FinCEN Joint Advisory on Non-Work Authorized Populations and Their Employers and Risks to the U.S. Financial System

1 The U.S. Department of the Treasury’s (Treasury) Financial Crimes Enforcement Network (FinCEN), jointly with the Federal Deposit Insurance Corporation, Office of the Comptroller of the Currency, and National Credit Union Administration, (collectively, the Agencies), is issuing this Advisory in coordination with the Internal Revenue Service (IRS) to advise financial institutions1 —in particular, banks2 —to be vigilant against fraud schemes and other suspicious or potentially criminal activities involving the unlawful employment of illegal aliens and the associated risks to the integrity of the U.S. financial system.3 Through these schemes, employers can gain an unfair advantage over legitimate U.S. businesses; depress wages; facilitate identity theft of people who are authorized to work in the United States, including American citizens; and steal millions of dollars in Federal and state payroll tax revenue meant for government benefit programs. Non-work authorized populations and their employers often rely on access to the U.S. financial system. In certain instances, the access to financial services and unlawfully obtained wages can be leveraged to facilitate the financing of transnational criminal organizations (TCOs)—several of which have been designated as Foreign Terrorist Organizations (FTOs)—and their global criminal enterprises, including drug trafficking, human trafficking, and other illegal activity in the United States.4

On January 20, 2025, President Trump issued Executive Order (E.O.) 14159, Protecting the American People Against Invasion, which declared it is the policy of the United States to faithfully execute

1. See 31 U.S.C. § 5312(a)(2); 31 C.F.R. § 1010.100(t).
2. Under the Bank Secrecy Act (BSA), the term “bank” includes each agent, agency, branch, or office within the United States of banks, savings associations, credit unions, and foreign banks. 31 C.F.R. § 1010.100(d).
3. As used in this Advisory, “illegal aliens” does not include: (1) U.S. citizens or nationals; (2) lawful permanent residents of the United States; or (3) other aliens whose employment in the United States is authorized by statute or regulation or who are otherwise specifically authorized to be employed in the United States.
4. See The White House, Proclamation Declaring a National Emergency at the Southern Border of the United States, 90 FR 8327 (Jan. 20, 2025); The White House, “Fact Sheet: President Donald J. Trump Declares a National Emergency at the Southern Border” (Jan. 22, 2025); The White House, Executive Order on Designating Cartels and Other Organizations as Foreign Terrorist Organizations and Specially Designated Global Terrorists, 90 FR 8439 (Jan. 20, 2025). FIN-2026-A002 June 5, 2026 Joint Advisory on Non-Work Authorized Populations and Their Employers and Risks to the Integrity of the U.S. Financial System Suspicious Activity Report (SAR) Filing Request: FinCEN requests that financial institutions reference this Advisory by including the key term “FINANCIALINTEGRITY-2026-A002” in SAR field 2 (Filing Institution Note to FinCEN) and the narrative.

FINCEN ADVISORY 2 the immigration laws against all inadmissible and removable aliens, and instructed the U.S. Government to ensure that employment authorization is not provided to any unauthorized aliens.5

The Trump Administration has since led a whole-of-government effort to secure the U.S. borders and deport the millions of illegal aliens who unlawfully reside and work in the United States.6

Further, on May 19, 2026, President Trump issued E.O. 14406, Restoring Integrity to America’s Financial System, which directed the Secretary of the Treasury to issue this Advisory to financial institutions as part of a whole-of-government effort to address the risks associated with the exploitation of the U.S. financial system by non-work authorized populations and their employers.7 This joint Advisory aligns with FinCEN’s Anti-Money Laundering/Countering the Financing of Terrorism (AML/CFT) National Priorities of Fraud, Terrorist Financing, Drug Trafficking Organization (DTO) Activity, TCO Activity, and Human Trafficking and Human Smuggling, and is issued as part of Treasury’s continued effort to prevent the exploitation of the U.S. financial system by illegal aliens in the United States.8 Methodologies and Financial Typologies Associated with the Hiring, Concealment, and Exploitation of Unlawful Alien Workers The Immigration Reform and Control Act (IRCA) of 1986 prohibits U.S. persons and entities from knowingly hiring, or recruiting or referring for a fee, unlawful aliens for employment.9

