FinCrime Intelligence Weekly
FinCEN ties $12.7bn to pig butchering scam centers, FATF finds hawala running as money laundering as a service, OFSI fines Citibank over Russia sanctions, and AUSTRAC probes Western Union.
Marco’s Take
Marco Beranzoni
This week’s five stories point to one shift: money laundering is turning into a specialized, outsourced service, while some of the machinery meant to catch it still assumes a less organized adversary.
FinCEN, the US Financial Crimes Enforcement Network, identified about $12.7 billion in suspicious activity tied to pig butchering investment scams, moved through professional money launderers, shell companies, and offshore stablecoin exchanges built purely to clean proceeds. The Financial Action Task Force, FATF, found the same pattern in underground banking. Over 80% of reporting jurisdictions now treat hawala networks as a principal money laundering channel, some moving over EUR 500 million in a few months, coordinated on WhatsApp, Telegram, and Signal rather than anything exotic.
The failures on the other side sat at the ordinary layer, not some unusual entry point. Citibank’s London branch processed 970 payments worth over GBP 19.7 million for accounts that should have been restricted under Russia sanctions. The Australian Transaction Reports and Analysis Centre, AUSTRAC, opened an investigation into how Western Union manages its high risk payment channels. Routine processing, not exotic risk, is where both gaps appeared.
Here is my uncomfortable ask for this week: pick one control that has not produced a single alert in six months, and find out whether that means it is working, or whether the criminals simply moved somewhere it cannot see.
See you next Monday.
Marco
A new FinCEN alert ties $12.7bn in Bank Secrecy Act filings to overseas romance and investment scams routed through stablecoins.
A new FATF report finds hawala and underground banking networks now operate as professional, commercially run laundering services, with over 80 percent of jurisdictions naming them a top channel.
The UK sanctions regulator penalised Citibank's London branch after it processed hundreds of payments for accounts linked to sanctioned Russian banks following the 2022 invasion of Ukraine.
AUSTRAC has opened an investigation into how Western Union manages high risk payment channels, after a 2025 audit raised customer due diligence and reporting concerns, with no penalty yet determined.
Belgian prosecutors seized 65.2 million euros, about 96 percent of the estimated tax loss, as part of a French investigation into alleged tax fraud and money laundering at McKinsey, which denies wrongdoing.
What changed this week, why it matters, and what to do about it.
| Region | Update | Why it matters | Action |
|---|---|---|---|
| US | On September 2, 2026, FinCEN and the federal banking agencies clarified that suspicious activity report (SAR) confidentiality rules do not prevent banks from discussing fraud, suspicious activity, or account closures with customers. Banks still cannot confirm or suggest that a SAR has been filed. | This gives frontline and compliance staff clearer language for conversations around blocked payments or closed accounts, without breaching confidentiality law. It does not alter any existing Bank Secrecy Act (BSA) obligation or create new supervisory expectations. | Update customer facing scripts and complaints handling guidance to reflect what staff may now say, and confirm with legal that no wording crosses into confirming or suggesting a SAR filing. |
| Other | AUSTRAC opened an investigation on September 1, 2026, into Western Union Financial Services Australia and its US parent over how they manage high risk payment channels, following a 2025 external audit that flagged customer due diligence (CDD), suspicious matter reporting, and international funds transfer instruction (IFTI) reporting concerns. AUSTRAC has made no finding at this stage. | An investigation is not a finding of wrongdoing, but it signals active regulatory interest in remittance providers with cross-border, high risk corridors. | If you operate similar payment channels, revisit your own last CDD and IFTI reporting audit findings now, rather than waiting for a regulator to ask. |
| Global | FATF reported that nearly 70% of surveyed jurisdictions have seen underground banking networks shift toward coordinating settlements through encrypted messaging apps such as WhatsApp, Telegram, and Signal, rather than through in person brokers. | This moves part of the money trail onto consumer messaging platforms that transaction monitoring systems cannot see and that typically only surface through a law enforcement request or a cooperating witness. | Add references to messaging apps in account opening records, device evidence, or customer interviews as a documented typology indicator in hawala related investigations, and train investigators to ask about it directly. |
On September 2, 2026, FinCEN and the federal banking agencies clarified that suspicious activity report (SAR) confidentiality rules do not prevent banks from discussing fraud, suspicious activity, or account closures with customers. Banks still cannot confirm or suggest that a SAR has been filed.
Why it matters:This gives frontline and compliance staff clearer language for conversations around blocked payments or closed accounts, without breaching confidentiality law. It does not alter any existing Bank Secrecy Act (BSA) obligation or create new supervisory expectations.
