FinCEN Alert and Notice on Minnesota Fraud Measures: Two SAR Key Terms

The FinCEN alert and notice issued on 30 October 2026 give U.S. financial institutions two new suspicious activity report (SAR) key terms and 36 red flags. FIN-2026-Alert009 covers payments that U.S.-based money services businesses (MSBs) send abroad at the direction of foreign agents, with the key term FIN2026FOREIGNAGENT. FIN-2026-NTC2 covers the exploitation of charities and non-profit organizations (NPOs), with FIN2026NPO. Treasury announced both in Minnesota under the White House Task Force to Eliminate Fraud.

According to Treasury, U.S. financial institutions reported more than $8 billion in potentially suspicious wire payments through U.S.-based MSBs at the direction of foreign agents between 2021 and 2025. Both documents address financial institutions as defined in 31 U.S.C. 5312(a)(2), and neither confines its red flags or filing requests to Minnesota. Each frames its asks as FinCEN requests and restates existing BSA obligations, so the work lands in monitoring scenarios and SAR tagging. The Minnesota-specific reporting duty sits in a separate geographic targeting order (GTO).

Related reading: FinCEN A7 Network Special Measure: Prohibiting Sub-Agent Transmittals

FinCEN alert and notice side by side

SAR field 2 is the Filing Institution Note to FinCEN. Both documents also allow filers to highlight additional Advisory, Alert or Notice keywords in the narrative.

The string formats differ from FinCEN’s earlier 2026 terms. The 30 October terms carry no hyphens, while FIN-2026-MNFRAUD (the January 2026 Minnesota child nutrition alert, FIN-2026-Alert001) and FIN-2026-IRANCHARITYABUSE (the 15 October 2026 alert on Iranian abuse of religious charity networks, FIN-2026-Alert008) do. A key-term list built by copying the older pattern would produce FIN-2026-FOREIGNAGENT, a string neither 30 October document contains.

The January alert also asked filers to select SAR field 34(z) (Fraud, Other) and enter “Federal Child Nutrition Programs” in its text box. The October documents give no instruction on the suspicious activity category fields.

Foreign agents that use a principal MSB’s bank account

The alert describes agreements that let a foreign agent direct its U.S. principal MSB to pay third parties abroad, presented as suppliers or partners. The principal then often completes the payment by instructing its U.S. bank to wire the funds. FinCEN’s analysis suggests that both the MSB and its banks may receive limited, and in some instances contradictory, information about the agent, the recipient and the purpose of the payment.

Recurring patterns in BSA reporting include beneficiaries with no clear business purpose, among them foreign exchange houses in the United Arab Emirates, Chinese commercial banks and trading companies, and numerous recipients across East Africa; round-dollar or daily payments; and funds leaving the MSB’s bank account within hours or days. In the alert’s illustrated case, a foreign agent directed dozens of wires totalling over $5 million over four years to a third-country beneficiary that also received funds from a general trading company later designated by the Office of Foreign Assets Control (OFAC).

Red flag 1 is drafted against the contract: a foreign agent directs a payment, including one labelled as settlement between principal and agent, to a third-party entity that the agent clearing agreement does not cover. Where a clearing agreement is silent on third-party payees, the principal should assess whether the payment instruction is authorised, has a legitimate commercial purpose and is supported by appropriate documentation. The principal MSB’s obligation to conduct risk-based monitoring of its agents applies whether or not the clearing agreement lists permitted third-party payees.

The alert repeats Treasury’s position that no type of customer, MSBs included, should be considered uniformly high risk, and that no single red flag is determinative. The five bank-side flags turn on the customer MSB’s payments, for example recipients without the profile of a bulk MSB fund recipient, or a customer MSB that is reluctant or fails to provide invoices, contracts or orders when the bank asks. Our Wolfsberg non-bank PSP guidance article covers the relationship-mapping side of banking payment providers.

Contracts leave the program obligation where it was. Under 31 CFR 1022.210(d)(1)(iii), a principal MSB and an agent that is itself an MSB solely because it acts for that principal may agree on the allocation of responsibility for developing the specified policies, procedures and internal controls. Each MSB remains responsible for implementing its own AML program. The alert adds that neither party can avoid liability for an ineffective AML/CFT program by pointing to the contract.

Three NPO abuse schemes and where government money enters

The notice sorts NPO abuse into sham charities, where complicit management uses the NPO for illicit ends such as funding terrorist organizations; NPO fraud, where operators enrich themselves while donors are typically unaware; and embezzlement, where insiders or contractors steal from a legitimate NPO. The categories can overlap.

