On August 28, 2025, the U.S. Department of the Treasury’s Financial Crimes Enforcement Network (“FinCEN”) released an advisory (FIN-2025-A003) alongside a comprehensive Financial Trend Analysis (“FTA”), shining a spotlight on one of today’s most significant illicit finance risks: the integration of Chinese Money Laundering Networks (“CMLNs”) into the operations of Mexico-based transnational criminal organizations, better known as cartels. This pairing not only illustrates an evolution in global money laundering typologies but also presents new compliance challenges for financial institutions and multinational businesses alike.

The CMLN–Cartel Partnership

FinCEN’s latest analysis highlights how two very different regulatory environments have fostered an unlikely alliance:

1. Mexican cartels, flush with U.S.-dollar drug proceeds but restricted by Mexican currency controls that limit dollar deposits into local financial institutions (See related blog posts here, here and here.)
2. Chinese nationals, facing strict capital controls at home that cap annual foreign currency conversions at $50,000 per person.

These pressures have produced what FinCEN describes as “a mutualistic relationship”: CMLNs purchase dollars from cartels desperate to move cash out of reach; they then sell this cash to Chinese clients seeking ways around China’s capital controls, effectively weaving together criminal proceeds with ostensibly legitimate wealth migration.

As professional money launderers operating globally, including within U.S. borders, CMLNs have become vital intermediaries capable of handling vast sums quickly while minimizing risk for their cartel clients by offering both speed and sophistication at scale.

Mutual Interests

This alliance operates on simple logic: Cartels need to move large volumes of cash out of Mexico without attracting law enforcement scrutiny or breaching currency controls. Chinese individuals want access to overseas dollars beyond China’s annual conversion limits for investments or personal spending abroad.

CMLNs buy cash from cartel operatives at discounted rates, then sell this cash to Chinese clients seeking U.S. dollars outside formal channels, effectively blending criminal proceeds with legitimate wealth migration.

By operating globally, including within U.S borders, CMLNs serve as professional intermediaries who can rapidly move millions while minimizing risk for their cartel partners through fast settlements and advanced tradecraft.

Core Money Laundering Methods Used by CMLNs

FinCEN identifies three primary money laundering methodologies employed by CMLNs in support of cartel operations:

1. Mirror Transactions

Mirror transactions are at the heart of CMLN operations:

• These transactions resemble informal value transfer systems (“IVTS”), where one member receives illicit cash in one country while another delivers an equivalent value, often in pesos or yuan, to a recipient abroad.
• A hypothetical example: A U.S.-based operator collects dollar proceeds from a cartel contact. Simultaneously, an associate pays pesos directly to cartel representatives in Mexico without physically moving funds via formal banks.
• Increasingly, mirror transactions rely on convertible virtual currencies such as Bitcoin for swift settlement outside traditional banking channels. This system allows participants to evade detection by avoiding official remittance routes altogether, a key reason why these schemes continue thriving despite heightened regulatory scrutiny worldwide.

2. Trade-Based Money Laundering

Trade-Based Money Laundering (“TBML”) remains central within this threat landscape:

• Illicit funds are used within the United States to purchase bulk quantities of high-value goods, such as smartphones or luxury handbags, which are exported through complicit companies based often in Hong Kong or Latin America.
• Shell entities facilitate shipments overseas. These goods may be resold for local currency or serve directly as stores of wealth among Chinese buyers seeking alternatives to mainland investment restrictions. Layered export-import flows obscure both originators and ultimate beneficiaries across multiple jurisdictions. Frequently involved are “daigou” buyers, agents familiar throughout Chinese diaspora communities who use credit cards funded from laundered proceeds before shipping inventory home for resale on popular e-commerce platforms.

3. Use and Exploitation of Money Mules

Money mules play a crucial role:

• Large-scale recruitment targets vulnerable populations, including students on temporary visas (especially those restricted from lawful employment), retirees with modest means but clean credentials, or anyone willing to participate for compensation. These individuals may knowingly accept small fees or be misled under false pretenses via social media connections.  Facilitators within  CMLN structures may provide counterfeit passports for opening bank accounts. After the accounts are opened,  substantial deposits, often inconsistent with the account holder’s declared income sources, are made and quickly wired onward or converted into cashier’s checks used later for real estate acquisitions across desirable markets.

In addition,

• FinCEN has documented extensive misuse of retail credit card systems, with laundered funds being used to finance shopping sprees that do not fit established customer profiles;
• Outstanding balances are settled using fresh infusions from network-controlled accounts; and
• Reward points earned through spending cycles become additional vehicles for offshore payments, all facilitated using promotional platforms that are popular among Peoples Republic of China (“PRC”) nationals.

Key Red Flags and Compliance Vulnerabilities

To assist financial institutions in learning how money launderers exploit gaps across KYC processes and transaction monitoring frameworks, FinCEN has identified the following red flags:

1. Accounts opened with Chinese passports plus student or visitor visas, followed immediately by high-volume activity unrelated to customer profiles
2. Frequent large-dollar cash deposits closely followed by wire-outs or cashier’s check purchases
3. Multiple wire transfers originating abroad where legitimate business relationships cannot be substantiated
4. Reluctance, or outright refusal, to explain sources behind incoming transfers when questioned during onboarding or enhanced due diligence reviews
5. Shell companies focused on electronics or export trades reporting income inconsistent with typical business size, type, or geography
6. Businesses receiving repeated credits from online marketplaces but rarely engaging suppliers or purchasing needed inventory

Legacy rules-based monitoring tools frequently fail to detect suspicious activity unless multiple red flags appear together over time. This highlights the importance of adding contextual behavioral analysis to existing AML programs for more effective detection.

