FATF Scam Compounds Report: Following Victim Money to Cash-Out

On 5 November 2026 the Financial Action Task Force published Combating End-to-End Illicit Financial Flows Linked to Scam Compounds: Applying the FATF Toolkit to the Fraud Epidemic. The FATF scam compounds report, approved at the plenary of 28 to 30 October 2026, follows the money behind industrial-scale fraud operations from the first victim payment to cash-out and reinvestment. It draws on almost 120 case studies and good practices from more than 60 jurisdictions, and it arrives with a separate set of FATF Principles for combating the illicit financial flows linked to scam compounds.

For AML, fraud and suspicious activity reporting teams, the report sits in the FATF’s Methods and Trends series and carries no new return, template or filing deadline. It describes the points where scam proceeds pass through bank accounts, digital wallets, money mule networks and virtual asset providers, and it presses for two things that reach reporting entities directly: earlier signals, and faster action in the first 24 to 72 hours after a scam is detected or reported.

The binding obligations remain in national and regional law. Two instruments show how that works in filing practice: the US Financial Crimes Enforcement Network (FinCEN) alert FIN-2026-Alert005 of 3 September 2026, which already gives US filers a scam-center SAR key term, and Regulation (EU) 2024/1624, the EU Anti-Money Laundering Regulation (AMLR), which applies from 10 July 2027.

Related reading: FATF Fraud Roadmap 2026-2028: Fraud as a Core AML Risk

Dates that frame the scam-compound workstream

• 3 September 2026: FinCEN issues FIN-2026-Alert005 on money laundering linked to digital asset investment scam centers, with the SAR key term FIN-2026-SCAMCENTERS.
• 28 to 30 October 2026: the FATF plenary approves the report as the first output of its Roadmap on combatting fraud under the UK Presidency.
• 5 November 2026: the FATF publishes the report and the FATF Principles.
• 10 July 2027: Regulation (EU) 2024/1624 applies, except for the obliged entities in Article 3, points (3)(n) and (o), for which it applies from 10 July 2029. AMLA’s guidelines on indicators of suspicious activity under Article 69(5) are due by the same date.

Scope of the FATF scam compounds report: compounds, cells and service providers

The FATF defines scam compounds as networked, industrialised and transnational criminal infrastructures. They can run through large physical compounds, through smaller or decentralised cells, and through specialised service providers, all tied together by common controllers, shared financial infrastructure and operational dependencies. The report examines them through a financial flows lens: how proceeds are generated, moved, laundered and reinvested.

That definition matters for screening design. The FATF release notes that large physical compounds remain the most extensively documented form, but the definition reaches decentralised cells and the service providers that sell to them. My reading is that a country-list approach, flagging only payments to or from the jurisdictions where compounds are best known, captures the documented form and misses the rest of the definition.

The geography is also moving. FinCEN’s alert describes Southeast Asian transnational criminal organisations operating industrial-scale scam centers primarily in Cambodia, Burma and Laos, and records expansion into South Asia, the Pacific Islands, Africa, the Middle East and South America. The FATF release puts losses from scam compounds in the tens of billions of dollars every year. FinCEN, citing the FBI’s Internet Crime Complaint Center (IC3), reports that US victim losses from digital asset investment scams rose from USD 907 million in 2021 to USD 7.2 billion in 2025.

Those two figures measure different things. The FATF number is an estimate of annual losses caused by scam compounds; the IC3 series counts reported US victim losses for one scam type. Neither measures what passes through any single institution.

Where the report sits against the FATF Recommendations

The publication is filed under Methods and Trends, and the plenary described it as the first output of the FATF’s Roadmap on combatting fraud under the UK Presidency, which runs from 1 July 2026 to 30 June 2028. The plenary said a wider study and recommendations on how the FATF toolkit can be used against fraud more broadly will follow. Nothing on the publication page or in the plenary outcomes presents the report as an amendment to the FATF Recommendations.

The obligation that matters most for reporting teams is already in the Standards. Recommendation 20 says that if a financial institution suspects or has reasonable grounds to suspect that funds are the proceeds of a criminal activity, it should be required by law to report its suspicions promptly to the financial intelligence unit (FIU). What the scam-compound report adds is a detailed account of what those proceeds look like at each stage.

