The FinCEN border GTO returns to March 2027, minus Arizona and California

The FinCEN border GTO was reissued on 3 September 2026, seven weeks after a federal appeals court affirmed an injunction against the order that started the programme. The cash reporting threshold stays at 1,000 dollars. The covered area now lists 304 zip codes in Texas and New Mexico, and no longer reaches Arizona or California.

• The new FinCEN border GTO took effect on 3 September 2026 and runs to 1 March 2027, exactly the 180 day statutory maximum.
• Covered money services businesses must file a Currency Transaction Report within 30 days on cash transactions of 1,000 to 10,000 dollars, with two exceptions.
• The covered area dropped four Arizona counties and eleven California zip codes, and now enumerates 210 Texas and 94 New Mexico zip codes.
• Firms that were not covered by the March 2026 order have until 3 October 2026 to comply.
• The identity step moves before the transaction closes: the document number used to verify the customer has to be written onto the report.

What did FinCEN just do to the border GTO?

FinCEN, the Financial Crimes Enforcement Network, signed a new Geographic Targeting Order on 2 September 2026, effective the following day and published in the Federal Register on 4 September at 91 FR 56776. It requires money services businesses in 304 named zip codes to report deposits, withdrawals, currency exchanges, payments and transfers in cash of 1,000 dollars or more, but not more than 10,000 dollars.

Deputy Director Jimmy L. Kirby signed it under 31 U.S.C. 5326, delegated to FinCEN by Treasury Order 180-01. Reports are e-filed through the BSA E-Filing System.

The filing system may warn that the transaction is below 10,000 dollars, so the order tells filers to override it: "The Covered Business shall ignore the warning and continue with the submission."

How does this order compare with the ones before it?

This is the fourth FinCEN border GTO in a chain that began in March 2025, and the third to sit at 1,000 dollars. What changed is the map and the drafting: the covered area is now a list of individual zip codes, and it stops at the Texas and New Mexico state lines.

The new order begins the day after the previous one expired, so the programme has run without a gap. Scope continuity is a separate question. Because the covered area is now a zip code list rather than a county list, a firm inside one of the eight named counties is covered only if its own code appears, and the order does not say whether the 304 codes exhaust those counties. Check the list, not the county name.

The order also carries forward a carve-out: while an injunction remains in force, any money services business the government is enjoined from applying the March 2025 order to stays outside the definition of a covered business. A footnote records that this still describes certain firms in Texas, from litigation separate from the California case below. It names neither the firms nor the case, so no Texas firm can apply the carve-out from the order text alone.

What does the FinCEN border GTO change in your obligations?

The order adds a second reporting trigger beneath the familiar one and pulls identity verification forward to the counter. The 10,000 dollar Currency Transaction Report duty under the Bank Secrecy Act is untouched, and so is every other duty a money services business already carries. Every category in 31 CFR 1010.100(ff) is in scope, from money transmitters to check cashers.

The two duties now run on different clocks, which is the detail most likely to break an existing workflow. An ordinary Currency Transaction Report above 10,000 dollars is due within 15 days under 31 CFR 1010.306. A report in the new band is due within 30 days, on the same form, marked MSB0926GTO in Field 45. Two carve-outs apply: transactions with a commercial bank, and, where the filer is the Postal Service, postage and philatelic sales. The business also answers for compliance by its officers, directors, employees and agents, any of whom may face civil or criminal penalties.

Identification is the operationally expensive part. Before concluding a covered transaction the firm must meet 31 CFR 1010.312: verify and record the name and address of the individual presenting the transaction, and record the identity, account number and taxpayer identification number of anyone on whose behalf it is made. For a customer who states they are an alien or non-resident, verification must come from a passport, alien identification card, or other official document evidencing nationality or residence. The identifying number used, a credit card account or driver's license number, is written onto the report. A note of "known customer" or "bank signature card on file" is prohibited.

Suspicious activity reporting is where the FinCEN border GTO does its quieter work. The order leaves the money services business Suspicious Activity Report threshold where it was, as low as 2,000 dollars under 31 CFR 1022.320, then encourages voluntary filing on transactions conducted to evade the new 1,000 dollar trigger. In practice that asks firms to detect structuring around a line most customers have no reason to know exists.

Firms leaving the covered area have their own checklist. The four Arizona counties and the eleven California zip codes stopped being covered on 3 September 2026, so the extra reporting stops with them, but the retention clock does not. Records tied to the March 2026 order run five years from its last effective day, renewals included. If the September order counts as a renewal, that clock starts in 2027 rather than on 2 September 2026.

What is still uncertain about the FinCEN border GTO?

