FinCEN Links $13B in Crypto Scams to Overseas Criminal Networks

The US Treasury's Financial Crimes Enforcement Network has published one of the most data-rich analyses of crypto-enabled fraud to date, tracing approximately $12.7 billion in suspicious digital asset transactions to scam operations run from compounds in Southeast Asia. The findings arrive via a review of more than 33,000 Suspicious Activity Reports, and they carry direct, practical weight for every financial institution, accounting firm, and CFO that touches digital assets in the United States or globally.

What FinCEN Actually Found

The report drew on SARs filed between September 2023 and December 2025, covering suspected crypto scams reported to FinCEN by banks, money services businesses, and virtual asset service providers. The roughly 33,000 reports collectively flagged about $13 billion in financial transactions, with the dominant share, $12.7 billion, attributed to activity that FinCEN traced to overseas scam centers.

The scam typologies identified

FinCEN's analysis highlighted three overlapping fraud categories. Pig butchering is the most structured: fraudsters build a relationship with a victim over weeks or months, then guide them into a fake crypto investment platform that shows fabricated returns until a lump-sum "withdrawal fee" drains the account entirely. Romance scams follow a similar emotional playbook but without the elaborate investment interface. Cryptocurrency confidence schemes, the third category, rely on impersonation or false authority, where victims are told that investing a specific amount in crypto will generate guaranteed outsized returns.

All three typologies share a common financial signature: the victim moves funds, usually in stablecoins or Bitcoin, to a wallet address controlled by the scam network, often via multiple hops designed to obscure the trail. That layering pattern is precisely what effective transaction monitoring is built to detect.

The geographic anchor: Southeast Asian compounds

FinCEN was direct about the organizational structure behind these schemes. The report attributes them to "transnational criminal organizations" operating from physical compounds in Southeast Asia. These are not loosely coordinated online groups; they are, according to the agency, organized operations where workers, sometimes trafficked themselves, are compelled to run scam pipelines at scale.

Legislative responses are forming in the region. Myanmar's parliament has moved toward penalties up to life imprisonment for operators who use violence, unlawful detention, or torture to compel participation. Cambodia enacted legislation earlier this year that also includes potential prison time for operators. The emergence of domestic criminal liability in source countries is relevant context for de-risking decisions and correspondent banking relationships.

Why This Report Matters for Compliance Teams

Gene Lange, performing the duties of Under Secretary for Terrorism and Financial Intelligence, described digital asset investment scams as "one of the most significant fraud threats facing Americans today." That is not regulatory boilerplate. When the Under Secretary for Terrorism and Financial Intelligence frames a fraud typology in those terms, it signals that examination priorities and enforcement attention will follow.

The SAR volume signal

Thirty-three thousand SARs in roughly 27 months is a substantial dataset. FinCEN has now used it to publish explicit typology guidance, which creates a de facto benchmark for what "adequate" transaction monitoring looks like. Any institution whose monitoring program cannot identify the behavioral patterns described in this report, structuring through multiple wallets, use of peer-to-peer platforms, and rapid conversion between asset types, faces heightened examination risk.

Obligations for virtual asset service providers and their banking partners

VASPs registered with FinCEN as money services businesses are already subject to Bank Secrecy Act obligations, including transaction monitoring and SAR filing. This report effectively updates the typology library they are expected to screen against. Banks that maintain correspondent or fiat on-ramp relationships with VASPs face similar pressure: regulators will expect those institutions to have assessed whether their VASP partners have adequate controls against the specific patterns FinCEN has now documented.

For compliance officers, the practical upshot is a requirement to revisit scenario libraries and, where those libraries predate the pig butchering and romance scam patterns, to update them promptly. Firms that use crypto compliance reporting workflows should map FinCEN's typologies directly to transaction monitoring rules. The report itself can serve as documented regulatory guidance justifying the update, which matters for audit trail purposes.

Accounting and Reporting Implications

The financial flows described by FinCEN have several direct accounting consequences that are easy to overlook when the headline is framed around law enforcement.

Client-side fraud losses and asset write-offs

For accounting firms advising individual or corporate clients who have been victimized, the first question is treatment of the loss. Under US GAAP, a realized loss on a digital asset that has been transferred to a fraudster and is unrecoverable is generally recognized at the point the asset is determined to be lost. ASC 350-60, which governs crypto asset accounting under the fair value model introduced by FASB, does not change the fundamental principle: if the asset is gone and recovery is not probable, the loss flows through the income statement. Firms need documented evidence of the scam, ideally a police report or FinCEN SAR reference, to support the write-off.

Tax treatment of scam losses

On the tax side, the deductibility of theft losses for individuals was significantly curtailed by the Tax Cuts and Jobs Act of 2017, which suspended the personal casualty and theft loss deduction for losses not attributable to a federally declared disaster. That suspension runs through 2025 under current law, though the legislative horizon beyond 2025 is still in flux. Business entities retain broader deductibility for theft losses under IRC Section 165(c)(1), subject to the ordinary and necessary standard. Accounting teams advising corporate clients should confirm whether the victim entity qualifies, document the loss thoroughly, and assess whether any recovery proceeds received in a later period create taxable income.