The same October 2026 plenary reiterated its call on Myanmar to address the illicit finance risks associated with fraud and cyber scam threats. Our note on the FATF October 2026 plenary list updates covers how that statement and the grey-list changes feed into EU, UK and US screening rules.

The proceeds lifecycle, stage by stage

The FATF describes scam compounds as criminal businesses with a recognisable cycle. Networks establish operating sites and financial infrastructure, recruit workers and target victims online. Victim funds are collected through bank accounts, digital wallets and money mule networks, then moved through multiple transactions and jurisdictions to hide their origin. Criminals cash out or invest in assets and businesses, and part of the profit is often reinvested to sustain and expand future scam operations.

FinCEN’s alert, drawn from Bank Secrecy Act reporting, blockchain data, open sources and law enforcement information, uses three stages. Set side by side, the two models give a reporting team a map of where its own data sits.

FinCEN’s Rapid Response Program data indicates that bank accounts receiving proceeds from victims of cyber-enabled fraud are located in a wide range of foreign jurisdictions, and the alert states that the jurisdiction of the initial transaction does not necessarily correspond to the ultimate destination. In Rapid Response Program cyber-scam cases from October 2024 to June 2026, the initial destination of ACH transfers was Asia and Pacific for about USD 386 million and Europe for about USD 146 million.

A European institution may encounter an EU first-hop receiving account in a scam coordinated elsewhere. An EU destination does not, by itself, make a payment domestic or establish where the fraud operation is based.

Upstream signals: the gap the FATF says countries have not closed

The FATF finds that countries are currently more effective at downstream action, following victim payments, criminal proceeds and assets, than at upstream disruption of the operations themselves. The report asks for both: downstream interventions combined with upstream disruption that targets the wider criminal infrastructure.

The publication page explains why. Scam compounds depend on a network of services, infrastructure and facilitators across the whole lifecycle: telecommunications, online platforms, money mules, corporate structures, financial services and professional facilitators. Some of those dependencies are hard to replace, and the FATF says they can represent high-value disruption points: identifying and targeting them raises the cost, complexity and risk of running a compound and disrupts the movement of illicit funds.

What a bank or virtual asset service provider can see are the dependencies that sit in its own customer base. FinCEN’s red flags show what those look like at account level:

• an MSB receiving customer funds that open-source information shows has claimed to be “approved by FinCEN”;
• a digital asset exchange receiving customer funds that advertises services “with no KYC”;
• a payment service provider operating a guarantee marketplace that changes its name, branding or website in an apparent attempt to hide its link to a marketplace hit by enforcement, takedowns or negative news;
• a payment service provider offering digital asset exchange that appears to operate in Burma, Cambodia or Laos and appears to obscure its location or corporate structure.

Each of those is a counterparty or customer-type signal, raised before any individual victim is identified. The FATF Principles aim at responses that target the wider ecosystem and the flows that sustain it, rather than individual sites, transactions or actors in isolation. From 10 July 2027, Article 69(2) of the AMLR will expressly allow a suspicion to rest on the link between several transactions or activities and on the characteristics of the customer’s counterparts, so a narrative that connects a collection account to its feeder and beneficiary accounts sits inside that framework.

Virtual assets, in-compound OTC desks and a USD 100 million wallet cluster

The FATF release treats virtual assets as a central laundering channel for scam compounds. It describes cases where over-the-counter exchange desks operate inside compounds to handle virtual asset exchange and domestic fund transfers. In one case, blockchain analysis traced more than USD 100 million in victim deposits to a virtual asset wallet cluster linked to a scam compound.

FinCEN’s alert fills in the mechanics. Professional money launderers use decentralised finance protocols to move scam proceeds across blockchains, for example swapping USDT from Ethereum to Tron, and swap other assets into stablecoins because stablecoins are widely accepted on guarantee marketplaces. Those marketplaces typically run as networks of Chinese-language chat groups on Telegram. They act as marketing venues and payment infrastructure for vendors, hold buyers’ payments in escrow and let scam operators arrange transactions with Chinese money laundering networks.

