FinCEN Sounds The Alarm On Digital Asset Investment Scam Centers: What Financial Institutions Need To Know

On September 3, 2026, the U.S. Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) issued Alert FIN-2026-Alert 005, urging financial institutions to be vigilant in detecting, identifying, and reporting suspicious activity connected to digital asset investment scam centers and the laundering of their illicit proceeds. The Alert builds on FinCEN’s September 2023 guidance on digital asset investment scams and reflects the growing scale and sophistication of this threat.

A Rapidly Growing Threat

The numbers are staggering. According to the FBI’s Internet Crime Complaint Center, reported U.S. victim losses from digital asset investment scams have surged from $907 million in 2021 to $7.2 billion in 2025. Total annual revenue collected by Southeast Asian scam centers is estimated in the tens of billions of dollars. These operations are predominantly run by transnational criminal organizations (TCOs) based in Southeast Asia—primarily in Cambodia, Burma, and Laos—with operations now expanding into South Asia, the Pacific Islands, Africa, the Middle East, and South America.

The Alert arrives on the heels of Executive Order 14390, issued by President Trump on March 6, 2026, declaring it the policy of the United States to protect Americans from cybercrime, fraud, and predatory schemes.

How the Scams Work

Scam center operators use a range of fraud schemes—including investment, romance, and government impersonation scams—to induce victims to make payments, often in digital assets. Scammers commonly initiate contact through social media or text messages and exploit enthusiasm around new technologies, including digital assets and artificial intelligence, to lure victims with the promise of outsized returns. TCOs have also adopted AI tools to scale and refine their schemes.

A human trafficking dimension makes these operations especially disturbing: criminal gangs have trafficked hundreds of thousands of people to scam centers, where victims have their passports confiscated and are coerced into perpetrating online fraud.

The Laundering Ecosystem: Guarantee Marketplaces

The Alert devotes significant attention to “guarantee marketplaces”—online marketplaces operating as networks of Chinese-language chat groups on social connection platforms like Telegram. These marketplaces function as marketing venues, payment infrastructure, and trusted intermediaries between buyers and sellers of illicit services, including money laundering, social media account creation, and mass phishing services.

FinCEN highlighted its October 2025 final rule severing Cambodia-based Huione Group from the U.S. financial system, noting that Huione Group laundered at least $4 billion in illicit proceeds between August 2021 and January 2025. In June 2026, FinCEN proposed expanding that rule to cover Huione Group’s successor entities attempting to circumvent the original measure.

Key Red Flags for Financial Institutions

FinCEN identified 16 specific red flags to help financial institutions detect suspicious activity relevant for this Alert, including but not limited to:

• Victim payment indicators, such as customers stating they were directed by purported law enforcement to make payments in digital assets, precious metals, or gift cards.
• Guarantee marketplace indicators, such as transactions involving tokens issued by or associated with a guarantee marketplace, or blockchain analysis revealing links to known marketplace infrastructure.
• Laundering technique indicators, such as stablecoin transactions originating from U.S.-based exchanges that undergo on-chain laundering patterns, or customers transacting through stablecoins whose issuers advertise they do not cooperate with law enforcement.

SAR Filing Guidance

Financial institutions are requested to reference the Alert in SAR filings by including the key term “FIN-2026-SCAMCENTERS” in SAR field 2 and the narrative, and by selecting “Fraud-Other” under SAR field 34(z) with the description “Scam Centers”. FinCEN also encourages institutions to include relevant technical cyber indicators—such as chat logs, phone numbers, digital asset addresses, and suspicious URLs—in SAR submissions.

The Bottom Line

In light of this Alert, financial institutions should consider the following actionable steps:

• Update transaction monitoring rules to incorporate the specific red flags identified in the Alert, including indicators related to victim payments, guarantee marketplace activity, and on-chain laundering techniques.
• Train frontline and compliance staff to recognize the hallmarks of digital asset investment scams, including customers who report being directed by purported government officials to make payments in digital assets or precious metals.
• Review SAR filing procedures to ensure staff include the key term “FIN-2026-SCAMCENTERS” in SAR field 2 and the narrative, and select “Fraud-Other” under SAR field 34(z) with the description “Scam Centers.”
• Leverage Section 314(b) information sharing with other financial institutions to identify repeat actors moving across institutions to evade detection.
• Enhance due diligence on MSBs and digital asset service providers, particularly those operating in or connected to Southeast Asia, and monitor for entities that appear to obscure their location or corporate structure.
• Refer potential victims to the FBI’s IC3 atic3.gov or the nearest U.S. Secret Service field office.

* Note: All references to specific reports, rules, alerts, and figures used in this blog posting can be found linked in the FinCEN Alert if not linked directly herein.