On October 1, the Treasury Department’s Financial Crimes Enforcement Network (FinCEN) Office of Foreign Assets Control (OFAC) took joint actions against the A7 Network, a global financial services infrastructure designed to evade sanctions, “to isolate Iran and its financial enablers,” as part of Operation Economic Outcast against Iran.

FinCEN NPRM

FinCEN issued a notice of proposed rulemaking (NPRM), under section 9714(a) of the Combatting Russian Money Laundering Act, finding transactions involving any company operating outside of the United States “that is controlled by the A7 Network” (i.e., any identified “Sub-Agent”) to be a class of transactions of primary money laundering concern in connection with Russian illicit finance. The finding means that the companies, designed to receive and remit payments to facilitate transactions for the network, present a material risk of facilitating fund transfers designed to evade sanctions by illicit actors like Russian and Iranian persons designated by OFAC.

If finalized, the rule would prohibit transmittal of funds, by any covered institution, involving transactions with A7 Network Sub-Agents. The NPRM was published in the Federal Register on Monday, October 5, and comments must be submitted on or before November 4.

A7 Network was initially created by fugitive Moldovan oligarch Ilan Shor and Russia-owned Promsyyazbank Public Joint Stock Company (PSB) to evade sanctions prompted by Russia’s invasion of Ukraine in 2022 by each of U.S., E.U. and U.K. sanctions.  Since then, the A7 Network has evolved into a largescale conduit for money laundering and other illicit activity, allowing actors like North Korea (DPRK), the Central Bank of Iran, Iran’s Islamic Revolutionary Guard Corps (IRGC), Iran-backed terrorist organizations, and cybercriminals and ransomware actors, to move funds through the international financial system.

OFAC Sanctions

Concurrently, OFAC sanctioned the A7 Network as a significant Transnational Criminal Organization (TCO), under E.O. 13581, “Blocking Property of Transnational Criminal Organizations” (July 27, 2011), as amended by E.O. 13863, “Taking Additional Steps to Address the National Emergency with Respect to Significant Transnational Criminal Organizations” (Mar. 19, 2019). This means that all property and property interests of the A7 Network or its founders or core components and enablers that are in the United States or in possession or control of U.S. persons are blocked and must be reported to OFAC. In addition, financial institutions and others engaging in certain transactions or activities with sanctioned individuals and entities may expose themselves to sanctions or enforcement actions.

This action builds on OFAC’s designations of several A7 Network entities, including the core businesses forming the A7 Network, A7 LLC and its subsidiaries A71 LLC and A7 Agent LLC, along with digital asset firm Old Vector LLC, which is part of the A7 Network, and digital asset exchange Garantex and its successor Grinex.

FinCEN Alert

To help financial institutions detect and report suspicious activity, FinCEN issued an Alert on the A7 Network, describing how the A7 Network operates and identifying red flag indicators for A7 activity.

According to FinCEN, the A7 Network provides a financial services infrastructure for customers in sanctioned jurisdictions to make cross-border payments in both fiat currency and digital assets while obscuring the origin of payments and making them appear to U.S. and foreign financial institutions as normal commercial activity. A customer will provide information to the network—supplier information and trade documentation—and the network then satisfies the customer’s payment obligation through network-controlled settlement mechanisms that record value inside the network. A Sub-Agent is then assigned to appear as the paying party on transaction documentation, allowing the payment to be executed through correspondent banking and SWIFT channels. The A7 Network uses digital assets, like its own A7A5 ruble-backed stablecoin, to transfer value between actors when banking channels are restricted.

FinCEN further explains that as of June 2026, the A7 Network operates hundreds of Sub-Agents—companies the network formed, acquired, or partnered with—with established bank accounts at approximately 435 financial institutions in at least 83 countries. These companies provide access to correspondent banking relationships and foreign-currency liquidity, allowing for fund transmittals through the international financial systems without sanctioned customers appearing in the payment chain—a form of trade-based money laundering (TBML). The A7 Network also leverages VPNs, using domains with IP addresses appearing to be in places like Dubai or Hong Kong, providing no indication of a connection with the sanctioned jurisdiction involved in the transaction.

