The SEC on September 29, 2026, announced fraud charges against two clusters of entities alleged to have defrauded hundreds of retail investors, including many in the United States, out of at least $15.3 million through what the agency calls “investment confidence scams.” In a pair of complaints filed in the U.S. District Court for the Southern District of New York, the SEC charged Cryptoaiml Ltd. and Cryptoaiml Capital Foundation with misappropriating more than $12.5 million from over 300 retail investors, and separately charged TSAI Pro Ltd. and TSAI Capital Foundation (also known as TSAI Exchange Ltd.) with stealing approximately $2.8 million from roughly 1,715 investors. Both sets of defendants are believed to be operated by unidentified individuals located overseas.

The two schemes shared a common architecture: the rapid creation of U.S. corporate entities, the filing of Forms D with the SEC containing fabricated information, registration as Money Services Businesses with FinCEN, and the aggressive use of WhatsApp group chats and social media to recruit victims. The SEC has since removed the fraudulent Forms D from its website.

How the Fraud Worked

Cryptoaiml. The Cryptoaiml scheme operated from approximately August 2024 through March 2025 and, according to the SEC’s complaint, followed a carefully staged progression. The defendants created a series of WhatsApp group chats with names like “VIP-Wealthy Affiliate Group,” “Citadel AI Community,” and “AI Advanced Community.” In those chats, the defendants impersonated real, named investment professionals at well-known firms, including a purported representative of Raymond James & Associates and the actual president of Citadel Securities. None of these real professionals or their firms had any involvement.

The impersonators claimed to share AI-generated trading “signals” with a purported 98% accuracy rate, directed investors to open accounts on a fake crypto trading platform, and posted fabricated testimonials from supposed satisfied investors to build confidence. The platform looked convincing, with real-time price displays and account dashboards showing growing balances, but no actual trading ever took place. To bolster legitimacy, the defendants embedded on their website a screenshot of a Form D filed with the SEC and an MSB registration with FinCEN, both of which contained fabricated names, addresses, and forged notarizations.

The endgame was blunt. When investors tried to withdraw their supposed profits, they were told their accounts were frozen and that they needed to pay advance fees to “unlock” them. Payments were directed to U.S. bank accounts held by shell entities, including Flavyo Trading Corporation, Neurotech IT Solutions Inc., INTY Endless LLC, and a sole proprietorship called Enjoy Time. Investors were coached on what to tell their banks about the transfers. Those funds were then wired to entities in the United Arab Emirates and to Chinese companies, commingled with funds of unknown origin. Some investors sold securities from brokerage accounts and 401(k)s to meet the defendants’ demands.

TSAI. The TSAI defendants ran a parallel but distinct scheme from September 2024 to March 2025, centered on a fake “AI Trading Bot Program.” Investors were told they could earn guaranteed profits by depositing crypto assets to “rent” AI-powered trading bots that would trade on their behalf. The bots ranged in price from $100 to $500,000; at the top end, the defendants promised returns of $17,500 per day for 360 days. The scheme also incorporated a pyramid structure: investors could earn commissions by recruiting others, with tiered levels from S0 to S7 and promises of monthly salaries and stock dividends for top recruiters.

As with Cryptoaiml, the entire operation was a fiction. There were no AI trading bots, no real accounts, and no actual trading. Like Cryptoaiml, TSAI also filed a Form D containing false information and posted a fabricated “SEC certificate” on its website to create the appearance of regulatory oversight. When investors tried to withdraw funds, they were told their accounts were blocked for “suspicion of illegal arbitrage” or were required to pay fabricated “taxes” and “verification payments.” By March 2025, the website went dark entirely.

What It Means

The SEC brought overlapping but distinct claims in the two actions, and the legal theories are worth examining.

Both complaints allege violations of Section 10(b) of the Exchange Act and Rule 10b-5, targeting both the defendants’ fraudulent misstatements and their broader deceptive schemes. But the two cases diverge in instructive ways.