The enforcement record behind that description is specific. On 14 October 2025 FinCEN issued a final rule under Section 311 of the USA PATRIOT Act severing Cambodia-based Huione Group from the US financial system. The rule prohibits covered US financial institutions from opening or maintaining correspondent accounts for or on behalf of Huione Group and requires reasonable steps not to process transactions for a foreign bank’s US correspondent account where Huione Group is involved. FinCEN found that, of USD 4 billion in illicit proceeds Huione Group laundered between August 2021 and January 2025, at least USD 300 million in digital assets came from cyber scams. On 23 June 2026 FinCEN proposed extending the rule to H-Pay Service PLC and other successor entities.

Much of the cash-out runs through informal rails. FinCEN places much of the integration stage in Chinese underground banking systems, including P2P exchangers and OTC brokers that operate outside the formal financial system and generally lack robust KYC and AML/CFT controls, and notes that these services typically rely on liquidity provided by large MSBs in the digital asset sector. The FATF examined those channels in its report on hawala and underground banking.

Several of FinCEN’s guarantee-marketplace and laundering red flags translate directly into exchange and banking scenarios:

• a customer conducts substantial transactions in a stablecoin whose issuer advertises that it does not cooperate with law enforcement or that the coin cannot be seized or frozen;
• an exchange customer uses the exchange’s liquidity to run large numbers of offsetting transactions consistent with operating as an OTC broker or P2P exchanger;
• a customer receives stablecoin deposits from a DeFi service without AML/CFT controls, converts them to fiat and withdraws the proceeds;
• blockchain analysis shows a customer transacting directly or indirectly with an address attributed to a guarantee marketplace, with no apparent economic, business or lawful purpose.

Read the list as indicators to test against the full picture. FinCEN states that no single red flag is determinative and that institutions should weigh the surrounding facts, including the customer’s historical activity and whether the transactions fit prevailing business practice. Each of the alert’s laundering-technique red flags pairs the asset or address with a counterparty, an issuer’s own advertising, open-source context or a pattern of behaviour.

The 24 to 72 hour window and the reporting clocks that bind

The FATF Principles state that the first 24 to 72 hours after a scam has been detected or reported are critical for freezing funds, recovering assets and preventing further losses. FATF President Giles Thomson called for faster action to freeze and seize scam proceeds when the report was launched.

The window describes when interventions work. It is framed as a principle for authorities and their partners, and none of the binding texts converts it into a filing deadline for reporting entities. The clocks that do bind look like this:

Two carve-outs are easy to lose. Article 71(2) covers the case where refraining is impossible or would frustrate efforts to pursue the beneficiaries: the entity then informs the FIU immediately after carrying out the transaction. And the Article 24 suspension periods are FIU powers that Member States must provide in national law under the Directive, so the operative number for a given institution is the one its own national transposition sets.

Writing the report: FinCEN’s scam-center instruction as a content checklist

FinCEN’s alert requests specific SAR identifiers and supporting information from US filers. The SAR filing obligation itself sits in the applicable US reporting rules, such as 31 CFR 1020.320 for banks. Its content checklist may inform STR narrative design elsewhere, subject to the receiving FIU’s requirements.

FinCEN requests that SARs related to scam centers carry the key term FIN-2026-SCAMCENTERS in SAR field 2 (Filing Institution Note to FinCEN) and in the narrative, and select Fraud-Other under SAR field 34(z) with the description “Scam Centers”. Filers should also select other relevant fields where applicable, such as fields 36 (Money Laundering) and 38 (Other Suspicious Activities). Where a Form 8300 relates to the alert, FinCEN asks for Box 1b (suspicious transaction) and the key term in the Comments section.

The content request goes further than the codes. FinCEN asks for relevant technical cyber indicators in the structured cyber fields or the attachment, with examples that include:

• chat logs, phone numbers and social media usernames used by the scammer, and suspicious email addresses;
• the type of virtual currency involved, the digital asset addresses and the transaction hashes;
• apps used, and the URL, domain and IP address of the service the victim was told to deposit into.

Filers should also describe any suspected nexus to a politically exposed person, a geographic region or a transnational criminal organisation, and name the service providers connected to the activity, including providers of financial, internet or corporate services. Where appropriate, FinCEN suggests considering a joint SAR on shared suspicious activity.

