On 3 September 2026 the Financial Crimes Enforcement Network published an alert that follows scam money from a victim’s first payment to a bank account in the United States. It reads as a map of where a bank’s own controls sit on that route, and it asks institutions to tag related suspicious activity reports with a single key term.
What FinCEN published
The alert, numbered FIN-2026-Alert005, covers money laundering tied to digital asset investment scam centers. FinCEN says transnational criminal organizations, predominantly in Southeast Asia, run these centers and target individuals, including numerous Americans. It asks financial institutions to put the key term “FIN-2026-SCAMCENTERS” in field 2 of the suspicious activity report and in the narrative, and to select “Fraud-Other” under field 34(z) with the description “Scam Centers.”
The scale figures come from the FBI’s Internet Crime Complaint Center, as cited in the alert. Reported US victim losses from digital asset investment scams rose from $907 million in 2021 to $7.2 billion in 2025. FinCEN adds that the total annual revenue collected by Southeast Asian scam centers is estimated in the tens of billions of dollars.
Advertisement
The alert also records how the work is divided. FinCEN says scam center operations frequently handle only the communication with the victim. Operators outsource the infrastructure for moving funds, including financial institution accounts and front companies, to professional money launderers. Under that split, the account that receives the money is set up by a different party than the one that contacted the victim.
Stage one: how the victim pays
FinCEN describes three broad stages. The first is the payment from the victim. Scammers use investment promises, romance and government impersonation to get the victim to pay, and they often ask for digital assets. FinCEN says most digital asset payments by victims originate from money services businesses that offer digital asset services, including digital asset kiosks. Victims are often told to open an account with such a business, buy a specific asset and send it to an address the scammers control.
Fiat payments are common too. Scammers direct victims to send a wire or an ACH transfer to a fiat account the scammers control, and the alert names the tools used to hold those accounts: bank accounts operated through money mules, shell companies, and in some cases fraudulent money services businesses. FinCEN notes that scammers have registered such businesses with FinCEN and used the registration to look legitimate. Some victims are told to buy gold coins or bars that a courier collects, and some are told to buy gift cards.
The alert includes a table from FinCEN’s Rapid Response Program, which helps victims and their institutions recover funds sent abroad after cyber-enabled fraud. For ACH transfers in its cyber scam cases between October 2024 and June 2026, the table lists first destinations by region: the Americas $113.2 million, Asia and Pacific $386.0 million (Hong Kong is grouped with the People’s Republic of China), Europe $145.7 million, the Middle East and North Africa $101.7 million, and Sub-Saharan Africa $5.1 million. Added together, those five lines come to about $752 million. FinCEN cautions that because fraud proceeds are typically laundered through multiple transactions, the first jurisdiction does not necessarily match the final destination.
Stage two: moving the money on chain
The second stage happens on blockchains. FinCEN lists rapid movement through multiple addresses, commingling in consolidation wallets, mixers and tumblers, and swaps across chains. It says launderers frequently use decentralized finance protocols to move proceeds between blockchains, for example from Ethereum to Tron, and swap into stablecoins because stablecoins are easy to use on the marketplaces described below.
Those marketplaces are the center of the alert. FinCEN calls them guarantee marketplaces: online venues that typically run as networks of Chinese-language chat groups on the Telegram messaging platform. They serve as marketing venues and payment infrastructure for vendors and as intermediaries between buyers and sellers, and they usually hold a buyer’s payment in escrow until delivery is confirmed. FinCEN says the services sold there include money laundering, social media account creation and verification, social media targeting, and mass phishing. It also says the marketplaces can quickly reconstitute after a takedown by creating new chat groups.
For one such operator, FinCEN has already acted. On 14 October 2025 the agency issued a final rule under Section 311 of the USA PATRIOT Act that severs Cambodia-based Huione Group from the US financial system. The rule bars covered financial institutions from opening or maintaining correspondent accounts for Huione Group, and requires reasonable steps to avoid processing transactions for a foreign bank’s US correspondent account if the transaction involves the group. The alert states that of the $4 billion in illicit proceeds Huione Group laundered between August 2021 and January 2025, at least $300 million came from other cyber scams, including virtual currency investment scams. On 23 June 2026 FinCEN proposed to extend the rule to H-Pay Service PLC and other successor entities, and said in that proposal that Huione Group had moved operations from Huione Pay PLC to H-Pay.
Stage three: entering the formal system
The third stage is where the proceeds reach regulated institutions. FinCEN says launderers integrate scam money through networks of money mules and through stablecoin transfers to digital asset exchanges outside the United States. Much of that runs through Chinese underground banking systems, which include peer-to-peer exchangers and over-the-counter brokers that generally lack strong know-your-customer and AML controls. According to FinCEN’s analysis, those services typically rely on liquidity from large money services businesses in the digital asset sector.
