The U.S. Department of Treasury’s Financial Crimes Enforcement Network (FinCEN) released its latest Financial Trend Analysis (FTA) this month, reporting data from banks and other financial institutions showing that, following a recent surge, the number of reported ransomware incidents and payment amounts dipped slightly in 2024. High-profile ransomware attacks frequently appear in the news and the impact can be severe: in just the last month, news broke that an e-tailer company was knocked offline for 45 days following one attack, and cities and towns across the U.S. lost access to their emergency alert systems after another.

Data indicates reality matches the perception—ransomware attacks surged to their highest levels in 2023, with a total of 1,512 reported incidents and $1.1 billion in reported ransom payments, a staggering 77 percent increase in total payments from the prior year. This continued a trend of increased malicious activity that first appeared in 2021, in which FinCEN received reports of approximately 1,400 incidents and nearly $1 billion in payments, more than double the previous year. Indeed, the three-year review period for the FTA (January 2022–December 2024) saw a total of 7,395 ransomware-related reports, totaling more than $2.1 billion in payments, while during the entire previous nine-year period (2013 through 2021), FinCEN received only 3,075 reports totaling approximately $2.4 billion in ransomware payments.

One year does not make a trend but the latest data show signs for cautious optimism. In 2024, companies reported a total of 1,476 ransomware incidents, and approximately $734 million in ransomware payments. The median ransomware payment also decreased, from $175,000 in 2023 to $155,257 in 2024. FinCEN attributes this decrease in part to U.S. and U.K. law enforcement disrupting high-profile ransomware groups in December 2023 and February 2024.

No industry is immune from the threat of attack, but the FTA identified that financial services, manufacturing, and healthcare industries reported both the greatest number of incidents and highest amount of aggregate payments sent to ransomware actors during the review period. Retail and legal services reported the next highest amount of overall incidents; meanwhile, science and technology and retail rounded out the highest reported total payments.

Other key findings reported in the FTA include:

• The data revealed 267 distinct ransomware variants used in attacks during 2022 – 2024, the most prevalent being Akira, ALPHV/BlackCat, LockBit, Phobos, and Black Basta.
• Ransomware actors most often used The Onion Router (“Tor”) to communicate with their victims, reported in 67 percent of ransomware incidents during the reporting period. TOR uses encryption and layered network infrastructure to allow users to browse the internet anonymously and conceal their identity and point of origin.
• Bitcoin (BTC) remains the prominent payment method of choice for ransomware actors, accounting for 97 percent of the reported ransomware transactions.

The financial threat to companies posed by ransomware is no secret. Data reported to FinCEN indicates that, although the vast majority of payments demanded by ransomware actors are below $250,000, individual demands can exceed $5 million. But the risk doesn’t end with the actual ransom payment—companies face increasing legal liability as well. According to one report from 2023, nearly one in five ransomware attacks resulted in a lawsuit against the victim company. Class actions against companies for failure to prevent or disclose ransomware breaches abounded in 2025, after several litigations arising from earlier breaches led to costly settlements.  

Therefore, it is as important as ever for companies to take steps to prevent, detect, and respond effectively to ransomware attacks. As FinCEN summarizes, “ransomware is a complex cybersecurity problem requiring a variety of preventive, protective, and preparatory best practices.” The FTA references several resources, including the Cybersecurity and Infrastructure Security Agency’s (CISA) website StopRansomware.gov, the National Security Agency’s (NSA) Ransomware Guide, and the National Institute of Standards and Technology’s (NIST) Data Integrity Project.

FinCEN publishes FTAs pursuant to section 6206 of the Anti-Money Laundering Act of 2020, 31 U.S.C. § 5318(g)(6)(B), which requires periodic reporting of threat pattern and trend information derived from data reported to FinCEN under the Bank Secrecy Act. The AML Blog has posted on previously-issued FTAs here and here.

If you would like to remain updated on these issues, please click here to subscribe to Money Laundering Watch. And please click here to find out about Ballard Spahr’s Anti-Money Laundering Team.

We blogged earlier this year about Attorney General Pam Bondi’s February 5, 2025 memorandum focusing the U.S. Department of Justice’s attention squarely on Mexican cartels, and about subsequent steps the Trump Administration has taken to follow through on that prioritization.  In the latest such effort, the U.S. Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) has issued a Notice of Proposed Rulemaking (NPRM) pursuant to Section 311 of the USA PATRIOT Act, which would prohibit U.S. financial institutions from processing any transactions which involve any of ten specific Mexican casinos (referred to collectively in the NPRM as the “Gambling Establishments”).  The casinos in question, spread across four Mexican states, are owned by three separate Mexican companies; however, FinCEN states in the NPRM it “assesses that the Gambling Establishments are ultimately controlled by a criminal group with a longstanding and transactional financial relationship in which the Gambling Establishments facilitate money laundering for the benefit of the Cartel de Sinaloa (Sinaloa Cartel)” – a drug trafficking organization which President Trump designated as a terrorist group on the first day of his second term, and which the Drug Enforcement Administration (DEA), in its 2024 National Drug Threat Assessment, characterized as being one of two cartels “at the heart” of the U.S. synthetic opioid crisis.

