On October 30, 2026, FinCEN issued a Notice to help financial institutions detect and report suspicious activity involving the exploitation of charities and non-profit organizations (NPOs). Th eNotice aligns with FinCEN’s ML/CFT National Priorities of Fraud, Terrorist Financing, and Corruption.
NPOs deliver essential aid, services, and assistance to vulnerable populations and perform other important services for the public good. However, NPOs can be exploited by individuals taking advantage of the public trust placed in NPOs and its fundraising capabilities to facilitate terrorist financing, fraud, and other illicit activity. Through schemes abusing NPOs, bad actors can funnel funds to terrorists, divert funds from government programs, and steal money intended for charitable causes. These schemes include sham charities, NPO fraud, fraudulently obtained or misappropriated donations, misappropriated government funding, and embezzlement schemes.
To address these risks, FinCEN has identified the following red flags to help financial institutions detect, prevent, and report suspicious activity connected to schemes involving NPOs:
Red flags related to an NPO and its officers or employees:
A customer that is an NPO solicits donations but does not appear to provide any services, has limited operations, or has little or no physical or online presence. For example, the address for the NPO may be a post office box, an address that does not appear to correspond to an NPO (such as a residential address or unrelated business), or an address shared by many different NPOs. Alternatively, the NPO may have no employees or no website or a dated or generic website.
A customer that is an NPO has a name similar to an existing or well-known NPO but does not appear to have any affiliation with it.
A customer that is an NPO openly supports terrorist or criminal activity or operations (such as in fundraising appeals or on social media) or includes, in the information related to a transaction between customers or the notes accompanying peer-to-peer transfers, key terms known to be associated with terrorism or terrorist organizations.
A customer that is an NPO is not registered with the appropriate state regulator (to the extent required in the relevant state) or cannot verify its legal operating status to the financial institution.
An individual with previous fraud convictions is a signatory to an NPO account or is an officer, employee, or contractor of an NPO.
A customer that is an NPO has been in existence for many years and, for no apparent lawful or business purpose, opens a new account, which may have signatories that differ from—or only partially overlap with—the signatories on its existing NPO accounts.
Red flags related to sources of funds:
A customer that is an NPO receives funds for multiple causes that appear unrelated to each other or from multiple unrelated crowdfunding platforms or campaigns or receives funds with notes indicating support for unrelated causes.
A customer that is an NPO receives large donations from an unknown source over a short period of time and then sends significant wire transfers or checks to other NPOs.
A customer that is a recently established NPO suddenly receives a significant number of donations or reimbursements in a short timeframe, including in connection with a disaster or other emergency, inconsistent with the customer profile of other similar entities.
A customer that is a recently established NPO starts receiving an unusually high volume of payments, payments in unusually large amounts, or reimbursements from government aid programs soon after starting its operations.
A customer that is an NPO receives unexplained funds from personal accounts of officers, employees, or contractors of the NPO, or other sources of funds that do not appear to be consistent with donations.
A customer that is an NPO employee, officer, or contractor receives, in an account used for personal expenditures, payments or credits that are addressed to or intended for the NPO itself rather than the employee, officer, or contractor.
Multiple customers that are NPOs have the same or similar signatories or controllers, but they receive funding from different government sources for unrelated services.
A customer that is not an NPO receives incoming payments or credits that reference NPO activity, such as charitable giving, fundraising campaigns, or humanitarian causes.
Red flags related to uses of funds:
A customer that is an NPO, or the employee, officer, or contractor of an NPO, exhibits spending patterns that are not commensurate with the customer’s known financial profile or that of similarly situated NPOs or NPO officials, including expenditures indicative of unexplained wealth or sudden changes in wealth. For example, the customer engages in significant transactions with broker-dealers, commodities and futures exchanges, money services businesses (including those involved in digital assets), or casinos or gambling establishments or has significant transactions related to personal expenses or retail point-ofsale transactions.
A customer that is an NPO has minimal or no operating costs other than purchases of ads on social media.
A customer that is an NPO has minimal or no operating costs other than payments for “consulting fees” or for other vague or repetitive invoices (e.g., “food supplies”).
A customer that is an NPO, or the employee, officer, or contractor of an NPO, engages in a pattern of behavior suggesting efforts to evade the Currency Transaction Report (CTR) reporting requirement (e.g., alters or cancels a transaction when advised a CTR would be filed or engages in structuring with multiple cash transactions in amounts below $10,000) or avoid recordkeeping requirements.
A customer that is an NPO, or the employee, officer, or contractor of an NPO, makes a significant amount of cash withdrawals or deposits or frequently purchases or redeems cashier’s checks for no clear purpose.
A customer that is an NPO focused on providing services in the United States sends a significant amount of funds to individuals and companies located in foreign jurisdictions.
A customer that is an NPO makes unexplained or one-off payments to managers, employees, contractors, or board members that are inconsistent with expected payroll patterns.
A customer that is an NPO conducts transactions with accounts that have the same signatories as the NPO’s accounts or transactions with family members, friends, or associates of NPO employees, officers, or contractors.
The full Notice can be found here.