Holding a fraud-originated report until the fraud is confirmed runs against the EU text. Recital 138 of the AMLR states that where the predicate offence is not known or apparent, the obliged entity need not specify it in the report, and that the reporting role is fulfilled more efficiently by detecting suspicions and reporting promptly. The same recital says entities should be able to report where they know or suspect that funds have been or will be used to carry out criminal activities, even if the funds do not appear to come from illicit sources.

The EU reporting format has not yet been finalised. Under Article 69(3), AMLA published a consultation on draft implementing technical standards, including proposed reporting and transaction-record templates, on 2 July 2026; the consultation closed on 20 September 2026. These draft specifications are not yet binding. Under Article 69(6), the compliance officer transmits reports to the FIU of the Member State where the obliged entity is established. Until adopted common formats apply, institutions must follow their national FIU’s operative filing requirements.

Victims, mules and trafficked workers in one customer file

The FATF Principles ask that investigations prioritise the protection of both scam victims and people trafficked or coerced into scam compounds, with safeguards, victim support and reporting mechanisms. FinCEN’s alert describes the scale on the worker side: criminal gangs have trafficked hundreds of thousands of people to these centers, where passports may be taken and victims coerced into online fraud.

For a reporting team, the practical consequence is that the same customer file can contain a victim, a mule, or a person who is both. Three of the red flags in FinCEN’s first group, headed victim payments, rest on what the customer says:

• a customer says a purported representative of law enforcement or a government agency directed them to pay in digital assets, send an international wire, or buy precious metals or gift cards;
• a customer says a payment will retain a law firm or other entity to recover funds lost to fraud, with no documentation showing the service is legitimate;
• a customer withdraws from an investment or retirement account to buy gold and says they were told to hand it to a courier.

FinCEN lists them as red flags for detecting, preventing and reporting potentially suspicious activity, and adds that institutions may consider giving consumers information on scams and are encouraged to refer likely victims to the FBI’s IC3. The recovery-scam flag deserves its own scenario: FinCEN notes that scammers may repeatedly target the same victim, posing as a government agency, law firm or business that promises to recover funds lost to an earlier scam.

On the mule side, FinCEN uses the FBI’s description of a money mule as someone who transfers or moves illegally acquired money on behalf of someone else, and records that scammers and their launderers have built US bank account infrastructure through mules and shell companies. My working assumption for narrative drafting is to describe the role the customer played in the observed transactions and leave the legal characterisation to the FIU. Our analysis of the FCA money mule review and cash-outs beyond the first receiving account follows the same chain past the first account.

Information sharing: the FATF call and what the AMLR permits

The FATF release says the report maps the financial and non-financial infrastructure criminal networks depend on, including payment services, virtual assets, technology and telecommunications. At launch, the FATF President called for working proactively with the technology, social media and communications sectors to prevent and disrupt scams before they happen.

Within the financial sector, the legal routes differ by jurisdiction. FinCEN’s alert strongly encourages voluntary Section 314(b) information sharing between eligible financial institutions about activity that may involve money laundering, including fraud, subject to the programme’s conditions. Cross-border sharing with a foreign institution does not automatically receive the Section 314(b) safe harbour. FinCEN’s June 2026 fact sheet limits that protection to recipients meeting the regulatory eligibility definition and says institutions should consider relevant obligations under other US legal authorities and, as applicable, foreign law.

From 10 July 2027, Article 75 of the AMLR sets the EU conditions for partnerships for information sharing:

• obliged entities notify their supervisors before joining, and the supervisor verifies the partnership’s compliance mechanisms and the data protection impact assessment before activities begin;
• sharing must be strictly necessary for compliance with Chapter III or Article 69, limited to the categories in Article 75(3), and restricted to customers satisfying one of the conditions in Article 75(4)(f), including the specified higher-risk or additional-information situations;
• every instance of sharing is recorded, and no entity may rely solely on partnership information or act on it without its own assessment;
• information generated by AI, machine learning or algorithms may be shared only where those processes had adequate human oversight;
• information on a suspicious transaction report is shared only where the FIU that received it has agreed.