FinCEN identifies key indicators of A7 activity to include typical money laundering indicators—high volume transactions after a company forms, descriptions inconsistent with supplier profiles, routing through apparent shell companies, and falsified or AI-altered invoices—and potential indicators that a Sub-Agent is involved, like use of a domain affiliated with domains muzpan.com or sodkamus.com, or domains running on servers based in Dubai, Hong Kong, or the Kyrgyz Republic. Additional indicators include unlikely dollar value prices for listed goods, AI-created or modified documentation, or out-of-place Cyrillic characters in otherwise English documents.  

Indicators of digital asset abuse can also suggest A7 Network activity, according to FinCEN, including that a customer was involved in trade denominated in the A7A5 token or in derivative, or wrapped, tokens based on the A7A5 token, or engaged in international trade with stablecoins to make large purchases or high-volume transactions, particularly if it related to military goods or oil and petroleum products.  Because no one indicator is determinative of A7 activity, FinCEN warns financial institutions to consider totality of the facts and circumstances.

If you would like to remain updated on these issues, please click here to subscribe to Money Laundering Watch. And please click here to find out about Ballard Spahr’s Anti-Money Laundering Team.

The SEC on September 29, 2026, announced fraud charges against two clusters of entities alleged to have defrauded hundreds of retail investors, including many in the United States, out of at least $15.3 million through what the agency calls “investment confidence scams.” In a pair of complaints filed in the U.S. District Court for the Southern District of New York, the SEC charged Cryptoaiml Ltd. and Cryptoaiml Capital Foundation with misappropriating more than $12.5 million from over 300 retail investors, and separately charged TSAI Pro Ltd. and TSAI Capital Foundation (also known as TSAI Exchange Ltd.) with stealing approximately $2.8 million from roughly 1,715 investors. Both sets of defendants are believed to be operated by unidentified individuals located overseas.

The two schemes shared a common architecture: the rapid creation of U.S. corporate entities, the filing of Forms D with the SEC containing fabricated information, registration as Money Services Businesses with FinCEN, and the aggressive use of WhatsApp group chats and social media to recruit victims. The SEC has since removed the fraudulent Forms D from its website.

How the Fraud Worked

Cryptoaiml. The Cryptoaiml scheme operated from approximately August 2024 through March 2025 and, according to the SEC’s complaint, followed a carefully staged progression. The defendants created a series of WhatsApp group chats with names like “VIP-Wealthy Affiliate Group,” “Citadel AI Community,” and “AI Advanced Community.” In those chats, the defendants impersonated real, named investment professionals at well-known firms, including a purported representative of Raymond James & Associates and the actual president of Citadel Securities. None of these real professionals or their firms had any involvement.

The impersonators claimed to share AI-generated trading “signals” with a purported 98% accuracy rate, directed investors to open accounts on a fake crypto trading platform, and posted fabricated testimonials from supposed satisfied investors to build confidence. The platform looked convincing, with real-time price displays and account dashboards showing growing balances, but no actual trading ever took place. To bolster legitimacy, the defendants embedded on their website a screenshot of a Form D filed with the SEC and an MSB registration with FinCEN, both of which contained fabricated names, addresses, and forged notarizations.

The endgame was blunt. When investors tried to withdraw their supposed profits, they were told their accounts were frozen and that they needed to pay advance fees to “unlock” them. Payments were directed to U.S. bank accounts held by shell entities, including Flavyo Trading Corporation, Neurotech IT Solutions Inc., INTY Endless LLC, and a sole proprietorship called Enjoy Time. Investors were coached on what to tell their banks about the transfers. Those funds were then wired to entities in the United Arab Emirates and to Chinese companies, commingled with funds of unknown origin. Some investors sold securities from brokerage accounts and 401(k)s to meet the defendants’ demands.

TSAI. The TSAI defendants ran a parallel but distinct scheme from September 2024 to March 2025, centered on a fake “AI Trading Bot Program.” Investors were told they could earn guaranteed profits by depositing crypto assets to “rent” AI-powered trading bots that would trade on their behalf. The bots ranged in price from $100 to $500,000; at the top end, the defendants promised returns of $17,500 per day for 360 days. The scheme also incorporated a pyramid structure: investors could earn commissions by recruiting others, with tiered levels from S0 to S7 and promises of monthly salaries and stock dividends for top recruiters.