The Minnesota thread runs through the passage on misappropriated government funding. NPOs may divert reimbursements or grants for medical, childcare, homelessness or educational services, or act as “sponsors” for third parties that purport to provide services, earning administrative fees and sometimes kickbacks. The footnotes cite FinCEN’s January 2026 Minnesota alert and the Department of Justice’s May 2026 release on the sentencing of the Feeding Our Future ringleader. Our FATF fraud roadmap 2026-2028 article covers the wider move to treat fraud as an AML priority.

Two of the 22 red flags describe accounts that are not NPO accounts at all. Flag 12 covers an NPO employee, officer or contractor receiving payments addressed to the NPO in an account used for personal spending; flag 14 covers a non-NPO customer receiving credits that reference charitable giving, fundraising campaigns or humanitarian causes. A scenario that runs only on customers coded as NPOs would miss both.

FinCEN pairs the red flags with a statement of proportion. According to the notice, the vast majority of U.S.-based NPOs present a low risk of terrorist financing and other illicit activity, and the U.S. government does not view the NPO sector as a whole as uniformly or unacceptably high risk. FinCEN encourages institutions to evaluate each NPO individually, and the notice says it should be read with Executive Order 14331, Guaranteeing Fair Banking for All Americans. Red flags 3 and 16 mention fundraising appeals and ad spending on social media; our FATF terrorist financing on social media article covers those typologies.

Hennepin and Ramsey: the GTO carries the Minnesota-specific duty

FinCEN announced the Minnesota GTO on 9 January 2026 and reissued it in August 2026 for a period running from 11 August 2026 to 6 February 2027. It applies to banks and money transmitters with a branch, subsidiary or office in Hennepin or Ramsey County and, in its own summary, requires them to retain and report records of certain payments of $3,000 or more.

A covered transaction is a recordable transfer of $3,000 or more for which the covered business accepts the payment or transmittal order as the originator’s bank or transmittor’s financial institution. The originator or transmittor must provide an address in Hennepin or Ramsey County, and the beneficiary or recipient, or its receiving financial institution, must be outside the United States. The order excludes originators that are SEC-exchange-listed companies or financial institutions subject to BSA AML program requirements. Where the covered business is a bank, additional originator exclusions under 31 CFR 1010.230(e)(2)(i)-(xvi) apply.

Covered businesses submit Minnesota GTO reports through FinCEN’s Financial Industry (FI) Portal, selecting “Special Measures” as the file type and entering “FIN-65547-X3M6T”. Submissions must be saved as CSV files adhering to the Minnesota Fraud GTO Submission Template; the order states that filenames should use the convention FilerName_TransactionYearMonth_File#ofTotal#_MNGTO2026.csv. Reports are due by the end of the month following the month of the covered transaction.

Beyond the underlying funds-transfer records, the GTO requires additional information according to whether the covered business is a bank or money transmitter. This includes specified beneficiary or recipient details and whether the source of funds for the transfer includes payments from any federal, state or local government contract or benefit program, which FinCEN’s GTO FAQs answer yes even where only part of the transfer comes from such payments. Where government-derived funds are identified, the report must also indicate whether the payments came from government agencies to entities in which the originator or transmittor has an ownership interest. Money transmitters must additionally report the funding method, form of transmission and, where applicable, specified cash-courier settlement information.

A U.S. principal MSB’s own-originated wire to a beneficiary abroad is excluded from Minnesota GTO reporting where the MSB is the originator and is subject to BSA AML program requirements. A Minneapolis money transmitter may separately have a GTO reporting obligation when it accepts a qualifying transfer from a non-excluded transmittor who provides a Hennepin or Ramsey County address. Whether the transfer also warrants a SAR requires an independent assessment under the applicable SAR rules. The order states that nothing in it modifies or affects any other provision of the BSA or its implementing regulations.

Under 31 CFR 1022.320(a)(2), the general mandatory SAR threshold for covered MSBs is $2,000 for a suspicious transaction or aggregate, subject to the $5,000 exception in paragraph (a)(3) for issuers of money orders or traveller’s cheques, to the extent that reportable transactions are identified from a review of clearance or other similar records. Required SARs must be filed within 30 calendar days after initial detection of facts that may warrant filing under 1022.320(b)(3). The alert notes that institutions may report regardless of amount and still rely on the safe harbor.

Frequently Asked Questions

A case fits both documents, for example an NPO wiring government reimbursements abroad through an MSB whose foreign agent then directs the settlement payment to an unrelated third party. Which key term goes in field 2?

Each document requests its own term in field 2 and the narrative, and neither says whether field 2 should carry both or which takes priority. Both expressly allow additional keywords in the narrative, so the narrative is where the text supports a second term. Where the transfer is also a Minnesota GTO covered transaction, FinCEN’s GTO FAQs (7 August 2026) separately ask the covered business to enter “Minnesota Fraud GTO” in field 2 and the narrative of any SAR it files on that transaction. Questions go to FinCEN’s Regulatory Support Section through ois.fincen.gov/contact.