The Cryptoaiml complaint additionally charges violations of Sections 206(1) and (2) of the Investment Advisers Act. The theory is that the defendants functioned as investment advisers because they entered into investment management agreements with at least two clients and held themselves out as providing securities advice for compensation. This is a notable claim. The advisory agreements were entirely sham documents, one purporting to be from “Cryptoaiml Venture Capital Management Group” and another invoking the name of Raymond James & Associates. Yet the SEC is treating those sham agreements as sufficient to establish an advisory relationship and trigger the Advisers Act’s fiduciary obligations. That willingness to look through form to substance is significant, particularly in a space where fraudsters routinely adopt the language and trappings of legitimate financial services.

The TSAI complaint takes a different path. In addition to the standard antifraud charges and Securities Act Section 17(a) claims, the SEC charges violations of Sections 5(a) and 5(c) for the sale of unregistered securities. The premise is that the AI Trading Bot Program constituted an investment contract under the Howey framework: investors pooled their funds, were promised returns generated by the defendants’ purported managerial efforts in developing and operating the trading bots, and could earn additional income through the pyramid recruitment structure. This matters because the SEC did not need to prove that the bots actually existed or functioned to bring the Section 5 claim; the offering was the investment contract itself. It is another example of the agency’s willingness to classify novel crypto-adjacent products as securities, and the registration charge gives the SEC an additional enforcement tool that does not require proof of scienter.

The Bigger Picture

These two actions are part of a broader pattern. Investment confidence scams that exploit encrypted messaging platforms and capitalize on public enthusiasm for AI are proliferating, and the SEC’s willingness to bring multiple legal theories against offshore entities reflects the agency’s determination to pursue these cases even when the individuals behind the schemes remain unidentified.

The cases also highlight a troubling feature of the current regulatory landscape: the ease with which bad actors can file Forms D and register as MSBs to manufacture an appearance of legitimacy. The SEC has encouraged investors to use Investor.gov to check the backgrounds of anyone offering or selling investments and has issued investor alerts specifically warning about fraudsters who use group chats or claim false SEC registration to lure victims. But as these complaints demonstrate, the fraudsters are getting more sophisticated in mimicking the markers of legitimate financial activity, and the combination of encrypted messaging, AI buzzwords, and fabricated regulatory credentials is proving effective at reaching unsophisticated investors.

If you would like to remain updated on these issues, please click here to subscribe to Money Laundering Watch. Please click here to find out about Ballard Spahr’s Anti-Money Laundering Team, and here to learn more about Ballard Spahr’s Securities Enforcement and Corporate Governance Litigation Team.

On September 9, 2026, the U.S. Department of the Treasury announced that its Financial Crimes Enforcement Network (“FinCEN”) has identified approximately $17.5 billion in suspicious financial activity potentially linked to health care fraud.  The announcement accompanied the release of a new Financial Trend Analysis (“FTA”), which analyzed over 5,700 Bank Secrecy Act (“BSA”) reports filed by financial institutions between March 1, 2025 and February 28, 2026.  The FTA is FinCEN’s second health care fraud-related issuance this year, following an Advisory issued in March 2026 urging financial institutions to be vigilant about health care fraud schemes targeting government health care benefit programs.  This second-in-one-year issuance demonstrates the Administration’s continued focus on health care fraud and related enforcement.

Treasury Secretary Scott Bessent framed the instant release as part of the Administration’s broader anti-fraud agenda, stating: “By identifying and reporting this suspicious activity, financial institutions have given law enforcement critical insight into the illicit actors who deliberately exploit U.S. health care benefits programs”.  The FTA’s findings are intended to provide law enforcement with critical financial intelligence to identify, investigate, and disrupt illicit schemes that exploit taxpayer-funded health care benefits. The findings will likely fuel further health care fraud enforcement efforts.

The FTA highlights several key trends:

Depository Institutions Drive BSA Reporting. Depository institutions, such as commercial banks and credit unions, filed approximately 89 percent of the BSA reports in the dataset and accounted for nearly 87 percent of the reported suspicious activity amounts. In total, 471 financial institutions filed reports, with filers reporting an average of approximately $3.3 million per filing and a median amount of approximately $600,000.  Just two depository institutions—the largest by asset size in the dataset—filed 29 percent of all health care fraud-related reports.

