The Financial Crimes Enforcement Network (FinCEN) and other U.S. regulators on Friday issued a joint advisory warning banks to be alert to payroll fraud and identity-theft schemes connected to the employment of undocumented migrants, citing more than $2.5 billion in suspicious activity reported to the bureau in 2025.

The advisory, FIN-2026-A002, was issued jointly with the Federal Deposit Insurance Corp., the Office of the Comptroller of the Currency, and the National Credit Union Administration, and was coordinated with the Internal Revenue Service. It identifies specific financial typologies, outlines 18 red flag indicators, and requests that institutions use a key term when filing suspicious activity reports (SARs) tied to suspected illegal migrant activity.

The advisory focuses heavily on payroll fraud schemes in which employers in the agriculture, construction, domestic service, hospitality, and staffing industries contract with “complicit labor brokers” to pay workers off the books, evading federal and state payroll taxes as well as workers’ compensation insurance premiums.

Labor brokers in such schemes typically establish shell companies, often unregistered money services businesses, to receive checks from employers for purported services. The brokers then distribute funds to workers through cash couriers, checks, or peer-to-peer platforms in structured transactions designed to fall below Bank Secrecy Act reporting thresholds, according to the advisory. 

The shell companies may have generic names that correspond to the broker’s initials, and may list beneficial owners as “self-employed” or “laborer,” FinCEN said. In some instances, these schemes are connected to broader money-laundering networks, including those linked to drug trafficking organizations and transnational criminal organizations, several of which carry Foreign Terrorist Organization designations, according to the bureau. 

The advisory separately outlines guidance on Individual Taxpayer Identification Numbers (ITINs). FinCEN and the co-issuing agencies encouraged banks to treat an ITIN presented in lieu of a Social Security number or valid employment authorization document as a potential risk factor when opening accounts or extending credit. The agencies emphasized that ITINs do not confer work authorization or legal status, and said institutions should assess ITIN use as part of holistic, risk-based customer due diligence.

The advisory’s 18 red flags span three customer categories: individuals, large companies, and small companies. Indicators for individuals include using an SSN that does not match Social Security Administration records, opening accounts with a foreign passport or ITIN for a purported small business while receiving high volumes of recurring check deposits, and maintaining accounts with little activity beyond foreign remittances.

For large companies, flags include payroll tax deposits disproportionately low relative to apparent workforce size and repetitive check issuances to newly formed companies with minimal online presence. For small companies, flags include beneficial owners with no prior industry involvement, absence of tax or payroll payment history despite significant client deposits, and indicators consistent with shell company status.

The advisory augments a White House executive order signed by President Trump last month that directed federal regulatory agencies to treat undocumented migrants as potential credit and anti-money-laundering compliance risks at the financial institutions they oversee. The order, titled “Restoring Integrity to America’s Financial System,” instructed the Treasury Department to issue a formal advisory flagging such issues as the use of ITINs. 

In a statement, Treasury Secretary Scott Bessent characterized Friday’s warning as a step taken by the president to safeguard U.S. tax dollars. 

“President Trump has done more than anyone in history to secure our nation’s borders. Part of that effort includes securing our financial system,” he said “This administration will not allow illegal aliens to abuse financial institutions to steal billions of dollars from hardworking American taxpayers.”