Article 69(8) allows participating obliged entities identifying a suspicion to designate an entity to submit a report, identifying all participants. Where the participating entities are established in several Member States, the information must be reported to each relevant FIU, through an obliged entity established in that FIU’s Member State. Entities filing separately must reference the partnership in their reports. Article 75 is written around obliged entities and competent authorities and does not mention telecoms or online platforms, so the cross-sector links the FATF calls for rest on arrangements outside that article. Our note on the FATF report on public-private partnerships for AML information sharing sets out the partnership models in more depth.

Frequently Asked Questions

Should an EU bank put FIN-2026-SCAMCENTERS in its suspicious transaction reports?

The key term is a FinCEN request for SARs filed with FinCEN. An EU obliged entity reports to the FIU of the Member State where it is established, in the format that FIU prescribes. A group with a US filing entity would use the key term in that entity’s SARs and follow the local format elsewhere.

Our customer is the victim, sending money out. Is there a suspicion to report?

It can be. FinCEN’s alert lists victim-side behaviour, such as payments directed by a purported official or gold handed to a courier, among its red flags. In the EU, recital 138 of the AMLR says entities should be able to report where funds will be used to carry out criminal activities even when the funds themselves do not appear illicit. My reading is that a victim’s outgoing payment to a scammer fits that description, because it funds the fraud.

Does the FATF’s 24 to 72 hour window let us hold a payment?

No. The window is a FATF principle and gives an institution no power.

Holding depends on the applicable national law. From 10 July 2027, Article 71 of the AMLR requires an entity to refrain from a transaction it knows or suspects relates to criminal proceeds or terrorist financing pending reporting and compliance with applicable FIU or competent-authority instructions. Where no contrary FIU instruction is received within three working days of reporting, the entity may proceed after assessing the risks. FIU suspension powers are provided through national law transposing Article 24 of Directive (EU) 2024/1640.

Does one FinCEN red flag mean we must file?

The alert says no single red flag is determinative and asks institutions to weigh the surrounding facts. A red flag must be assessed in context, and any resulting suspicion must be evaluated under the applicable reporting regime. FATF Recommendation 20 calls for prompt reporting based on suspicion, while AMLR Article 69(1) will require reporting regardless of amount from 10 July 2027. US institutions must apply their own SAR rules, including applicable thresholds and other conditions. For example, 31 CFR § 1020.320(a)(2) generally requires US banks to report qualifying suspicious transactions involving or aggregating at least USD 5,000, and § 1020.320(a)(1) permits voluntary reports of suspicious transactions that the section does not require.

We are a non-US bank. Can the Huione Section 311 rule reach us?

Indirectly. The final rule prohibits covered US financial institutions from maintaining correspondent accounts for or on behalf of Huione Group and requires reasonable steps not to process transactions for a foreign bank’s US correspondent account where Huione Group is involved. In my reading, a non-US bank clearing through a US correspondent should expect transactions involving Huione Group to be refused there, and FinCEN’s June 2026 proposal would extend the rule to H-Pay and other successor entities.

Can a suspicion that came out of a partnership be filed on the partnership’s information alone?

Article 75(4) of the AMLR requires each obliged entity to carry out its own assessment of the transactions and bars reliance solely on partnership information. A suspicion formed using partnership information must be reported through the arrangements permitted by Article 69(8). Where participating entities are established in several Member States, each relevant FIU must receive the information through an obliged entity established in its Member State. Separate reports must identify the partnership.

Related Articles

• FATF Fraud Roadmap 2026-2028: Fraud as a Core AML Risk: the FATF work programme under which this report is the first output, and what it means for fraud risk assessments.
• FATF October 2026 Plenary: Four Grey-List Exits, Black List Unchanged: the plenary that approved the scam-compound report and updated the FATF lists.
• FCA Money Mule Review: Look Beyond the First Receiving Account: the FCA’s review of mule detection and where cash-out happens in the account chain.
• FATF Public-Private Partnerships: Sharing AML Data at Scale: FATF’s report on partnership models and the EU Article 75 route.
• The EU AML Package: The Countdown to 10 July 2027: how the AMLR, AMLD6 and AMLA fit together ahead of application.