Under IRCA and its implementing regulations, employers are required to verify and document the identity and employment eligibility of their employees through the Employment Eligibility Verification Form I-9 (Form I-9).10 As part of its worksite enforcement strategy, the U.S. Department of Homeland Security’s Immigration and Customs Enforcement (ICE) inspects Form I-9s for compliance with U.S. employment laws to deter illegal employment and take action against employers that employ unlawful aliens.11 According to ICE, many employers across the agriculture, construction, domestic service, hospitality, and other industries (hereafter “complicit employers”) are knowingly—or through willful negligence—facilitating the hiring, concealment, and in some cases, exploitation of unlawful alien labor in their workforce to reduce labor costs and gain an unfair advantage over competitors.12 A key feature of these schemes is the use of identity theft and payroll fraud to conceal violations of IRCA and other U.S. immigration laws. 5. See The White House, Protecting the American People Against Invasion, 90 FR 8443 (Jan. 20, 2025). 6. See The White House, Secure the Border; U.S. Department of Homeland Security (DHS), Press Release, “DHS Removes More than Half a Million Illegal Aliens From U.S.” (Oct. 27, 2025); ICE, ICE Enforcement and Removal Operations Statistics. 7. See The White House, Restoring Integrity to America’s Financial System, 91 FR 30479 (May 22, 2026); The White House, “Fact Sheet: President Donald J. Trump Restores Integrity to America’s Financial System” (May 19, 2026). 8. See FinCEN, “AML/CFT National Priorities” (June 30, 2021); FinCEN, FIN-2025-Alert003, “FinCEN Alert on Cross￾Border Funds Transfers Involving Illegal Aliens” (Nov. 28, 2025). 9. See 8 U.S.C. § 1324a. 10. See ICE, “Form I-9 Inspection Under Immigration and Nationality Act § 274A” (Mar. 16, 2026). 11. See ICE, “Worksite Enforcement Strategy” (Apr. 30, 2009). 12. See ICE, Homeland Security Investigations Cornerstone, “Compliance & Enforcement Bulletin” (Dec. 2025); ICE, Worksite Enforcement Investigations.

