FinCEN charity alert: four red flags for Iranian abuse of khums networks

The FinCEN charity alert of 15 October 2026 asks US financial institutions to spot and report Iranian regime abuse of religious charity networks, including the diversion of khums tithes. It adds four red flags and a SAR key term. It creates no new rule, and FinCEN says legitimate charities should keep access to financial services.

• FinCEN issued FIN-2026-Alert008 on 15 October 2026 as part of Treasury's Operation Economic Outcast against Iran and its financial enablers.
• SARs on this activity should carry the key term FIN-2026-IRANCHARITYABUSE in field 2, the Filing Institution Note to FinCEN, and, per the alert's sidebar, in the narrative.
• The four red flags: charities that show no charitable services or openly back the regime; large unknown-source donations passed on to other NPOs; CTR and recordkeeping evasion; and unrelated recipients who withdraw charity funds in cash or remit them onward.
• Informal channels are the core concern: hawalas and cash couriers that may move khums payments to Iran or Iran-linked actors.
• FinCEN repeats that charities are not uniformly high risk, so the alert is a reason to sharpen customer due diligence, not to exit a sector.

What did FinCEN announce on 15 October?

FinCEN published the "FinCEN Alert to Counter Iranian Abuse of Religious Charity Networks", asking financial institutions to identify and report possible regime abuse of religious charities. It is the latest in a run of Iran-related FinCEN alerts in 2026. The FinCEN charity alert says it draws on Bank Secrecy Act data, open-source reporting and law enforcement information.

The alert sits inside Operation Economic Outcast, the campaign Treasury launched against Iran on 24 August 2026. In Treasury's press release, Secretary Scott Bessent said reporting gives law enforcement "critical information to isolate the Iranian regime and its financial enablers." The FinCEN news release tags the alert for these industries: casinos, depository institutions, insurers, money services businesses, mortgage lenders and brokers, precious metals dealers, and securities and futures firms.

The subject is khums. The alert describes it as donating a fifth of one's surplus annual income to religious institutions. FinCEN acknowledges that khums plays an important role in Shi'a communities. Its concern is narrower: some collecting organisations act for Iranian ayatollahs with regime ties, or for the Supreme Leader, and may remit funds through hawalas and cash couriers.

The sidebar asks for the key term in field 2 and the narrative; the closing paragraph names only field 2. Use both.

Which precedents does the alert rely on?

The alert builds on two 2020 OFAC designations and a 2024 criminal case. Together they show the pattern FinCEN wants flagged: charitable or religious labels on organisations that serve the regime, and small cash movements designed to stay under reporting thresholds.

In November 2020 OFAC designated the Islamic Revolution Mostazafan Foundation, a bonyad that Treasury said is ostensibly charitable but serves the Supreme Leader's office. Treasury said the foundation is estimated to account for over one percent of Iran's gross domestic product. In March 2020 OFAC designated the Reconstruction Organization of the Holy Shrines in Iraq, which the alert describes as an ostensibly religious body controlled by the IRGC-Qods Force.

The criminal precedent is closer to what a bank would see. According to the Department of Justice, Muzzamil Zaidi and Asim Mujtaba Naqvi pleaded guilty in 2024 for their roles in a scheme that collected tens of thousands of dollars, including khums, for transfer to Iran in violation of US sanctions. Associates carried the cash out of the United States in amounts under 10,000 dollars. One transfer used a group of 25 travellers on a pilgrimage to Iraq.

That case explains the FinCEN charity alert's focus on structuring and cash. It also shows the limits of transaction data: the money left the banking system as cash, so the signals a bank can catch sit in deposit patterns, cash withdrawals and onward transfers between charities, not in the final leg abroad.

How does it compare with FinCEN's other Iran alerts?

The FinCEN charity alert is the narrowest of FinCEN's recent Iran products. Most earlier documents targeted oil smuggling, IRGC front companies, aviation procurement and a sanctions evasion payment network, where the red flags sit in trade, corporate and payment data. This one targets community fundraising, where they sit in donor, deposit and cash behaviour, extending the charity indicators of the 2024 advisory.