In the NPRM, FinCEN declares that “reasonable grounds exist for concluding that transactions involving the Gambling Establishments are of primary money laundering concern” after considering certain relevant factors – that the casinos allegedly make monthly disbursements to the Sinaloa Cartel, as well as additional illicit payments to senior cartel members carefully arranged (in amounts and timing) “to prevent documentable connections” between the casinos; and that the money laundering allegedly facilitated by the casinos benefits the Sinaloa Cartel, which is (as framed in the NPRM) a major driver of the U.S. opioid crisis – thus constituting, in the words of the NPRM “a significant threat to U.S. national security.”

The “meat” of the NPRM is Section 1010.665(b) of the proposed rule, imposing a “special measure” to combat the instant problem. Section (b)(1) would impose a prohibition on covered financial institutions (e.g. banks, securities brokers and dealers, and mutual funds) “opening or maintaining in the United States any correspondent account for or on behalf of a foreign banking institution if such correspondent account is used to process a transaction involving any of the Gambling Establishments.” Section (b)(2) would require that a covered financial institution go beyond basic due diligence when assessing its foreign financial institution clients, as it calls for “apply[ing] special due diligence to its correspondent accounts that is reasonably designed to guard against such accounts being used to process transactions involving the Gambling Establishments[,]” and specifies that such enhanced due diligence must include both sending written notice to foreign financial institution customers that they must not provide the casinos with access to their correspondent accounts and implementing screening mechanisms to identify correspondent account transactions involving the casinos.

FinCEN notes in the NPRM that various alternatives were considered to the blanket prohibition on the opening or maintaining of correspondent accounts, but that “[b]ecause of the nature, extent, and purpose of the obfuscation engaged in” by the casinos, any efforts to require additional information collection – e.g., reporting obligations, beneficial ownership identification, or enhanced know-your-customer (KYC) requirements – would ultimately be inadequate in addressing the paired goals of (a) protecting the U.S. financial system from risk and (b) impacting the Sinaloa Cartel’s ability to profit from its illicit activities.

The press release announcing the NPRM stated that it was being promulgated “in coordination with the Government of Mexico” – importantly for cross-border relations, as implementation of this rule may severely deplete willingness of U.S. financial institutions to do business with Mexico-based financial institutions and businesses in light of the heightened scrutiny required.

            If you would like to remain updated on these issues, please click here to subscribe to Money Laundering Watch. And please click here to find out about Ballard Spahr’s Anti-Money Laundering Team.

On October 9, 2025, the Financial Crimes Enforcement Network (“FinCEN”) jointly issued updated Frequently Asked Questions (“FAQs”) with the Federal Reserve Board of Governors, the Federal Deposit Insurance Corporation, the National Credit Union Administration, and the Office of the Comptroller of the Currency, clarifying the circumstances under which financial institutions must file suspicious activity reports (“SARs”).

Background

            For decades, SARs have been a useful tool for law enforcement agencies to detect money laundering and counter the financing of terrorism. However, regulatory guidance regarding when and how financial institutions must file these reports has at times been unclear. Financial institutions often expended significant organizational resources meeting supervisory expectations or best practices from examination manuals, even where not strictly required by law. The FAQs seek to clarify and simplify what is required of financial institutions under the Bank Secrecy Act (“BSA”).

Recent regulatory updates indicate a shift in philosophy regarding SARs, emphasizing efficiency and effectiveness in suspicious activity reporting. FinCEN has signaled an intent to pivot away from blanket expectations that can lead to duplicative work and information overload for both financial institutions and law enforcement. This marks a notable departure from previous practices where compliance obligations often resulted in substantial resource expenditures with limited incremental value for investigators.

What Do These FAQs Say?

            FinCEN and its partners identify four key areas: structuring SARs; continuing activity reviews; timelines for continuing activity SARs; and documentation requirements, clarifying both legal standards and practical expectations within the SAR regulatory scheme.

1. SAR Filings for Potential Structuring-related Activity

FinCEN writes that financial institutions are not required to file SARs for a transaction or series thereof with a value at or near the $10,000 Currency Transaction Report (“CTR”) threshold solely because it meets that amount, unless there is knowledge or suspicion that such transactions are designed specifically “to evade BSA reporting requirements.” In absence of any knowledge, suspicion, or reason to suspect, a financial institution is not required to file SARs simply because a transaction is at or above the CTR threshold.