Five-Year Data Trends: SAR Insights (2020–2024)

The FTA supporting FinCEN’s advisory analyzed more than 137,000 Suspicious Activity Reports (“SAR”s) filed between January 2020–December 2024 under Bank Secrecy Act (“BSA”) obligations, with roughly $312 billion flagged as activity possibly tied back toward CMLN involvement.

Major Takeaways:

1. Depository Institutions are Prime Gateways

• Banks accounted for nearly 85% of all relevant filings, from national chains down through community branches serving immigrant-heavy metro areas where bulk-cash placement occurs largely undetected via traditional surveillance alone
• About 9% came from money services businesses reflecting vulnerability among smaller operators less equipped with modern anti-money laundering controls

2. TBML Schemes Remain Prevalent

• Over $9 billion cited specifically involved trade-based methods characterized by unusual funding behind exports/imports routed East Asia, Mexico, and Middle East corridors

3. Daigou Buyers and Credit Card Abuse Feature Prominently

• Only twenty SARs flagged daigou buyers explicitly, but associated retail or luxury typologies driven mainly through serial credit card spending cycles accounted collectively upwards $19 billion

4. Human Trafficking and Elder Fraud Crossovers Noted

• More than sixteen hundred filings implicated human trafficking or smuggling flows representing about $4+ billion transferred directly into massage parlors, spas, or restaurants owned ultimately via proxy structures linked back toward PRC and U.S dual residents (See related blog post here.)
• Adult daycare and healthcare fraud centered around New York facilities reflected hundreds more filings totaling nearly three quarters-of-a-billion dollars

5. Real Estate Remains Favored Integration Channel

• Over $53 billion in illicit funds were laundered through property acquisitions. These transactions were either conducted directly using accounts, wire transfers, or check payments held by money mules and falsely described as coming from “relatives abroad,” or indirectly routed through shell companies set up for single transactions and then abandoned after the deals closed.

6. Students Frequently Serve as Account Openers or Mules

• Roughly fourteen percent ($13+ billion) cited account holders listing status only as students, with patterns showing repeat openings, multiple bank links, or spending behavior well beyond background justification

Banks remain frontline defenders against this evolving threat ecosystem, yet also risk becoming unwitting conduits if robust internal practices lag rising sophistication exhibited among laundering networks themselves.

Regulatory Responses and Risk Mitigation Strategies

The evolving legal environment reflects increased regulatory attention and a growing focus on industry compliance obligations:

• FinCEN guidance aligns closely with broader policy developments including Executive Order 14157 which now designates major cartels and transnational crime organizations (“TCO”s) under Foreign Terrorist Organization statutes.
• The Department of Justice view even indirect facilitation, such as what could occur unwittingly through correspondent banking and remittance partnerships, as grounds not merely technical BSA breaches, but also as potential material support violations.
• In June 2025, FinCEN invoked new authority barring certain Mexican financial institutions labeled primary money laundering concerns from interacting with the U.S. financial system (See related blog post here).

For practitioners tasked daily with managing exposure amid rising complexity several actionable steps stand out:

Practical Steps Forward:

1. Revisit transaction monitoring and risk rating models by integrating the latest red flag indicators and placing greater emphasis on behavioral surveillance, especially in situations where multiple risk vectors converge over time;
2. Intensify customer due diligence especially regarding beneficial ownership verification and source-of-funds tracing;
3. Ensure that escalation protocols and internal reporting lines facilitate prompt legal and compliance review of any linkages, even circumstantial, to sanctioned entities, TCOs, and CMLNs;
4. Where third-party exposure exists overseas, including logistics providers, supply chain partners, freight forwarders, and export-import brokers operating out of affected regions, embed contract language granting audit rights and requires proof of adequate AML/CFT program compliance; and
5. Educate staff routinely regarding current threat typologies, new sanctions lists, and red flag scenarios, ensuring awareness extends to non-financial operational units likely exposed day-to-day interactions.

Implementing these strategies helps ensure defenses remain dynamic in response to both evolving geopolitical realities and technological advances increasingly exploited criminal actors.

Conclusion: Adapting Amid Escalating Complexity

With more than $312 billion flagged suspicious over just four years, and robust government action underway, FinCEN’s message is unmistakable: professionalized global networks will continue adapting rapidly unless private sector vigilance rises correspondingly.

Financial institutions must evolve beyond box-ticking compliance toward genuinely intelligent risk assessment incorporating current geopolitical shifts, regulatory changes, and emerging technology-enabled evasion tactics deployed alike by the cartels and CMLN brokers.

As reflected throughout both FIN-2025-A003 advisory and the FTA, a multi-layered defense posture leveraging intelligence-driven detection capabilities will prove indispensable if industry participants aim not simply survive, but thrive, in today’s ever-changing regulatory landscape.

By implementing comprehensive detection techniques, drawing on international best practices and a nuanced understanding of the specific cross-border risks associated with modern money laundering methods, the financial sector can better protect itself and fulfill regulatory obligations to maintain the integrity of global payment systems.

If you would like to remain updated on these issues, please click here to subscribe to Money Laundering Watch.  Please click here to find out about Ballard Spahr’s Anti-Money Laundering Team.

On August 6^th, 2025, following a four-week trial, a jury found Roman Storm, the founder of a crypto mixing service called Tornado Cash, guilty of conspiracy to operate an unlicensed money transmitting business. The jury was deadlocked and unable to reach a verdict on the two more serious charges against Storm: conspiracy to commit money laundering, and conspiracy to violate sanctions. The Tornado Cash case has been closely watched due to its implications for cryptocurrency regulation and the use of privacy-enhancing technologies in financial transactions.

Tornado Cash provides an open-source protocol frequently referred to as a “mixer,” which breaks the link between senders and recipients of cryptocurrency in order to enhance privacy. Essentially, the protocol allows users to anonymize cryptocurrency transactions by obscuring the source, recipient, and general movement of the assets that flow through it. It relies on immutable smart contracts, which are essentially one-party contracts between users and the platform, for the movement of assets. Crucially, neither Tornado Cash nor its founders ever directly took custody of users’ funds, and the creators had no discretionary control over the platform’s use. It was governed by a Decentralized Autonomous Organization (“DAO”), wherein users who own Tornado Cash Tokens vote to make decisions on behalf of the platform.