FINCEN ADVISORY 3 Use of Identity Theft In some instances, complicit employers have pleaded guilty to hiring unlawful aliens for on-the￾books employees and knowingly accepting fraudulent identification documents—such as legal permanent resident cards, Social Security cards, and drivers’ licenses—as evidence of authorized status or employment in the United States.13 According to recent ICE worksite enforcement operations, unlawful aliens illicitly obtain Social Security numbers (SSNs) and other personally identifiable information (PII) of U.S. citizens and lawful permanent residents and submit this information to make the Form I-9s appear legitimate, gain unlawful employment and wages, as well as employer- and government-provided health care benefits in the United States, and, based on FinCEN’s analysis of Bank Secrecy Act (BSA) reporting, fraudulently obtain access to financial services and extension of credit for automobile and other types of loans.14 Victims of these identity theft schemes can face higher taxes, and denial of employer and government provided health care, disability, and tuition benefits as a result of illegal aliens using their stolen identity to earn wages and employment benefits.15 The fraudulently obtained SSNs and other PII can also be used by illegal aliens to remit unlawfully obtained wages through financial institutions to their home countries.16 As part of these schemes, complicit employers may also assist illegal aliens in perpetrating identity theft and obtaining fraudulent documentation.17 In some instances, this may serve as a means to exploit and abuse their unlawful alien workers.18 13. See e.g., U.S. Department of Justice (DOJ), U.S. Attorney’s Office, Eastern District of Pennsylvania, Press Release, “Asplundh Tree Expert Co. Charged with Recruiting, Hiring, and Employing Unauthorized Aliens” (Sept. 19, 2017). 14. See ICE, Press Release, “ICE Worksite Enforcement Operation Uncovers Widespread Identity Theft Affecting More Than 100 Victims Across the Nation” (June 18, 2025); see, e.g., DOJ, U.S. Attorney’s Office, Western District of North Carolina, Press Release, “Mexican National Pleads Guilty To Identity Theft And Seven Others Face Immigration Violations Following Federal Search At Kings Mountain Business” (July 31, 2025); DOJ, U.S. Attorney’s Office, Western District of Michigan, Press Release, “Illegal Alien Who Unlawfully Used A Social Security Number and Assaulted Agents Sentenced to 15 Months in Custody” (Apr. 14, 2026); DOJ, U.S. Attorney’s Office, Southern District of Mississippi, Press Release, “119 Illegal Aliens Prosecuted For Stealing Identities of Americans, Falsifying Immigration Documents, Fraudulently Claiming to be U.S. Citizens, Other Crimes” (Nov. 7, 2019); DOJ, U.S. Attorney’s Office, District of Rhode Island, Press Release, “Dominican National Pleads Guilty to Illegal Reentry, Misuse of Social Security Number, and Benefits Fraud” (Apr. 2, 2026). 15. See ICE, Press Release, “ICE Worksite Enforcement Operation Uncovers Widespread Identity Theft Affecting More Than 100 Victims Across the Nation” (June 18, 2025). 16. See FinCEN, FIN-2025-Alert003, “FinCEN Alert on Cross-Border Funds Transfers Involving Illegal Aliens” (Nov. 28, 2025). 17. See e.g., DOJ, Eastern District of Michigan, Press Release, “Restaurant Owner Indicted on Charges of Harboring Illegal Aliens and Visa Fraud” (Apr. 24, 2026); DOJ, U.S. Attorney’s Office, Northern District of West Virginia, Press Release, “Morgantown Construction Company Sentenced for Tax Fraud, Employing Illegals” (Jan. 8, 2026). 18. Severe forms of trafficking in persons includes the recruitment, harboring, transportation, provision, or obtaining of a person for labor or services, through the use of force, fraud, or coercion for the purpose of subjection to involuntary servitude, peonage, debt bondage, or slavery. See 22 U.S.C. § 7102(11)(B); see also 18 U.S.C. § 1589; DHS, “What is Forced Labor?” (last updated Sept. 23, 2025); DOJ, Eastern District of Michigan, Press Release, “Restaurant Owner Indicted on Charges of Harboring Illegal Aliens and Visa Fraud” (Apr. 24, 2026); DOJ, U.S. Attorney’s Office, District of Idaho, Press Release, “Guatemalan National Arrested and Charged for Employing Illegal Aliens at Caldwell Business” (Mar. 2, 2026); DOJ, U.S. Attorney’s Office, Central District of California, Press Release, “Simi Valley Couple Arrested for Abusing Asylum-Seeking Immigrants, Operating Illegal ‘Work for Smuggling’ Scheme” (Feb. 26, 2025).