Fraud Spans Medicare, Medicaid, and Private Insurance. Suspected perpetrators frequently received payments from a combination of federal and state programs, as well as private insurance companies. Medicare and/or Medicaid were named in approximately 38 percent of the dataset, and Medicare Administrative Contractors (“MACs”) were identified in approximately 22 percent.

Subjects Located Across the Country. Filers identified subjects in all 50 U.S. states, as well as Puerto Rico, Guam, and the U.S. Virgin Islands. California, Florida, New York, and Minnesota were the most frequently identified states. At the county level, Los Angeles County, Hennepin County (Minnesota), and Miami-Dade County appeared the most frequently.

Home Health Care Businesses Lead Provider Types. Home health care businesses were the most frequently identified suspected fraudulent providers, appearing in approximately 32 percent of BSA reports (when excluding Puerto Rico Medicaid eligibility-related filings). Other frequently identified provider types included hospice care companies, mental and behavioral health and addiction treatment providers, durable medical equipment providers, and adult or child daycares. Notably, the majority of home health care businesses identified as potentially fraudulent were registered at residential homes.

Fraud Proceeds Fund Personal Spending and Luxury Purchases. Suspected perpetrators employed a range of apparent money laundering techniques before spending the obtained health care payments. In many cases, proceeds that did not go through a complex funds transfer process were used on personal expenses and luxury goods. More sophisticated schemes involved circular transactions with linked businesses, payments to individuals under the guise of payroll, and commingling of health care payments with other deposits. Approximately five percent of the dataset identified instances of funds either directly or indirectly funding international transfers, most frequently to Hong Kong.

Connections to Criminal Networks. Approximately four percent of the BSA reports identified health care fraud-related suspicious activity potentially involving larger fraud rings or criminal networks. The FTA noted examples including potentially fraudulent hospice care providers in northern Los Angeles County that may be linked to organized crime, home health care and adult daycare businesses in Minnesota potentially tied to large fraud rings, and potentially fraudulent adult daycares in the New York City area that have previously been tied to Chinese money laundering networks.

The FTA also highlighted a notable trend in Puerto Rico, where 59 financial cooperatives filed approximately 29 percent of all BSA reports in the dataset. These reports primarily described suspicious activity related to eligibility for Puerto Rico’s Medicaid program, in which customers reportedly sought to lower their account balances prior to eligibility meetings with Plan Vital representatives in order to remain below the eligibility threshold.

As noted above, this FTA is part of the Trump Administration’s broader efforts to combat fraud in the healthcare industry and across federally funded programs.  Treasury has been working with the White House Task Force to Eliminate Fraud, established by Executive Order 14395 and led by Vice President Vance, and has encouraged whistleblowers to report credible information related to fraud, money laundering, sanctions violations, and tax-law violations.  The FTA also highlights the critical role that financial institutions play in identifying and reporting suspicious activity, and should serve as a reminder that health care fraud remains a top enforcement priority.

If you would like to remain updated on these issues, please click here to subscribe to Money Laundering Watch. Please click here to find out about Ballard Spahr’s Anti-Money Laundering Team.

Banks and their employees face a difficult balancing act when discussing suspected fraud or money laundering activity with a customer on whose account activity the bank has filed a suspicious activity report (SAR).  The bank must take practical steps to protect the customer and the institution (for example, verifying transactions, restricting account access, or requesting additional documentation) while strictly preserving SAR confidentiality. If a bank employee discloses—or even inadvertently implies—that a SAR has been filed, that law enforcement is involved, or even that internal investigations are ongoing, the bank can be exposed to regulatory findings, civil penalties, litigation risk, and reputational harm.  What’s more, the employees engaged in these conversations may face discipline or termination for violating policy and confidentiality requirements. At the same time, poorly chosen language or a refusal to provide a customer with information about his or her account, can cause customer disputes, prompt complaints, or create safety risks for frontline personnel.

On September 2, 2026, FinCEN and the federal banking agencies (the Federal Reserve, FDIC, NCUA, and OCC) issued a joint statement clarifying the application of SAR confidentiality requirements to communications with customers. The statement explains that SAR confidentiality requirements do not prohibit banks and credit unions from communicating with customers about potentially fraudulent transactions, suspicious activity, account restrictions, or account closures, provided those communications do not disclose the existence of a SAR.