Supporters hail Tornado Cash for making great strides in the privacy—and, correspondingly, safety—associated with cryptocurrency. As Storm’s defense team highlighted, this is crucial for various types of users, like high-net-worth individuals, or activists, who have legitimate concerns that their safety may be jeopardized by traceable transactions.

Law enforcement and regulatory bodies, however, are still trying to figure out what to do with technology that permits substantial amounts of currency to move with minimal, if any, accountability or oversight. Anti-Money Laundering (“AML”) and Know Your Customer (“KYC”) laws and regulations, and Financial Crimes Enforcement Network (“FinCEN”) registration and other requirements, exist to protect against the harms that flow from criminal actors’ use of financial services to prevent enforcement authorities from tracing proceeds of criminal activity. The problem is that the legal and regulatory framework in place now was not designed for today’s technology. As the Tornado Cash verdict demonstrates, this leaves enforcement bodies trying to fit a square peg in a round hole where they perceive that harm has been caused by digital asset technology. The result is further uncertainty regarding what obligations developers have to moderate and regulate users—a function that would not be possible with Tornado Cash’s model—and what liabilities may follow if they fail or refuse to do so.

In this case, the government sought to hold Roman liable for when criminal actors utilized the platform after he created it, and after he gave up any ability to control or regulate its use. The jury’s inability to reach a verdict on the two more serious charges—conspiracy to commit money laundering and conspiracy to commit sanctions violations—likely reflects a deep divide regarding who should be held responsible for harms perpetuated in the digital assets space. On one hand, it is difficult to prove that Roman conspired to commit money laundering or sanctions violations when there was no relationship between Roman and the illicit actors. Roman developed the platform they later used, but he had no control over it by the time they used it, and neither the platform itself nor its creators ever took custody of the assets at issue. On the other hand, it was reasonably predictable that the platform would be used for illicit purposes. From a prevention-focused perspective, Tornado Cash’s creators were in a better position than anyone else to deter wrongdoers from using the platform. But that does not mean that they could be held criminally liable for failing to do so.

This month’s jury verdict highlights the challenges in doing so. The one count on which Storm was convicted, conspiracy to operate an unlicensed money transmitting business, did not require the jury to find that Storm had any ties to illicit funds or hackers. Moreover, while Roman was convicted for his decision not to register Tornado Cash as a money transmitting business, there are substantial questions that will surely be raised on appeal. Can Roman actually be liable for “operating” a money transmitting business that he designed in such a way that he had no operational control over it? And, can Tornado Cash itself be considered a “money transmitter” when it never actually takes custody of funds?

The outcome does not, however, clear creators of mixers like Tornado Cash, or creators in the digital asset space generally, of concerns for regulatory and criminal liability. First, while the count for operation of an unlicensed money transmitting business is the least serious of the counts, it is still a criminal conviction, for which Storm could face up to five years of in prison. Further, the jury did not acquit Storm. It was deadlocked. This means that some members of the jury believed the government had proven its case against Storm on those counts. And the claims were at least determined legally sufficient to go through to trial. The lack of an acquittal indicates that future cases with similar, slightly altered facts, could lead to more serious convictions than we saw here.

In short, the outcome does little, if anything, to resolve the uncertainty that pervades this space. Individuals or entities involved in the creation or operation of tools for digital asset users should exercise caution and consult counsel regarding whether they should register as a money transmitting business, and what steps they may be required to take with respect to AML or KYC laws and regulations. Unless and until new legislation is passed to address these questions, the law is likely to remain murky regarding how the current rules apply to operators in the digital asset space. The Tornado Cash verdict shows that juries may be willing to accept theories of liability that hold creators of these platforms accountable under traditional financial services regulations when the tools and platforms they create are ultimately used by criminal actors.

If you would like to remain updated on these issues, please click here to subscribe to Money Laundering Watch.  Please click here to find out about Ballard Spahr’s Anti-Money Laundering Team.

On August 4, 2025, the Financial Crimes Enforcement Network (“FinCEN”) issued Notice FIN-2025-NTC1 (the “Notice”) to address mounting concerns over regulatory risks related to convertible virtual currency (“CVC”) kiosks, also known as cryptocurrency ATMs. This action is part of a broader response to the rise in money laundering, fraud, and other financial crimes linked to digital assets.

What Are CVC Kiosks? How Do They Work?

CVC kiosks are terminals that allow customers to exchange physical cash for cryptocurrencies such as Bitcoin or Ethereum. Their popularity has accelerated due to their user-friendly interfaces and widespread presence in public venues like convenience stores and supermarkets. Typically, a transaction begins with customer identification, ranging from providing basic details like a phone number to scanning a government-issued ID, depending on the kiosk operator’s compliance protocols. After verification, users enter or scan their personal crypto wallet address so the purchased funds can be transferred directly. Payment is settled either by depositing cash into the machine or using card payment options available at certain kiosks. These devices may connect in real time with online cryptocurrency exchanges or use pre-loaded inventories managed by operators.

While convenient access through high-traffic retail locations benefits legitimate consumers, including those who might otherwise avoid digital assets, the relative anonymity of CVC kiosk transactions and lower oversight compared to bank branches create significant opportunities for criminal misuse.

Why Is FinCEN Focusing on These Kiosks Now?

FinCEN has observed sharp increases in consumer complaints and financial losses associated with CVC kiosk-related scams. In 2024 alone, the FBI’s Internet Crime Complaint Center recorded over 10,956 complaints involving these machines, a year-over-year surge of nearly 99%, with aggregate victim losses approaching $246.7 million (an increase of about 31%). This pattern extends beyond consumer fraud. Criminal organizations such as Cartel Jalisco Nueva Generación have embraced virtual currencies for their rapid global transferability and anonymity unavailable through traditional banking channels.

