FinCEN Logged $12.7 Billion Going to Scam Compounds. Its New Red Flags Look Like a Bitcoin Buyer's Bank Statement

What Happened

On Thursday, September 3, the Financial Crimes Enforcement Network (FinCEN), the Treasury bureau that collects Bank Secrecy Act reporting, published a Financial Trend Analysis and a companion alert, FIN-2026-Alert005, on digital asset investment scams operated by overseas scam centers.

The analysis covers 33,904 reports filed between September 8, 2023 and December 31, 2025, tied to approximately $12.7 billion in suspected activity. About 1,300 institutions filed. Money services businesses, mostly crypto firms, filed 55% of the reports and flagged $5.5 billion; banks filed 41% and flagged $6.

4 billion; securities firms accounted for the remaining $784.5 million. Victims appeared in every US state. The schemes are what FinCEN labels pig butchering, romance baiting, and crypto confidence scams: a fabricated relationship, a fake trading platform showing fictitious gains, escalating deposits, and a withdrawal fee that never ends.

The alert asks banks, money services businesses, and other reporting institutions to watch for transactions involving suspected scam operators, money mules, shell companies, the guarantee marketplaces where operators buy laundering services, and professional laundering networks.

It encourages voluntary information sharing between institutions under Section 314(b) of the USA PATRIOT Act and asks that related suspicious activity reports carry the key term FIN-2026-SCAMCENTERS. FinCEN found at least 22 digital assets in the suspected transactions, with ether, USDT, and USDC appearing most often, and reported that proceeds were nearly always converted into stablecoins, almost exclusively USDT, before moving through decentralized finance protocols, exchanges outside the United States, peer-to-peer exchangers, and over-the-counter brokers.

The release extends a Treasury campaign that includes the October 2025 designation of Cambodia's Prince Group, a Section 311 rule cutting Huione Group off from the US financial system, and a further round of scam-center designations on June 23, 2026.

A reporting system that can describe $12.7 billion leaving in exquisite detail, and stop very little of it, has told you exactly what it is for. Plan the on-ramp, then put the keys where no filer can follow.

The Reports Were Filed While the Money Was Leaving

Read the numbers as a performance review of the reporting regime rather than as a crime statistic. The window opens on September 8, 2023, the day FinCEN issued its 2023 pig-butchering alert and asked institutions to tag filings with FIN-2023-PIGBUTCHERING. Over the 28 months that followed, filings grew an average of 10.

9% a month and flagged dollars grew 18% a month. A suspicious activity report is confidential by statute, the customer is never told one was filed, and nothing in the Bank Secrecy Act requires the filer to stop the transaction. So the regime produced 33,904 documents describing $12.

7 billion in motion, and the motion continued. The follow-up, 2 years later, is a larger total, a new alert number, and a new key term.

The case for the system deserves a fair hearing. Suspicious activity reports are intelligence, not interdiction, and this body of reporting plausibly fed the enforcement that followed: the Prince Group designation and the Huione rule rest on tracing that starts with filings like these, and a federal strike force had frozen or seized more than $580 million tied to the compounds by March, according to Bitcoin.

com News. FinCEN's analysis also records cases in which a bank talked a customer out of a transfer or recalled a wire before the money moved on, and its alert template carries the standard caveat that no single red flag is determinative. The rejoinder is proportion: $580 million recovered against $12.

7 billion reported, and for the overwhelming share of that money the record is the loss. This site made the same point 4 days ago about a different collection in 'A Ransomware Gang Leaked the ATF's Wiretap-Support Files. The Collectors Cannot Protect the Collection.' The surveillance layer is very good at seeing.

Seeing is not the same job as protecting.

The Red Flags Describe a Funding Sequence, Not a Scammer

Most of the alert's indicators live on the victim's side of the ledger, because that is the side US institutions can see. FinCEN describes a recognizable sequence: the customer drains checking and savings, liquidates investment and retirement accounts, then taps home equity lines, second mortgages, credit cards, and personal loans, each tranche moving to a digital asset platform.

The examples are specific. One woman sent nearly $640,000 from a retirement fund. Another lost more than $1 million over 6 months. The behavioral cues that ride alongside are unsolicited contact, promises of unusually high returns, pressure to use an unfamiliar platform, and fees demanded before a withdrawal will clear.

Strip the scammer out of that picture and what remains is a bank statement. A person who decides, deliberately, to move a meaningful share of retirement savings into bitcoin and hold it behind their own keys will liquidate a brokerage account, wire to an exchange, and withdraw to a hardware wallet.

From a compliance desk, that is hard to distinguish from the opening steps of the sequence FinCEN just asked institutions to flag, and the desk has every incentive to file rather than to distinguish. The 55% share of filings from money services businesses is the detail to sit with: the category of institution you buy through is the most prolific reporter in the dataset.

Under 314(b), your bank and your exchange may now compare notes on you without notice. The practical effect for a large buyer is not a warrant or a freeze. It is friction, questions, holds, and a file that follows you, at the exact boundary where fiat becomes bearer.

What This Means for You

The perimeter is the on-ramp. The red flags that touch an ordinary customer attach to the moment fiat leaves an institution and heads toward digital assets, and the reporting stops where you take delivery. Bitcoin in self-custody, on a hardware wallet whose private keys you generated, has no filer, no institution to receive a 314(b) request, and no address for a key term.

That is the structural reason to finish the trip rather than parking on an exchange: a balance held on a platform stays inside the surveillance layer indefinitely and remains a jurisdictional contact point. A balance behind your own keys leaves the layer once, at a known moment, and the friction is a one-time cost rather than a permanent condition.

Plan for that moment. Expect a large liquidation followed by a crypto-bound wire to draw questions, and answer them plainly: document the source of funds, keep the brokerage and retirement statements that show where the money came from, and give the transfer time. Do not split a large purchase into smaller pieces to stay under reporting thresholds; structuring is a federal crime on its own, independent of whether the money is clean, and it is among the oldest red flags on every list.

If an exchange places a hold, the remedy is documentation, not a second exchange.

Then use the same list against yourself, because it is a competent scam detector. If a platform shows you gains but you do not hold the keys, you do not hold the gains. If a withdrawal requires a fee, a tax, or a deposit first, the withdrawal is not coming. The $12.7 billion in this dataset left accounts voluntarily, one authorized transfer at a time, which is why key control rather than surveillance is the defense that works: a hardware wallet that never signs a transfer to a stranger's platform is a wallet no compound can reach.

Note also that the scammers' rail of choice was USDT, the issuer-controlled token whose freeze switch this site examined 2 days ago. The system could see the money and the issuer could stop it. Neither capability got most victims their savings back.

What to Watch

Watch whether the new key term changes institutional behavior, meaning holds and closures on crypto-bound transfers rather than filings alone; the curve to date suggests institutions have been willing to report and reluctant to interfere, and this alert leans on the interfere side.

Watch the leadership transition at FinCEN, where Director Andrea Gacki is leaving for Citi and career official Jenna Casanova was named acting director. Watch the Senate's September 15 cloture vote on the CLARITY Act and the pending permitted payment stablecoin issuer anti-money-laundering rule, both of which decide how much of this red-flag apparatus becomes permanent law.

And watch the geography: Interpol has warned that the compound model is spreading beyond Southeast Asia, so the next analysis will not be about one region's problem.

Tracked entities this report names, with total coverage across the archive. Follow one into the Actor Network to see every report it appears in.

Other reports that name the same tracked actors — a different thread than “related,” which follows wording. These are linked by who appears in them.