FINCEN ADVISORY 4 Case Study: Mexican National Pleads Guilty to Identity Theft and Seven Others Face Immigration Violations Following Federal Search at Kings Mountain Business On July 31, 2025, the U.S. Department of Justice (DOJ) announced that Jose De La Cruz-Lopez, an illegal alien from Mexico, pleaded guilty to using a fraudulent SSN and false immigration identification documents. In addition to De La Cruz-Lopez, two others also entered guilty pleas. According to DOJ, De La Cruz-Lopez, who was not authorized to work in the United States, admitted to obtaining employment at Buckeye Fire Equipment using a driver’s license bearing De La Cruz-Lopez’s image and the name of an individual eligible to work in the United States and a copy of the individual’s Social Security card. The defendant, who had been employed at the company since 2022, falsely attested on the I-9 employment eligibility verification form that he was the person presented on the ID and that he was a citizen of the United States.19 Use of Payroll Fraud Schemes Complicit employers can also conceal their violation of IRCA and the hiring of low wage unlawful alien workers through off-the-books payments.20 These schemes allow complicit employers to further reduce their labor costs by evading Federal payroll taxes—contributing to a significant tax gap in recent years21—under the Federal Insurance Contributions Act (FICA)22 for Social Security and Medicare and the Federal Unemployment Tax Act (FUTA), as well as state-level payroll taxes and premiums for required employment benefits such as workers’ compensation insurance. In its simplest form, these schemes involve complicit employers making cash payments or using irregular payment methods to pay unlawful alien workers while maintaining two sets of books for payroll—one to submit fraudulent filings to the IRS and one to track the actual, illegal payments.23 19. See DOJ, U.S. Attorney’s Office, Western District of North Carolina, Press Release, “Mexican National Pleads Guilty To Identity Theft And Seven Others Face Immigration Violations Following Federal Search At Kings Mountain Business” (July 31, 2025). 20. See FinCEN, FIN-2023-NTC1, “FinCEN Calls Attention to Payroll Tax Evasion and Workers’ Compensation Fraud in the Construction Sector” (Aug. 15, 2023). 21. For example, the tax gap for employment taxes in 2022 was $127 billion. See IRS, IRS: The Tax Gap (last updated Apr. 14, 2026). 22. See Social Security Administration (SSA), What is FICA. 23. See, e.g., DOJ, U.S. Attorney’s Office, Eastern District of California, Press Release, “Viva Grocery Store Owner and Former Sacramento City Councilmember Pleads Guilty for His Role in Multiple Fraudulent Schemes” (Apr. 23, 2026); DOJ, U.S. Attorney’s Office, District of New Jersey, Press Release, “South Jersey Man Admits Hiring Illegal Immigrants, Failing to Collect Payroll Taxes” (May 6, 2016).

FINCEN ADVISORY 5 In recent years, complicit employers have contracted with complicit labor brokers24 to hire, house, transport, and pay unlawful alien workers through off-the-books payroll fraud schemes that evade Federal and state payroll taxes and workers’ compensation benefits.25 FinCEN has observed a significant amount of BSA reporting involving this type of scheme since FinCEN issued its August 2023 Notice on Payroll Tax Evasion and Workers’ Compensation Fraud in the Construction Sector (2023 Payroll Tax Fraud Notice). According to FinCEN analysis, financial institutions reported over $2.5 billion in suspicious activity associated with this type of scheme in 2025.26 These schemes often start with complicit employers contracting with a complicit labor broker. The labor broker will set up a shell company27 either directly or through a nominee owner purporting to be involved in the agriculture, construction, domestic service, hospitality, or staffing industries. The shell company will often be an unregistered money services business (MSB)28 providing off￾the-books payroll or payment processor services for the complicit employers. According to the IRS, these shell companies may have generic names such as ABC Construction or XYZ Logistics that may correlate to the initials of the labor broker’s name. Based on FinCEN’s analysis of BSA reporting and other available information, complicit labor brokers may also use the shell company to engage in other illicit transactions such as money laundering for DTOs and TCOs.29 These schemes are often part of a broader, global money laundering network that inserts cash into the U.S. financial system in small amounts, across a large number of cities, and then collects checks from the involved businesses—including shell companies associated with payroll fraud schemes.30 According to FinCEN analysis of BSA reporting, complicit labor brokers, or individuals acting on their behalf, may use a foreign identity document—such as a foreign passport—or an Individual Taxpayer Identification Number (ITIN) to open the account for the shell company with themselves listed as “self-employed,” “laborer,” or a similar term.31 The labor broker may also try to evade Customer Identification Program (CIP) requirements32 by using a Commercial Mail Receiving 24. Legitimate labor brokers exist in a variety of industries and serve as intermediaries who recruit, hire, and supply American and other lawful workers to employers. As part of these services, labor brokers often handle payroll, contracts, and logistics on the employer’s behalf. 25. See DOJ, U.S. Attorney’s Office, Eastern District of Pennsylvania, Press Release, “Labor Contractor Indicted for Operating Undocumented Worker Conspiracy and Extensive Tax Fraud” (Apr. 14, 2021); see also FinCEN, FIN-2023- NTC1, “FinCEN Calls Attention to Payroll Tax Evasion and Workers’ Compensation Fraud in the Construction Sector” (Aug. 15, 2023). 26. See generally FinCEN, FIN-2023-NTC1, “FinCEN Calls Attention to Payroll Tax Evasion and Workers’ Compensation Fraud in the Construction Sector” (Aug. 15, 2023). 27. See Treasury, “2026 National Money Laundering Risk Assessment” (Mar. 2026), p. 59; see also FinCEN, “The Role of Domestic Shell Companies in Financial Crime and Money Laundering: Limited Liability Companies” (Nov. 2006). 28. See 31 C.F.R. § 1010.100(ff). 29. See FinCEN, FIN-2023-NTC1, “FinCEN Calls Attention to Payroll Tax Evasion and Workers’ Compensation Fraud in the Construction Sector” (Aug. 15, 2023), p. 2. 30. Id. 31. Id. 32. See 31 C.F.R. § 1020.220(a)(2)(i)(A)(3).

