On September 9, 2026, the U.S. Department of the Treasury announced that its Financial Crimes Enforcement Network (“FinCEN”) has identified approximately $17.5 billion in suspicious financial activity potentially linked to health care fraud.  The announcement accompanied the release of a new Financial Trend Analysis (“FTA”), which analyzed over 5,700 Bank Secrecy Act (“BSA”) reports filed by financial institutions between March 1, 2025 and February 28, 2026.  The FTA is FinCEN’s second health care fraud-related issuance this year, following an Advisory issued in March 2026 urging financial institutions to be vigilant about health care fraud schemes targeting government health care benefit programs.  This second-in-one-year issuance demonstrates the Administration’s continued focus on health care fraud and related enforcement.

Treasury Secretary Scott Bessent framed the instant release as part of the Administration’s broader anti-fraud agenda, stating: “By identifying and reporting this suspicious activity, financial institutions have given law enforcement critical insight into the illicit actors who deliberately exploit U.S. health care benefits programs”.  The FTA’s findings are intended to provide law enforcement with critical financial intelligence to identify, investigate, and disrupt illicit schemes that exploit taxpayer-funded health care benefits. The findings will likely fuel further health care fraud enforcement efforts.

The FTA highlights several key trends:

Depository Institutions Drive BSA Reporting. Depository institutions, such as commercial banks and credit unions, filed approximately 89 percent of the BSA reports in the dataset and accounted for nearly 87 percent of the reported suspicious activity amounts. In total, 471 financial institutions filed reports, with filers reporting an average of approximately $3.3 million per filing and a median amount of approximately $600,000.  Just two depository institutions—the largest by asset size in the dataset—filed 29 percent of all health care fraud-related reports.

Fraud Spans Medicare, Medicaid, and Private Insurance. Suspected perpetrators frequently received payments from a combination of federal and state programs, as well as private insurance companies. Medicare and/or Medicaid were named in approximately 38 percent of the dataset, and Medicare Administrative Contractors (“MACs”) were identified in approximately 22 percent.

Subjects Located Across the Country. Filers identified subjects in all 50 U.S. states, as well as Puerto Rico, Guam, and the U.S. Virgin Islands. California, Florida, New York, and Minnesota were the most frequently identified states. At the county level, Los Angeles County, Hennepin County (Minnesota), and Miami-Dade County appeared the most frequently.

Home Health Care Businesses Lead Provider Types. Home health care businesses were the most frequently identified suspected fraudulent providers, appearing in approximately 32 percent of BSA reports (when excluding Puerto Rico Medicaid eligibility-related filings). Other frequently identified provider types included hospice care companies, mental and behavioral health and addiction treatment providers, durable medical equipment providers, and adult or child daycares. Notably, the majority of home health care businesses identified as potentially fraudulent were registered at residential homes.

Fraud Proceeds Fund Personal Spending and Luxury Purchases. Suspected perpetrators employed a range of apparent money laundering techniques before spending the obtained health care payments. In many cases, proceeds that did not go through a complex funds transfer process were used on personal expenses and luxury goods. More sophisticated schemes involved circular transactions with linked businesses, payments to individuals under the guise of payroll, and commingling of health care payments with other deposits. Approximately five percent of the dataset identified instances of funds either directly or indirectly funding international transfers, most frequently to Hong Kong.

Connections to Criminal Networks. Approximately four percent of the BSA reports identified health care fraud-related suspicious activity potentially involving larger fraud rings or criminal networks. The FTA noted examples including potentially fraudulent hospice care providers in northern Los Angeles County that may be linked to organized crime, home health care and adult daycare businesses in Minnesota potentially tied to large fraud rings, and potentially fraudulent adult daycares in the New York City area that have previously been tied to Chinese money laundering networks.

The FTA also highlighted a notable trend in Puerto Rico, where 59 financial cooperatives filed approximately 29 percent of all BSA reports in the dataset. These reports primarily described suspicious activity related to eligibility for Puerto Rico’s Medicaid program, in which customers reportedly sought to lower their account balances prior to eligibility meetings with Plan Vital representatives in order to remain below the eligibility threshold.