These trends intersect with this administration’s priorities around anti-money laundering (“AML”) and countering terrorist financing (“CTF”): protecting vulnerable populations from fraud, disrupting cyber-enabled crime, and intercepting organized crime-driven money laundering activities.

Key Risks Identified by FinCEN

The Notice highlights several major risks linked to CVC kiosk usage. Organized crime groups increasingly exploit these terminals as alternatives to conventional cash-based schemes, particularly in U.S cities that have become hotspots for laundering proceeds via local kiosks instead of banks because transactions are faster and more difficult for authorities to monitor effectively. Vulnerable populations are especially at risk. FinCEN states that nearly two-thirds of scam-related losses involve individuals aged sixty or older. Many attacks begin with phone-based deception before victims are remotely guided through withdrawal processes at kiosks.

Prevalent scams exploiting CVC kiosks include tech support frauds where victims are told their computer is infected and instructed to pay via Bitcoin ATMs using QR codes supplied by scammers; government impostor schemes invent fake tax liabilities payable only through kiosk deposits; romance scams manipulate targets into sending cryptocurrency under false pretenses built on fabricated relationships; lottery hoaxes promise non-existent prizes contingent upon upfront payments made through crypto transfers at kiosks.

Regulatory Requirements

FinCEN reminds operators that they must register as Money Services Businesses (“MSBs”), comply fully with Bank Secrecy Act (“BSA”) obligations, including robust AML protocols. and maintain proper recordkeeping standards before operating any CVC kiosk business. Operators need strong Know Your Customer (“KYC”) procedures so customers can be properly identified, a critical measure against anonymous abuse facilitating illicit activity. In addition, ongoing monitoring for suspicious activity is required; this includes filing Suspicious Activity Reports (“SARs”) when detecting patterns such as structured deposits just below reporting thresholds or rapid withdrawals indicative of potential money laundering efforts.

Regular audits and compliance reviews are essential since lapses expose operators not only to civil penalties but potentially criminal liability under federal law. Common compliance failures include inadequate customer verification procedures; poor retention of documentation; marketing strategies promoting “no-ID required” features contrary to regulations; lack of state licensure; or use of fraudulent business identities or accounts, all vulnerabilities that regulatory authorities scrutinize closely.

Practical Guidance

To help detect suspicious activity involving CVC kiosks, the Notice outlines key red flags:

1. Customers structuring payments just below reporting thresholds using multiple accounts or kiosks.
2. Unusual high-value transactions from customers lacking transaction history, with rapid movement across wallets or currencies.
3. Multiple interconnected accounts, phone numbers, or wallet addresses used across geographically distant locations.
4. Transactions sent directly toward wallets flagged by blockchain analysis as tied either to scams, illicit conduct, or investment fraud institutions.
5. Elderly customers conducting large transactions after remote direction, often following significant cash withdrawals.
6. Operators running without appropriate federal or state registration.
7. Advertising minimal or no-ID requirements despite regulatory mandates regarding identification/documentation collection practices.

FinCEN reminds financial institutions to file SARs whenever they identify these indicators, even if supporting evidence is limited at the outset. All SAR filings must be securely retained for at least five years after submission, in accordance with BSA requirements and strict access controls to protect sensitive information. Section §314(b) of the USA PATRIOT Act also permits voluntary sharing of this information among authorized organizations engaged in efforts to disrupt terrorist financing and money laundering networks globally.

Looking Ahead

The issuance of this Notice signals intensifying regulatory scrutiny prompted not just by rising incidents but also industry control gaps among certain market participants operating outside robust standards expected within digital asset sectors today.

As digital asset transactions expand, it is important for banks, cryptocurrency platforms, fintech companies, and kiosk operators to proactively integrate FinCEN’s red flag indicators and enhance AML/CFT protocols. Doing so helps safeguard clients while meeting legal obligations and promoting trust within the sector. Consumers are also encouraged to be aware of potential risks associated with using CVC kiosks until industry-wide protections are strengthened.

If you would like to remain updated on these issues, please click here to subscribe to Money Laundering Watch.  Please click here to find out about Ballard Spahr’s Anti-Money Laundering Team.

On July 23, 2025, Senators John Fetterman (D-PA), Chuck Grassley (R-IA), Sheldon Whitehouse (D-RI), Bill Cassidy (R-LA), Andy Kim (D-NJ), and David McCormick (R-PA), introduced the federal Art Market Integrity Act (the “Act”). The Act is bipartisan legislation that would require art dealers and auction houses to comply with anti-money-laundering and counter-terrorism financing regulations under the Bank Secrecy Act (“BSA”).

The Act seeks to amend the BSA to align the United States’s laws with international standards adopted by the United Kingdom, European Union, and Switzerland, preventing America from becoming a safe haven for illicit activities. The Act targets high-risk art market transactions while exempting artists and businesses with under $50,000 in annual art transactions.

The Act would expand the definition of “financial institution” in 31 U.S.C. § 5312(a)(2) to include:

a person engaged in the trade in works of art, including a dealer, advisor, consultant, custodian, gallery, auction house, museum, collector, or any other person who engages as a business as an intermediary in the sale of works of art, unless the person —

• during the prior year, participated in no single transaction valued over $10,000 that involved a work of art;
• has not, during the prior year, participated in total transactions valued at $50,000 that involved a work of art; or
• is a person engaged in the art market for the sole purpose of selling works of art created by the person.

The Act defines “work of art” as “any original painting, sculpture, watercolor, print, drawing, photograph, installation art, or video art, not including — (A) applied art such as product design, fashion design, architectural design, or interior design; or (B) mass-produced decorative art, including ceramics, textiles, or carpets.’’

