On September 3, 2026, the U.S. Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) published an alert and accompanying Financial Trend Analysis (FTA) revealing that approximately $12.7 billion in financial activity tied to suspected digital asset investment scams flowed through the U.S. financial system between September 2023 and December 2025. The alert, designated FIN-2026-Alert005, urges financial institutions to detect, identify, and report suspicious activity connected to the operation of overseas scam centers and the laundering of associated illicit proceeds. The primary takeaway for Bank Secrecy Act (BSA)/Anti-Money Laundering (AML) professionals, compliance officers, and bank counsel is that digital asset investment scams are now one of the most significant fraud threats to the U.S. financial system, and the regulatory expectation is that your institution is actively calibrated to respond.
A Global Criminal Industry That Has Outpaced Traditional Illicit Markets
FinCEN’s findings follow other reports of the growing impact of digital asset investment scams worldwide. Digital asset investment scams, also known as “pig butchering,” “romance baiting,” or “cryptocurrency confidence schemes,” are part of a broader global criminal economy that has expanded at a pace that has stunned international law enforcement. The United Nations Office on Drugs and Crime (UNODC) estimated that cyber-enabled scams generated between $18 billion and $37 billion in illicit profits in East and Southeast Asia in 2023 alone. By 2025, that figure had ballooned: UNODC’s July 2026 threat assessment estimated combined annual scam losses across East Asia, Southeast Asia, Australia, and New Zealand at between $88.3 billion and $114.1 billion, a sum that exceeds the GDP of several countries in the region.
UNODC’s regional analyst put it plainly in April 2025: “The regional cyberfraud industry… has outpaced other transnational crimes, given that it is easily scalable and able to reach millions of potential victims online, with no need to move or traffic illicit goods across borders.” The Financial Action Task Force (FATF), the global standard-setter for anti-money laundering controls, confirmed in its own reporting that cyber-enabled fraud is “now one of the most widespread and damaging profit-motivated forms of crime, generating large volumes of illicit proceeds through the exploitation of victims around the world.” Meanwhile, the FBI’s 2025 Internet Crime Report documented nearly $21 billion in total U.S. cybercrime losses, with cryptocurrency-related complaints alone accounting for more than $11 billion. That number was a 22% increase over 2024. Investment scams were the single largest loss category at over $8.6 billion, 72% of which involved cryptocurrency.
The scale of suspected fraud, both globally and in the United States, makes it a significant risk for U.S. financial institutions. The revenue generated by overseas scam centers now rivals or surpasses that of traditional illicit markets like drug trafficking, making this a first-order compliance priority for every institution in the United States.
Inside the Scam Center Ecosystem: Scale, Sophistication, and Human Trafficking
FinCEN’s alert describes an industrial-scale fraud operation run by transnational criminal organizations (TCOs) predominantly based in Cambodia, Burma, and Laos. Criminal gangs have trafficked hundreds of thousands of people to scam compounds, where victims, who may be lured by fake job offers, have their passports confiscated and are coerced into conducting online fraud under threat of violence. Escaped victims have reported beatings for failing to meet scam quotas and being forced into commercial sex work. Recently, TCOs have expanded these operations beyond Southeast Asia to South Asia, the Pacific Islands, Africa, the Middle East, and South America.
The operational model is highly professionalized. Scam center operators use “guarantee marketplaces,” which are Chinese-language, Telegram-based platforms that serve as one-stop shops for purchasing cybercrime and money-laundering services. These marketplaces connect operators with professional money launderers, particularly Chinese money-laundering networks, which exploit underground banking systems, peer-to-peer exchangers, and over-the-counter brokers operating outside the formal financial system and generally lacking robust Know Your Customer (KYC) and AML/countering the financing of terrorism (CFT) controls. In October 2025, FinCEN severed Cambodia-based Huione Group from the U.S. financial system under Section 311 of the USA PATRIOT Act because it operated a marketplace that facilitated at least $4 billion in laundered proceeds.
Against this backdrop, FinCEN analyzed 33,904 BSA reports filed during the review period. The data showed an accelerating trend: Each month, FinCEN received an average of 10.9% more scam-related reports than the prior month and 18% more in reported dollar volume. Money Services Businesses (MSBs) filed 55% of all reports; depository institutions filed 41%. Depository institutions reported the largest dollar amounts — approximately $6.4 billion — often detecting schemes when victims sent wire transfers to scam-affiliated accounts or liquidated retirement savings, took out second mortgages, or applied for personal loans to fund their “investments.”
Red Flags Every Bank Should Be Monitoring
FinCEN’s alert identifies specific red-flag indicators organized into three categories: victim payments, guarantee marketplace activity, and laundering techniques. No single indicator is determinative, and FinCEN emphasizes that institutions should evaluate context before determining whether activity is suspicious. That may include a customer’s historical financial activity, prevailing business practices, and multiple related red flags.
- Victim Payment Red Flags – Watch for customers who state they were directed by a purported law enforcement or government agency to make digital asset payments, international wire transfers, or purchases of precious metals. Customers withdrawing funds from investment or retirement accounts to purchase gold for handoff to a courier are a high-priority signal. Customers claiming to retain a “law firm” or “asset recovery service” to recover funds lost to fraud, but who cannot produce legitimate documentation, present another critical indicator. MSBs that claim to be “approved by FinCEN,” or digital asset exchanges advertising “no KYC” services, should also trigger heightened scrutiny.
- Guarantee Marketplace Activity Red Flags – Transactions involving digital asset tokens associated with a guarantee marketplace, digital asset exchanges operating in Burma, Cambodia, or Laos that obfuscate their location or corporate structure, and blockchain analysis indicating direct or indirect transactions with addresses attributed to a guarantee marketplace all warrant investigation.
