On October 30, 2026, Treasury Secretary Scott Bessent announced a package of fraud prevention initiatives in Minnesota under the White House Task Force to Eliminate Fraud. Two FinCEN publications came out of that announcement: an alert on risks associated with foreign-agent-directed transactions, and a notice on the use of charities and non-profit organizations for illicit activity. FinCEN also published a short release pointing institutions at both documents.

The direct answer for a compliance team is that neither document creates a new filing obligation, a new threshold, or a new deadline. What they do is put a specific typology in front of you with FinCEN's framing attached. The first is cross-border payment activity that a U.S. money services business moves at the direction of a party outside the country. The second is the exploitation of charitable structures for fraud, embezzlement or terrorist financing. If your institution touches either flow, the two publications give you a documented reason to test whether your monitoring and due diligence would actually catch the behavior they describe.

Treasury framed the Minnesota work around protecting taxpayer funds and federal benefits programs. In the release, Bessent said Treasury had stopped nearly $190 million in funds tied to overseas fraud and returned more than $100 million to U.S. victims. Those figures are the department's own accounting and belong to the policy announcement rather than to the technical content of the two publications, which is what the rest of this article works through.

What FinCEN Means by a Foreign-Agent-Directed Transaction

The public description is specific enough to work from. From 2021 to 2025, U.S. financial institutions reported more than $8 billion in potentially suspicious wire payments sent through U.S.-based money services businesses at the direction of foreign agents. A foreign agent here is not an employee or a branch of the MSB. It is a party outside the United States that directs where the money goes and why, while the MSB's U.S. account relationship provides the access point into the U.S. financial system.

FinCEN's stated concern is structural rather than a statement about MSBs as a category. The alert acknowledges that MSBs provide important services to underserved populations, and explains that the cross-border relationships MSBs maintain to make overseas money transmission possible may give rise to potential risks to the U.S. financial system. Treasury's release describes the mechanism plainly: bad actors may exploit certain MSBs' cross-border relationships to move funds through the U.S. system while obscuring the ultimate beneficiaries and the underlying purposes of transactions, and those structures can conceal illicit activity such as funding for terrorist organizations.

Two implications follow from that framing and they pull in different directions. The first is that direction matters as much as destination. A payment where the purpose and the endpoint are set by someone outside the country, with the domestic institution functioning mainly as a conduit, is a different risk profile from a customer sending money abroad for their own stated reason. The second is that MSB status is not the indicator. A transmitter with real agent oversight and a corridor risk assessment grounded in its own data is not the subject of this alert.

Key Red Flags Financial Institutions Should Evaluate

The alert contains its own list of red flags, and that list is the version your team should work from directly. What follows is how the behavior described in the public framing of the alert tends to surface in transaction data, organized so it can be compared against the scenarios currently running in your monitoring system.

• The stated purpose does not match the flow. The narrative on the payment describes one kind of activity and the movement of funds fits another. Purpose codes get selected because a field had to be completed, not because they describe the transaction.
• The directing party sits outside the customer relationship. Instructions, beneficiary details or routing decisions originate with a party who is not the account holder and who has not been through your onboarding. The customer relays rather than decides.
• Beneficiary information is thin or drifts. Beneficiary names are generic, inconsistent between transactions for the same flow, or change while the sending pattern stays identical. Each payment looks unremarkable and only the sequence is telling.
• Inbound and outbound activity move in matched pairs. Funds arrive into an account and leave again in similar amounts within a short window, with no economic reason for the money to pause in the United States at all.
• The corridor does not match the customer profile. A business or individual with no clear connection to a jurisdiction begins originating volume into it, or volume into that corridor grows without a corresponding change in the underlying business.
• Agent or counterparty behavior departs from its own history. An agent, subagent or foreign counterparty whose volume, timing or beneficiary mix shifts sharply is worth a second look even when every individual transaction clears.
• Records that should be easy to produce are not. Requests for beneficiary detail, purpose or the identity of the directing party get incomplete or delayed answers, which is itself a control finding regardless of what the transactions show.

