FinCEN's Foreign Agent Alert: What Money Transmitters Must Fix in Agent Oversight

On 30 October 2026 FinCEN issued Alert FIN-2026-Alert009 on foreign-agent-directed transactions: payments a US money transmitter makes to third parties abroad because its foreign agent told it to. FinCEN's analysis of Bank Secrecy Act (BSA) reporting found more than USD 8 billion of suspicious payments of this kind between 2021 and 2025. The alert reminds principals that they remain responsible for their anti-money laundering (AML) programme whatever the agent contract says, and asks filers to put the key term FIN2026FOREIGNAGENT on related suspicious activity reports (SARs).

The alert does not change the rules. It shows where FinCEN has seen existing rules fail, and it gives examiners, banks and law enforcement one shared list of red flags. A money transmitter that pays third parties on an agent's instruction should expect questions on it at its next state examination and its next bank review.

The alert at a glance

FinCEN also states that MSBs provide important services to underserved populations and that no type of customer, MSBs included, should be treated as uniformly high risk. The alert is aimed at one arrangement, not at the sector.

What a foreign-agent-directed payment is

The principal is the licensed money transmitter whose service is sold. An agent is a separate business the principal authorises to sell that service; a foreign agent does so outside the United States. Principal and agent settle with each other through bank accounts, meaning each pays what it owes the other for the transfers handled.

Some agent agreements let the foreign agent direct the principal to pay third parties that the agent calls its suppliers or partners. The principal wires the money from its own US bank account to the third party's overseas account. The bank sees a payment from a licensed money transmitter, not the agent's instruction or the reason for it.

FinCEN illustrates one case. Over four years a foreign agent directed a US principal to send dozens of wires, totalling over USD 5 million, to a beneficiary in a third country. The principal did little or no due diligence or monitoring. The same beneficiary also received funds from a general trading company that the Office of Foreign Assets Control (OFAC), the US sanctions authority, later designated for material support of a network that financed Hizballah and a Houthi financial facilitator.

The five patterns FinCEN found

FinCEN's review of BSA reporting found five recurring patterns.

• Beneficiaries with no clear link to the principal, including foreign exchange houses in the United Arab Emirates (UAE), Chinese commercial banks and trading companies, and many recipients across East Africa.
• Volume and timing that do not fit the business, such as daily transfers or round and near-round dollar amounts.
• Recipients with the wrong profile: general trading companies, companies with no web presence or newly created companies, paid instead of the agent and often labelled settlement for goods and services.
• Fast pass-through: funds deposited into the principal's bank account were often wired abroad within hours or days.
• The agent using the principal's account as its own, with little information or documentation on the recipient or the purpose, leaving the principal and its bank with limited sight of either end.

The nine red flags for principal MSBs

No single red flag proves wrongdoing. FinCEN asks firms to weigh all the facts, including the customer's history, normal practice in the business and whether several flags appear together.

1. The foreign agent directs a payment, including one described as settlement, to a third party not covered by the agent clearing agreement.
2. The agent regularly directs payments to third parties in third countries such as China, the UAE, Egypt, Kenya, Uganda and Djibouti.
3. Payment reasons are vague, repetitive or unsupported, such as "settlement", "services" or "business expense".
4. The agent is reluctant or fails to provide invoices, contracts or orders, or provides documents that are inconsistent.
5. The third party has no apparent relationship with the agent, for example a textile company, a general trading company, a company with no web presence or a newly created company.
6. The agent is reluctant or fails to show it did due diligence on the third party.
7. The timing, volume or nature of the payments does not match the stated settlement arrangement.
8. The agent will not or cannot give information on its licensing or regulatory status, its business or its AML controls.
9. The agent regularly directs payments in round or near-round dollar amounts.

The five bank red flags mirror these from the bank's side: payees unlike a normal recipient of bulk MSB funds, missing documents, payments to countries that do not match the population the MSB serves, timing that does not fit settlement, and repeated round-dollar payments. Expect your bank to raise them.

The principal stays responsible

The rule is 31 CFR 1022.210. Every MSB must have an effective written AML programme, reasonably designed to stop it being used for money laundering and terrorist financing, and proportionate to its risks. Paragraph (d)(1)(iii) lets a principal and its agent agree who writes the policies and procedures, but each MSB remains solely responsible for putting the programme into effect.

Two earlier FinCEN documents explain what that means for agents, and the alert builds on both.