FINCEN ADVISORY 6 Agency33 during account onboarding instead of their real address to obfuscate the fact that they do not have any real business operations. The complicit labor broker then directs the complicit employers to write checks payable to the shell company for purported services or products related to their industry (e.g., a construction business sending checks for framing, drywall, stucco, masonry, or painting). The complicit labor brokers can then launder the funds by cashing the checks to the shell companies in structured transactions through banks and MSBs, including check cashiers,34 or depositing the checks into the shell company’s bank account. After deducting a four to ten percent fee for the off-the-books payroll services, the complicit labor broker sends payments to the unlawful alien workers on behalf of the complicit employers through (i) cash couriers, (ii) checks, or (iii) peer-to-peer (P2P) platforms.35 These payments (known as “structuring” and “microstructuring”) are often repetitive transactions that are designed to fall below BSA reporting and recordkeeping thresholds, and that may correlate to payroll cycles outside of standard payroll processing systems.36 Neither the complicit labor broker nor the complicit employers withhold any Federal and state payroll taxes for the unlawful alien workers, and do not pay the employer share of such taxes. Complicit labor brokers may also use the shell company to obtain a minimal workers’ compensation policy for a small number of purported employees and “rent” or sell access to the complicit employers that are employing hundreds of unlawful alien workers to allow them to avoid costly premiums by committing insurance fraud.37 As a result of this off-the-books payroll tax evasion and workers’ compensation fraud scheme, the complicit employers undercut legitimate companies hiring lawful workers, steal millions of dollars of payroll taxes, and defraud insurance companies. 33. See U.S. Postal Service, Commercial Mail Receiving Agency. 34. Check cashers are a type of MSB. See 31 C.F.R. § 1010.100(ff)(2). 35. See FinCEN, FIN-2023-NTC1, “FinCEN Calls Attention to Payroll Tax Evasion and Workers’ Compensation Fraud in the Construction Sector” (Aug. 15, 2023), p. 4. 36. See The White House, Restoring Integrity to America’s Financial System, 91 FR 30479 (May 22, 2026). 37. Insurance fraud may occur under state law when a company materially and knowingly misrepresents to insurers the number of its employees and associated payroll to obtain a lower premium. See FinCEN, FIN-2023-NTC1, “FinCEN Calls Attention to Payroll Tax Evasion and Workers’ Compensation Fraud in the Construction Sector” (Aug. 15, 2023); see, e.g., DOJ, Press Release, “Two Honduran Nationals Sentenced for Their Roles in Years-Long Off-the-Books Payroll Scheme” (Apr. 14, 2026); DOJ, Press Release, “Florida Businessman Sentenced in Connection with Migrant Labor Employment Scheme, Payroll Tax Evasion, and Worker Death” (Feb. 20, 2025); DOJ, U.S. Attorney’s Office, Middle District of Florida, Press Release, “Illegal Alien Sentenced in Multi-Million Dollar Wire and Tax Fraud Scheme” (Dec. 5, 2024).

