FinCEN Advisory Sets Out Red Flags for Payroll Fraud & ITIN Misuse

The US Department of the Treasury's Financial Crimes Enforcement Network (FinCEN) has issued an advisory setting out typologies and red flag indicators for financial institutions to detect and report payroll tax fraud, identity theft and money laundering linked to unauthorised employment schemes.

The advisory, issued jointly with the Federal Deposit Insurance Corporation (FDIC), the Office of the Comptroller of the Currency (OCC) and the National Credit Union Administration (NCUA), and in coordination with the Internal Revenue Service (IRS), centres on schemes in which complicit labour brokers establish shell companies, often operating as unregistered money services businesses, to provide off-the-books payroll services. These brokers receive payments from employers for purported goods or services, then launder the funds to workers via cash couriers, cheques or peer-to-peer platforms, withholding no federal or state payroll taxes.

A key supervisory expectation concerns the use of Individual Taxpayer Identification Numbers (ITINs). The advisory encourages banks to assess whether an ITIN presented in lieu of a Social Security number or valid employment authorisation document constitutes a relevant risk factor when applying customer due diligence, considered alongside other available information. FinCEN also flags the use of foreign identity documents, such as passports, to open shell company accounts.

The advisory identifies identity theft as a recurring feature, with Social Security numbers and other personally identifiable information of US citizens and lawful permanent residents misused to obtain employment, wages, benefits and financial services. It notes that in 2025 institutions reported over $2.5 billion in suspicious activity associated with these payroll tax fraud schemes.

FinCEN sets out 18 red flag indicators to support detection and reporting, and asks institutions to reference the key term "FINANCIALINTEGRITY-2026-A002" in SAR field 2 and the narrative when filing related Suspicious Activity Reports. The advisory is relevant to depository institutions, money services businesses, casinos, the securities and futures sector and other regulated entities.

Read the press release here.