As with Cryptoaiml, the entire operation was a fiction. There were no AI trading bots, no real accounts, and no actual trading. Like Cryptoaiml, TSAI also filed a Form D containing false information and posted a fabricated “SEC certificate” on its website to create the appearance of regulatory oversight. When investors tried to withdraw funds, they were told their accounts were blocked for “suspicion of illegal arbitrage” or were required to pay fabricated “taxes” and “verification payments.” By March 2025, the website went dark entirely.

What It Means

The SEC brought overlapping but distinct claims in the two actions, and the legal theories are worth examining.

Both complaints allege violations of Section 10(b) of the Exchange Act and Rule 10b-5, targeting both the defendants’ fraudulent misstatements and their broader deceptive schemes. But the two cases diverge in instructive ways.

The Cryptoaiml complaint additionally charges violations of Sections 206(1) and (2) of the Investment Advisers Act. The theory is that the defendants functioned as investment advisers because they entered into investment management agreements with at least two clients and held themselves out as providing securities advice for compensation. This is a notable claim. The advisory agreements were entirely sham documents, one purporting to be from “Cryptoaiml Venture Capital Management Group” and another invoking the name of Raymond James & Associates. Yet the SEC is treating those sham agreements as sufficient to establish an advisory relationship and trigger the Advisers Act’s fiduciary obligations. That willingness to look through form to substance is significant, particularly in a space where fraudsters routinely adopt the language and trappings of legitimate financial services.

The TSAI complaint takes a different path. In addition to the standard antifraud charges and Securities Act Section 17(a) claims, the SEC charges violations of Sections 5(a) and 5(c) for the sale of unregistered securities. The premise is that the AI Trading Bot Program constituted an investment contract under the Howey framework: investors pooled their funds, were promised returns generated by the defendants’ purported managerial efforts in developing and operating the trading bots, and could earn additional income through the pyramid recruitment structure. This matters because the SEC did not need to prove that the bots actually existed or functioned to bring the Section 5 claim; the offering was the investment contract itself. It is another example of the agency’s willingness to classify novel crypto-adjacent products as securities, and the registration charge gives the SEC an additional enforcement tool that does not require proof of scienter.

The Bigger Picture

These two actions are part of a broader pattern. Investment confidence scams that exploit encrypted messaging platforms and capitalize on public enthusiasm for AI are proliferating, and the SEC’s willingness to bring multiple legal theories against offshore entities reflects the agency’s determination to pursue these cases even when the individuals behind the schemes remain unidentified.

The cases also highlight a troubling feature of the current regulatory landscape: the ease with which bad actors can file Forms D and register as MSBs to manufacture an appearance of legitimacy. The SEC has encouraged investors to use Investor.gov to check the backgrounds of anyone offering or selling investments and has issued investor alerts specifically warning about fraudsters who use group chats or claim false SEC registration to lure victims. But as these complaints demonstrate, the fraudsters are getting more sophisticated in mimicking the markers of legitimate financial activity, and the combination of encrypted messaging, AI buzzwords, and fabricated regulatory credentials is proving effective at reaching unsophisticated investors.

If you would like to remain updated on these issues, please click here to subscribe to Money Laundering Watch. Please click here to find out about Ballard Spahr’s Anti-Money Laundering Team, and here to learn more about Ballard Spahr’s Securities Enforcement and Corporate Governance Litigation Team.

On September 9, 2026, the U.S. Department of the Treasury announced that its Financial Crimes Enforcement Network (“FinCEN”) has identified approximately $17.5 billion in suspicious financial activity potentially linked to health care fraud.  The announcement accompanied the release of a new Financial Trend Analysis (“FTA”), which analyzed over 5,700 Bank Secrecy Act (“BSA”) reports filed by financial institutions between March 1, 2025 and February 28, 2026.  The FTA is FinCEN’s second health care fraud-related issuance this year, following an Advisory issued in March 2026 urging financial institutions to be vigilant about health care fraud schemes targeting government health care benefit programs.  This second-in-one-year issuance demonstrates the Administration’s continued focus on health care fraud and related enforcement.

