September 24, 2026

Pig Butchering and Scam Centers: Coding FinCEN's 2026 Alert Into Rules

Axle Team

Key takeaways

FIN-2026-Alert005 (September 3, 2026) lists 16 red flags in three groups: victim payments, guarantee marketplaces, and laundering techniques. Roughly half assume blockchain analytics or open-source research rather than transaction data.
For a bank, the detectable signals sit at Stage 1 (victim payments going out) and Stage 3 (mule and front-company accounts integrating proceeds). Stage 2, on-chain laundering, is the exchanges' problem.
Several flags turn on what the customer says at the counter or on the phone. Those are frontline conduct signals. They need an escalation path from the branch and contact center into the case system, not a threshold rule.
SARs should carry the key term FIN-2026-SCAMCENTERS in field 2 and the narrative, with Fraud-Other selected in field 34(z) and "Scam Centers" in the text box.
Victim SARs and mule SARs are different products. Code the dispositions separately so the response, protect or restrict, follows automatically.

FinCEN scam center alert red flags: what is actually new

FinCEN's September 2026 scam center alert, FIN-2026-Alert005, identifies 16 red flags for money laundering tied to Southeast Asian digital asset investment scam centers. They cover victim payments in crypto, wires, gold, and gift cards, links to Telegram-based guarantee marketplaces, and stablecoin laundering patterns. FinCEN asks filers to use the key term FIN-2026-SCAMCENTERS in SAR field 2 and the narrative.

The alert supplements FinCEN's September 2023 pig butchering alert rather than replacing it. The 2023 red flags described the victim relationship: the unsolicited contact, the fake trading platform, the fees to "unlock" withdrawals. The 2026 alert describes the industrial back end. FinCEN's accompanying release put numbers on it:

FinCEN analyzed 33,904 BSA reports involving suspected digital asset investment scam-related activity filed between September 8, 2023, and December 31, 2025, totaling approximately $12.7 billion in financial activity tied to suspected digital asset investment scams.
— FinCEN, FinCEN Identifies Nearly $13 Billion Linked to Suspected Digital Asset Scams Operated by Overseas Scam Centers (September 3, 2026)

The alert also cites FBI IC3 figures showing reported U.S. victim losses rising from $907 million in 2021 to $7.2 billion in 2025. Treasury is working the other end of the pipeline: OFAC's Prince Group designations (October 2025, expanded June 23, 2026) and FinCEN's October 2025 Section 311 rule severing the Huione Group from U.S. correspondent banking.

The three-stage laundering model, and where your institution sits

FinCEN describes the flow of scam proceeds in three stages: victims pay, often in digital assets; the assets are laundered on-chain through address hopping, consolidation wallets, mixers, and cross-chain swaps; and professional money launderers convert proceeds to fiat and integrate them. The organizational detail matters for detection:

Scam center operations frequently only handle communication with the victim. Operators outsource creating the infrastructure necessary to move funds—including establishing financial institution accounts and front companies—and the movement of funds to PMLs, relationships often facilitated by guarantee marketplaces.
— FinCEN, FIN-2026-Alert005 (September 3, 2026)

That division of labor tells you what you will see. A bank sees the victim leaving and the mule receiving. A digital asset exchange sees the middle.

1. Victim payments — What FinCEN describes: Purchases at crypto MSBs and kiosks, wires and ACH to mule or shell accounts, gold and gift cards. Who observes it: Banks, brokerages, MSBs. Data you need: Counterparty type, account age, beneficiary novelty, frontline notes.
2. On-chain laundering — What FinCEN describes: Rapid hops, consolidation wallets, mixers, Ethereum-to-Tron USDT swaps via DeFi. Who observes it: Exchanges, DeFi front ends, analytics vendors. Data you need: Address attribution, cluster analysis.
3. Integration — What FinCEN describes: Money mule networks, stablecoin transfers to offshore exchanges, Chinese underground banking, OTC and P2P brokers. Who observes it: Banks, U.S. exchanges providing liquidity. Data you need: Inbound-diversity metrics, MSB registration data, offsetting-flow detection.

Turning the 16 red flags into detection logic

The alert groups its indicators into three sets. Each set calls for a different kind of control.

Victim payments (five flags)

Three of the five hinge on what the customer says: they were told by purported law enforcement to pay in digital assets, wire funds abroad, or buy precious metals or gift cards; the payment is to retain a law firm to recover prior losses; they are withdrawing from a retirement account to buy gold for a courier. No monitoring scenario fires on a sentence spoken at a teller window. The control is a frontline disposition code that opens a case automatically.

The other two are counterparty flags: an MSB claiming to be "approved by FinCEN" and an exchange advertising "no KYC." Those belong in a curated counterparty list matched against wire and ACH beneficiary names.

The transactional shadow is codable: a first-ever transfer to a digital asset MSB shortly after a large inbound from a brokerage or retirement custodian, or a new precious metals beneficiary from an account with no history of either.

Guarantee marketplaces (five flags)

Three of the five depend on blockchain data: transactions in a token issued by a marketplace, unattributed clusters sharing infrastructure with a known marketplace, and direct or indirect exposure to a marketplace address with no lawful purpose. A fourth is an open-source flag about a payment service provider rebranding to hide a marketplace link. Exchanges with analytics coverage can code these. Banks mostly cannot.

