFR §§ 1020.320(e)(1)(ii)(A)(2))(i), 1021.320(e)(1)(ii)(A)(2)), 1022.320(d)(1)(ii)(A)(2), 1023.320(e)(1)(ii)(A)(2)(i), 1024.320(d)(1)(ii)(A)(2), 1025.320(e)(1)(ii)(A)(2), 1026.320(e)(1)(ii)(A)(2)(i), 1029.320(d)(1)(ii)(A)(2), 1030.320(d)(1)(ii)(A)(2). 35. See, e.g., 31 CFR §§ 1020.320(b)(3), 1022.320(b)(3), 1023.320(b)(3). 36. The purpose of the hotline is to expedite the delivery of this information to law enforcement. Financial institutions should immediately report any imminent threat to appropriate law enforcement officials. In considering whether particular activity may relate to terrorist or terrorist financing activity, FinCEN reminds financial institutions that State designated certain Cartels as FTOs and SDGTs. 37. A report of each deposit, withdrawal, exchange of currency, or other payment or transfer, by, through, or to a financial institution that involves a transaction in currency of more than $10,000. Multiple transactions may be aggregated when determining whether the reporting threshold has been met. See 31 CFR §§ 1010.310–13, 1020.310–13, 1021.310–13, 1022.310–13, 1023.310–13, 1024.310–13, 1026.310–13. 38. A report filed by a trade or business that receives currency in excess of $10,000 in one transaction or two or more related transactions. The transactions are required to be reported on a joint FinCEN/Internal Revenue Service form when not otherwise required to be reported on a CTR. See 31 CFR §§ 1010.330–31. A Form 8300 also may be filed voluntarily for any suspicious transaction, even if the total amount does not exceed $10,000.

FINCEN ALERT 12 Financial Accounts (FBAR),39 Report of International Transportation of Currency or Monetary Instruments (CMIR),40 Registration of Money Services Business (RMSB),41 and Designation of Exempt Person (DOEP).42 Form 8300 Filing Instructions When filing a Form 8300 involving a suspicious transaction relevant to this Alert, FinCEN requests that the filer selects Box 1b (“suspicious transaction”) and includes the key term “FIN-2025-OILSMUGGLING” in the “Comments” section of the report. Due Diligence Banks, brokers or dealers in securities, mutual funds, and futures commission merchants and introducing brokers in commodities (FCM/IBs) are required to have appropriate risk￾based procedures for conducting ongoing customer due diligence that include, but are not limited to: (i) understanding the nature and purpose of customer relationships for the purpose of developing a customer risk profile; and (ii) conducting ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information.43 Covered financial institutions are required to identify and verify the identity of beneficial owners of legal entity customers, subject to certain exclusions and exemptions.44 Among other things, this facilitates the identification of legal entities that may be owned or controlled by foreign politically exposed persons (PEPs). 39. A report filed by a U.S. person that has a financial interest in, or signature or other authority over, foreign financial accounts with an aggregate value exceeding $10,000 at any time during the calendar year. See 31 CFR § 1010.350; FinCEN Form 114. 40. A form filed to report the transportation of more than $10,000 in currency or other monetary instruments into or out of the United States. See 31 CFR § 1010.340. 41. A form filed to register a money services business (MSB) with FinCEN, or to renew such a registration. See 31 CFR § 1022.380. 42. A report filed by banks to exempt certain customers from currency transaction reporting requirements. See 31 CFR § 1020.315. 43. See 31 CFR §§ 1020.210(a)(2)(v), 1023.210(b)(5), 1024.210(b)(6), and 1026.210(b)(5). 44. See 31 CFR §§ 1010.230 and 1010.605(e)(1) (defining “covered financial institution”). 45. See 31 CFR § 1010.620. The definition of “covered financial institution” is found in 31 CFR § 1010.605(e)(1). The definition of “private banking account” is found in 31 CFR § 1010.605(m). The definition of “non-U.S. person” is found in 31 CFR § 1010.605(h). Senior foreign political figures and due diligence obligations for private banking accounts In addition to these due diligence obligations, under section 312 of the USA PATRIOT Act (31 U.S.C. § 5318(i)) and its implementing regulations, covered financial institutions must implement due diligence programs for private banking accounts held for non-U.S. persons that are designed to detect and report any known or suspected money laundering or suspicious activity conducted through or involving such accounts.45 Covered financial institutions must establish risk-based controls and procedures for ascertaining the identities of nominal and beneficial owners of such

FINCEN ALERT 13 accounts and ascertaining whether any of these owners are senior foreign political figures, and for conducting enhanced scrutiny on accounts held by senior foreign political figures that is reasonably designed to detect and report transactions that may involve the proceeds of foreign corruption.46 46. See 31 CFR § 1010.620(c). 47. See 31 CFR §§ 1010.210, 1020.210, 1021.210, 1022.210, 1023.210, 1024.210, 1025.210, 1026.210, 1027.210, 1028.210, 1029.210, and 1030.210. 48. See 31 CFR § 1010.610. 49. See FinCEN, Anti-Money Laundering Program Requirements for Money Services Businesses with Respect to Foreign Agents or Foreign Counterparties, Interpretive Release 2004-1, 69 FR 74,439 (Dec. 14, 2004); see also FinCEN, “Guidance on Existing AML Program Rule Compliance Obligations for MSB Principals with Respect to Agent Monitoring” (Mar. 11, 2016). AML/CFT program and correspondent account due diligence requirements Financial institutions are reminded of AML/CFT program requirements,47 and covered financial institutions are reminded of correspondent account due diligence requirements under Section 312 of the USA PATRIOT Act (31 U.S.C. § 5318(i)) and implementing regulations.48 As described in FinCEN Interpretive Release 2004-1, the AML/CFT program of a money services business (MSB) must include risk-based policies, procedures, and controls designed to identify and minimize risks associated with foreign agents and counterparties.49 For Further Information FinCEN’s website at www.fincen.gov contains information on how to register for FinCEN Updates. Questions or comments regarding the contents of this Alert should be addressed to the FinCEN Regulatory Support Section by submitting an inquiry at www.fincen.gov/contact. The mission of the Financial Crimes Enforcement Network is to safeguard the financial system from illicit activity, counter money laundering and the financing of terrorism, and promote national security through strategic use of financial authorities and the collection, analysis, and dissemination of financial intelligence.