The statement follows a June 2025 Request for Information regarding payments fraud, in which commenters identified questions concerning the extent to which financial institutions may discuss fraud-related matters with customers when a SAR has been or may be filed. It also references Executive Order 14331, Guaranteeing Fair Banking for All Americans.

The Guidance

The agencies reiterate that the Bank Secrecy Act (BSA) prohibits the disclosure of a SAR or information that would reveal the existence of a SAR. At the same time, the agencies note that FinCEN’s SAR confidentiality regulations permit the disclosure of the underlying facts, transactions, and documents upon which a SAR is based.

As a result, banks and credit unions may communicate with customers or third parties regarding potentially fraudulent transactions, suspicious activity, account restrictions, and account closures, so long as the communication does not disclose that a SAR has been filed.

The agencies also state that the fact that a customer or third party could potentially infer from the underlying facts that a SAR may have been filed does not, by itself, constitute a prohibited disclosure under the SAR confidentiality requirements.

Relationship to Prior Guidance

The joint statement builds on existing SAR confidentiality guidance. FinCEN’s 2010 final rule addressing SAR confidentiality established that the prohibition on disclosure does not apply to the underlying facts, transactions, and documents on which a SAR is based. More recently, FinCEN’s September 2025 guidance regarding cross-border information sharing (FIN-2025-G001) reiterated that principle in the context of information sharing among affiliated institutions.

The September 2026 joint statement focuses specifically on communications with customers and provides additional clarification regarding how financial institutions may apply existing SAR confidentiality requirements in customer-facing situations.

Examples of Permissible Communications

The statement provides a non-exhaustive list of communications that “would not typically” disclose the existence of a SAR. Examples include:

• Requesting customer due diligence information to better understand the nature and purpose of a customer relationship;
• Notifying a customer that a delay, limitation, or account closure may be related to suspected fraud or suspicious activity;
• Notifying a customer that a deposit, such as an altered or counterfeit check, has been rejected due to suspected fraud;
• Asking about the purpose of a transaction or the source of funds;
• Providing educational materials or warnings regarding fraud schemes, typologies, and money mule activity;
• Communicating account maintenance decisions, including declining transactions or closing accounts; and
• Requesting information concerning the originator or beneficiary of a funds transfer.

The agencies emphasize that institutions should evaluate communications on a case-by-case basis and exercise caution to avoid revealing the existence of a SAR.

Practical Considerations

The statement does not modify existing legal or regulatory requirements and does not create new supervisory expectations. Instead, it provides additional clarification regarding how existing SAR confidentiality requirements apply in the context of customer communications.

Financial institutions may wish to review existing policies, procedures, and training materials relating to customer communications in situations involving fraud investigations, suspicious activity reviews, account restrictions, and account closures. Institutions should also consider whether additional guidance or training is appropriate to help personnel distinguish between discussing underlying facts and disclosing information that could reveal the existence of a SAR.

Because the agencies’ examples are non-exhaustive and emphasize a facts-and-circumstances analysis, institutions should continue to assess individual situations carefully and document decision-making where appropriate.

Looking Ahead

The joint statement provides additional clarification regarding the scope of SAR confidentiality requirements and confirms that institutions generally may discuss underlying facts, transactions, and documents with customers, provided they do not disclose the existence of a SAR. Financial institutions should consider the guidance when evaluating customer communication practices and related compliance procedures.

If you would like to remain updated on these issues, please click here to subscribe to Money Laundering Watch. And please click here to find out about Ballard Spahr’s Anti-Money Laundering Team.

On August 11, 2026, the U.S. Department of the Treasury’s Financial Crimes Enforcement Network (“FinCEN”) renewed its Geographic Targeting Order (“GTO”) Imposing Recordkeeping and Reporting Requirements on Certain Financial Institutions in Minnesota. The GTO requires financial institutions located in Hennepin and Ramsey Counties, Minnesota, to “retain and report records of certain payments of $3,000 or more.”