FINCEN ADVISORY 7 Case Study: Two Honduran Nationals Sentenced for Their Roles in Years-Long Off-the-Books Payroll Scheme On April 14, 2026, two Honduran nationals, Iris Villafranca and Osman Donaldo Zapata, were sentenced to 204 months and 51 months in prison, respectively, for their roles in operating a years-long, off-the-books cash payroll scheme that facilitated the employment of undocumented aliens working illegally in the United States and caused a loss of more than $38 million to the United States. According to DOJ, from 2015 to 2022, Villafranca and Zapata conspired together and with others to create a series of shell companies to run an unlicensed check cashing and cash courier service business. These shell companies cashed approximately $89 million in checks from subcontractors in the construction industry, charging them a percentage of the dollar amount of the checks they cashed as a fee for this service. Through this scheme, construction contractors and subcontractors paid their workers in cash without withholding and paying required payroll taxes, allowing them to operate without regard to the workers’ legal authority to work in the United States. The defendants also caused the filing of false tax documents with the IRS to conceal the off-the-books payroll scheme. In addition, the defendants defrauded workers’ compensation insurance companies by leasing their certificates of insurance to contractors and by providing fraudulent information to the insurers about, among other things, the number of workers covered by the insurance and the amount workers were paid. Villafranca and Zapata both pleaded guilty to one count of conspiracy to defraud the United States and one count of conspiracy to operate an unlicensed money transmitting business. Villafranca also pleaded guilty to four counts of filing false individual income tax returns, which did not report all the income she earned from the scheme and rental income she earned from real estate she owned. Villafranca was ordered to pay more than $38 million in restitution to the United States and forfeit $89 million of criminal proceeds from the scheme, and Zapata was ordered to pay more than $2.5 million in restitution to the United States. Francisco Alvarez, who conspired with Villafranca, Zapata, and others, was previously sentenced to four years of probation and ordered to pay more than $2.3 million in restitution. A fourth member of the conspiracy is scheduled to be sentenced in June 2026.38 38. See DOJ, Press Release, “Two Honduran Nationals Sentenced for Their Roles in Years-Long Off-the-Books Payroll Scheme” (Apr. 14, 2026).

FINCEN ADVISORY 8 Enhanced Due Diligence for ITINs Under existing CIP requirements, banks are required to identify and verify the identities of each customer to the extent reasonable and practicable.39 In addition to collecting a customer’s name, date of birth, and address, a bank must collect an identification number, which, under the relevant regulations, includes: a. For a U.S. person, a taxpayer identification number; or b. For a non-U.S. person, one or more of the following: a taxpayer identification number; passport number and country of issuance; alien identification card number; or number and country of issuance of any other government-issued document evidencing nationality or residence and bearing a photograph or similar safeguard.40 FinCEN’s regulations define the term Taxpayer Identification Number (TIN) by cross-referencing section 6109 of the Internal Revenue Code of 1986 (the IRC).41 The IRC and its implementing regulations define ITINs, which are issued to resident and nonresident aliens not eligible for an SSN solely for Federal tax purposes.42 An ITIN is a nine-digit number beginning with the number “9” and has a range of numbers from “50” to “65,” “70” to “88,” “90” to “92,” and “94” to “99” for the fourth and fifth digits (i.e. 9XX-7X-XXXX).43 ITINs do not provide evidence of legal status in the United States, authorize recipients to work legally in the United States, or serve as identification outside of the Federal tax system.44 Although ITINs facilitate tax compliance, the Agencies, in accordance with E.O. 14406, note that the use of an ITIN in lieu of an SSN or valid employment authorization document may be identified as a risk factor requiring enhanced due diligence to ensure the account is not being utilized to facilitate the unlawful employment of unlawful aliens.45 The Agencies are also particularly concerned by the use of an ITIN to obtain credit products or open depository accounts where the applicant lacks verified legal presence and the potential illicit finance risks associated with such activity. Consistent with existing BSA obligations, the Agencies encourage banks subject to the jurisdiction of the Agencies to consider the use of an ITIN as part of the bank’s application of appropriate risk￾based procedures for customer due diligence. Specifically, when an ITIN is presented in lieu of an SSN or valid employment authorization document to obtain credit products or open an account, banks are encouraged to assess whether the use of an ITIN may be a relevant risk factor. Banks are further encouraged to conduct this assessment in light of the totality of other factors and information available to the bank to understand the nature and purpose of customer relationships for the purpose of developing customer risk profiles and conduct ongoing monitoring to identify and report suspicious transactions.46 39. 31 C.F.R. § 1020.220. 40. 31 C.F.R. § 1020.220(a)(2)(i)(4). 41. 26 U.S.C. § 6109. 42. Id.; 26 C.F.R. § 301.6109(d)(3). 43. See IRS, “Understanding Your IRS Individual Taxpayer Identification Number (ITIN)” (Dec. 2025), p. 5. 44. See, e.g., IRS, Individual taxpayer identification number (ITIN). 45. See The White House, Restoring Integrity to America’s Financial System, 91 FR 30479 (May 22, 2026). 46. Id.

