Detection & Defense · raw.githubusercontent.com

FinCEN Issues Detection Guidance on Crypto Investment Scam Center Laundering

Oct 20, 2026 · Original Report (PDF) ↗

Original report publisher: not verified. Report discovered via Awesome Annual Security Reports.

Summary

FinCEN’s September 2026 alert details how investment scam centers launder digital assets and gives financial institutions transaction red flags and suspicious activity reporting guidance.

Key points

FinCEN bases the alert on Bank Secrecy Act reporting, blockchain analysis, open-source reporting and law-enforcement information; it cites FBI-reported U.S. investment scam losses of $7.2 billion in 2025.
Telegram-based guarantee marketplaces connect scam operators with money launderers and offer escrow, social media targeting, account verification and mass phishing services.
The laundering chain moves victim payments through wallets, mixers and cross-chain swaps before conversion to fiat through exchanges, money mules and underground banking networks.
Victim-payment warning signs include purported government demands for cryptocurrency, undocumented recovery services and exchanges advertising no KYC controls.
Marketplace and laundering indicators include unexplained transactions with attributed wallets, rebranding after enforcement action, aggregated suspected scam proceeds and offsetting transactions consistent with informal brokerage.
FinCEN cautions that no single red flag establishes illicit activity; institutions should evaluate customer history, business purpose and multiple related indicators.
FinCEN requests the keyword “FIN-2026-SCAMCENTERS” in SAR field 2 and the narrative, with “Fraud-Other” and “Scam Centers” in field 34(z), alongside available scam communications and transaction indicators.

Article Details

Defense Focus: Detect, prevent, and report payments to digital asset investment scam centers and laundering of their proceeds through guarantee marketplaces, digital asset services, and the formal financial system.
Detection Methods: Assess multiple related red flags against customer transaction history, business practices, and the apparent economic or lawful purpose of transactions; no single red flag is determinative.
Identify customers instructed by purported government or law enforcement representatives to pay with digital assets, international transfers, precious metals, or gift cards.
Investigate recovery-service payments lacking evidence of legitimacy and investment or retirement withdrawals used to purchase gold for collection by a courier.
Review recipient businesses for false claims of FinCEN approval, advertised absence of KYC controls, or rebranding apparently intended to conceal links to a previously disrupted guarantee marketplace.
Use blockchain analysis to identify direct or indirect transactions with guarantee marketplaces and unattributed address clusters sharing their blockchain infrastructure.
Trace rapid transfers through multiple addresses, consolidation wallets, mixers, and cross-asset or cross-blockchain swaps that may obscure scam proceeds.
Identify deposits from wallets aggregating suspected scam proceeds followed by conversion through decentralized finance services to another asset or blockchain.
Investigate substantial use of stablecoins advertised as unfreezable or whose issuers advertise noncooperation with law enforcement.
Examine large numbers of offsetting transactions that suggest a customer is using exchange liquidity as an OTC broker or P2P exchanger.
Identify stablecoin deposits from decentralized finance services lacking AML/CFT controls followed by fiat conversion and withdrawal.
Review public messaging posts linking customer digital asset addresses to Chinese-language money laundering terminology and investigate payment providers obscuring their location or corporate structure.
Data Sources: Bank Secrecy Act reporting and supporting documentation
Blockchain transactions, digital asset addresses, transaction hashes, and address-cluster attribution
Customer transaction histories, account records, source-of-funds documentation, and stated payment purposes
Customer identity, beneficial ownership, corporate structure, and geographic information
Open-source reporting, provider websites, advertising, and public branding changes
Messaging-platform posts, chat logs, phone numbers, social media usernames, and suspicious email addresses
Law enforcement information
Rapid Response Program International Financial Fraud Kill Chain case data
Defensive Actions: Apply risk-based ongoing customer due diligence, verify beneficial owners where required, and update customer risk profiles and information.
Apply enhanced scrutiny to relevant private banking accounts held by senior foreign political figures to detect possible proceeds of foreign corruption.
Provide customers with information about scam tactics and refer potential victims to the FBI's IC3 or the nearest U.S. Secret Service field office.
For related SARs, include FIN-2026-SCAMCENTERS in field 2 and the narrative; select Fraud-Other in field 34(z) and enter Scam Centers. Select other applicable suspicious activity fields.
Include available cyber indicators, blockchain addresses and transaction hashes, scam communications, deposit-service URLs and IP addresses, account details, beneficial owners, connected service providers, and suspected geographic or criminal-organization links in SAR reporting.
Retain SARs and supporting documentation for five years and independently verify the identities of officials requesting supporting records.
Immediately notify appropriate law enforcement by telephone about violations requiring immediate attention, in addition to filing a timely SAR.
For relevant suspicious Form 8300 filings, select Box 1b and include FIN-2026-SCAMCENTERS in the Comments section.
Use eligible section 314(b) information sharing and appropriate cross-border information-sharing processes to investigate activity spanning institutions.
Comply with the final rule prohibiting covered correspondent accounts for Huione Group and take reasonable steps to prevent its indirect access through foreign-bank correspondent transactions; the article describes inclusion of successor entities as a proposed amendment.