Key Takeaways

• Re-cut monitoring scenarios by lifecycle stage (set-up, victim payment, layering, cash-out) and check that each stage has at least one rule that fires on a counterparty or customer-type signal.
• Do not infer where a scam is run, or whether a case is domestic, from the first receiving account: in FinCEN’s Rapid Response Program ACH data for October 2024 to June 2026, the Europe region was the second-largest initial destination after Asia and Pacific.
• US filers: since 3 September 2026 FinCEN has requested that scam-center SARs carry FIN-2026-SCAMCENTERS plus “Scam Centers” under field 34(z), with cyber indicators such as wallet addresses, transaction hashes and deposit URLs.
• Give recovery scams their own scenario: FinCEN flags repeat targeting of earlier victims by fake agencies, law firms or businesses promising to recover losses.
• EU entities preparing for July 2027: under Article 71 an entity that has refrained must comply with any FIU or competent-authority instruction, and may proceed after assessing the risks if the FIU gives no contrary instruction within 3 working days of the report; the FATF’s 24 to 72 hours is a principle addressed to authorities and their partners.
• From 10 July 2027, before joining a fraud-sharing partnership under Article 75, notify the supervisor and complete the data protection impact assessment; sharing STR content needs the agreement of the FIU that received the report.
• When AMLA’s Article 69(5) indicator guidelines arrive, test them against the scam-compound lifecycle and the FinCEN red flags to find gaps in local indicator lists.

Sources and References

• FATF, Combating End-to-End Illicit Financial Flows Linked to Scam Compounds: Applying the FATF Toolkit to the Fraud Epidemic, publication page (5 November 2026): fatf-gafi.org
• FATF, full report (PDF): combating-illicit-financial-flows-linked-to-scam-compounds-fatf-2026.pdf
• FATF, Principles for Combating Illicit Financial Flows Linked to Scam Compounds (PDF): fatf-principles-on-combating-scam-compounds.pdf
• FATF news release on the report (5 November 2026): fatf-gafi.org/en/news
• FATF, Outcomes FATF Plenary, 28-30 October 2026: fatf-gafi.org
• FATF Recommendations, June 2026 version (Recommendation 20): fatf-gafi.org
• FinCEN, FIN-2026-Alert005, FinCEN Alert on Money Laundering Activity Associated with Digital Asset Investment Scam Centers (3 September 2026): fincen.gov
• FinCEN, Section 314(b) Fact Sheet (issued 12 June 2026): fincen.gov
• AMLA, public consultation on draft ITS on the format for reporting suspicions and providing transaction records (2 July to 20 September 2026): amla.europa.eu
• 31 CFR 1020.320, Reports by banks of suspicious transactions: ecfr.gov
• FinCEN, final rule, Imposition of Special Measure Regarding Huione Group, as a Foreign Financial Institution of Primary Money Laundering Concern, 90 FR 48295 (16 October 2025), codified at 31 CFR 1010.664: govinfo.gov
• FinCEN news release, FinCEN Identifies Nearly $13 Billion Linked to Suspected Digital Asset Scams Operated by Overseas Scam Centers (3 September 2026): fincen.gov
• Regulation (EU) 2024/1624 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing (AMLR), Articles 69, 71, 75 and 90 and recital 138: EUR-Lex
• Directive (EU) 2024/1640 on the mechanisms to be put in place by the Member States for the prevention of the use of the financial system for the purposes of money laundering or terrorist financing (AMLD6), Article 24: EUR-Lex

Next checkpoint for scam-compound reporting

The FATF plenary has said that a wider study and recommendations on using its toolkit against fraud will follow this report. The material already published supports the operational work in the meantime: the lifecycle map, the FinCEN red flags and the reporting framework of the AMLR from 10 July 2027 give enough to rebuild scenarios by stage, add counterparty-level signals and tighten the content of fraud-originated reports.

The artifact to produce is a stage-by-stage scenario inventory that shows, for set-up, victim payment, layering and cash-out, which rule fires, which field or narrative element carries it into the report, and who decides on holding a payment. For EU entities, the next fixed date is 10 July 2027, when Regulation (EU) 2024/1624 applies and AMLA’s guidelines on indicators of suspicious activity fall due.

Disclaimer: The information on RegReportingDesk.com is for educational and informational purposes only. It does not constitute legal, regulatory, tax, or compliance advice. Always consult your compliance officer, legal counsel, or the relevant supervisory authority for guidance specific to your institution.