FATF Report Sets Out Approaches to Disrupt Scam Compounds

The FATF published a report on November 5, 2026 that draws on almost 120 case studies from more than 60 jurisdictions to show how authorities and banks can disrupt scam compounds.

The report, Combating End-to-End Illicit Financial Flows Linked to Scam Compounds, follows the Financial Action Task Force plenary held in October. It is the first output of the UK Presidency’s roadmap, which runs from July 1, 2026 to June 30, 2028.

For compliance teams, the FATF scam compounds report matters because it follows the money through the whole chain, from the first victim payment to cash-out. That is the stretch where banks, payment firms and exchanges see the activity. The FATF estimates annual losses in the tens of billions of dollars.

The FATF describes compounds as “networked, industrialised and transnational criminal infrastructures.” Many rely on trafficked or coerced workers, so the report ties fraud controls to human trafficking risk.

What the FATF scam compounds report finds

The report documents scam compounds or related activity in jurisdictions across Africa, Europe, the Americas and Asia. Cambodia, Burma and Laos remain core locations, according to FinCEN’s alert on the same threat. Operations have also spread to South Asia, the Pacific Islands, Africa, the Middle East and South America.

The FATF warns that fewer visible mega-compounds should not be read as a fall in the networks or the money moving through them. Activity has shifted toward apartments, houses, hotels and office floors, and some operators present themselves as outsourcing or marketing firms.

The report also finds that countries have been more effective downstream, against victim payments, proceeds and assets, than upstream. It calls for action on both. Upstream targets include telecoms, online platforms, mules, corporate structures and professional facilitators.

One case traced more than $100 million in victim deposits to a single wallet cluster. Virtual assets are a central laundering channel, and some compounds run over-the-counter exchange desks inside their own premises.

Scam compounds red flags and typologies for banks

The FATF report follows the lifecycle of the proceeds from scam compounds. Set-up involves outsourced account creation, front companies and fraudulent money services business registrations. Victim payments move through digital assets, wires and ACH transfers via mules and shell companies, gold handed to couriers, and gift cards.

Layering relies on rapid address hopping, consolidation wallets, mixers and cross-chain swaps. Cash-out runs through Chinese underground banking, peer-to-peer exchangers, over-the-counter brokers and stablecoin transfers to offshore exchanges. Some networks also use Telegram-based guarantee marketplaces that hold buyers’ funds in escrow.

The FATF also flags recovery scams, in which fake agencies or law firms target earlier victims again. Signals that sit outside payment data include unusually high or continuous utility usage, payments to utility providers, and holdings of land, buildings and vehicles. The report also points to fake social media and messaging accounts and fraudulent advertising as indicators that appear before a first payment.

FinCEN’s September 3, 2026 alert, a separate document, sets out the red flag indicators US filers are working from. They include payments directed by a purported government official, law firm or recovery service, an exchange advertising “no KYC,” a payment provider that rebrands after enforcement, and stablecoins whose issuers resist freezing. FinCEN states that no single red flag is determinative.

These typologies bear on transaction monitoring. Rapid pass-through of funds, mule-like inbound and outbound patterns and cross-border flows to the jurisdictions above are the scenarios the lifecycle points to. Teams that tune rules against such patterns can use the transaction monitoring tuning template pack as a starting point.

Information sharing and asset recovery for supervised firms

The FATF Principles call the first 24 to 72 hours after detection or a report “critical” for freezing funds and recovering assets. The principle is addressed to authorities. It is not a filing deadline for institutions.

The report calls for public-private cooperation. FATF President Giles Thomson has called for proactive work with the technology, social media and communications sectors to prevent and disrupt scams. Banks see the payment leg. Platforms and telecoms see the approach to the victim.

In the US, FinCEN strongly encourages voluntary sharing under Section 314(b), though cross-border sharing may not receive safe harbor protection. The FinCEN alert asks filers to use the key term FIN-2026-SCAMCENTERS in suspicious activity reports. It also asks them to include wallet addresses, transaction hashes, chat logs, phone numbers, usernames, URLs, domains, IP addresses and third-party service providers.

In the EU, Article 75 of Regulation (EU) 2024/1624, the anti-money laundering regulation (AMLR), sets conditions for information sharing partnerships from July 10, 2027. Participants must notify their supervisor, carry out a data protection impact assessment, record the sharing and avoid relying on partnership information alone. They also need the agreement of the financial intelligence unit before sharing suspicious transaction report information. Article 75 does not cover telecoms or online platforms, so links with those sectors need other arrangements.

Where scam compounds meet fraud and mule accounts

The report sits alongside a rise in online fraud that reaches banks as customer losses. FinCEN, citing FBI data, reports that US digital asset investment scam losses rose from $907 million in 2021 to $7.2 billion in 2025. These schemes include pig butchering, in which victims are groomed into fake investments.

For banks, the exposure shows up in two places. Victims send money, often under pressure, and mule accounts receive and move it on. The wires and ACH transfers described in the typologies pass through those accounts and through shell companies, which is why account opening and mule detection feature in the lifecycle. UK firms face the same pattern in authorised push payment fraud, where the customer approves the transfer.

FinCEN’s earlier action shows how the US treats the counterparties involved. Its Section 311 final rule severed Cambodia’s Huione Group from the US financial system. FinCEN found at least $300 million in digital assets from cyber scams among $4 billion in illicit proceeds laundered between August 2021 and January 2025. On June 23, 2026, it proposed extending the rule to H-Pay Service PLC and successor entities.

What comes next for the FATF and scam compounds

The FATF said a wider study and recommendations on using its toolkit against fraud will follow. The October plenary also repeated its call on Myanmar to address fraud and cyber scam risks.

The EU’s AMLR applies from July 10, 2027, and the EU Anti-Money Laundering Authority’s guidelines on indicators of suspicion under Article 69(5) are due by the same date. A consultation on its draft reporting technical standards closed on September 20, 2026, and those drafts are not yet binding.