FinCEN lists 22 red flags for nonprofit abuse and asks banks to judge each charity on its own

The Treasury Department's Financial Crimes Enforcement Network (FinCEN) published a notice on October 30, 2026, that tells banks and other financial institutions how to recognize and report the abuse of charities and nonprofit organizations. It describes three kinds of scheme, lists 22 warning signs and asks institutions to mark related suspicious activity reports with the key term "FIN2026NPO" in field 2 and in the narrative.

The notice, FIN-2026-NTC2, draws on Bank Secrecy Act data, open sources and information from law enforcement. Its last pages restate existing duties, such as keeping a copy of each report and its supporting records for five years.

Three kinds of abuse

FinCEN sorts the cases into sham charities, nonprofit fraud and embezzlement. In a sham charity, the people in charge advertise a legitimate cause but use the organization for illicit ends, such as funding a terrorist group; the notice's case studies are organizations that Treasury's sanctions office has designated for supporting Hamas, the Popular Front for the Liberation of Palestine or the Muslim Brotherhood. In nonprofit fraud, the leaders use the organization to enrich themselves, and the donors are the victims. In embezzlement, insiders steal from an otherwise legitimate organization, which is itself a victim.

Government money features prominently. The notice describes nonprofits that take grants or reimbursements for social services such as childcare, homelessness and education and divert them, sometimes acting as "sponsors" for third parties that claim to provide the services and taking kickbacks. Its case studies include the founder of a Los Angeles nonprofit with homelessness contracts who agreed to plead guilty in a scheme that misappropriated millions of dollars, and a contractor who, from January 2019 to August 2023, embezzled more than $1.5 million of the over $5.3 million that Virginia state employees gave through their workplace charity campaign.

The warning signs

The red flags fall into three groups: six about the organization and its people, eight about where its money comes from and eight about how it is spent.

No single red flag proves wrongdoing, FinCEN says; institutions should weigh all the facts, including a customer's history and whether it shows several signs.

Most nonprofits are low risk, the notice says

The notice also seeks to protect legitimate groups. Citing a 2020 joint fact sheet by FinCEN and the federal banking and credit union regulators, it says the vast majority of U.S.-based nonprofits are at low risk of being used for terrorist financing or other illicit activity, and that the government does not view the sector as a whole as uniformly or unacceptably risky. It asks institutions to evaluate each nonprofit individually and to match their controls to the risk "to avoid unintended consequences that unduly disrupt or discourage legitimate NPO activities."

It is to be read with a 2025 executive order on fair banking, and repeats that no American should be denied financial services because of protected beliefs, affiliations or political views. The Bank Secrecy Act does not require specific information about nonprofits, the notice says, but institutions may consider asking about a nonprofit's donor base, funding sources and fundraising methods, including foreign funding, and its affiliations with other nonprofits, governments or groups.

Announced in Minnesota

Treasury Secretary Scott Bessent announced the notice in St. Cloud, Minnesota, with a FinCEN alert on cross-border payments through money services businesses, as part of the White House Task Force to Eliminate Fraud. Treasury's release said a co-conspirator in the Feeding Our Future fraud, which abused a federally funded child nutrition program during the pandemic, had been sentenced that week to 30 years in prison. On October 15, FinCEN issued a separate alert on possible abuse of religious charity networks by Iran's government, including the diversion of religious tithes known as khums.

The notice counts about 1.96 million registered exempt organizations in the United States as of September 2026, and cites the FBI's Internet Crime Complaint Center, which received more than 4,500 complaints in 2024 about fraudulent charities, crowdfunding accounts and disaster relief campaigns, with about $96 million in losses. Our Form 990 guide explains the IRS return the notice cites for nonprofits' annual reporting.