None of these indicators proves anything on its own, and cross-border payments are not inherently suspicious. The alert's own framing points at that balance. Moving money across borders is the ordinary function of a money transmitter and of the banks that serve it. What makes a pattern worth escalating is the combination of context: who is directing the flow, whether the beneficiary can be identified, whether the stated purpose holds up, and whether the geography and volume make sense for that customer. An institution that treats cross-border activity as a category-level flag will generate noise and will still miss the cases where every individual field looked complete.

The Notice: Charities and Non-Profits Used for Illicit Activity

The second document has a different purpose. It is written to help financial institutions detect and report suspicious activity involving the exploitation of charities and non-profit organizations, domestic and international. Treasury's release describes three scheme types, and they are worth separating because each produces a different transaction profile and a different investigative question.

• Sham charities. An organization advertises a legitimate purpose, collects funds on that basis, and routes the money to illicit activity including terrorism. The question is whether the organization exists as described.
• Fraud schemes. An organization advertises a legitimate purpose and uses the money to support the organizers' own lifestyle. The question is whether funds ever reach a charitable purpose.
• Embezzlement. An insider at a legitimate organization abuses a position of trust to take the money. The question is whether the people with authority are the ones moving the funds.

The notice also carries a point that matters as much as the typologies. The U.S. government does not view the non-profit sector as a whole as presenting a uniform or unacceptably high risk. FinCEN's instruction to institutions is to apply a risk-based approach and determine whether they can effectively mitigate the vulnerabilities by evaluating each organization individually rather than treating the sector as a block.

That is not a formality. Broad de-risking of charities creates its own harm, and it does not improve detection. A blanket rule that flags every organization with international programming will bury the file where the pattern actually matched.

How Financial Institutions Can Identify Potential Nonprofit Financial Crime Risks

The notice is the authoritative source for the indicators FinCEN considers relevant, and it should be read in full by whoever owns the nonprofit segment of your book. The practical categories below are where those risks show up in account behavior, framed as questions a reviewer can actually answer.

• Does the money in match the mission out? An organization raising funds publicly but showing little evidence of program spending, or spending concentrated in a way that does not correspond to its stated activities, is the central sham charity question.
• Where do donations come from, and how fast do they leave? Large inflows from sources the organization cannot identify, followed quickly by outbound transfers to other entities or overseas accounts, is the pattern that matters most in a pass-through.
• Is the account used for something other than charity? Payments to vendors unrelated to the stated mission, transfers to the personal accounts of officers, or use of the account for activity the organization does not describe publicly.
• Does the control environment fit the money moving through it? A single signer, an officer who both approves and disburses, absent board oversight over expenditures, or an organization that resists providing governing documents and financials.
• Are there cash patterns that suggest structuring? Repeated deposits sized to stay under reporting thresholds, or cash volume inconsistent with the organization's visible fundraising.
• Does the fundraising story change character? Appeals that shift suddenly in tone or audience, or public messaging that does not line up with what the organization tells the bank.

Two cautions belong with that list. Non-profit status, international charitable programming, and association with a particular community or country do not independently establish suspicious conduct, and treating them as if they did is both unfair and operationally self-defeating. The notice points in the other direction, toward individual evaluation. Where a legitimate organization does present elevated risk, the usual response is enhanced due diligence proportionate to that risk: clearer documentation of governance, program evidence, and a documented rationale for the level of scrutiny applied.

What This Means for MSBs and Payment Providers

The two documents land differently depending on where you sit in the flow. The common thread is that the party directing a payment is now an explicit part of the question, not just the party sending it.

Money transmitters and remittance providers

This is the group the alert describes directly. The items to review are the agent and counterparty inventory for the corridors you actually serve, whether the party setting the destination is visible in your records or effectively invisible, and whether your monitoring compares a corridor's current pattern against its own history rather than against a static risk tier. A transmitter that cannot say who is directing its largest outbound flows has a documentation gap before it has a compliance problem.

Payment processors and fintech platforms

Platforms typically sit one layer away from the underlying transaction, which is exactly the layer where beneficiary and purpose information gets lost. The practical questions are what fields you actually capture and retain, whether onboarding of a merchant or program partner includes the downstream flow, and whether your contracts and monitoring give you a route to ask a partner a question when a pattern looks wrong.