Our institution is outside the United States but clears payments for a U.S. MSB. Does the alert apply?

The SAR requests are addressed to financial institutions as defined in 31 U.S.C. 5312(a)(2) and 31 CFR 1010.100(t), the U.S. BSA perimeter. The alert does encourage U.S. institutions to use, and potentially expand, their processes for sharing information with foreign financial institutions on cross-border investigations, citing FinCEN’s September 2025 guidance FIN-2025-G001.

Does the notice require us to collect donor lists from charity customers?

The notice states that the BSA does not require the collection of specific NPO-related information. Institutions may still consider collecting general information on an NPO’s donor base, funding sources, fundraising methods (including foreign funding for U.S.-based NPOs) and affiliations with other NPOs, governments or groups.

Related Articles

• FinCEN A7 Network Special Measure: Prohibiting Sub-Agent Transmittals: FinCEN’s October 2026 proposal on U.S. transmittals involving listed A7 Network sub-agents.
• Wolfsberg Non-Bank PSP Guidance: Banking the Sector Without De-Risking: a risk-based baseline for banks serving non-bank payment providers.
• FATF Fraud Roadmap 2026-2028: Fraud as a Core AML Risk: how the FATF folds fraud into AML/CFT risk assessment and reporting.
• FATF Terrorist Financing on Social Media: What AML Teams Should Check: FATF’s June 2026 typologies for social media and messaging platforms.

Key Takeaways

• Principal MSBs: assess foreign-agent-directed third-party payments against the clearing agreement, payment authorisation, documented commercial purpose and available supporting evidence, including where the agreement does not expressly define permitted third-party payees.
• Banks with MSB customers: a logged documentation request and the customer’s response form the evidence trail for the refusal-to-document flag.
• NPO monitoring scope extends to staff personal accounts and non-NPO customers receiving charity-referenced credits.
• Form 8300 filers: Box 1b plus the relevant key term in Comments when a suspicious cash payment relates to either typology.
• Hennepin and Ramsey covered businesses: a filed GTO report leaves the SAR decision on the same transfer open.

Sources and References

• FinCEN, “FinCEN Issues Alert and Notice to Support New Fraud Prevention Measures in Minnesota” (30 October 2026): fincen.gov press release
• FinCEN, FIN-2026-Alert009, “FinCEN Alert on Risks Associated with Foreign-Agent-Directed Transactions” (30 October 2026): Alert (PDF)
• FinCEN, FIN-2026-NTC2, “FinCEN Notice on the Use of Charities and Non-Profit Organizations for Illicit Activity” (30 October 2026): Notice (PDF)
• U.S. Department of the Treasury, “Secretary Bessent, Senior U.S. Officials Announce New Fraud Prevention Measures in Minnesota” (30 October 2026): Treasury press release
• FinCEN, FIN-2026-Alert001, “FinCEN Alert on Fraud Rings and Their Exploitation of Federal Child Nutrition Programs in Minnesota” (9 January 2026): Alert (PDF)
• FinCEN, Minnesota GTO and alert announcement (9 January 2026): fincen.gov news release
• FinCEN, “Frequently Asked Questions: Geographic Targeting Order Imposing Recordkeeping and Reporting Requirements on Certain Financial Institutions in Minnesota” (7 August 2026): FAQs (PDF)
• FinCEN, Geographic Targeting Order on Certain Financial Institutions in Minnesota (effective 11 August 2026 to 6 February 2027): Order (PDF)
• FinCEN, “FinCEN Renews Minnesota Geographic Targeting Order” (7 August 2026): fincen.gov news release
• FinCEN, FIN-2026-Alert008, “FinCEN Alert to Counter Iranian Abuse of Religious Charity Networks” (15 October 2026): Alert (PDF)
• 31 CFR Part 1022, Rules for Money Services Businesses, sections 1022.210 and 1022.320 (1 July 2025 edition): govinfo (PDF)

Tagging and scenario work before the GTO ends in February 2027

The only fixed end date in this cluster belongs to the GTO: for banks and money transmitters in Hennepin and Ramsey counties, the renewed order period ends on 6 February 2027 unless FinCEN renews it again. The 30 October documents attach no compliance date or transition period to their key terms.

Disclaimer: The information on RegReportingDesk.com is for educational and informational purposes only. It does not constitute legal, regulatory, tax, or compliance advice. Always consult your compliance officer, legal counsel, or the relevant supervisory authority for guidance specific to your institution.