The Act directs the Treasury to coordinate with appropriate federal agencies revise its advisory issued by the Office of Foreign Asset Control on October 30, 2020, regarding the risks of high-value artwork transactions involving sanctioned persons or entities. The 2020 advisory highlighting the problem of individuals blocked by OFAC from entering the U.S. financial system trying to evade those restrictions through the commerce of art, and emphasizing sanctions for U.S. persons who engage in prohibited transactions. See our prior blog on the advisory.

The Act directs FinCEN to in consultation and coordination with appropriate Federal agencies, to issue proposed rules to carry out the amendments made by subsection (a), including —

1. determining which persons should be subject to the rulemaking based on domestic or international geographical location;
2.  the degree to which the regulations should apply based on status as an agent or intermediary acting on behalf of a purchaser; and
3. whether certain exemptions should apply to the regulations.

The Act, if passed, would become effective on the earlier of (i) 360 days after enactment or (ii) the effective date of rules issued by FinCEN.

Similar legislative was introduced in 2020 to (i) add to the list of “financial institutions” covered by the BSA “a person trading or acting as an intermediary in the trade of antiquities, including an advisor, consultant or any other person who engages as a business in the solicitation of the sale of antiquities;” and (ii) require a study by the Secretary of the Treasury “on the facilitation of money laundering and terror finance through the trade of works of art or antiquities,” including an evaluation of whether art industry markets should be regulated under the BSA.

If you would like to remain updated on these issues, please click here to subscribe to Money Laundering Watch. Please click here to find out about Ballard Spahr’s Anti-Money Laundering Team.

We blogged last year about the Final Rule issued by the U.S. Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) extending Anti-Money Laundering/Countering the Financing of Terrorism (AML/CFT) requirements to certain investment advisers.  The Final Rule, which was set to become effective as of January 1 of next year, was the result of years of effort to bring investment advisers within the scope of the Bank Secrecy Act.  The Final Rule required certain investment advisers to: (1) develop and maintain an AML/CFT compliance program; (2) file Suspicious Activity Reports (SARs) and Currency Transaction Reports (CTRs); (3) comply with the Recordkeeping and Travel Rules; (4) respond to Section 314(a) requests; and (5) implement special due diligence measures for correspondent and private banking accounts.

But this week, in yet another significant regulatory scale-back in the anti-money laundering space, the Treasury Department announced that FinCEN will postpone the effective date of the Final Rule two years, to January 1, 2028 – and, more portentously, that it intends to “revisit the scope” of the Rule “at a future date.”  The stated basis for this institutional about-face is “recogni[tion]…that the rule must be effectively tailored to the diverse business models and risk profiles of the investment adviser sector.”  The Department’s press release further stated that postponing the effective date “may help ease potential compliance costs for industry and reduce regulatory uncertainty while FinCEN undertakes a broader review” of the Rule.  (While the cost point is undoubtedly accurate, as firms will now be able to put off outlays for implementation of AML/CFT compliance programs, it is unclear how going back to the drawing board on the Rule will reduce regulatory uncertainty.)

This is the latest move by the Treasury Department to pause or delay enforcement of financial regulations.  We blogged in March about the Department’s announcement that it would not enforce penalties or fines associated with the Corporate Transparency Act’s beneficial ownership information reporting requirements, and that it would issue a proposed rulemaking to narrow the scope of the rule to only apply to foreign reporting companies.  At that time, the Department similarly spoke of “ensuring that the rule is appropriately tailored to advance the public interest.”  We’ve also blogged on Administration efforts to broadly limit regulation of digital assets. 

It remains to be seen whether FinCEN’s “broader review” of the Rule will indeed lead to “effective[] tailor[ing]” to the unique aspects of the investment adviser sector, or whether the AML/CFT requirements for the sector will simply die on the vine over the next few years.  We will continue to monitor developments on this front.

If you would like to remain updated on these issues, please click here to subscribe to Money Laundering Watch. Please click here to find out about Ballard Spahr’s Anti-Money Laundering Team.

On June 25, 2025, the U.S. Department of the Treasury’s Financial Crimes Enforcement Network (“FinCEN”) issued three orders designating CIBanco S.A., Intercam Banco S.A., and Vector Casa de Bolsa, S.A. de C.V. (collectively, the “Designated Institutions”) as “financial institutions of primary money laundering concern.” These measures, taken under the FEND Off Fentanyl Act of 2024, target the entities’ role in laundering proceeds linked to opioid trafficking and restrict U.S. financial institutions from transacting with them. The prohibitions will take effect 21 days after their publication in the Federal Register.

Legislative Authority and Background

The legislative foundation for these actions stems from the FEND Off Fentanyl Act, enacted to address the growing crisis of synthetic opioid trafficking, particularly fentanyl, which has significantly impacted the U.S. (See our previous blog post, located here.) The Act empowers the Secretary of the Treasury to designate foreign financial institutions as primary money laundering concerns when these entities are linked to opioid trafficking activities. Under this framework, FinCEN is authorized to impose “special measures” as described in 31 U.S.C. 5318A(b) and 21 U.S.C. 2313a. These measures can include prohibitions or conditions on transactions involving the designated institutions, creating a mechanism to disrupt illicit financial flows and safeguard the integrity of the U.S. financial system.

Building on this legislative foundation, FinCEN has targeted specific institutions due to their involvement in illicit activities.