The alert gives institutions a list of red flags in three groups, and it says no single flag is determinative. A bank should weigh a customer’s history, whether the activity matches the customer’s business and whether several flags appear together. Several of the flags describe what a branch, a call center or a payments operations team can hear or see directly:
- A customer says a purported law enforcement or government representative told them to pay with digital assets, send an international wire, or buy precious metals or gift cards.
- A customer says a payment is meant to retain a law firm or other entity to recover money lost to fraud, and no documentation shows the service is legitimate.
- A customer withdraws money from an investment or retirement account to buy gold and says they were told to hand it to a courier.
- A money services business that receives customer funds has claimed to be “approved by FinCEN.”
- A digital asset exchange that receives customer funds advertises services “with no KYC.”
The other flags are mostly for exchanges, stablecoin issuers and payment service providers. They include customers transacting in tokens tied to a guarantee marketplace without documenting the source of funds, a payment service provider that changed its name or website after law enforcement action against a marketplace it was linked to, and heavy use of a stablecoin whose issuer advertises that it does not cooperate with law enforcement or that the coin cannot be seized or frozen. The alert also covers recovery scams, in which a scammer posing as a government agency, law firm or business offers to help a victim get back money lost earlier.
The SAR instructions go beyond the key term. FinCEN asks filers to include technical indicators in the structured cyber event fields or an attachment: chat logs, phone numbers, social media usernames, email addresses, wallet addresses, transaction hashes, apps used, and the URL, domain and IP address of the service the victim was told to deposit into. It also asks for the names of service providers connected to the activity and any suspected link to a politically exposed person or a transnational criminal organization. Institutions are encouraged to refer customers who may be victims to the FBI’s IC3.
The advertising side: the FTC’s rulemaking
The alert deals with money after the fact. A separate federal action deals with how victims are reached. On 24 September 2026 the Federal Trade Commission announced an advance notice of proposed rulemaking on whether to update its Rule on Impersonation of Government and Businesses to address the role of online platforms. The notice asks how far the ad-optimization tools of social media, search engines and digital marketplaces help scammers impersonate businesses and agencies in ads. It lists possible measures such as vetting advertisers, monitoring and removing scam ads, and disciplining advertisers. The Commission voted 2-0 to submit the notice for publication, and comments are due 60 days after it appears in the Federal Register.
The FTC release gives its own numbers. It says the agency received more than 1 million reports about imposter scams in 2025 and that consumers reported losing nearly $3.5 billion. It also says nearly 30% of consumers who reported losing money in 2025 said they were first contacted on social media, with reported losses of $2.1 billion. Those figures cover a wider set of scams than the FinCEN alert does, so the two should not be added together.
A bank sees the two documents at different points. The FTC’s questions concern the ad that produced the first contact. FinCEN’s alert concerns the payment that follows. Between them sits the customer’s own decision to send money, which is the point a bank’s staff and systems can still interrupt.
What it means for the finance leader
For a bank, a payments company or a fintech with a fraud or financial crime team, the alert changes some day-to-day work and leaves other work as it was.
SAR tagging. Any filing that touches a scam center now has a key term and a field 34(z) entry to carry. Teams that file on authorized push payment fraud, mule accounts or kiosk-funded transfers should decide who applies the term and how the case management system captures the technical indicators FinCEN lists, because those indicators usually sit in customer chat records or call notes rather than in the transaction data.
Mule and shell accounts. The alert says the fiat leg runs through accounts that mules and shell companies open. Onboarding and account-monitoring rules for new business accounts with little activity history are where that leg shows up. We covered the identity side of this problem in an earlier opinion piece.
Customer conversations. Several flags are statements a customer makes to staff. A question asked at the point of a large wire, a gold purchase from a retirement account or a gift card purchase can surface that statement. FinCEN’s footnote says that when consumers are informed about specific scams and understand the perpetrators’ tactics, they are more likely to recognize a scam and less likely to lose money.
Crypto-adjacent counterparties. Banks that bank exchanges, stablecoin issuers or payment service providers can use the guarantee marketplace flags as a screening list. The Huione rule already bars correspondent relationships, and the H-Pay proposal shows FinCEN watching for successor entities. Our earlier look at AML systems and stablecoins and at the Fed’s stablecoin rule covers the stablecoin side of that screening.
In our reading, the most useful part of the alert for operations teams is the stage structure itself. A bank usually sees one slice of the route, and the alert shows which slice that is: the victim’s outgoing payment, the mule’s incoming one, or the exchange deposit. Knowing the slice tells a team which red flags apply and what to put in the SAR narrative.
What to watch
Two items are still open. The FTC comment period runs 60 days from Federal Register publication, and the notice asks questions without proposing a rule, so any platform obligations are further off. FinCEN’s H-Pay rule is also still a proposal. The key term can go on any SAR that relates to scam centers.
Source: FinCEN Alert FIN-2026-Alert005, “FinCEN Alert on Money Laundering Activity Associated with Digital Asset Investment Scam Centers” (3 September 2026). Further sources: FinCEN, final rule severing Huione Group (14 October 2025) and FTC, advance notice of proposed rulemaking on impersonation scams (24 September 2026).