The one bank-facing flag is a payment service provider offering digital asset exchange services that appears to operate in Burma, Cambodia, or Laos while obscuring its location or corporate structure. That is a counterparty and correspondent due diligence control, backed by sanctions and 311 screening for Huione, its proposed successor H-Pay, and the Prince Group designations.

Laundering techniques (six flags)

Five of the six are written for digital asset exchanges and DeFi services: stablecoin inflows from U.S. exchanges bearing on-chain laundering patterns, DeFi deposits from aggregation wallets, heavy use of a stablecoin whose issuer advertises that it cannot be frozen or seized, offsetting trades consistent with an unlicensed OTC or P2P desk, and stablecoin-to-fiat-to-withdrawal cycles. The sixth is an open-source flag about wallet addresses posted near Chinese-language laundering terms.

For a bank, the equivalent signal is the mule account from the alert's integration stage: a new account receiving inbound transfers from many unrelated individuals, followed by rapid outbound to a crypto MSB or foreign beneficiary. The alert also notes scammers registering fraudulent MSBs with FinCEN to look legitimate, so an MSB customer whose registration date, business age, and volume do not line up deserves a look.

FinCEN's own caveat should sit at the top of any rule specification:

Because no single red flag is determinative of illicit or other suspicious activity, financial institutions should consider the surrounding facts and circumstances, such as a customer's historical financial activity, whether the transactions are in line with prevailing business practices, and whether the customer exhibits multiple related red flags, before determining if a transaction or attempted transaction is indicative of money laundering activity associated with scam centers or is otherwise suspicious.
— FinCEN, FIN-2026-Alert005

SAR filing mechanics under the alert

The alert asks for the key term FIN-2026-SCAMCENTERS in SAR field 2 (Filing Institution Note to FinCEN) and in the narrative, with "Fraud-Other" selected in field 34(z) and "Scam Centers" in the text box. Field 36 (Money Laundering) and field 38 (Other Suspicious Activities) should be selected where applicable.

FinCEN also wants the technical indicators in the structured cyber fields or the attachment: chat logs, phone numbers, social media usernames, wallet addresses and transaction hashes, apps used, and the URL, domain, and IP of the platform the victim deposited into, plus any connected financial, internet, or corporate service providers. Analysts drafting with Sam, Axle's SAR narrative agent, should treat that list as a required checklist. FinCEN separately encourages 314(b) participation and referring victims to the FBI's IC3.

A practitioner's view: victim SARs and mule SARs are different products

The alert presents one list of red flags. Your case management should not present one disposition. A victim SAR is protective: the customer is not the subject, the outcome is a hold, a conversation, and an IC3 referral, and the account stays open. A mule SAR is a subject SAR: the outcome is restriction or exit and, ideally, a 314(b) request to the receiving institutions.

When both run through one queue, two failure modes show up. Victim cases close as "customer confirmed the transaction was authorized," which is exactly what a coached victim says. Mule cases stall waiting for a callback that never comes. Splitting the disposition also settles the friction trade-off: intervening on a first-ever crypto transfer after a retirement liquidation is worth the inconvenience; stopping a repeat purchaser with two years of exchange history is not.

A 30-day plan for coding the alert

Tag counterparties. Build or refresh lists of digital asset MSBs, kiosk operators, precious metals dealers, and gift card issuers, and load the Huione and Prince Group actions into screening.
Add the frontline path. Create a "customer reports third-party payment instruction" disposition in branch and contact-center tooling that opens a case without analyst intervention.
Stand up four scenarios. Two victim-side (post-liquidation crypto MSB transfer; new precious metals or foreign beneficiary) and two mule-side (inbound-diversity spike with rapid outbound; MSB registration mismatch). Backtest against last year's scam SARs before setting thresholds.
Update SAR templates. Add the key term, the field 34(z) selection, and the cyber indicator checklist.
Split the dispositions. Separate victim and mule outcomes in the case system and route each to its own playbook.
Sample for QA. Add scam center typologies to analyst training and the quality review sample for the next quarter.

Teams using Rose, Axle's transaction monitoring agent, encode the counterparty enrichment and inbound-diversity logic as investigation steps rather than standalone rules, so the analyst sees the alert already annotated with counterparty type, account age, and the FinCEN flag it matches. The transaction monitoring alerts page walks through that workflow.

FAQ

What SAR key term does the FinCEN scam center alert require?

FIN-2026-SCAMCENTERS, entered in SAR field 2 (Filing Institution Note to FinCEN) and in the narrative, with "Fraud-Other" selected in field 34(z) and "Scam Centers" in the text box. For Form 8300 filings, the same term goes in the Comments section.

How is the 2026 alert different from FinCEN's 2023 pig butchering alert?

The 2023 alert (FIN-2023-Alert005) focused on the victim-facing scam and its behavioral red flags. The 2026 alert covers the laundering infrastructure behind it: guarantee marketplaces, Chinese money laundering networks, stablecoin flows, and mule and shell accounts. FinCEN says institutions should also stay aware of the 2023 red flags and its 2025 kiosk notice.

Do banks with no crypto exposure need to act on this alert?

Yes. Victims are bank customers before they are exchange customers. The alert lists wires and ACH to mule accounts, gold, and gift cards as payment channels, and mule and front-company accounts as the integration channel. All of those touch a depository institution.

If your scenarios still stop at "outbound wire over threshold to a new beneficiary," see how Rose investigates scam center alerts with the counterparty context FinCEN is asking for.

Pig Butchering and Scam Centers: Coding FinCEN's 2026 Alert Into Rules

More from the blog