Banks serving MSBs

For a bank, the alert is a reminder that an MSB customer's cross-border relationships are part of that customer's risk profile whether or not the bank sees them directly. That means the due diligence file should describe the corridors, the agent network at a meaningful level of detail, and the oversight the MSB applies to its own agents. It also means the transaction monitoring that watches the MSB account has to be able to see matched inbound and outbound activity, not just single large transfers.

Institutions processing cross-border payments generally

Correspondent and payment intermediary relationships create visibility gaps that are structural rather than anyone's fault. Where you cannot see the ultimate beneficiary, the compensating control is usually the quality of what you can see: the originator information, the consistency of the reference data, and a documented escalation path when a counterparty cannot or will not supply detail.

Businesses serving charities and non-profits

Banks, credit unions and payment providers with nonprofit customers carry both documents at once. The notice tells them to look at each organization individually, and the alert tells them that some of the money moving through charitable structures may be crossing borders at the direction of parties the organization does not fully control. The two concerns meet in organizations that both fundraise publicly and transmit internationally.

One boundary is worth stating plainly. Reading the alert, running the exposure analysis it prompts, and updating your monitoring are recommended risk management steps that support your existing risk-based program obligations. They are not separately codified duties that FinCEN created on October 30, and no deadline accompanied either document.

Six Compliance Actions Businesses Should Consider

Not every organization needs the same controls, and the right response depends on what you actually do. For most institutions this is a few days of focused work with a written record at the end rather than a program rebuild.

1. Read both documents with the people who own monitoring and onboarding. Not forwarded to a folder. Read, with the red flag and indicator sections mapped line by line against what your system currently does.
2. Evaluate your exposure to foreign-agent-directed flows. Identify which corridors, agents and counterparties appear in your book, and for each one answer whether you can identify the party directing the payment. Where the answer is no, that is the finding.
3. Compare monitoring scenarios against the indicators. Check for the matched inbound and outbound pattern, the directing party outside the relationship, and beneficiary consistency over time. A scenario that only fires on transaction size will not see any of these.
4. Review customer due diligence and ongoing monitoring for the nonprofit segment. Confirm that organizations are assessed individually, that governance and program evidence are part of the file where risk justifies it, and that the risk rating reflects the actual activity rather than the sector label.
5. Walk the escalation and reporting path end to end. Take one recent alert from each typology and follow it through investigation, decision and documentation. Most weaknesses show up at the handoff rather than in the detection rule.
6. Document the decisions and train on them. Record what changed, who approved it, and brief front-line staff on what to flag. A training record with names and dates is the cheapest evidence you will ever produce.

Understanding Suspicious Activity Reporting Obligations

The purpose of a Suspicious Activity Report is to give law enforcement and FinCEN a channel for information that a financial institution cannot resolve on its own. The institution observes something, investigates within the limits of what it can see, and reports when the activity meets the regulatory standard for reporting. The report is not an accusation and it is not a finding of wrongdoing. It is a record of what the institution saw and what it concluded.

Neither the alert nor the notice changes those rules. What FinCEN publications of this kind do is help with the judgment call inside the existing framework: they describe typologies so that an analyst has a reference point when deciding whether behavior is explainable. Whether a specific activity triggers a reporting obligation still depends on the BSA regulations that apply to your institution, the dollar and fact patterns those regulations describe, and your own procedures for making and documenting that decision. Nothing in the October 30 material sets a new threshold, a new deadline, or a new filing requirement.

Two practical points carry more weight than they usually get. The first is that the narrative is where value is created or lost. A filing that says funds moved and leaves out which party directed the transaction, what the stated purpose was, and why the combination did not hold up gives the reader almost nothing. The second is that the decision not to file deserves the same documentation as the decision to file. Examiners consistently ask about the alerts that were closed, and a closure with a written rationale is a very different artifact from a closure with a status update.

These publications should be read alongside the regulations and your existing filing guidance, not in place of them. Where the alert describes a behavior that your institution has observed and cannot explain, that is the point at which your reporting procedures take over.

Why a Risk-Based AML Program Matters More Than the Documents

Typologies age. The specific scheme described in an alert gets displaced by the next variation, and an institution that built its controls around a list of published examples finds itself one step behind indefinitely. What survives is the structure: a documented risk assessment, written procedures that describe your actual business, monitoring that can be adjusted, an escalation path with named authority, training that reaches the people who see the transactions, independent testing, and records that can be produced on request.