The initial GTO was announced on January 9, 2026, as part of the Trump Administration’s efforts to combat alleged “rampant government benefits fraud in Minnesota.” The first GTO went into effect on February 12, 2026, and was set to expire on August 10, 2026. The renewed GTO has extended this deadline and will remain in effect until February 6, 2027. FinCEN has released frequently asked questions in connection with the renewal that explain the requirements of the renewed GTO.

The renewed GTO is nearly identical to the initial order but, as explained in the Frequently Asked Questions, exempts certain Covered Businesses “that are banks from [the] GTO’s requirement to record or report fund transfers where the originator falls into certain categories[.]” The exemptions are consistent with the Exemptive Relief Order for the Geographic Targeting Order Imposing Recordkeeping and Reporting Requirements on Certain Financial Institutions in Minnesota, which granted “tailored exemptive relief” to “exempt certain categories [of] fund transfers that are lower risk for government benefits fraud, and to allow banks sufficient time to report certain information required by the GTO.”

The renewed GTO continues to exempt banks from funds transfers where the originator falls into one of the sixteen categories excluded under the Customer Due Diligence Rule, but, importantly, it does not extend the temporary relief that had limited banks’ obligations to information already covered by the Recordkeeping Rule.

The renewed GTO, as explained, is otherwise identical to the first GTO. It requires banks and money services businesses (MSBs) located in Hennepin and Ramsey Counties to report international fund transfers of $3,000 or more when the beneficiary or recipient is located outside of the United States. Banks and MSBs located in these counties are “covered businesses,” which is defined as any bank as defined in 31 CFR 1010.100(d), or any money transmitter, as defined in 31 CFR 1010.100(ff)(5), with a branch, subsidiary, or office located in the covered geographic area. The GTO requires covered businesses to report to FinCEN certain information required to be retained under “31 CFR 1020.410(a)(1) and (2), along with certain other additional information, regardless of whether the information is provided with the payment order[.]” This information, which is set forth in the Frequently Asked Questions, includes:

1. The name and employer identification number of the Covered Business;

2. The account number of the originator;

3. The name of the beneficiary; 

4. The address of the beneficiary;

5. The date of birth of the beneficiary;

6. A phone number of the beneficiary;

7. An email address of the beneficiary; 

8. The account number of the beneficiary; 

9. Whether the source of funds for the transfer includes payments that are from any federal,

state, or local government contract or benefit program; and,

10. If the answer to question (9) is yes, whether those payments are from government

agencies to entities in which the originator has any ownership interest.

If the Covered Business is a money transmitter, additional information concerning the form of the transmittal is required. If the renewed GTO is “willfully” violated, a business could be subject to civil penalties, with a separate penalty applied for each individual violation. Criminal fines are also available, as well as imprisonment for no more than five years.

This renewed GTO is part of Secretary of the Treasury Scott Bessent’s plan “to follow the money” and should serve as a reminder that the Trump Administration appears willing to impose strict reporting requirements and enforcement tools to further its goals.

If you would like to remain updated on these issues, please click here to subscribe to Money Laundering Watch. And please click here to find out about Ballard Spahr’s Anti-Money Laundering Team.

On July 13, a divided Ninth Circuit panel upheld a lower court order that barred enforcement of FinCEN’s border Geographic Targeting Order (“GTO”). The GTO would have forced money services businesses (“MSBs”) in 30 ZIP codes along the U.S.-Mexico border to report cash transactions of just over $200, a dramatic reduction from the longstanding $10,000 reporting threshold. The decision in Novedades Y Servicios, Inc. v. FinCEN, 181 F.4th 961, 967 (9th Cir. 2026)  is a significant procedural check on the administration’s anti-cartel enforcement agenda.

Cartels as a National Security Priority

The Trump administration has repeatedly framed cartel-linked money laundering as a national security threat. On January 20, 2025 – the first day of his second term – President Trump issued an executive order designating certain international cartels as Foreign Terrorist Organizations and Specially Designated Global Terrorists. The order declared that cartels “present an unusual and extraordinary threat to the national security, foreign policy, and economy of the United States,” and set its goal as “the total elimination of these organizations’ presence in the United States.”