Treasury Secretary Scott Bessent framed the instant release as part of the Administration’s broader anti-fraud agenda, stating: “By identifying and reporting this suspicious activity, financial institutions have given law enforcement critical insight into the illicit actors who deliberately exploit U.S. health care benefits programs”.  The FTA’s findings are intended to provide law enforcement with critical financial intelligence to identify, investigate, and disrupt illicit schemes that exploit taxpayer-funded health care benefits. The findings will likely fuel further health care fraud enforcement efforts.

The FTA highlights several key trends:

Depository Institutions Drive BSA Reporting. Depository institutions, such as commercial banks and credit unions, filed approximately 89 percent of the BSA reports in the dataset and accounted for nearly 87 percent of the reported suspicious activity amounts. In total, 471 financial institutions filed reports, with filers reporting an average of approximately $3.3 million per filing and a median amount of approximately $600,000.  Just two depository institutions—the largest by asset size in the dataset—filed 29 percent of all health care fraud-related reports.

Fraud Spans Medicare, Medicaid, and Private Insurance. Suspected perpetrators frequently received payments from a combination of federal and state programs, as well as private insurance companies. Medicare and/or Medicaid were named in approximately 38 percent of the dataset, and Medicare Administrative Contractors (“MACs”) were identified in approximately 22 percent.

Subjects Located Across the Country. Filers identified subjects in all 50 U.S. states, as well as Puerto Rico, Guam, and the U.S. Virgin Islands. California, Florida, New York, and Minnesota were the most frequently identified states. At the county level, Los Angeles County, Hennepin County (Minnesota), and Miami-Dade County appeared the most frequently.

Home Health Care Businesses Lead Provider Types. Home health care businesses were the most frequently identified suspected fraudulent providers, appearing in approximately 32 percent of BSA reports (when excluding Puerto Rico Medicaid eligibility-related filings). Other frequently identified provider types included hospice care companies, mental and behavioral health and addiction treatment providers, durable medical equipment providers, and adult or child daycares. Notably, the majority of home health care businesses identified as potentially fraudulent were registered at residential homes.

Fraud Proceeds Fund Personal Spending and Luxury Purchases. Suspected perpetrators employed a range of apparent money laundering techniques before spending the obtained health care payments. In many cases, proceeds that did not go through a complex funds transfer process were used on personal expenses and luxury goods. More sophisticated schemes involved circular transactions with linked businesses, payments to individuals under the guise of payroll, and commingling of health care payments with other deposits. Approximately five percent of the dataset identified instances of funds either directly or indirectly funding international transfers, most frequently to Hong Kong.

Connections to Criminal Networks. Approximately four percent of the BSA reports identified health care fraud-related suspicious activity potentially involving larger fraud rings or criminal networks. The FTA noted examples including potentially fraudulent hospice care providers in northern Los Angeles County that may be linked to organized crime, home health care and adult daycare businesses in Minnesota potentially tied to large fraud rings, and potentially fraudulent adult daycares in the New York City area that have previously been tied to Chinese money laundering networks.

The FTA also highlighted a notable trend in Puerto Rico, where 59 financial cooperatives filed approximately 29 percent of all BSA reports in the dataset. These reports primarily described suspicious activity related to eligibility for Puerto Rico’s Medicaid program, in which customers reportedly sought to lower their account balances prior to eligibility meetings with Plan Vital representatives in order to remain below the eligibility threshold.

As noted above, this FTA is part of the Trump Administration’s broader efforts to combat fraud in the healthcare industry and across federally funded programs.  Treasury has been working with the White House Task Force to Eliminate Fraud, established by Executive Order 14395 and led by Vice President Vance, and has encouraged whistleblowers to report credible information related to fraud, money laundering, sanctions violations, and tax-law violations.  The FTA also highlights the critical role that financial institutions play in identifying and reporting suspicious activity, and should serve as a reminder that health care fraud remains a top enforcement priority.

If you would like to remain updated on these issues, please click here to subscribe to Money Laundering Watch. Please click here to find out about Ballard Spahr’s Anti-Money Laundering Team.