As noted above, this FTA is part of the Trump Administration’s broader efforts to combat fraud in the healthcare industry and across federally funded programs.  Treasury has been working with the White House Task Force to Eliminate Fraud, established by Executive Order 14395 and led by Vice President Vance, and has encouraged whistleblowers to report credible information related to fraud, money laundering, sanctions violations, and tax-law violations.  The FTA also highlights the critical role that financial institutions play in identifying and reporting suspicious activity, and should serve as a reminder that health care fraud remains a top enforcement priority.

If you would like to remain updated on these issues, please click here to subscribe to Money Laundering Watch. Please click here to find out about Ballard Spahr’s Anti-Money Laundering Team.

Banks and their employees face a difficult balancing act when discussing suspected fraud or money laundering activity with a customer on whose account activity the bank has filed a suspicious activity report (SAR).  The bank must take practical steps to protect the customer and the institution (for example, verifying transactions, restricting account access, or requesting additional documentation) while strictly preserving SAR confidentiality. If a bank employee discloses—or even inadvertently implies—that a SAR has been filed, that law enforcement is involved, or even that internal investigations are ongoing, the bank can be exposed to regulatory findings, civil penalties, litigation risk, and reputational harm.  What’s more, the employees engaged in these conversations may face discipline or termination for violating policy and confidentiality requirements. At the same time, poorly chosen language or a refusal to provide a customer with information about his or her account, can cause customer disputes, prompt complaints, or create safety risks for frontline personnel.

On September 2, 2026, FinCEN and the federal banking agencies (the Federal Reserve, FDIC, NCUA, and OCC) issued a joint statement clarifying the application of SAR confidentiality requirements to communications with customers. The statement explains that SAR confidentiality requirements do not prohibit banks and credit unions from communicating with customers about potentially fraudulent transactions, suspicious activity, account restrictions, or account closures, provided those communications do not disclose the existence of a SAR.

The statement follows a June 2025 Request for Information regarding payments fraud, in which commenters identified questions concerning the extent to which financial institutions may discuss fraud-related matters with customers when a SAR has been or may be filed. It also references Executive Order 14331, Guaranteeing Fair Banking for All Americans.

The Guidance

The agencies reiterate that the Bank Secrecy Act (BSA) prohibits the disclosure of a SAR or information that would reveal the existence of a SAR. At the same time, the agencies note that FinCEN’s SAR confidentiality regulations permit the disclosure of the underlying facts, transactions, and documents upon which a SAR is based.

As a result, banks and credit unions may communicate with customers or third parties regarding potentially fraudulent transactions, suspicious activity, account restrictions, and account closures, so long as the communication does not disclose that a SAR has been filed.

The agencies also state that the fact that a customer or third party could potentially infer from the underlying facts that a SAR may have been filed does not, by itself, constitute a prohibited disclosure under the SAR confidentiality requirements.

Relationship to Prior Guidance

The joint statement builds on existing SAR confidentiality guidance. FinCEN’s 2010 final rule addressing SAR confidentiality established that the prohibition on disclosure does not apply to the underlying facts, transactions, and documents on which a SAR is based. More recently, FinCEN’s September 2025 guidance regarding cross-border information sharing (FIN-2025-G001) reiterated that principle in the context of information sharing among affiliated institutions.

The September 2026 joint statement focuses specifically on communications with customers and provides additional clarification regarding how financial institutions may apply existing SAR confidentiality requirements in customer-facing situations.

Examples of Permissible Communications

The statement provides a non-exhaustive list of communications that “would not typically” disclose the existence of a SAR. Examples include:

• Requesting customer due diligence information to better understand the nature and purpose of a customer relationship;
• Notifying a customer that a delay, limitation, or account closure may be related to suspected fraud or suspicious activity;
• Notifying a customer that a deposit, such as an altered or counterfeit check, has been rejected due to suspected fraud;
• Asking about the purpose of a transaction or the source of funds;
• Providing educational materials or warnings regarding fraud schemes, typologies, and money mule activity;
• Communicating account maintenance decisions, including declining transactions or closing accounts; and
• Requesting information concerning the originator or beneficiary of a funds transfer.

