On June 5, 2026, FinCEN, jointly with the FDCI, OCC, and NCUA, issued an advisory to advise banks to be vigilant against fraud schemes and other suspicious or potentially criminal activities involving the unlawful employment of illegal aliens and the associated risks to the integrity of the U.S. financial system.
This action is in accordance with President Trump’s E.O. 14406 “Restoring Integrity to America’s Financial System,” which directed the Treasury to issue an Advisory to financial institutions as part of a whole-of-government effort to address the risks associated with the exploitation of the U.S. financial system by non-work-authorized populations and their employers. According to the Department of Homeland Security’s Immigration and Customs Enforcement, some employers in industries such as agriculture, construction, and hospitality knowingly—or through negligence—hire and conceal unauthorized workers to lower labor costs and gain a competitive advantage. A key feature of these schemes is the use of identity theft and payroll fraud.
FinCEN has identified the following red flags to help financial institutions detect, prevent, and report suspicious activity connected to fraud schemes involving the unlawful employment of unlawful aliens:
A customer is an individual that:
Uses an SSN that, upon verification, does not match or is inconsistent with the SSA’s records;
Opens an account using a non-U.S. passport or ITIN claiming to be self-employed or operating a small business in the agriculture, construction, domestic service, hospitality, or staffing industries and is receiving a significant amount and volume of recurring check deposits from multiple companies before either making a significant and repetitive amount of structured cash withdrawals or issuing low-dollar checks to multiple individuals;
Cashes a significant volume of checks drawn on accounts owned by companies in the agriculture, construction, domestic service, hospitality, or staffing industries on a recurring basis at an MSB, including a check cashier;
Receives recurring P2P payments from a small, recently established company in the agriculture, construction, domestic service, hospitality, or staffing industries;
Works in the agriculture, construction, domestic service, hospitality, or staffing industries and opens a bank account with an ITIN with little to no transactional activity besides remittances to foreign jurisdictions;
Opens an account for a company in the agriculture, construction, domestic service, hospitality, or staffing industries and is attempting to use a Commercial Mail Receiving Agency instead of a business address;
Possesses no known prior involvement in the agriculture, construction, domestic service, hospitality, or staffing industries and provides a non-U.S. passport or ITIN as a form of identification when opening an account for a new company in those industries;
Makes statements as the account holder or company representative to bank tellers or check cashers that the purpose of the cash withdrawals, negotiation of checks for cash, or check cashing activity is for payroll and the volume, amount, and frequency of transactions are uncharacteristic for a company in agriculture, construction, domestic service, hospitality, or staffing industries with a small number of employees;
A customer is a large company in the agriculture, construction, domestic service, hospitality, or staffing industries that:
Has been identified by ICE worksite enforcement news releases and open-source reporting that the customer has a history of worksite compliance violations from ICE;51
Has significant business operations and transactional activity but with little to no payroll activity commensurate to the customer’s profile;
Is making Federal and state payroll tax deposits that are significantly less than what would be expected based on their business operations and associated workforce size;
Is issuing a significant and repetitive amount of checks to a singular or small number of recently established companies with little to no online presence;
Recently acquired a workers’ compensation policy for a small number of workers that is not commensurate with their customer profile and transactional activity;
A customer is a small company in the agriculture, construction, domestic service, hospitality, or staffing industries:
With beneficial owners that have no known prior involvement with, or in, the company or these industries and may have prior fraud convictions;
With minimal to no history of tax- or payroll-related payments to the IRS, state and local tax authorities, or a third-party payroll company despite a large volume of deposits from clients;
That conducts large or unusual volumes of cash withdrawals or negotiation of checks for cash when accompanied by another involved person(s) or using an armored car service to deliver bulk cash (i.e., conducting informal or off-the-books payroll);
That is issuing recurring, large volumes of checks for under $1,000 that are made payable to a significant number of separate individuals who cash the checks; and/or
That is a new customer (i.e., less than two years old) with minimal to no online presence and has indicators of being a shell company.
Read the Treasury’s press release here.
The full Advisory can be found here.