Designation of Mexican Financial Institutions

FinCEN’s investigation determined that each of the designated institutions facilitated illicit financial flows for Mexican drug trafficking organizations (“DTO”s), including the Jalisco New Generation Cartel, the Sinaloa Cartel, and the Gulf Cartel. The findings include:

1. CIBanco S.A., Institución de Banca Múltiple: Identified as having substantial ties to DTOs, which utilize its financial services to facilitate money laundering operations. Despite assertions from CIBanco regarding its anti-money laundering (“AML”) compliance measures, FinCEN’s investigation revealed significant gaps and inadequacies in its AML framework. Evidence points to CIBanco’s involvement in processing considerable funds that are subsequently channeled into DTO operations, supporting illicit opioid trafficking activities.
2. Intercam Banco S.A., Institución de Banca Múltiple: Offering a range of financial services and maintains USD correspondent banking relationships with multiple U.S. financial institutions. According to FinCEN’s findings, Intercam has played a role in processing funds related to the importation of precursor chemicals necessary for the synthesis of synthetic opioids. The investigation indicated that Intercam had been persistently involved in money laundering activities tied to DTOs, underscoring its critical role in facilitating complex financial flows that support the drug trade.
3. Vector Casa de Bolsa, S.A. de C.V.: Implicated in processing transactions for DTOs, including high-profile groups such as the Sinaloa and Gulf Cartels. Despite having an AML/CFT compliance program, FinCEN’s analysis revealed that Vector has facilitated ongoing transactions that benefit DTO operations. Its services reportedly involved processing funds associated with the importation of precursor chemicals and laundering profits back into Mexico, further entrenching its role in the illicit financial network.

Although the orders focus on operations located in Mexico, the practical effects will be felt by financial institutions globally, particularly U.S. firms with correspondent banking or payment relationships involving these entities.

Details of Prohibitions and Effective Dates

FinCEN’s orders prohibit all covered U.S. financial institutions from engaging in any transmittal of funds to or from the Designated Institutions. This includes:

• Wire transfers
• ACH transactions
• Convertible virtual currency transfers
• Any payment involving accounts or intermediaries administered by these institutions

Notably, these measures are civil in nature, but violations could trigger significant civil or criminal penalties under the Bank Secrecy Act and related statutes.

The orders are scheduled to become effective 21 days after publication in the Federal Register. While publication is still pending, U.S. financial institutions are expected to begin preparing immediately to comply with the prohibitions. The orders specify no expiration date but may be modified or rescinded in the future under certain conditions, such as litigation outcomes or resolution of underlying concerns.

Scope and Application of Restrictions

The prohibitions apply to:

• The specified entities’ operations within Mexico
• Any account or address (including crypto wallets) administered on behalf of those entities

They do not apply to the Designated Institutions’ branches or subsidiaries located outside Mexico, such as in the U.S.—but financial institutions should remain cautious of indirect exposures.

Rationale Behind FinCEN’s Action

The FEND Off Fentanyl Act authorizes Treasury to target foreign institutions facilitating illicit opioid trafficking. According to Treasury, these designations are part of a broader national security and public health strategy to combat the synthetic opioid crisis by cutting off DTOs from the global financial system.

DTOs often rely on sophisticated cross-border financial channels—including legitimate institutions—to launder proceeds from trafficking. The designations serve to disrupt those networks and signal the U.S. government’s zero-tolerance stance on enabling illicit drug finance.

Immediate Actions for Financial Institutions

U.S. financial institutions must take immediate compliance actions:

• Screen for exposure: Review existing clients, counterparties, and transactions to identify any links to the Designated Institutions.
• Update internal controls: Modify AML/CFT protocols, enhance transaction screening tools, and adjust payment routing mechanisms.
• Reassess relationships: Evaluate correspondent banking ties and terminate or revise any arrangements involving the Designated Institutions.
• Conduct training: Educate compliance teams and staff on the scope of the orders and risk of inadvertent violations.
• Monitor updates: Stay alert for FAQs, clarifications, and guidance from FinCEN and other U.S. regulatory authorities.

Final Thoughts

FinCEN’s unprecedented use of Section 2313a authority under the FEND Off Fentanyl Act underscores a new era in countering global drug finance. The designations of CIBanco, Intercam, and Vector aim to cut off the financial lifelines of DTOs and disrupt illicit opioid flows into the U.S. U.S. financial institutions must act swiftly to ensure compliance—not only to avoid regulatory penalties, but also to safeguard the integrity of the global financial system.

If you would like to remain updated on these issues, please click here to subscribe to Money Laundering Watch.  Please click here to find out about Ballard Spahr’s Anti-Money Laundering Team.

In a significant move to curb illegal activities at the U.S. Southwest border, the Financial Crimes Enforcement Network (FinCEN) issued an alert, on May 1, 2025, concerning oil smuggling from Mexico into the United States, orchestrated by notorious cartels such as the Cartel Jalisco Nueva Generacion (CJNG). This alert highlights the crucial role of financial institutions in identifying and reporting suspicious activities linked to this illicit trade. It forms part of a broader initiative involving U.S. law enforcement agencies, including the Treasury’s Office of Foreign Assets Control (OFAC), the DEA, FBI, and Homeland Security Investigations (HSI), all working in concert to dismantle the financial networks underpinning these transnational criminal operations. (See related blog posts here and here.) Simultaneously, OFAC announced sanctions against key individuals and entities connected to CJNG, which are involved in drug trafficking, fuel theft, and oil smuggling, generating extensive illicit revenues. Together, FinCEN and OFAC aim to outline specific financial typologies and red flags to effectively combat these smuggling schemes.

The Cartel’s Revenue Streams: Beyond Drugs

Crude oil smuggling has emerged as a significant revenue source for cartels like CJNG, Sinaloa, and Gulf Cartel, who have been implicated in stealing oil from Petróleos Mexicanos (Pemex). This stolen oil crosses the U.S. southwest border, finding its way into the hands of small U.S.-based oil companies. The ramifications are significant: exacerbating violence and corruption in Mexico while disrupting legitimate business operations in the U.S. oil market. Recognized as a Foreign Terrorist Organization (FTO) and Specially Designated Global Terrorist (SDGT), CJNG is involved in trafficking fentanyl and other narcotics into the U.S., contributing to economic instability. Recently, these groups have broadened their criminal portfolios to include fuel theft and crude oil smuggling, resulting in notable financial losses for the Mexican government and facilitating violence along the border.

