The U.S. Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) on Friday issued a formal advisory asking financial institutions to increase monitoring and reporting of suspicious transactions connected to the illegal employment of unauthorized workers.
The notice was issued jointly with the Federal Deposit Insurance Corporation, the Office of the Comptroller of the Currency and the National Credit Union Administration, and it was coordinated with the Internal Revenue Service.
The advisory lays out how employers that hire unauthorized workers can obtain a competitive edge over businesses that comply with the law. It highlights several mechanisms by which this edge is gained - paying lower wages, enabling identity theft, and diverting tax revenue that would otherwise support government benefit programs.
FinCEN also warns that wages obtained illegally can flow into criminal networks. The advisory states that unlawfully obtained payroll funds may be used to finance transnational criminal organizations engaged in drug trafficking, human trafficking and other illegal activities.
To illustrate the scale of such schemes, the document includes a case study of two foreign nationals who ran a multi-year payroll operation that the advisory says cost the United States more than $38 million.
Identity theft and payroll fraud are identified as central elements in the schemes described. Employers across a range of sectors - including agriculture, construction, domestic service and hospitality - are cited as using these methods to conceal immigration law violations.
The advisory explains that unauthorized workers sometimes obtain Social Security numbers and other personal data belonging to U.S. citizens to secure employment, receive wages, access healthcare benefits and open financial accounts. Employers, the document says, can use payroll tax fraud to hide the fact that they have hired unauthorized workers and to avoid paying taxes and workers’ compensation benefits.
FinCEN notes that in 2025 financial institutions filed reports that linked more than $2.5 billion in suspicious activity to payroll tax fraud schemes.
The document describes how labor brokers may create shell companies - often operating as unregistered money services businesses - to run off-the-books payroll systems. These brokers, according to the advisory, may rely on foreign identity documents or Individual Taxpayer Identification Numbers (ITINs) to open bank accounts, then launder funds and distribute payments to unauthorized workers through cash couriers, checks or peer-to-peer platforms without withholding federal and state payroll taxes.
As part of its guidance, the advisory urges banks to apply enhanced due diligence when an ITIN is presented in place of a Social Security number or a valid employment authorization document. It includes 18 red flag indicators intended to help financial institutions identify and report suspicious activity tied to these employment and payroll schemes.
FinCEN requests that institutions reference the key term "FINANCIALINTEGRITY-2026-A002" in Suspicious Activity Reports that relate to the types of activity described in the advisory.
What banks are being asked to do
- Increase monitoring of account activity and payroll-related transactions that may indicate identity theft, shell company usage or payroll tax evasion.
- Use enhanced due diligence when ITINs are used instead of Social Security numbers or proof of work authorization.
- File Suspicious Activity Reports using the specified key term when appropriate.
Context provided in the advisory
The advisory ties together several related misconduct patterns: identity theft to obtain employment credentials, payroll tax fraud to mask illegal hiring and the use of shell entities and informal payment channels to move and disburse funds outside standard withholding and reporting mechanisms.
It underscores the cross-cutting impact of these practices on lawful employers, government revenue streams and the integrity of financial systems.