The agencies emphasize that institutions should evaluate communications on a case-by-case basis and exercise caution to avoid revealing the existence of a SAR.

Practical Considerations

The statement does not modify existing legal or regulatory requirements and does not create new supervisory expectations. Instead, it provides additional clarification regarding how existing SAR confidentiality requirements apply in the context of customer communications.

Financial institutions may wish to review existing policies, procedures, and training materials relating to customer communications in situations involving fraud investigations, suspicious activity reviews, account restrictions, and account closures. Institutions should also consider whether additional guidance or training is appropriate to help personnel distinguish between discussing underlying facts and disclosing information that could reveal the existence of a SAR.

Because the agencies’ examples are non-exhaustive and emphasize a facts-and-circumstances analysis, institutions should continue to assess individual situations carefully and document decision-making where appropriate.

Looking Ahead

The joint statement provides additional clarification regarding the scope of SAR confidentiality requirements and confirms that institutions generally may discuss underlying facts, transactions, and documents with customers, provided they do not disclose the existence of a SAR. Financial institutions should consider the guidance when evaluating customer communication practices and related compliance procedures.

If you would like to remain updated on these issues, please click here to subscribe to Money Laundering Watch. And please click here to find out about Ballard Spahr’s Anti-Money Laundering Team.

On August 11, 2026, the U.S. Department of the Treasury’s Financial Crimes Enforcement Network (“FinCEN”) renewed its Geographic Targeting Order (“GTO”) Imposing Recordkeeping and Reporting Requirements on Certain Financial Institutions in Minnesota. The GTO requires financial institutions located in Hennepin and Ramsey Counties, Minnesota, to “retain and report records of certain payments of $3,000 or more.”

The initial GTO was announced on January 9, 2026, as part of the Trump Administration’s efforts to combat alleged “rampant government benefits fraud in Minnesota.” The first GTO went into effect on February 12, 2026, and was set to expire on August 10, 2026. The renewed GTO has extended this deadline and will remain in effect until February 6, 2027. FinCEN has released frequently asked questions in connection with the renewal that explain the requirements of the renewed GTO.

The renewed GTO is nearly identical to the initial order but, as explained in the Frequently Asked Questions, exempts certain Covered Businesses “that are banks from [the] GTO’s requirement to record or report fund transfers where the originator falls into certain categories[.]” The exemptions are consistent with the Exemptive Relief Order for the Geographic Targeting Order Imposing Recordkeeping and Reporting Requirements on Certain Financial Institutions in Minnesota, which granted “tailored exemptive relief” to “exempt certain categories [of] fund transfers that are lower risk for government benefits fraud, and to allow banks sufficient time to report certain information required by the GTO.”

The renewed GTO continues to exempt banks from funds transfers where the originator falls into one of the sixteen categories excluded under the Customer Due Diligence Rule, but, importantly, it does not extend the temporary relief that had limited banks’ obligations to information already covered by the Recordkeeping Rule.

The renewed GTO, as explained, is otherwise identical to the first GTO. It requires banks and money services businesses (MSBs) located in Hennepin and Ramsey Counties to report international fund transfers of $3,000 or more when the beneficiary or recipient is located outside of the United States. Banks and MSBs located in these counties are “covered businesses,” which is defined as any bank as defined in 31 CFR 1010.100(d), or any money transmitter, as defined in 31 CFR 1010.100(ff)(5), with a branch, subsidiary, or office located in the covered geographic area. The GTO requires covered businesses to report to FinCEN certain information required to be retained under “31 CFR 1020.410(a)(1) and (2), along with certain other additional information, regardless of whether the information is provided with the payment order[.]” This information, which is set forth in the Frequently Asked Questions, includes:

1. The name and employer identification number of the Covered Business;

2. The account number of the originator;

3. The name of the beneficiary; 

4. The address of the beneficiary;

5. The date of birth of the beneficiary;

6. A phone number of the beneficiary;

7. An email address of the beneficiary; 

8. The account number of the beneficiary; 

9. Whether the source of funds for the transfer includes payments that are from any federal,

state, or local government contract or benefit program; and,

10. If the answer to question (9) is yes, whether those payments are from government

agencies to entities in which the originator has any ownership interest.