Banks and their employees face a difficult balancing act when discussing suspected fraud or money laundering activity with a customer on whose account activity the bank has filed a suspicious activity report (SAR).  The bank must take practical steps to protect the customer and the institution (for example, verifying transactions, restricting account access, or requesting additional documentation) while strictly preserving SAR confidentiality. If a bank employee discloses—or even inadvertently implies—that a SAR has been filed, that law enforcement is involved, or even that internal investigations are ongoing, the bank can be exposed to regulatory findings, civil penalties, litigation risk, and reputational harm.  What’s more, the employees engaged in these conversations may face discipline or termination for violating policy and confidentiality requirements. At the same time, poorly chosen language or a refusal to provide a customer with information about his or her account, can cause customer disputes, prompt complaints, or create safety risks for frontline personnel.

On September 2, 2026, FinCEN and the federal banking agencies (the Federal Reserve, FDIC, NCUA, and OCC) issued a joint statement clarifying the application of SAR confidentiality requirements to communications with customers. The statement explains that SAR confidentiality requirements do not prohibit banks and credit unions from communicating with customers about potentially fraudulent transactions, suspicious activity, account restrictions, or account closures, provided those communications do not disclose the existence of a SAR.

The statement follows a June 2025 Request for Information regarding payments fraud, in which commenters identified questions concerning the extent to which financial institutions may discuss fraud-related matters with customers when a SAR has been or may be filed. It also references Executive Order 14331, Guaranteeing Fair Banking for All Americans.

The Guidance

The agencies reiterate that the Bank Secrecy Act (BSA) prohibits the disclosure of a SAR or information that would reveal the existence of a SAR. At the same time, the agencies note that FinCEN’s SAR confidentiality regulations permit the disclosure of the underlying facts, transactions, and documents upon which a SAR is based.

As a result, banks and credit unions may communicate with customers or third parties regarding potentially fraudulent transactions, suspicious activity, account restrictions, and account closures, so long as the communication does not disclose that a SAR has been filed.

The agencies also state that the fact that a customer or third party could potentially infer from the underlying facts that a SAR may have been filed does not, by itself, constitute a prohibited disclosure under the SAR confidentiality requirements.

Relationship to Prior Guidance

The joint statement builds on existing SAR confidentiality guidance. FinCEN’s 2010 final rule addressing SAR confidentiality established that the prohibition on disclosure does not apply to the underlying facts, transactions, and documents on which a SAR is based. More recently, FinCEN’s September 2025 guidance regarding cross-border information sharing (FIN-2025-G001) reiterated that principle in the context of information sharing among affiliated institutions.

The September 2026 joint statement focuses specifically on communications with customers and provides additional clarification regarding how financial institutions may apply existing SAR confidentiality requirements in customer-facing situations.

Examples of Permissible Communications

The statement provides a non-exhaustive list of communications that “would not typically” disclose the existence of a SAR. Examples include:

• Requesting customer due diligence information to better understand the nature and purpose of a customer relationship;
• Notifying a customer that a delay, limitation, or account closure may be related to suspected fraud or suspicious activity;
• Notifying a customer that a deposit, such as an altered or counterfeit check, has been rejected due to suspected fraud;
• Asking about the purpose of a transaction or the source of funds;
• Providing educational materials or warnings regarding fraud schemes, typologies, and money mule activity;
• Communicating account maintenance decisions, including declining transactions or closing accounts; and
• Requesting information concerning the originator or beneficiary of a funds transfer.

The agencies emphasize that institutions should evaluate communications on a case-by-case basis and exercise caution to avoid revealing the existence of a SAR.

Practical Considerations

The statement does not modify existing legal or regulatory requirements and does not create new supervisory expectations. Instead, it provides additional clarification regarding how existing SAR confidentiality requirements apply in the context of customer communications.

Financial institutions may wish to review existing policies, procedures, and training materials relating to customer communications in situations involving fraud investigations, suspicious activity reviews, account restrictions, and account closures. Institutions should also consider whether additional guidance or training is appropriate to help personnel distinguish between discussing underlying facts and disclosing information that could reveal the existence of a SAR.

Because the agencies’ examples are non-exhaustive and emphasize a facts-and-circumstances analysis, institutions should continue to assess individual situations carefully and document decision-making where appropriate.