- Laundering Technique Red Flags – Stablecoin transactions originating from centralized U.S. exchanges that exhibit patterns associated with on-chain laundering, digital asset addresses posted on messaging platforms near Chinese-language money-laundering terms, and customers using DeFi protocols to move suspected scam proceeds across blockchains are all indicators that FinCEN has flagged. Customers transacting in stablecoins whose issuers advertise non-cooperation with law enforcement or whose tokens “cannot be seized or frozen,” which is a direct reference to entities like Huione Group’s USDH stablecoin, are especially significant.
SAR Filing Obligations and BSA Compliance: What FinCEN Expects Now
FinCEN’s Suspicious Activity Report (SAR) filing instructions in this alert are unusually specific, and compliance teams should treat them as a near-term implementation priority. Financial institutions filing SARs related to scam center activity should reference the alert by including the key term “FIN-2026-SCAMCENTERS” in SAR field 2 (Filing Institution Note to FinCEN) and in the narrative. Institutions should select “Fraud—Other” under SAR field 34(z) with the description “Scam Centers” in the text box. Additional relevant fields, including SAR fields 36 (Money Laundering) and 38 (Other Suspicious Activities), should be selected where applicable.
FinCEN’s instructions go further: Institutions should include all available technical cyber indicators in the structured cyber event indicator fields or the SAR attachment field. That may include chat logs, phone numbers, social media usernames, email addresses, digital asset types, blockchain addresses, transaction hashes, app names, and URLs. SARs should detail any suspected nexus to a politically exposed person, geographic region, or TCO and include identifying information of any service providers connected to the suspected activity. In situations involving ongoing money laundering schemes, immediate telephone notification to law enforcement is required in addition to filing a timely SAR. Institutions wanting to report suspected terrorist-related transactions should call the Financial Institutions Toll-Free Hotline at (866) 556-3974.
FinCEN also strongly encourages participation in voluntary information sharing under Section 314(b) of the USA PATRIOT Act, which provides safe harbor protections for institutions that share information regarding potential money laundering or terrorist financing activity. Given the cross-institutional nature of these scams, in which victims interact with MSBs, depository institutions, and securities firms at different stages, 314(b) sharing is one of the most effective tools for connecting the dots across a scam’s lifecycle.
Building Resilience: Practical Steps for Your Institution
Now is the time for compliance officers and BSA/AML teams to review existing defenses against scam center activity and make targeted enhancements:
- Calibrate transaction monitoring systems to detect the specific tactics described in the alert. Update rules and typologies to flag rapid digital asset purchases followed by transfers to unattributed addresses; unusual retirement or investment account liquidations; wire transfers to MSBs or foreign accounts referencing digital asset investments; and customers taking on debt (home equity, personal loans, credit card advances) to fund purported investments.
- Enhance SAR quality and completeness. Ensure your SAR narrative team is trained on the “FIN-2026-SCAMCENTERS” keyword, the required field selections, and the expectation that technical cyber indicators and counterparty details be included. FinCEN is using this data to support law enforcement investigations and its Rapid Response Program, which has facilitated the recovery of over $1 billion in stolen proceeds since its 2015 inception.
- Invest in customer-facing fraud awareness. Scam victims often resist intervention. FinCEN’s FTA notes that financial institutions frequently detected scam activity only after victims had already lost significant funds, and that victims would insist on completing transactions despite warnings. Front-line staff training is essential: Tellers, relationship managers, and digital support personnel need scripts and escalation protocols to recognize and respond to potential victims of scams, including older adults who may be subject to emotional manipulation.
- Reassess correspondent banking and third-party risk. The alert’s discussion of guarantee marketplaces, underground banking networks, and Huione Group’s Section 311 designation underscores the correspondent account exposure. Covered financial institutions must ensure their Section 312 due diligence programs are risk-based and calibrated to identify foreign financial institution relationships that may serve as conduits for scam proceeds, particularly those operating in or connected to high-risk Southeast Asian jurisdictions.
- Coordinate with law enforcement and leverage FinCEN’s reporting channels. Refer potential scam victims to the FBI’s Internet Crime Complaint Center (IC3) at ic3.gov and the nearest U.S. Secret Service field office. FinCEN’s Rapid Response Program is specifically designed to help institutions and law enforcement partners recover funds sent abroad as a result of cyber-enabled fraud, but speed is critical.
- Train compliance and investigative staff on evolving scam typologies. The convergence of investment fraud, romance scams, government impersonation scams, and “recovery scams” means that digital asset investment fraud now overlaps with virtually every fraud category your team monitors. Ensure your staff understands that scammers use AI-generated deepfakes, large language models, and forged investment platforms to scale operations, and that the same victim may be targeted multiple times through different schemes.
The Bottom Line
FinCEN’s September 2026 alert is the latest and most data-rich signal yet that digital asset investment scams have become a systemic threat to the U.S. financial system. The $12.7 billion identified in BSA reporting represents only what institutions detected and filed; the true scope is almost certainly larger. Globally, UNODC now estimates scam losses in the tens of billions — potentially exceeding $100 billion annually in the Asia-Pacific region alone — and the FATF has confirmed that cyber-enabled fraud ranks among the most damaging profit-driven crimes worldwide.
For financial institutions, this alert is not advisory in the traditional sense. It is a compliance expectation backed by specific filing instructions, red-flag indicators, and a clear regulatory posture from FinCEN, the DOJ’s Scam Center Strike Force, and the White House, as set forth in Executive Order 14390. Institutions that treat this as a routine update and fail to act do so at their peril. Financial institutions should review monitoring typologies, retrain front-line staff, enhance SAR processes, and ensure correspondent banking due diligence reflects the current threat landscape.
Recent Comments