FIN-2016-G001 is explicit, and the alert repeats it: neither the agent nor the principal can avoid liability by pointing to a contract that gives the duty to the other party.

In practice the duty has three parts.

Due diligence. Identify the agent's owners and check them against OFAC's sanctions list. Check the agent's licence and regulatory status, its AML controls and record, the markets it serves and the activity expected. Repeat the review when its ownership, business or regulatory position changes.

Risk-based monitoring. Monitor transactions to, from or through the United States that run through foreign agents, looking for unusual wires, structuring (splitting amounts to avoid reporting) and needlessly complex routes. After this alert, that includes third-party payments the agent directs.

Corrective action and termination. Keep written procedures to require fixes from an agent and to end the relationship where it poses an unacceptable risk or shows systemic, wilful or repeated lapses.

Mapping each red flag to a control

Screen every third-party payee against OFAC sanctions lists before release, and again when lists change. The case in the alert shows why a payee screen matters as much as a customer screen.

Filing SARs with the key term

Under 31 CFR 1022.320, an MSB must file a SAR on a transaction of at least USD 2,000 where it knows, suspects or has reason to suspect the activity involves illicit funds, is designed to evade BSA requirements, has no business or apparent lawful purpose, or uses the MSB to facilitate crime. The SAR is due within 30 calendar days of initial detection, and the SAR and supporting documents must be kept for five years.

For this activity FinCEN asks filers to:

• enter FIN2026FOREIGNAGENT in SAR field 2 (Filing Institution Note to FinCEN) and in the narrative
• include all available information on the accounts, locations, entities and people involved, and on other domestic and foreign financial institutions
• consider a joint SAR where suspicious activity is shared with another institution
• call the Financial Institutions Toll-Free Hotline on (866) 556-3974 for suspected terrorist activity, and notify law enforcement by telephone at once where an ongoing scheme needs immediate attention

Where the activity also involves a charity or non-profit, the companion notice asks for its own key term, FIN2026NPO; a narrative may carry both. FinCEN also encourages voluntary information sharing between financial institutions under section 314(b) of the USA PATRIOT Act, which helps where an agent works for several principals.

A strong narrative for this typology names the agent, the instruction, the stated purpose, the payee and its profile, the documents requested and received, and why the explanation did not hold.

What examiners will ask at the next examination

FinCEN has delegated BSA examination of MSBs to the Internal Revenue Service (IRS), and state regulators may also examine BSA compliance as part of their licensing requirements. The BSA/AML Examination Manual for Money Services Businesses was written by FinCEN and the IRS with state agencies, the Money Transmitter Regulators Association and the Conference of State Bank Supervisors, so that examinations apply the BSA consistently. Its foreign agent procedures, read with the alert, point to the questions to prepare for:

• Does the AML programme set out risk-based due diligence on new and existing foreign agents, including identifying their owners?
• How are foreign agent transactions monitored, and does monitoring cover third-party payments the agent directs?
• How does the firm learn of a change in an agent's ownership, business or regulatory status?
• Which agents are rated highest risk, and why?
• What are the volume and size of transactions at each foreign agent, and what explains significant changes?
• What are the procedures for corrective action and termination, and what do the files of terminated agents show?
• Where red flags appeared, was a SAR considered, and does it carry the key term?

FIN-2016-G001 adds that FinCEN expects a principal to have information readily available to show it has developed and implemented risk-based agent monitoring. That means a file for each agent, not a policy alone.

State law sets its own standard for authorised delegates, the agents that conduct money transmission for a licensee. Under the Money Transmission Modernization Act, the model law written by state regulators, a licensee must adopt written policies, sign a written contract and complete a risk-based background investigation before appointing one. That is a sensible benchmark for foreign agent files too. Our guide to money transmitter compliance requirements explains how examinations run.

A 30-day action plan

The 30-day SAR clock runs from initial detection, so a SAR arising from the look-back should be filed when it is due, not held for the end of the plan. The independent review required by the rule is the natural place to test the new controls; our independent AML testing work covers agent oversight.

Where agent oversight sits in the compliance year

Agent oversight is part of the federal programme every FinCEN-registered MSB runs, and state regulators review it again under each US money transmitter licence. Our money transmitter compliance calendar sets out the related training, review and reporting dates to December 2027.

The firms that handle this alert well can show, agent by agent, who the agent is, whom it asked them to pay, why, and what they did when the answer was weak. Regulatory Counsel supports that work through ongoing compliance support.