FINCEN ADVISORY 9 Red Flag Indicators FinCEN has identified the following red flags to help financial institutions detect, prevent, and report suspicious activity connected to fraud schemes involving the unlawful employment of unlawful aliens. Many of these red flags build off of FinCEN’s 2023 Payroll Tax Fraud Notice, which remain relevant for this joint Advisory.47 Where a financial institution has risk-based concerns about the authenticity of the SSN presented by a customer that prevent the institution from forming a reasonable belief that it knows the true identity of the customer, FinCEN encourages financial institutions to verify the SSN to determine if it matches the Social Security Administration’s (SSA) records.48 As highlighted in E.O. 14406, the Agencies further encourage banks subject to the jurisdiction of the Agencies to consider the use of an ITIN as part of the bank’s application of appropriate risk-based procedures for customer due diligence. Specifically, when an ITIN is presented in lieu of an SSN or valid employment authorization document to obtain credit products or open an account, banks are encouraged to assess whether the use of an ITIN may be a relevant risk factor. Banks are further encouraged to conduct this assessment in light of the totality of other factors and information available to the bank to understand the nature and purpose of customer relationships for the purpose of developing customer risk profiles and conduct ongoing monitoring to identify and report suspicious transactions.49 As no single red flag is determinative of illicit or suspicious activity, no single red flag should be taken in isolation. Financial institutions should consider the surrounding facts and circumstances, such as a customer’s historical financial activity, whether the transactions are in line with prevailing business practices, and whether the customer exhibits multiple red flags, before determining if a behavior or transaction is suspicious or otherwise indicative of risks to the integrity of the U.S. financial system. FinCEN reminds financial institutions that no customer type presents a single level of uniform risk or a particular risk profile related to money laundering, terrorist financing, or other illicit financial activity.50 Additionally, while FinCEN is providing these red flag indicators to assist financial institutions in identifying potentially suspicious activity, these red flag indicators do not convey or alter any independent regulatory obligations or supervisory expectations. 47. See FinCEN, FIN-2023-NTC1, “FinCEN Calls Attention to Payroll Tax Evasion and Workers’ Compensation Fraud in the Construction Sector” (Aug. 15, 2023). 48. See SSA, Verifying Social Security Numbers. 49. See The White House, Restoring Integrity to America’s Financial System, 91 FR 30479 (May 22, 2026). 50. See Board of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation, FinCEN, National Credit Union Administration, Office of the Comptroller of the Currency, “Joint Statement on the Risk-Based Approach to Assessing Customer Relationships and Conducting Customer Due Diligence” (July 6, 2022).

FINCEN ADVISORY 10 Red flags may include: A customer is an individual that: 51. See ICE, News Releases and Statements. Uses an SSN that, upon verification, does not match or is inconsistent with the SSA’s records; Opens an account using a non-U.S. passport or ITIN claiming to be self-employed or operating a small business in the agriculture, construction, domestic service, hospitality, or staffing industries and is receiving a significant amount and volume of recurring check deposits from multiple companies before either making a significant and repetitive amount of structured cash withdrawals or issuing low-dollar checks to multiple individuals; Cashes a significant volume of checks drawn on accounts owned by companies in the agriculture, construction, domestic service, hospitality, or staffing industries on a recurring basis at an MSB, including a check cashier; Receives recurring P2P payments from a small, recently established company in the agriculture, construction, domestic service, hospitality, or staffing industries; Works in the agriculture, construction, domestic service, hospitality, or staffing industries and opens a bank account with an ITIN with little to no transactional activity besides remittances to foreign jurisdictions; Opens an account for a company in the agriculture, construction, domestic service, hospitality, or staffing industries and is attempting to use a Commercial Mail Receiving Agency instead of a business address; Possesses no known prior involvement in the agriculture, construction, domestic service, hospitality, or staffing industries and provides a non-U.S. passport or ITIN as a form of identification when opening an account for a new company in those industries; Makes statements as the account holder or company representative to bank tellers or check cashers that the purpose of the cash withdrawals, negotiation of checks for cash, or check cashing activity is for payroll and the volume, amount, and frequency of transactions are uncharacteristic for a company in agriculture, construction, domestic service, hospitality, or staffing industries with a small number of employees; A customer is a large company in the agriculture, construction, domestic service, hospitality, or staffing industries that: Has been identified by ICE worksite enforcement news releases and open-source reporting that the customer has a history of worksite compliance violations from ICE;51 Has significant business operations and transactional activity but with little to no payroll activity commensurate to the customer’s profile;