The border GTO flowed directly from that priority. Issued by FinCEN in March 2025, the GTO targeted MSBs in 30 ZIP codes along the U.S.-Mexico border, requiring a Currency Transaction Report (“CTR”) filing for any cash transaction between $200 and $10,000. Treasury Secretary Scott Bessent made the administration’s priorities clear: “[f]or too long, cartels have abused the U.S. financial system to profit from poisoning Americans with deadly fentanyl. At Treasury, we are expanding our efforts to keep drug money out of the United States and to provide law enforcement with additional information to put these traffickers behind bars.”

The Ninth Circuit Holding

The panel’s decision turned on administrative procedure rather than the merits of AML enforcement.  

The majority concluded that the border GTO was likely a rule – rather than an order – under the Administrative Procedure Act (APA), because it applied to all unnamed and unspecified MSBs across a geographic area home to over one million people, rather than targeting specific identified businesses based on particularized findings. Because 31 U.S.C. § 5326 authorizes FinCEN to act only by “order,” the GTO likely exceeded the agency’s statutory authority.

The panel also found that FinCEN was required to conduct notice-and-comment rulemaking which it skipped entirely, and that the GTO was likely arbitrary and capricious because FinCEN “entirely failed to consider the cost of compliance to regulated parties.” On that point, the court noted that the only evidence the government offered on cost consideration was an internal FinCEN memorandum dated “March XX” that was undated, in draft form, and heavily redacted.

Who Challenged It

The case was brought by the Institute for Justice on behalf of Esperanza Gomez Escobar, who owns and runs Novedades y Servicios, a family-run MSB in San Diego. Escobar’s customers are largely people without bank accounts who come in to cash paychecks and wire money to family.

The compliance burden was, by Escobar’s account, impossible for her MSB to absorb. The $200 threshold swept in roughly 99% of Novedades’s monthly transactions, and the complaint alleged that filing the resulting CTRs would require an additional 14 to 17 hours per day. During the single week the order was in effect, Escobar alleges she lost between 50 and 60 percent of her customers after explaining the new reporting requirements. The Institute for Justice argued the lowered threshold amounted to “enlisting [small business owners] as surveillance agents of the government.”

The dynamic is not new. As the President of the National Small Business Association told the Wall Street Journal in 2024 when discussing a separate FinCEN rule, “FinCEN has never dealt with small businesses, and small businesses don’t know who FinCEN is and FinCEN doesn’t know how to regulate small businesses.”

Implications

The Ninth Circuit’s decision is a procedural check rather than a policy reversal. Nothing in the Ninth Circuit’s ruling calls into question the policy objective of targeting cartel finances. The panel’s concerns were exclusively procedural: FinCEN bypassed formal notice-and-comment rulemaking, and the record before the Circuit suggested the agency never accounted for the costs it was imposing on border MSBs.

Financial institutions and their compliance teams should consider the following:

• The injunction does not reduce the underlying compliance imperative. The administration’s commitment to disrupting cartel cash flows has not wavered, and a formally noticed rule is the likely next step.
• For institutions with border exposure, the question is not whether new requirements will come, but when and in what form. FinCEN has every incentive – both political and practical – to return with a formally noticed rule.

If you would like to remain updated on these issues, please click here to subscribe to Money Laundering Watch. And please click here to find out about Ballard Spahr’s Anti-Money Laundering Team.

In an alert issued this July, FinCEN urged banks and other financial institutions to increase their focus on detecting, preventing, and reporting fraud schemes targeting federal student aid (“FSA”) programs. The alert provides specific red flags for identifying suspicious activity—and signals that regulators expect proactive compliance efforts.

The United States Department of Education (“ED”) has launched a national effort to prevent student aid fraud, and estimates that it prevented about $1 billion in FSA-related fraud in 2025 alone. The scale of FSA funding—and the associated fraud risks—is enormous. Every year approximately $120 billion go out to around 13 million students for grants, work-study funds, and low-interest loans. The FSA office also oversees the Free Application for Federal Student Aid (FAFSA), through which students apply for financial aid for post-secondary education.