Looking Ahead

The joint statement provides additional clarification regarding the scope of SAR confidentiality requirements and confirms that institutions generally may discuss underlying facts, transactions, and documents with customers, provided they do not disclose the existence of a SAR. Financial institutions should consider the guidance when evaluating customer communication practices and related compliance procedures.

If you would like to remain updated on these issues, please click here to subscribe to Money Laundering Watch. And please click here to find out about Ballard Spahr’s Anti-Money Laundering Team.

On August 11, 2026, the U.S. Department of the Treasury’s Financial Crimes Enforcement Network (“FinCEN”) renewed its Geographic Targeting Order (“GTO”) Imposing Recordkeeping and Reporting Requirements on Certain Financial Institutions in Minnesota. The GTO requires financial institutions located in Hennepin and Ramsey Counties, Minnesota, to “retain and report records of certain payments of $3,000 or more.”

The initial GTO was announced on January 9, 2026, as part of the Trump Administration’s efforts to combat alleged “rampant government benefits fraud in Minnesota.” The first GTO went into effect on February 12, 2026, and was set to expire on August 10, 2026. The renewed GTO has extended this deadline and will remain in effect until February 6, 2027. FinCEN has released frequently asked questions in connection with the renewal that explain the requirements of the renewed GTO.

The renewed GTO is nearly identical to the initial order but, as explained in the Frequently Asked Questions, exempts certain Covered Businesses “that are banks from [the] GTO’s requirement to record or report fund transfers where the originator falls into certain categories[.]” The exemptions are consistent with the Exemptive Relief Order for the Geographic Targeting Order Imposing Recordkeeping and Reporting Requirements on Certain Financial Institutions in Minnesota, which granted “tailored exemptive relief” to “exempt certain categories [of] fund transfers that are lower risk for government benefits fraud, and to allow banks sufficient time to report certain information required by the GTO.”

The renewed GTO continues to exempt banks from funds transfers where the originator falls into one of the sixteen categories excluded under the Customer Due Diligence Rule, but, importantly, it does not extend the temporary relief that had limited banks’ obligations to information already covered by the Recordkeeping Rule.

The renewed GTO, as explained, is otherwise identical to the first GTO. It requires banks and money services businesses (MSBs) located in Hennepin and Ramsey Counties to report international fund transfers of $3,000 or more when the beneficiary or recipient is located outside of the United States. Banks and MSBs located in these counties are “covered businesses,” which is defined as any bank as defined in 31 CFR 1010.100(d), or any money transmitter, as defined in 31 CFR 1010.100(ff)(5), with a branch, subsidiary, or office located in the covered geographic area. The GTO requires covered businesses to report to FinCEN certain information required to be retained under “31 CFR 1020.410(a)(1) and (2), along with certain other additional information, regardless of whether the information is provided with the payment order[.]” This information, which is set forth in the Frequently Asked Questions, includes:

1. The name and employer identification number of the Covered Business;

2. The account number of the originator;

3. The name of the beneficiary; 

4. The address of the beneficiary;

5. The date of birth of the beneficiary;

6. A phone number of the beneficiary;

7. An email address of the beneficiary; 

8. The account number of the beneficiary; 

9. Whether the source of funds for the transfer includes payments that are from any federal,

state, or local government contract or benefit program; and,

10. If the answer to question (9) is yes, whether those payments are from government

agencies to entities in which the originator has any ownership interest.

If the Covered Business is a money transmitter, additional information concerning the form of the transmittal is required. If the renewed GTO is “willfully” violated, a business could be subject to civil penalties, with a separate penalty applied for each individual violation. Criminal fines are also available, as well as imprisonment for no more than five years.

This renewed GTO is part of Secretary of the Treasury Scott Bessent’s plan “to follow the money” and should serve as a reminder that the Trump Administration appears willing to impose strict reporting requirements and enforcement tools to further its goals.

If you would like to remain updated on these issues, please click here to subscribe to Money Laundering Watch. And please click here to find out about Ballard Spahr’s Anti-Money Laundering Team.