FINCEN ADVISORY 11 Is making Federal and state payroll tax deposits that are significantly less than what would be expected based on their business operations and associated workforce size; Is issuing a significant and repetitive amount of checks to a singular or small number of recently established companies with little to no online presence; Recently acquired a workers’ compensation policy for a small number of workers that is not commensurate with their customer profile and transactional activity; 52. See FinCEN, “The Role of Domestic Shell Companies in Financial Crime and Money Laundering: Limited Liability Companies” (Nov. 2006). A customer is a small company in the agriculture, construction, domestic service, hospitality, or staffing industries: With beneficial owners that have no known prior involvement with, or in, the company or these industries and may have prior fraud convictions; With minimal to no history of tax- or payroll-related payments to the IRS, state and local tax authorities, or a third-party payroll company despite a large volume of deposits from clients; That conducts large or unusual volumes of cash withdrawals or negotiation of checks for cash when accompanied by another involved person(s) or using an armored car service to deliver bulk cash (i.e., conducting informal or off-the-books payroll); That is issuing recurring, large volumes of checks for under $1,000 that are made payable to a significant number of separate individuals who cash the checks; and/or That is a new customer (i.e., less than two years old) with minimal to no online presence and has indicators of being a shell company.52 Reporting Employment of Unlawful Workers and Exploitation of the U.S. Financial System FinCEN requests that financial institutions indicate a connection between the suspicious activity being reported and the activities highlighted in this Advisory by including the key term “FINANCIALINTEGRITY-2026-A002” in SAR field 2 (Filing Institution Note to FinCEN) and the narrative. In addition to filing a SAR, FinCEN encourages financial institutions and the public to report any tips or complaints about employers that knowingly employ and/or exploit unauthorized workers to ICE’s Tip Form or by calling (866) 347-2423.

FINCEN ADVISORY 12 FinCEN’s Whistleblower Program FinCEN maintains a whistleblower incentive program for violations of the BSA and certain national security laws such as the International Emergency Economic Powers Act (IEEPA). Individuals located in the United States or abroad who provide information may be eligible for awards if the information they provide leads to a successful enforcement action that results in monetary penalties exceeding $1,000,000 and the statutory requirements in 31 U.S.C. § 5323 are otherwise met. Under 31 U.S.C. § 5323, there are certain confidentiality protections to individuals submitting information as well as certain protections from retaliation by employers. Individuals may also choose to submit information anonymously to FinCEN, including through an attorney. FinCEN is currently accepting whistleblower tips and encourages those with knowledge of potential violations to contact FinCEN. To learn more about FinCEN’s Whistleblower Program, visit https://www.fincen.gov/whistleblower-program. For Further Information FinCEN’s website (www.fincen.gov) contains information on how to register for FinCEN Updates emails which are sent when new content is added to the site. Questions or comments regarding the contents of this Advisory should be addressed to the FinCEN Regulatory Support Section by submitting an inquiry at www.fincen.gov/contact. The mission of the Financial Crimes Enforcement Network is to safeguard the financial system from illicit activity, counter money laundering and the financing of terrorism, and promote national security through strategic use of financial authorities and the collection, analysis, and dissemination of financial intelligence.