FinCEN’s alert identifies the three most common types of schemes to defraud the FSA program, explaining how in each case, fraudsters seek to divert funds intended for bona fide student-recipients of federal aid. FSA funds are paid directly to educational institutions, and once those institutions apply the funds to any tuition and fees the student-recipients owe, the institutions then issue a “refund” of the difference to the students for use toward living expenses. Students must be enrolled in the institutions for 60% of the enrollment period to receive these refunds, and it is these refunds that most FSA schemes target.

The three types of schemes FinCEN identifies are those using “ghost students,” “straw students,” and insider assistance.

• Ghost Students: In ghost-student schemes, fraudulent actors either use personally identifying information (“PII”) of identity theft victims, or wholly fabricated information to create synthetic identities, in order to pose as legitimate students. They then enroll these “ghost students” in educational institutions and apply for federal student aid and collect the FSA refunds. To satisfy the requirement that students maintain enrollment for 60% of the enrollment period, the fraudulent actors often use AI chatbots to complete the coursework.
• Straw Students: Straw-student schemes are similar to ghost-student schemes, except that the enrolled student is a willing participant. In these cases, individuals provide their PII to be used in the fraudulent scheme, and they are willingly enrolled in educational institutions. The straw students typically do not attend classes, with the fraudsters ensuring the completion of any coursework required to satisfy the 60% requirement.
• Insider-Assisted Schemes: Lastly, FinCEN explained that in some cases, a staff member with insider access will facilitate the scheme, including by recruiting straw students and helping ensure they get approved for FSA funds. The insider staff member will then either steal the aid refund entirely or require the students to pay a portion of the funds as a kickback in exchange for facilitating the scheme.

Banks can spot these schemes by watching for red flags when stolen refunds are laundered. Entities can usually identify deposits as FSA refunds by the transaction references in ACH deposits—typically identifying an educational institution (either by name or a common abbreviation) and “refund.” Once entities identify incoming FSA refunds, they may be able to flag the common tools used to launder the fraudulently obtained proceeds, including the use of “money mules” to transfer the funds, shell companies, fraudulent accounts opened with fake customer identification materials, and abuse of digital assets.

As guidance to banks and financial institutions seeking to improve detection of FSA schemes, FinCEN identifies the following “red flags,” which either independently or in conjunction with other indicators—such as a customer’s historical financial activity, whether transactions are in line with prevailing business practices, and whether multiple red flags coexist—can indicate that an account or customer is involved in an FSA fraud scheme:

• An account that receives FSA refunds where the account’s history and the customer’s profile are not consistent with enrollment at an educational institution, especially if the stated recipient of the refund has no known connection to the account.
• A customer uses funds received from a student aid refund to quickly purchase digital assets, and then rapidly transfers them to a digital asset wallet for no apparent legitimate purpose.
• Multiple unrelated students use the same account to deposit federal student aid refunds.
• A newly established customer account is funded solely by student aid refunds and lacks other financial activity.
• A customer receives multiple peer-to-peer or wire transfers from accounts that recently received student aid refunds, for no business or apparent lawful purpose.
• Multiple accounts that receive a student aid refund are accessed from the same out-of-state or international IP address or the same device.
• Multiple accounts are created online within a short timeframe at a financial institution and receive student aid refunds.

FinCEN also explains that often the funds deposited in these accounts are rapidly transferred through peer-to-peer or wire transfers to other accounts, used to purchase digital assets, or used in transactions with online money service businesses that typically process international funds transfers.

Finally, FinCEN’s alert emphasizes the obligations banks and other financial institutions owe under the BSA to implement appropriate due diligence procedures and report suspicious activity. It urges entities that may be used in furtherance of FSA fraud schemes to take steps to detect such schemes, and to report any suspicious activity they identify.

While FinCEN’s alert does not suggest that its enforcement focus is on legitimate businesses whose products are subverted for unlawful purposes, it makes clear that this administration expects them to take affirmative steps to prevent fraud. Especially given FinCEN’s increased focus on student aid fraud, financial institutions should review their fraud detection and prevention programs to ensure they account for the patterns and red flags FinCEN has identified and that they fulfill their obligations under the BSA to detect and report suspicious activity.

If you would like to remain updated on these issues, please click here to subscribe to Money Laundering Watch. And please click here to find out about Ballard Spahr’s Anti-Money Laundering Team.