Similarly, financial institutions must file a SAR only when they know, suspect, or have reason to suspect transactions aggregating $5,000 or more are designed specifically “to evade BSA reporting requirements” such as CTRs.

The FAQ also addresses structuring – an unlawful attempt to evade CTR reporting requirements under 31 C.F.R. § 103.18. FinCEN regulations define structuring as “a person, acting alone, or in conjunction with, or on behalf of, other persons, conducting or attempting to conduct one or more transactions in currency, in any amount, at one or more financial institutions, on one or more days, in any manner, for the purpose of evading CTR reporting requirements.” This definition is inclusive of attempts to evade requirements by breaking sums of currency above the CTR threshold into smaller sums below the threshold. The FAQs make clear that financial institutions should operate and maintain anti-money laundering and CFT protocols to detect and report structuring. The FAQs reflect FinCEN’s intention that institutions focus their efforts on high-value information rather than routine filings based solely on transaction amounts.

    2. Continuing Activity Reviews

The FAQs also address ongoing or continuing suspicious activity by a single customer or account. Prior FinCEN guidance suggested that financial institutions are expected or required to monitor whether suspicious activity is ongoing after a SAR has been filed. This guidance expressly states that financial institutions are not required to independently review a customer or account to evaluate whether suspicious activity continues after the filing of a SAR. Financial institutions can fulfill their SAR compliance obligations by relying on their standard policies and protocols for monitoring suspicious activity, and reporting it as appropriate, provided that those internal policies are reasonably designed to identify and report suspicious activity.

FinCEN stated in a prior guidance that financial institutions should file SARs for continuing suspicious activity after a 90-day period, with a filing deadline of 120 calendar days following the filing of a previous, related SAR. This FAQ now clarifies that financial institutions are not required to do so.

The revised FAQs address longstanding industry concerns about ongoing reviews of customer activity after initial SAR filings. Historically, examiners have interpreted prior advisories as requiring frequent re-evaluations of previously flagged accounts on a set timetable. The new FAQs clarify that separate, post-SAR investigations need not be conducted unless dictated by risk-based internal processes or relevant facts emerge during routine monitoring. This move encourages institutions to leverage their own protocols rather than defaulting to rigid mandates, potentially allowing compliance teams greater flexibility while still meeting regulatory expectations.

    3. Timing of Reports

If a financial institution elects to file a continuing activity SAR in accordance with FinCEN’s continuing suspicious activity guidance, they should do so within 120 calendar days of the filing of an initial SAR. This provides financial institutions a 90-day period after the filing of an initial SAR to evaluate continuing suspicious activity, and a 30-day period to file the subsequent SAR if the institution detects ongoing suspicious activity. In such a case, the institution should mark the date range of suspicious activity to include the entire 90-day period immediately following the filing of an initial or most recent SAR, on Item 30 of the SAR form. If a financial institution elects further reporting due to continued suspicion, the revised timeline allows up to 150 calendar days following detection, providing additional flexibility compared with prior practice.

    4. SAR Documentation

FinCEN clarifies that neither the BSA nor its implementing regulations require a financial institution to document a decision not to file a SAR. Prior FinCEN guidance had encouraged financial institutions to document such a decision, but there is no requirement for them to do so. If a financial institution chooses to document the decision not to file a SAR, a short, concise statement documenting the decision, consistent with internal policies and procedures, is likely sufficient, though institutions may consider additional documentation in complex investigations.

Documentation standards surrounding decisions not-to-file have shifted from “best practice” recommendations toward an explicitly optional stance. For many years, documenting “no-file” determinations was encouraged, and became ingrained as best practice, but this has now been reframed as optional rather than required by law. Financial institutions are advised that concise recordkeeping aligned with their risk-based policies will generally suffice; extensive narrative explanations should be reserved for especially complex matters or when warranted by specific circumstances.

Conclusions and Practical Steps

The recently issued FAQs clarify supervisory expectations without changing existing legal or regulatory requirements for suspicious activity reporting. They respond to feedback from financial institutions while streamlining prior guidance. By clarifying ambiguous areas and prioritizing efficiency, regulators aim to align compliance efforts with national security priorities while minimizing unnecessary operational burdens for filers. Financial institutions should monitor how this new guidance is implemented during examinations, including any changes to supervisory manuals, and proactively adjust their reporting policies as needed to leverage efficiencies without compromising vigilance against illicit finance.

If you would like to remain updated on these issues, please click here to subscribe to Money Laundering Watch. Please click here to find out about Ballard Spahr’s Anti-Money Laundering Team.