If the Covered Business is a money transmitter, additional information concerning the form of the transmittal is required. If the renewed GTO is “willfully” violated, a business could be subject to civil penalties, with a separate penalty applied for each individual violation. Criminal fines are also available, as well as imprisonment for no more than five years.

This renewed GTO is part of Secretary of the Treasury Scott Bessent’s plan “to follow the money” and should serve as a reminder that the Trump Administration appears willing to impose strict reporting requirements and enforcement tools to further its goals.

If you would like to remain updated on these issues, please click here to subscribe to Money Laundering Watch. And please click here to find out about Ballard Spahr’s Anti-Money Laundering Team.

On July 13, a divided Ninth Circuit panel upheld a lower court order that barred enforcement of FinCEN’s border Geographic Targeting Order (“GTO”). The GTO would have forced money services businesses (“MSBs”) in 30 ZIP codes along the U.S.-Mexico border to report cash transactions of just over $200, a dramatic reduction from the longstanding $10,000 reporting threshold. The decision in Novedades Y Servicios, Inc. v. FinCEN, 181 F.4th 961, 967 (9th Cir. 2026)  is a significant procedural check on the administration’s anti-cartel enforcement agenda.

Cartels as a National Security Priority

The Trump administration has repeatedly framed cartel-linked money laundering as a national security threat. On January 20, 2025 – the first day of his second term – President Trump issued an executive order designating certain international cartels as Foreign Terrorist Organizations and Specially Designated Global Terrorists. The order declared that cartels “present an unusual and extraordinary threat to the national security, foreign policy, and economy of the United States,” and set its goal as “the total elimination of these organizations’ presence in the United States.”

The border GTO flowed directly from that priority. Issued by FinCEN in March 2025, the GTO targeted MSBs in 30 ZIP codes along the U.S.-Mexico border, requiring a Currency Transaction Report (“CTR”) filing for any cash transaction between $200 and $10,000. Treasury Secretary Scott Bessent made the administration’s priorities clear: “[f]or too long, cartels have abused the U.S. financial system to profit from poisoning Americans with deadly fentanyl. At Treasury, we are expanding our efforts to keep drug money out of the United States and to provide law enforcement with additional information to put these traffickers behind bars.”

The Ninth Circuit Holding

The panel’s decision turned on administrative procedure rather than the merits of AML enforcement.  

The majority concluded that the border GTO was likely a rule – rather than an order – under the Administrative Procedure Act (APA), because it applied to all unnamed and unspecified MSBs across a geographic area home to over one million people, rather than targeting specific identified businesses based on particularized findings. Because 31 U.S.C. § 5326 authorizes FinCEN to act only by “order,” the GTO likely exceeded the agency’s statutory authority.

The panel also found that FinCEN was required to conduct notice-and-comment rulemaking which it skipped entirely, and that the GTO was likely arbitrary and capricious because FinCEN “entirely failed to consider the cost of compliance to regulated parties.” On that point, the court noted that the only evidence the government offered on cost consideration was an internal FinCEN memorandum dated “March XX” that was undated, in draft form, and heavily redacted.

Who Challenged It

The case was brought by the Institute for Justice on behalf of Esperanza Gomez Escobar, who owns and runs Novedades y Servicios, a family-run MSB in San Diego. Escobar’s customers are largely people without bank accounts who come in to cash paychecks and wire money to family.

The compliance burden was, by Escobar’s account, impossible for her MSB to absorb. The $200 threshold swept in roughly 99% of Novedades’s monthly transactions, and the complaint alleged that filing the resulting CTRs would require an additional 14 to 17 hours per day. During the single week the order was in effect, Escobar alleges she lost between 50 and 60 percent of her customers after explaining the new reporting requirements. The Institute for Justice argued the lowered threshold amounted to “enlisting [small business owners] as surveillance agents of the government.”

The dynamic is not new. As the President of the National Small Business Association told the Wall Street Journal in 2024 when discussing a separate FinCEN rule, “FinCEN has never dealt with small businesses, and small businesses don’t know who FinCEN is and FinCEN doesn’t know how to regulate small businesses.”