Action:Update customer facing scripts and complaints handling guidance to reflect what staff may now say, and confirm with legal that no wording crosses into confirming or suggesting a SAR filing.
AUSTRAC opened an investigation on September 1, 2026, into Western Union Financial Services Australia and its US parent over how they manage high risk payment channels, following a 2025 external audit that flagged customer due diligence (CDD), suspicious matter reporting, and international funds transfer instruction (IFTI) reporting concerns. AUSTRAC has made no finding at this stage.
Why it matters:An investigation is not a finding of wrongdoing, but it signals active regulatory interest in remittance providers with cross-border, high risk corridors.
Action:If you operate similar payment channels, revisit your own last CDD and IFTI reporting audit findings now, rather than waiting for a regulator to ask.
FATF reported that nearly 70% of surveyed jurisdictions have seen underground banking networks shift toward coordinating settlements through encrypted messaging apps such as WhatsApp, Telegram, and Signal, rather than through in person brokers.
Why it matters:This moves part of the money trail onto consumer messaging platforms that transaction monitoring systems cannot see and that typically only surface through a law enforcement request or a cooperating witness.
Action:Add references to messaging apps in account opening records, device evidence, or customer interviews as a documented typology indicator in hawala related investigations, and train investigators to ask about it directly.
Typology of the week
Hawala and other underground banking systems move value without physically moving money across borders. A customer pays cash to a broker in one country, and a linked broker pays the equivalent, minus a fee, to a recipient elsewhere, with the two brokers settling their own balance separately and later. FATF's report found that over 80% of reporting jurisdictions now identify these networks as a principal channel for professional money laundering. Nearly 70% of respondents told FATF the model has shifted toward what the report calls digital hawala, where brokers coordinate settlements through encrypted messaging apps instead of meeting in person or working through physical broker networks.
Example
FATF's report describes some underground banking networks moving over EUR 500 million in a matter of months. This illustrates the scale a professional, laundering as a service network can reach without a single traditional cross-border wire transfer.
Recent actions and the control lessons behind them.
US Department of Justice, District of New Jersey
Control failure:Menashe Davidovitz, a real estate developer, pleaded guilty to paying cash bribes to Newark city employees in exchange for permits and certificates of occupancy, which he then used to list his properties for sale. Separately, from October 2021 to January 2023, he worked with a former US Air Marshal to sell Law Enforcement Family Member cards bearing apparent Department of Homeland Security insignia. Municipal permitting oversight and government issued identity credentials were both exploited for an extended period before detection.
Lesson:This is not a banking story, but it is a financial crime one. A clean looking property listing can trace back to bribery further up the chain. When underwriting a real estate transaction or a developer relationship, ask where the permits and certificates of occupancy actually came from, not just whether they exist.
On September 3, 2026, FinCEN reported approximately $12.7 billion in financial activity across 33,904 BSA reports filed from September 2023 to December 2025, linked to pig butchering investment scams run by Southeast Asia based criminal organizations. The scam operators relied on professional money launderers, shell companies, money mules, and offshore stablecoin exchanges to move proceeds. Transaction monitoring teams should review rules for patterns connecting romance or investment scam complaints to stablecoin off ramps, not only direct victim to scammer wire transfers.
FATF found that nearly 70% of surveyed jurisdictions have seen underground banking networks shift to coordinating settlements through WhatsApp, Telegram, and Signal, rather than through in person brokers. That shift moves part of the money trail off systems banks can monitor directly. Compliance teams investigating suspected hawala activity should treat messaging app references in account records, device evidence, or interviews as a documented typology indicator, not background noise.
Career & Skills Corner
When AUSTRAC opened its investigation into Western Union this month, plenty of commentary treated it as a settled finding of guilt. It is not. An investigation is a regulator deciding a concern is worth formal examination, nothing more and nothing less. The habit worth building is separating what is confirmed from what is alleged, every time, out loud, in writing. Note the date the investigation opened, what triggered it, in this case a 2025 external audit flagging CDD, suspicious matter reporting, and IFTI concerns, and what has not yet been decided. Then stop there until a finding is published. This discipline matters beyond accuracy. A compliance officer or investigator who states allegations as fact in a report, a training session, or a casual comment to a colleague is telling their employer, and eventually a regulator, that their judgment cannot be trusted with ambiguous information. The professionals who get handed the harder cases are the ones who visibly hold the line between fact and inference, even when a shortcut would make for a better story.
I will be watching for AUSTRAC's next update on the Western Union investigation, and for whether any other regulator follows FATF's hawala report with its own supervisory guidance on digital coordination channels.
Turn this weekly intelligence into a career. Marco’s AML & Financial Crime course takes you from curious to hireable.
AML & Financial Crime course →