The largest open question is whether the FinCEN border GTO survives contact with a court a second time. On 13 July 2026 the Ninth Circuit affirmed a preliminary injunction against the March 2025 order in Novedades y Servicios, Inc. v. FinCEN, No. 25-4238, and we covered that ruling at the time. Its conclusion: "the Border GTO is likely a rule and not an order under the APA."

That reasoning now has nowhere to bite. Texas sits in the Fifth Circuit and New Mexico in the Tenth, and Novedades is persuasive rather than binding in either. A fresh challenge would have to start again in a district court, and a second appellate ruling would outlast the 180 days this order runs. If a later court does invalidate it, filings already made and the records behind them still have to be retained. Enumerating 304 zip codes makes the new order more precise, but it still does not name a single business, which was the objection.

A second gap is closer to the counter. The order sets a 1,000 dollar trigger but states no aggregation rule, and the aggregation rule in 31 CFR 1010.313 is written around a 10,000 dollar daily total. A firm asked to spot evasion of the new line therefore has to build its own aggregation logic and document the reasoning, because the order does not supply one.

The official burden estimate for a Currency Transaction Report is 40 minutes. The plaintiff used 25 minutes and still calculated fourteen or more additional hours of reporting per day, for a shop that normally has one person on duty. The district court found a "threat of extinction". Judge Lee dissented on irreparable harm, and the burden findings stay contested.

In the single week the March 2025 order applied to the plaintiff before the injunction, it lost 50 to 60 percent of the customers it explained the requirement to, customers saying they would move to businesses in unaffected zip codes, one a five minute drive away. The Ninth Circuit found that map's zip codes non-contiguous and surrounded by uncovered ones. The new map is denser, but Bernalillo and San Juan remain inland islands, so displacement stays built in.

Why does the covered map now stop at the Ninth Circuit?

The covered map stops there because of where the remaining states sit in the federal appellate system. Arizona and California are both in the Ninth Circuit under 28 U.S.C. 41. After the map changed, no covered zip code lies inside the circuit that has published an opinion against the programme.

The FinCEN border GTO gives no reason for the change, and a motive should not be read into a document that does not state one. What can be said is that the narrowing was not compelled. The Ninth Circuit upheld the district court's decision to limit the injunction to the Southern District of California, which covers Imperial and San Diego counties. Nothing in that relief reached Maricopa, Pima, Santa Cruz or Yuma counties in Arizona, yet all four are gone.

A firm outside the covered area should not read this as a retreat. The renewal power in 31 U.S.C. 5326 means the FinCEN border GTO map can be redrawn every six months, and it has been redrawn three times in eighteen months.

How should compliance teams respond?

Start with scope, because the FinCEN border GTO changed shape rather than just size. Check every location and agent address against the zip code list in the order. If any was not covered before, the compliance date is 3 October 2026, and the order has to reach every agent in the area and the chief executive before then.

Then take the reporting and identity workflow apart. Run two clocks on the same form, 15 days above 10,000 dollars and 30 days in the new band, and brief staff that the sub-threshold warning is expected. Transactions up to 2 September still belong to the expired March order and its own code, so do not retag the tail. Move document capture ahead of completion so the number reaches the report. Set your own aggregation logic for the 1,000 dollar line, document the call, and diary 1 March 2027.

What none of this removes is the evidence itself. A verified identity record now has to survive five years, be producible on demand, and put a document number on a federal form. Zyphe reads the NFC chip to ICAO 9303 and eIDAS standards and shards the data across a decentralised network, so no single node holds a complete record and there is no central honeypot to lose, and the audit trail stays exportable. See decentralised PII storage, how it works, how our AML software handles thresholds, or book a demo.

The bottom line

The reporting band did not move. What moved is the boundary, and the way it is drawn. A FinCEN border GTO that a federal appeals court has called a likely rule in disguise now runs on a map redrawn to sit outside that court. For teams running KYC and AML at the counter, the lesson is to build for a threshold that moves, and to keep identity evidence defensible without hoarding copies of every document checked.

Cited sources

• Geographic Targeting Order on certain money services businesses along the southwest border, 91 FR 56776
• Novedades y Servicios, Inc. v. FinCEN, No. 25-4238 (9th Cir., 13 July 2026), opinion
• The previous southwest border order, 91 FR 11456, March 2026
• The September 2025 order that raised the band to 1,000 dollars, 90 FR 43557
• The original border order, 90 FR 12106, March 2025
• 31 U.S.C. 5326, records of certain domestic transactions
• 31 CFR 1010.306, filing of reports
• 31 CFR 1010.311, reports of currency transactions by financial institutions
• 31 CFR 1010.100, definition of a money services business
• 31 CFR 1010.312, identification required
• 31 CFR 1010.313, aggregation of multiple transactions
• 31 CFR 1022.320, reports by money services businesses of suspicious transactions
• 28 U.S.C. 41, the numbers and composition of the federal circuits