Implications

The Ninth Circuit’s decision is a procedural check rather than a policy reversal. Nothing in the Ninth Circuit’s ruling calls into question the policy objective of targeting cartel finances. The panel’s concerns were exclusively procedural: FinCEN bypassed formal notice-and-comment rulemaking, and the record before the Circuit suggested the agency never accounted for the costs it was imposing on border MSBs.

Financial institutions and their compliance teams should consider the following:

• The injunction does not reduce the underlying compliance imperative. The administration’s commitment to disrupting cartel cash flows has not wavered, and a formally noticed rule is the likely next step.
• For institutions with border exposure, the question is not whether new requirements will come, but when and in what form. FinCEN has every incentive – both political and practical – to return with a formally noticed rule.

If you would like to remain updated on these issues, please click here to subscribe to Money Laundering Watch. And please click here to find out about Ballard Spahr’s Anti-Money Laundering Team.

In an alert issued this July, FinCEN urged banks and other financial institutions to increase their focus on detecting, preventing, and reporting fraud schemes targeting federal student aid (“FSA”) programs. The alert provides specific red flags for identifying suspicious activity—and signals that regulators expect proactive compliance efforts.

The United States Department of Education (“ED”) has launched a national effort to prevent student aid fraud, and estimates that it prevented about $1 billion in FSA-related fraud in 2025 alone. The scale of FSA funding—and the associated fraud risks—is enormous. Every year approximately $120 billion go out to around 13 million students for grants, work-study funds, and low-interest loans. The FSA office also oversees the Free Application for Federal Student Aid (FAFSA), through which students apply for financial aid for post-secondary education.

FinCEN’s alert identifies the three most common types of schemes to defraud the FSA program, explaining how in each case, fraudsters seek to divert funds intended for bona fide student-recipients of federal aid. FSA funds are paid directly to educational institutions, and once those institutions apply the funds to any tuition and fees the student-recipients owe, the institutions then issue a “refund” of the difference to the students for use toward living expenses. Students must be enrolled in the institutions for 60% of the enrollment period to receive these refunds, and it is these refunds that most FSA schemes target.

The three types of schemes FinCEN identifies are those using “ghost students,” “straw students,” and insider assistance.

• Ghost Students: In ghost-student schemes, fraudulent actors either use personally identifying information (“PII”) of identity theft victims, or wholly fabricated information to create synthetic identities, in order to pose as legitimate students. They then enroll these “ghost students” in educational institutions and apply for federal student aid and collect the FSA refunds. To satisfy the requirement that students maintain enrollment for 60% of the enrollment period, the fraudulent actors often use AI chatbots to complete the coursework.
• Straw Students: Straw-student schemes are similar to ghost-student schemes, except that the enrolled student is a willing participant. In these cases, individuals provide their PII to be used in the fraudulent scheme, and they are willingly enrolled in educational institutions. The straw students typically do not attend classes, with the fraudsters ensuring the completion of any coursework required to satisfy the 60% requirement.
• Insider-Assisted Schemes: Lastly, FinCEN explained that in some cases, a staff member with insider access will facilitate the scheme, including by recruiting straw students and helping ensure they get approved for FSA funds. The insider staff member will then either steal the aid refund entirely or require the students to pay a portion of the funds as a kickback in exchange for facilitating the scheme.

Banks can spot these schemes by watching for red flags when stolen refunds are laundered. Entities can usually identify deposits as FSA refunds by the transaction references in ACH deposits—typically identifying an educational institution (either by name or a common abbreviation) and “refund.” Once entities identify incoming FSA refunds, they may be able to flag the common tools used to launder the fraudulently obtained proceeds, including the use of “money mules” to transfer the funds, shell companies, fraudulent accounts opened with fake customer identification materials, and abuse of digital assets.

