FinCEN Red Flags for Nonprofit Organizations

Nonprofits must watch for: donors with no apparent connection to the charity's mission; large donations from businesses with no commercial relationship; wires to overseas recipients that cannot be independently verified; boards composed entirely of family members; rapid crowdfunding inflows followed by immediate transfers to individuals; round-dollar donations from multiple donors sharing the same IP address or payment method; and expenditures disproportionately directed to administrative costs rather than programs.

Terrorist organizations exploit nonprofits by: establishing front charities with names similar to legitimate organizations; diverting humanitarian aid to armed groups in conflict zones; using charity donation pages to collect funds from unsuspecting donors; and funneling donations through multiple jurisdictions to break the financial trail. FinCEN's Hizballah Financing Alert specifically warns about charities linked to designated terrorist organizations or individuals on the OFAC SDN list.

A sanctions conduit charity receives funds from donors in sanctioned jurisdictions and immediately wires the equivalent amount to different recipients in non-sanctioned countries. The charity acts as a financial pipeline that breaks the direct connection between the sanctioned source and the final destination, effectively facilitating sanctions evasion. This is a federal crime under 31 CFR § 501 and can result in severe civil and criminal penalties for the charity and its officers.

Ghost contractors are overseas vendors or service providers that a charity claims to pay but that have no verifiable business registration, website, physical address, or independent existence. Red flags include payments to contractors in conflict zones with no documented procurement process, invoices without supporting documentation, and contractors whose names are slight variations of known legitimate organizations. Ghost contractors are a primary mechanism for diverting charitable funds to illicit purposes.

Nonprofit organizations themselves are generally not required to file SARs unless they operate as financial institutions (such as credit unions or MSBs). However, the banks that hold nonprofit accounts must file SARs when they detect suspicious activity involving the charity. Nonprofits should maintain strong internal controls, document all transactions, and report suspicious donor behavior to their bank and, if appropriate, to law enforcement or FinCEN.