Huachicol: The Mechanics of Smuggling

Cartels exploit existing trade flows to smuggle crude oil into the United States, taking advantage of Mexico’s export of unrefined and partially refined crude oil. They employ various illicit methods such as bribing employees, tapping pipelines, and hijacking tanker trucks to steal oil from Pemex. The stolen oil is often mislabeled as “waste oil” to avoid scrutiny and is sold at discounted rates by complicit importers in U.S. energy markets. This practice, known as huachicol, represents a substantial revenue source for cartels, with profits funneled back to sustain their operations.

Financial Institutions’ Role in Reporting

FinCEN has requested financial institutions to include the term “FIN-2025-OILSMUGGLING” in Suspicious Activity Reports (SARs) to enhance tracking of these activities. This initiative leverages financial oversight to combat transnational criminal organizations (TCOs), aiding law enforcement agencies in gathering data for targeted investigations.

Financial Typologies and Red Flags

Oil smuggling operations are characterized by complex financial maneuvers designed to disguise the origin and movement of funds. Cartels employ brokers to transport stolen oil, collaborating with U.S. importers who sell it in domestic and international markets. The proceeds are routed through multiple accounts, often via wire transfers that obscure transactions. Front and shell companies further mask operations, making it difficult for authorities to trace funds. FinCEN’s alert advises financial institutions to monitor for indicators such as below-market pricing, unusual profit margins, lack of appropriate registrations, and complex wire transfers across jurisdictions. To assist financial institutions in identifying suspicious activities related to oil smuggling, FinCEN has outlined several red flag indicators:

1. Transactional Activity and Profit Margins: Companies exhibiting transactional activity or profit margins significantly above industry norms may warrant further scrutiny.
2. Pricing of Crude Oil: Selling crude oil at prices well below market rates could indicate illicit sourcing.
3. Online Presence: Companies with minimal online presence or websites that mimic major industry players may be attempting to legitimize illicit operations.
4. Inconsistencies in Business Operations: Discrepancies between claimed business activities and transactional behavior, such as purchasing waste oil despite a focus on crude oil sales, are potential indicators.
5. EPA Registrations: Companies dealing with waste oil or hazardous materials without appropriate registrations from the U.S. Environmental Protection Agency (EPA) should be examined.
6. Shell Company Activity: Sudden, significant transactional activity with companies lacking online presence and exhibiting other characteristics of shell companies.
7. Wire Transfer Patterns: Complex wire transfer patterns involving multiple jurisdictions and accounts may be designed to obscure the origins and destinations of funds.

These indicators are not individually determinative of illicit activity, but when combined, they can provide a comprehensive profile of potentially suspicious operations.

Strategic Sanctions: Targeting Key Players

The FinCEN alert aligns with OFAC sanctions targeting individuals and entities involved in oil smuggling, aiming to dismantle networks facilitating illegal activities. Key figures sanctioned under Executive Orders 14059 and 13224 include CJNG leader Cesar Morfin Morfin, linked to both drug trafficking and oil theft. Associates and transportation companies involved in these operations have also been sanctioned, reinforcing efforts to dismantle the operational infrastructure of CJNG.

Collaborative Efforts and Compliance

FinCEN emphasizes the importance of information sharing under section 314(b) of the USA PATRIOT Act. Collaboration among financial institutions is crucial for tracing and preventing the movement of illicit funds. Sharing account or transaction information does not violate SAR confidentiality unless it reveals a SAR, allowing institutions to support investigations without legal complications. This complements the Treasury Department’s strategy of using sanctions to counter TCOs, reinforcing efforts to address narcotics trafficking and related crimes.

Conclusion: A Unified Approach

The FinCEN alert and OFAC sanctions represent a coordinated strategy to address cartel operations like those of CJNG. These measures provide insights into oil smuggling methodologies and aim to impact illicit revenue streams. Financial institutions play a key role in this process by adhering to outlined measures, supporting the integrity of the financial system and enhancing regional security. By targeting key figures and networks, U.S. authorities aim to contribute to a safer and more stable international environment, with financial entities playing an essential role in these efforts.

In this multifaceted approach, the collaboration between law enforcement and financial institutions is important to dismantling the intricate networks that support these criminal enterprises, paving the way for more effective interventions and a reduction in cartel-driven violence and instability.

If you would like to remain updated on these issues, please click here to subscribe to Money Laundering Watch. Please click here to find out about Ballard Spahr’s Anti-Money Laundering Team.

On May 1, 2025, the Financial Crimes Enforcement Network (FinCEN) released a Notice of Proposed Rulemaking (NPRM) regarding the Huione Group, a foreign financial institution located in Cambodia. This proposal, enacted under section 311 of the USA PATRIOT Act, suggests prohibiting U.S. financial institutions from forming or maintaining correspondent banking relationships with Huione Group. The NPRM identifies Huione Group as a significant money laundering concern, based on its purported role in facilitating unlawful financial activities.

Following an investigation, FinCEN found that Huione Group was involved in laundering at least $4 billion in illegal proceeds between August 2021 and January 2025, with the funds distributed as follows:

• Approximately $37 million was linked to cyber thefts conducted by North Korea;
• Around $36 million originated from scams known as “pig butchering”;
• About $300 million was related to various other cyber fraud schemes.

Background: Understanding Section 311 of the USA PATRIOT Act

Section 311 of the USA PATRIOT Act grants the Secretary of the Treasury the authority to identify foreign jurisdictions, financial institutions, or types of transactions that pose significant money laundering concerns. Upon such identification, the Secretary can impose special measures to mitigate risks to the U.S. financial system. These special measures can range from requiring enhanced record-keeping and reporting to prohibiting certain types of banking relationships.