Implications for digital asset accounting software and audit workflows

The FinCEN dataset underscores why transaction-level provenance matters in any serious crypto bookkeeping software or digital asset accounting software workflow. When auditors assess digital asset balances, they now have regulatory precedent for asking whether outflows were screened against scam-linked typologies. Firms that can demonstrate systematic on-chain analysis, address screening, and documented SAR filing workflows are in a materially better position than those relying on manual ledger reconciliation. The report gives audit committees concrete language to use when requesting management assessments of fraud exposure in digital asset portfolios.

Global Ripple Effects

Although FinCEN's jurisdiction is domestic, the $12.7 billion figure and the Southeast Asian compound findings will inform regulators beyond US borders. The Financial Action Task Force has long identified virtual asset fraud as a high-risk typology; FinCEN's granular SAR data will feed into FATF mutual evaluation processes and is likely to appear in upcoming FATF guidance updates. For firms operating in multiple jurisdictions, this is a signal to check whether their transaction monitoring frameworks align with the scam typologies FinCEN has now formally documented, because other regulators will use those same typologies as reference points in their own supervisory work.

The cross-border dimension also intersects with travel rule compliance. When funds hop across jurisdictions through multiple VASPs, travel rule data should, in principle, accompany each transfer. The scam patterns FinCEN describes, multiple wallet hops, rapid conversion, and use of peer-to-peer channels, are in many cases travel rule evasion techniques. Firms should review whether their travel rule implementation captures the specific layering sequences the report outlines. For background on how enforcement actions in other contexts have shaped these obligations, see our analysis of FBI crypto seizure and AML compliance obligations and the broader framework covered in how sanctions and crypto enforcement reshape global compliance.

Practical Next Steps for Firms and CFOs

The FinCEN report is not a rule, but it functions like one in practice. Examiners will use it. Here is where to focus attention immediately.

Review and update transaction monitoring scenarios

Map the three typologies, pig butchering, romance scams, and crypto confidence schemes, against your current SAR scenario library. If your rules were last reviewed before September 2023, the baseline period of FinCEN's dataset, they almost certainly need updating. Document the review and the rationale for any changes or decisions not to change.

Assess correspondent and VASP relationships

If your institution provides banking services to VASPs, or if your firm advises clients who do, request updated AML program certifications that specifically address scam typology monitoring. The FinCEN report gives you documented regulatory backing for that request.

Client communication and fraud loss documentation

Accounting firms should proactively reach out to clients who hold or actively trade digital assets, particularly retail or high-net-worth individuals, to confirm they have not been affected by schemes matching FinCEN's typologies. Where losses have occurred, begin the documentation process now: gather transaction records, wallet addresses, and any communications with the fraudulent platform. That evidence will be essential for both tax treatment and any potential civil recovery.

Audit committee briefings

CFOs at entities with material digital asset holdings should brief audit committees on this report. The $13 billion figure and the FinCEN imprimatur make it a credible basis for requesting a fraud risk assessment specific to the digital asset portfolio. That assessment should cover both direct exposure (client or treasury holdings) and indirect exposure through banking or lending relationships with VASP counterparties.

Frequently Asked Questions

What is pig butchering and why does FinCEN flag it specifically?

Pig butchering is a long-horizon fraud where the criminal builds a trust relationship with the victim before introducing a fake crypto investment opportunity. The victim is encouraged to invest gradually, sees fabricated gains, and is eventually persuaded to commit a large sum before the fraudster disappears with the funds. FinCEN flags it because it generates a distinctive on-chain pattern, multiple small inbound transfers followed by a single large outbound transfer, that transaction monitoring systems can be tuned to detect.

Does FinCEN's report create new legal obligations for firms?

The report itself is not a rule or final guidance with binding legal effect. However, it does update the publicly available typology library that examiners use when assessing whether a firm's AML program is "reasonably designed." Failing to incorporate documented typologies into monitoring programs has historically been cited as a program deficiency in enforcement actions, so the practical compliance obligation is real even if the legal mechanism is indirect.

How should a US accounting firm treat a client's crypto scam loss on the tax return?

For individual clients, the personal theft loss deduction is suspended through 2025 under the Tax Cuts and Jobs Act, except for federally declared disaster losses, so the deduction is generally not available. Business entities may deduct theft losses under IRC Section 165, subject to documentation requirements. In all cases, the firm should obtain contemporaneous evidence of the fraud, including transaction records and any law enforcement or SAR references, and apply the applicable rules based on the client's entity type and the tax year in which the loss became ascertainable.

What does this mean for firms using crypto bookkeeping software or digital asset accounting software?

Any robust crypto bookkeeping software or digital asset accounting software workflow should now incorporate address screening against known scam-linked wallet clusters as a standard step in reconciliation. Auditors will increasingly ask whether outflows have been reviewed against regulatory typology lists. Firms that can demonstrate systematic screening and documented SAR filing are better positioned for both regulatory examination and client audit engagements.

Are non-US firms affected by FinCEN's findings?

Directly, no. FinCEN's authority is over US-based financial institutions. Indirectly, yes. FATF member states routinely incorporate US typology findings into their own supervisory frameworks, and the scam compounds identified by FinCEN operate globally, targeting victims in multiple countries. Non-US firms with exposure to Southeast Asian payment corridors or with clients who transact on international crypto platforms should treat the FinCEN findings as relevant risk intelligence even without a direct US nexus.

Source: Cointelegraph