On July 13, a divided Ninth Circuit panel upheld a lower court order that barred enforcement of FinCEN’s border Geographic Targeting Order (“GTO”). The GTO would have forced money services businesses (“MSBs”) in 30 ZIP codes along the U.S.-Mexico border to report cash transactions of just over $200, a dramatic reduction from the longstanding $10,000 reporting threshold. The decision in Novedades Y Servicios, Inc. v. FinCEN, 181 F.4th 961, 967 (9th Cir. 2026)  is a significant procedural check on the administration’s anti-cartel enforcement agenda.

Cartels as a National Security Priority

The Trump administration has repeatedly framed cartel-linked money laundering as a national security threat. On January 20, 2025 – the first day of his second term – President Trump issued an executive order designating certain international cartels as Foreign Terrorist Organizations and Specially Designated Global Terrorists. The order declared that cartels “present an unusual and extraordinary threat to the national security, foreign policy, and economy of the United States,” and set its goal as “the total elimination of these organizations’ presence in the United States.”

The border GTO flowed directly from that priority. Issued by FinCEN in March 2025, the GTO targeted MSBs in 30 ZIP codes along the U.S.-Mexico border, requiring a Currency Transaction Report (“CTR”) filing for any cash transaction between $200 and $10,000. Treasury Secretary Scott Bessent made the administration’s priorities clear: “[f]or too long, cartels have abused the U.S. financial system to profit from poisoning Americans with deadly fentanyl. At Treasury, we are expanding our efforts to keep drug money out of the United States and to provide law enforcement with additional information to put these traffickers behind bars.”

The Ninth Circuit Holding

The panel’s decision turned on administrative procedure rather than the merits of AML enforcement.  

The majority concluded that the border GTO was likely a rule – rather than an order – under the Administrative Procedure Act (APA), because it applied to all unnamed and unspecified MSBs across a geographic area home to over one million people, rather than targeting specific identified businesses based on particularized findings. Because 31 U.S.C. § 5326 authorizes FinCEN to act only by “order,” the GTO likely exceeded the agency’s statutory authority.

The panel also found that FinCEN was required to conduct notice-and-comment rulemaking which it skipped entirely, and that the GTO was likely arbitrary and capricious because FinCEN “entirely failed to consider the cost of compliance to regulated parties.” On that point, the court noted that the only evidence the government offered on cost consideration was an internal FinCEN memorandum dated “March XX” that was undated, in draft form, and heavily redacted.

Who Challenged It

The case was brought by the Institute for Justice on behalf of Esperanza Gomez Escobar, who owns and runs Novedades y Servicios, a family-run MSB in San Diego. Escobar’s customers are largely people without bank accounts who come in to cash paychecks and wire money to family.

The compliance burden was, by Escobar’s account, impossible for her MSB to absorb. The $200 threshold swept in roughly 99% of Novedades’s monthly transactions, and the complaint alleged that filing the resulting CTRs would require an additional 14 to 17 hours per day. During the single week the order was in effect, Escobar alleges she lost between 50 and 60 percent of her customers after explaining the new reporting requirements. The Institute for Justice argued the lowered threshold amounted to “enlisting [small business owners] as surveillance agents of the government.”

The dynamic is not new. As the President of the National Small Business Association told the Wall Street Journal in 2024 when discussing a separate FinCEN rule, “FinCEN has never dealt with small businesses, and small businesses don’t know who FinCEN is and FinCEN doesn’t know how to regulate small businesses.”

Implications

The Ninth Circuit’s decision is a procedural check rather than a policy reversal. Nothing in the Ninth Circuit’s ruling calls into question the policy objective of targeting cartel finances. The panel’s concerns were exclusively procedural: FinCEN bypassed formal notice-and-comment rulemaking, and the record before the Circuit suggested the agency never accounted for the costs it was imposing on border MSBs.

Financial institutions and their compliance teams should consider the following:

• The injunction does not reduce the underlying compliance imperative. The administration’s commitment to disrupting cartel cash flows has not wavered, and a formally noticed rule is the likely next step.
• For institutions with border exposure, the question is not whether new requirements will come, but when and in what form. FinCEN has every incentive – both political and practical – to return with a formally noticed rule.

If you would like to remain updated on these issues, please click here to subscribe to Money Laundering Watch. And please click here to find out about Ballard Spahr’s Anti-Money Laundering Team.