As guidance to banks and financial institutions seeking to improve detection of FSA schemes, FinCEN identifies the following “red flags,” which either independently or in conjunction with other indicators—such as a customer’s historical financial activity, whether transactions are in line with prevailing business practices, and whether multiple red flags coexist—can indicate that an account or customer is involved in an FSA fraud scheme:

• An account that receives FSA refunds where the account’s history and the customer’s profile are not consistent with enrollment at an educational institution, especially if the stated recipient of the refund has no known connection to the account.
• A customer uses funds received from a student aid refund to quickly purchase digital assets, and then rapidly transfers them to a digital asset wallet for no apparent legitimate purpose.
• Multiple unrelated students use the same account to deposit federal student aid refunds.
• A newly established customer account is funded solely by student aid refunds and lacks other financial activity.
• A customer receives multiple peer-to-peer or wire transfers from accounts that recently received student aid refunds, for no business or apparent lawful purpose.
• Multiple accounts that receive a student aid refund are accessed from the same out-of-state or international IP address or the same device.
• Multiple accounts are created online within a short timeframe at a financial institution and receive student aid refunds.

FinCEN also explains that often the funds deposited in these accounts are rapidly transferred through peer-to-peer or wire transfers to other accounts, used to purchase digital assets, or used in transactions with online money service businesses that typically process international funds transfers.

Finally, FinCEN’s alert emphasizes the obligations banks and other financial institutions owe under the BSA to implement appropriate due diligence procedures and report suspicious activity. It urges entities that may be used in furtherance of FSA fraud schemes to take steps to detect such schemes, and to report any suspicious activity they identify.

While FinCEN’s alert does not suggest that its enforcement focus is on legitimate businesses whose products are subverted for unlawful purposes, it makes clear that this administration expects them to take affirmative steps to prevent fraud. Especially given FinCEN’s increased focus on student aid fraud, financial institutions should review their fraud detection and prevention programs to ensure they account for the patterns and red flags FinCEN has identified and that they fulfill their obligations under the BSA to detect and report suspicious activity.

If you would like to remain updated on these issues, please click here to subscribe to Money Laundering Watch. And please click here to find out about Ballard Spahr’s Anti-Money Laundering Team.

On June 30, 2026, the U.S. Department of the Treasury’s Financial Crimes Enforcement Network (“FinCEN”) issued an alert (the “Alert”), alongside a press release, outlining efforts to combat fiscal fuel theft (known in Mexico as “huachicol fiscal”) along the U.S.-Mexico border.  In simplest terms, fiscal fuel theft occurs when fuel is smuggled from the U.S. to Mexico to evade Mexico’s import tax.

FinCEN’s action is part of U.S. law enforcement’s broader effort to curtail money laundering activities by Mexico-based cartels,” including the Jalisco New Generation Cartel (CJNG), the Sinaloa Cartel, and the Gulf Cartel— a subject we have previously covered. The Alert supplements FinCEN’s May 2025 alert on the topic and it provides updates in methodologies used in the operation and on new sanctions imposed by the Treasury’s Office of Foreign Assets Control (“OFAC”).  FinCEN’s alerts describe a scheme to bypass Mexican energy regulations, evade taxes, and undercut the fuel market, while relying on U.S. financial institutions to process transactions. In response, U.S. financial institutions operating in oil and gas markets along the southern border should remain vigilant in their due diligence and their reporting obligations.

Background: How Cartels Smuggle and Commercialize U.S. Fuel in Mexico

Mexico’s regulatory and economic programs have led to an expensive and concentrated market for fuel products. Cartels are taking advantage of rising costs by smuggling fuel across the southern border to evade Mexican import taxes while using the excess profits to advance their enterprises.

While Mexico produces oil, it depends on imports of refined petroleum to support its economy. The U.S. is a major trading partner in this sector, exporting refined fuel that accounts for over 70% of Mexico’s fuel consumption. Although foreign fuel is necessary, importing energy into Mexico is a highly regulated, multipart process.

Companies must have a permit from Mexico’s Secretariat of Energy (SENER) to import fuel. A SENER permit allows a company to pay the Special Tax on Products and Services (IEPS) through a licensed customs broker. After paying import taxes, companies with SENER permits can only sell their imports to companies with permits from Mexico’s National Energy Commission (CNE). A CNE permit allows a company to commercialize fuel products in Mexico, but without a SENER permit they are prohibited from importing fuel themselves. Mexico has made a concerted effort to separate importing and commercializing, as most companies are only permitted to have one of the permits.