Sources: the 2024 advisory, the 2025 advisory, Alert002, Alert006 and the A7 alert, which we covered in our A7 Network analysis. The new alert states that its red flags add to the charity indicators in the 2024 advisory and the October 2023 Hamas alert, so rules tuned for those documents are a base to extend.

Trade-based flags fire on counterparties, goods and jurisdictions. Charity flags fire on the relationship between an NPO customer, its donors and the people or charities that receive its money.

What does the FinCEN charity alert change for your obligations?

The alert adds no new legal duty, but it changes how existing duties apply to charity customers. Customer due diligence, SAR filing, CTR monitoring and sanctions escalation each have a specific point where these red flags now belong.

Customer due diligence comes first. The 2020 joint fact sheet says charities do not present a uniform or unacceptably high risk, and the alert reminds banks to apply a risk-based approach. In practice, an NPO's risk profile should record who it collects for, which religious authority it represents, where funds are sent and what its public appeals say. The first red flag, a charity that solicits donations but shows no charitable services or openly supports the regime or its proxies in appeals or on social media, needs evidence. It can only be tested if the CDD file describes what the charity does and someone reviews its public fundraising material.

Suspicious activity reporting is the second duty. A bank must file a SAR on a transaction of at least 5,000 dollars that it knows, suspects or has reason to suspect is suspicious, under 31 CFR 1020.320. The deadline is 30 calendar days from initial detection, extendable to 60 if no suspect is identified. A suspicious activity report linked to this typology should carry FIN-2026-IRANCHARITYABUSE.

CTR and recordkeeping evasion is the third. The alert flags a charity, or its employee, officer or contractor, who alters or cancels a transaction once told a CTR would be filed, splits cash below the 10,000 dollar threshold in 31 CFR 1010.311, or avoids recordkeeping requirements. The alert also cites the October 2025 interagency SAR FAQs: cash near the threshold "is not information sufficient to require the filing" of a SAR. The test is reason to suspect structuring.

Sanctions escalation is the fourth. The FinCEN charity alert encourages institutions to notify OFAC through the OFAC Disclosure Portal when they identify potential sanctions violations, while still filing SARs. The same file may need both a SAR and an OFAC disclosure, which makes this a joint AML and sanctions matter.

Money services businesses carry a lower SAR threshold of 2,000 dollars under 31 CFR 1022.320. A hawala operating in the United States is generally a money transmitter, and so one of the money services businesses that must register with FinCEN under 31 CFR 1022.380, unless it acts only as an agent of a registered MSB. A bank's due diligence on an MSB customer should confirm that registration.

What is still uncertain about the FinCEN charity alert?

The main risk is de-risking: banks may close accounts for legitimate Shi'a charities rather than build the monitoring the alert asks for. FinCEN states that "legitimate charities should have access to financial services". The alert gives no measure of how widespread the abuse is.

Without a scale estimate, institutions cannot tell whether the typology sits in a handful of networks or across many collectors. A bank with a small NPO book may decide that a customised scenario costs more than exiting the relationships. That would push donations into cash and informal channels.

The red flags also need context to work. FinCEN writes that "no single red flag is determinative of illicit or suspicious activity". A surge in donations around religious festivals is normal. What the second red flag adds is large donations from an unknown source followed by significant wires or checks to other charities, so tuning needs a giving calendar and source-of-funds data, not volume thresholds alone.

Visibility is a further limit. The DOJ case shows the money leaving the country as cash. Banks see deposits, withdrawals and transfers, not what happens at the airport. A bank may see the fourth red flag, a recipient with no clear relationship to the charity withdrawing the funds in cash, and nothing after it. Where the recipient remits the money onward through the bank, the outgoing transfer is visible; a hand-off to a hawala is not.

Finally, the FinCEN charity alert is guidance issued under a Treasury sanctions campaign. Operation Economic Outcast may produce further designations that turn a red flag into a strict-liability sanctions problem. A charity counterparty that is low risk today could be added to the SDN List later, so screening must be repeated, not done once at onboarding.