The intention behind section 311 is to provide the U.S. government with flexible tools to protect the financial system from being exploited by money launderers and terrorist financiers. By targeting specific entities or jurisdictions, the U.S. aims to cut off illicit actors from accessing the global financial infrastructure.

Huione Group: A Profile of Concern

Huione Group, operating primarily out of Phnom Penh, Cambodia, is a conglomerate that includes several subsidiaries: Huione Crypto, Haowang Guarantee, and Huione Pay PLC. FinCEN’s investigations have identified the group as being involved in activities that significantly contribute to international money laundering schemes.

Key Findings

1. Laundering Proceeds from Cybercrimes and Sanctions Evasion

FinCEN’s analysis indicates that Huione Group has been utilized to launder funds associated with cyber heists, notably those executed by the Lazarus Group, a North Korean entity known for its cybercriminal activities. (Explore other blog posts about Lazarus Group here, here, and here.) These heists have targeted cryptocurrency exchanges and other digital asset platforms, resulting in the theft of substantial amounts of convertible virtual currency (CVC). The proceeds from these activities allegedly support the North Korean regime’s evasion of international sanctions, which are intended to prevent the financing of its weapons programs.

The relationship between Huione Group and North Korean actors is particularly concerning due to the geopolitical implications. By facilitating the movement of illicit funds, Huione Group potentially undermines international efforts to curb North Korea’s nuclear ambitions. This connection underscores the severity of the risk posed by the group’s activities.

    2.  Facilitation of CVC Investment Scams

In addition to laundering cybercrime proceeds, Huione Group is reportedly involved in facilitating CVC investment scams, commonly referred to as “pig butchering” scams. (We have previously discussed pig-butchering scams in our blog post here.) These scams are orchestrated by transnational criminal organizations (TCOs) operating primarily in Southeast Asia. They involve deceiving victims into investing in fraudulent CVC schemes under the pretense of high returns. Once the funds are invested, they are channeled through networks like Huione Group, where they are layered and integrated to obscure their illicit origins.

The prevalence of these scams highlights the vulnerabilities in the global financial system, especially regarding digital assets. The ability of criminal organizations to exploit these vulnerabilities has significant implications for consumer protection and financial stability. It also raises questions about the adequacy of regulatory frameworks governing the use of digital assets.

    3.  Ineffective AML/KYC Practices

Another critical finding from FinCEN’s analysis is the inadequacy of Huione Group’s anti-money laundering (AML) and know-your-customer (KYC) practices. Despite being subject to various reports and criticisms, the group has not implemented effective measures to detect and prevent money laundering activities. This lack of robust compliance infrastructure is a significant factor contributing to its designation as a primary money laundering concern.

Public statements from Huione Group have acknowledged these deficiencies, citing challenges in maintaining effective KYC capabilities. Such admissions raise concerns about the group’s ability to comply with international AML standards and its willingness to address identified shortcomings.

Proposed Special Measures

In response to these findings, FinCEN proposes to implement special measure five, under Section 311 of the USA PATRIOT Act, which involves prohibiting U.S. financial institutions from opening or maintaining correspondent accounts for Huione Group. This measure seeks to mitigate the risks by severing the group’s access to the U.S. financial system, thereby limiting its ability to facilitate illicit financial activities.

Rationale for the Proposed Measures

1. Effectiveness in Addressing Risks

The proposed prohibition is considered the most effective measure to prevent Huione Group from engaging in activities that pose a risk to the U.S. financial system. Given the group’s history and the complexity of its operations, other measures, such as enhanced reporting or additional due diligence requirements, may not adequately deter or monitor its activities. The prohibition aims to directly cut off the pathways through which illicit funds are processed.

      2.  Impact on Legitimate Business Activities

While the prohibition may impact some legitimate business activities conducted by Huione Group, FinCEN’s analysis suggests that a substantial portion of the group’s transactions are linked to illicit activities. By focusing on correspondent banking relationships, FinCEN seeks to target specific channels through which money laundering risks are most pronounced, minimizing the impact on legitimate operations to the extent possible.

    3.  Alignment with International Efforts

Although similar actions have not been widely adopted by other countries, FinCEN’s proposal aligns with broader international efforts to combat money laundering and financial crimes. The global nature of financial networks means that actions taken in one jurisdiction can have ripple effects worldwide. This proposal underscores the importance of international cooperation and coordination in tackling these issues.

Broader Implications for the Financial Sector

The proposed measures against Huione Group have significant implications for the financial sector, both domestically and internationally. For U.S. financial institutions, the prohibition necessitates a reevaluation of existing correspondent banking relationships and the implementation of enhanced due diligence procedures. Institutions must ensure compliance with the proposed rule to avoid potential penalties and reputational damage.

On an international level, FinCEN’s actions may prompt other jurisdictions to reassess their regulatory frameworks and cooperation mechanisms. The designation of Huione Group as a primary money laundering concern highlights the need for robust AML/CFT (counter-financing of terrorism) measures that can effectively address the challenges posed by digital assets and transnational financial crimes.

Conclusion

FinCEN’s proposal to impose special measures against Huione Group represents an important development in efforts to maintain the integrity of the U.S. financial system. This action is part of a broader initiative by the Treasury Department to address financial entities that contribute to cybercrime and sanctions evasion, particularly in regions with weaker regulatory environments. By concentrating on issues such as crypto-related fraud, state-sponsored cybercrime, and international money laundering networks, FinCEN highlights its commitment to using the tools available under Section 311. This strategy addresses immediate threats while emphasizing the need for global collaboration to combat money laundering and financial crimes. If you would like to remain updated on these issues, please click here to subscribe to Money Laundering Watch. Please click here to find out about Ballard Spahr’s Anti-Money Laundering