Cartels bypass the regulations by using companies with CNE permits as fronts to broker foreign purchases, import products, and commercialize smuggled fuel without paying the IEPS. The Alert provides a general overview of the operation: Cartel- affiliated brokers with CNE permits—but without SENER permits—illegally purchase fuel directly from well-connected U.S. traders. These traders, primarily based in Texas, use industry connections to purchase products to source products from major refineries and distributors, diverting fuel designated for legitimate export to Mexico to cartel fronts and shell companies instead. After securing the products, cartels use a variety of methods to move fuel across the southern border, including falsifying customs documents to misrepresent products as those not subject to the IEPS import tax; bribing border officials; and using shipping containers to disguise and hide the fuel. Once in Mexico, the cartels legitimatize the smuggled fuel through forged invoices claiming the fuel was purchased in compliance with applicable regulations.

By significantly reducing costs to bring fuel to the commercial market in Mexico, cartels can sell fuel below market value at affiliated gas stations and unregulated roadside stops. The scheme both undercuts legitimate operators in the supply chain and deprives the state of significant tax revenue.

The Alert also details how Cartel-affiliated Mexican brokers pay their U.S. counterparts, primarily through international wire transfers and digital asset payments, including stablecoins, processed through U.S. and Mexican financial institutions and digital asset service providers, as well as through structured cash deposits along the southern border. U.S. traders then launder these illicit proceeds through purchases of luxury goods, real estate, and investment assets.

New Sanctions

In conjunction with the Alert, OFAC imposed sanctions on two individuals and nine associated entities involved with the scheme. These sanctions highlight the variety of roles necessary in the Cartel’s operation.

First, the government sanctioned Oscar Guillermo Juraidini Silva and his businesses for operating as an accountant and key planner of financial operations in the smuggling scheme. Second, the government sanctioned J. Refugio Ruiz Villagomez for knowingly smuggling fuel into Mexico. These sanctions were pursuant to Executive Order (“E.O.”) 14059, Imposing Sanctions on Foreign Persons Involved in the Global Illicit Drug Trade and E.O. 13224, Blocking Property and Prohibiting Transactions With Persons Who Commit, Threaten To Commit, or Support Terrorism, as amended by E.O. 13886, Modernizing Sanctions To Combat Terrorism.

In a sign of deepening cross-border coordination, Mexico’s Financial Intelligence Unit announced that it had blocked the domestic bank accounts of Juraidini, Ruiz Villagomez, and nine additional individuals identified through its own parallel financial analysis—underscoring that U.S. and Mexican authorities are pursuing these fiscal fuel theft networks in tandem.

Key Takeaways for U.S. Financial Institutions

U.S. financial institutions should do their best to discern whether a customer is a reputable company operating in a way that is typical in the oil and gas industry for a company of their size. A non-exhaustive list of red flags in due diligence for industry relevant customer behavior includes:

• A customer engages in traditional money laundering typologies with transactions having no clear connection to the industry (e.g., the sale or purchase of luxury goods, real estate, and investment assets)
• A customer receives payments directly from Mexican companies without a SENER permit or with a CNE permit
• A customer receives payments from a company affiliated with the Cartel
• A customer has little to no business expenses, operations, or online presence
• A customer is a U.S.-based company operating in Mexico without a Mexican subsidiary
• A customer receives funds from small, recently established U.S. companies
• A customer sends or receives a significant volume of non-descript payments
• A customer receives significant transaction activity with insufficient infrastructure to store or transport the fuel
• A customer receives funds from companies registered to residential addresses

Financial institutions who uncover suspicious activity in their due diligence processes must follow reporting requirements under the Bank Secrecy Act (BSA), which includes filing a Suspicious Activity Report (SAR) if a transaction is related to criminal activity. In the twelve months following FinCEN’s May 2025 alert, financial institutions filed more than 160 SARs detailing over $7 billion in suspicious activity connected to these schemes, with Texas and Florida the most commonly implicated states. Financial institutions operating along the southern border should also consider joining voluntary information sharing programs amongst financial institutions. If you would like to remain updated on these issues, please click here to subscribe to Money Laundering Watch. Please click here to find out about our Anti-Money Laundering Team.