Which firms are most exposed?

Banks and credit unions with community, faith-based or diaspora NPO customers face the most direct exposure, followed by money services businesses that serve those communities. Their customer base holds both the legitimate collectors FinCEN wants protected and the channels it wants watched.

A hawala-like pattern can appear inside a registered MSB as many small senders paying one recipient abroad, or one account paying out to many individuals. The fourth red flag, transfers from a charity to a customer with no clear relationship followed by cash withdrawal or onward remittance, is visible in retail and fintech accounts.

How should compliance teams respond?

Start with the NPO customer list, not the transaction monitoring system. Identify every charity and religious organisation customer, then confirm that each file records its purpose, its affiliation, its public appeals and where its funds are sent. Without those fields, none of the four red flags can be tested.

Next, map the four indicators in the FinCEN charity alert to existing scenarios. Rapid pass-through of donations, cash withdrawals or onward remittances by unrelated recipients, and CTR avoidance often exist as generic rules. Add an NPO segment so they fire with the right thresholds, add adverse media and social media review for the first red flag, and train analysts to cite FIN-2026-IRANCHARITYABUSE in field 2 and the narrative. See our AML transaction monitoring guide.

Then fix the escalation route. A confirmed match should reach both the SAR team and the sanctions team, so the case can be assessed for an OFAC disclosure. Re-screen NPO customers and their officers on a schedule, because Operation Economic Outcast may bring further Iran designations. Finally, document why each retained charity stays: that record shows the risk-based approach FinCEN asked for, not a blanket exit.

Zyphe helps here by giving teams verified identity data on the officers, trustees and other control persons behind an NPO, with screening and an exportable audit trail, without building a central store of customer PII. See Zyphe's AML software or book a demo.

The bottom line

The FinCEN charity alert does not change the law. It changes what a defensible charity file should show. A bank with charity customers needs files that describe what each NPO does and says in public, monitoring that can tell a festival surge from a pass-through, and an escalation path that reaches both the SAR and sanctions teams. Banks that do this are better placed to keep legitimate charities banked and still detect the abuse. FinCEN has asked for both: reporting of abuse and continued access for legitimate charities.

Cited sources

• FinCEN, FIN-2026-Alert008, Alert to Counter Iranian Abuse of Religious Charity Networks, 15 October 2026
• US Treasury press release, Operation Economic Outcast targets Iranian regime's abuse of religious charity networks
• FinCEN news release on the religious charity network alert, with the list of affected industries
• US Department of Justice, Scheme to transfer money to Iran results in guilty pleas, 1 May 2024
• US Treasury, Treasury targets vast Supreme Leader patronage network, 18 November 2020
• US Treasury, Treasury designates vast network of IRGC-QF officials and front companies in Iraq, Iran, 26 March 2020
• Joint Fact Sheet on Bank Secrecy Act Due Diligence Requirements for Charities and Non-Profit Organizations, 19 November 2020
• Interagency FAQs regarding suspicious activity reporting requirements, October 2025
• FinCEN, FIN-2026-Alert002 on IRGC front companies, facilitators and digital asset infrastructure
• FinCEN, FIN-2026-Alert006 on Iranian procurement for commercial aviation
• FinCEN, FIN-2026-Alert007 on the A7 Network
• FinCEN, FIN-2025-A002 advisory on Iranian oil smuggling, shadow banking and weapons procurement
• FinCEN, FIN-2024-A001 advisory on the financing of Iran-backed terrorist organisations
• FinCEN, FIN-2023-Alert006 on Hamas's terrorist financing, 20 October 2023
• 31 CFR 1020.320, reports by banks of suspicious transactions (eCFR)
• 31 CFR 1010.311, filing obligations for reports of transactions in currency (eCFR)
• 31 CFR 1022.320, reports by money services businesses of suspicious transactions (eCFR)
• 31 CFR 1022.380, registration of money services businesses (eCFR)