The two October 30 documents are a good illustration of why the assessment is the load-bearing element. Whether the foreign-agent typology is material to you depends on whether you serve MSBs, hold their accounts, or process their payments. Whether the nonprofit typology is material depends on whether you bank charities and how much international transmission runs through those accounts. Those are risk assessment questions, and a program that answers them has already done most of the work the alert is asking for.

For MSBs and payment companies specifically, the pressure is concentrated. Volumes are high, transaction values are often small, and the compliance function is frequently one or two people who also do something else. In that setting, the useful controls are the ones that scale: monitoring built on corridor and counterparty behavior rather than manual review of individual transfers, due diligence that captures the directing party at onboarding rather than retrofitting it later, and a written record that lets a bank partner or examiner see the design without a walkthrough.

Training is where all of this either reaches the front line or does not. An analyst who has never read a typology will not recognize it in a queue, and a customer service representative who takes a request to change beneficiary details has no way to know that the request matters unless someone told them. That is why training records and completion tracking are not administrative overhead. They are the evidence that the program reached the people it was designed for. Soflo Consulting's training is video based and covers customer due diligence, suspicious activity reporting, OFAC and role-specific content, with progress tracking, completion records and downloadable certificates. Each certificate carries a unique barcode that can be verified independently through the Verify a Certificate tool, which is the part a bank partner usually asks about first.

How Soflo Consulting Helps Businesses Strengthen AML Compliance

Soflo Consulting operates as an AML/BSA compliance platform plus professional services, so the pieces can be adopted in stages rather than as a single engagement.

• AML program development. Risk-based policies and procedures written around what the organization actually does, including how it handles cross-border activity and any nonprofit customers.
• AML risk assessments. An evaluation across customer, product, geographic, transaction and delivery channel risk, with the ratings and the reasoning recorded so a later question about a rating has an answer.
• AML compliance training. Helping personnel recognize suspicious activity, including the typologies described in current FinCEN publications, and understand what to do when they see it.
• Independent AML reviews. An evaluation of program design and implementation by someone who does not run the program day to day, where that applies to your institution.
• Compliance training dashboard. Centralized assignment, completion tracking, certificates and reporting, so training evidence can be produced rather than reconstructed.

The free tools are a reasonable place to start before any conversation about a plan. The BSA/AML Audit Simulator asks questions across the five BSA pillars and returns a scored gap report, which is a fast way to see whether monitoring, training or documentation is your thinnest element. The AML Red Flag Library holds more than 427 verified red flags across 13 industries with source citations, and the 24 item AML compliance checklist works as a quick structural review.

Primary next step: the AML compliance solutions overview explains how the platform and the professional services fit together. Secondary next step: if the gap is specifically cross-border or MSB related, the money services business compliance page and the MSB AML training page go deeper, and plans and pricing shows what each tier includes. The team can be reached at (737) 258-8804.

No training product and no consulting engagement prevents fraud or guarantees an examination outcome, and nothing here should be read as a promise about how a regulator will view your program. What a structured, documented program does is make the work visible and repeatable, which is the part within anyone's control.

Where to Start This Week

If the October 30 publications are the trigger for a review, the highest value first move is not a policy rewrite. Take the red flag section of the alert and the indicator discussion in the notice, and sit down with whoever owns monitoring for a single working session to answer one question per line: would we see this, and would we know what to do with it? The answers become your gap list, and the gap list becomes a defensible record that you read the guidance and responded to it specifically rather than generally.

This article is general educational information about FinCEN publications and AML/BSA program considerations. It is not legal advice, and it does not determine whether your business is a covered financial institution or how any particular customer, transaction or organization should be treated. Coverage and obligations depend on your business model, licensing and regulator. Descriptions of the alert and the notice are drawn from FinCEN and Treasury materials published on October 30, 2026, and the documents themselves should be read in full as the authoritative source. Allegations and figures referenced in the underlying announcement are attributed to the agencies that made them. Confirm your obligations with your own legal or compliance advisors.