OFAC designated Xinbi Guarantee on 9 September 2026 and listed 52 TRON addresses. What changes for sanctions screening, SAR filing and crypto KYC controls.
Table of contents
On 9 September 2026 OFAC designated Xinbi Guarantee, a Telegram-based marketplace serving Southeast Asian scam centres, as a significant transnational criminal organization and listed 52 TRON wallet addresses. The Justice Department said about 52 million dollars in crypto was restrained the same day. US persons must now block and report any Xinbi property they hold.
- OFAC designated Xinbi Guarantee under Executive Order 13581, as amended, plus two app developers: Cambodia-based Anwen Technology and Singapore-based SafeW Technology.
- Treasury says the marketplace processed the equivalent of over 24 billion dollars in digital assets and fiat since around 2022.
- The SDN List entry for Xinbi carries 52 TRON digital currency addresses, which gives wallet screening a concrete match target.
- DOJ's Scam Center Strike Force says about 52 million dollars was restrained, including two seized wallets holding about 12 million dollars, after it sought restraint of 47 more wallets.
- The UK entry for the same target, Xinbi Company Limited, lists 40 addresses, all among OFAC's 52, so UK-only screening data misses 12.
- FinCEN's alert of 3 September 2026 asks filers to tag scam centre SARs with the key term "FIN-2026-SCAMCENTERS".
What did OFAC and DOJ announce about Xinbi Guarantee?
OFAC added Xinbi Guarantee to the Specially Designated Nationals (SDN) List on 9 September 2026, and blocking took effect that day. Treasury's press release describes a Chinese-language platform connecting scam syndicates with vendors of financial services and technology, and providing escrow for their deals.
Treasury Secretary Scott Bessent framed the stakes plainly: "Scam centers in Southeast Asia steal billions of dollars from American victims each year." Treasury adds that the platform has reportedly been used by North Korean hackers and by already designated entities, including Jin Bei Group and parts of the Prince Group TCO. The release also says that after FinCEN acted against Huione Pay, cybercriminals moved their activity to Xinbi's marketplace, which kept offering substantially similar services to an overlapping customer base.
The designation was coordinated with the Justice Department. According to the US Attorney's Office for the District of Columbia, a federal court authorised seizure of the Telegram channels hosting the marketplace on 7 September 2026. Those facts come from a seizure warrant, so they remain allegations, and the release announces no criminal charges against the platform's operators.
| Item | Detail | Source |
|---|---|---|
| Designation date | 9 September 2026 | OFAC recent actions |
| Legal authority | E.O. 13581, as amended by E.O. 13863 | Treasury release |
| Entities listed | Xinbi Guarantee, Anwen Technology Co., Ltd., SafeW Technology Co., Ltd. | SDN List update |
| Identifiers | 52 TRON (TRX) addresses on the Xinbi entry | SDN List update |
| Volume | Over 24 billion dollars equivalent since around 2022 | Treasury release |
| Crypto restrained | About 52 million dollars in total, including two seized wallets holding about 12 million dollars | DOJ release |
| Earlier listing | UK asset freeze on Xinbi Company Limited, 26 March 2026 | UK Sanctions List |
How does a guarantee marketplace launder scam proceeds?
A guarantee marketplace is an escrow service for criminals. FinCEN's alert FIN-2026-Alert005 describes networks of Chinese-language Telegram groups that market vendors, hold payment until a service is delivered, and settle disputes. In FinCEN's words, they "are attractive to illicit actors seeking to avoid the formal financial system."
The services on sale go well beyond laundering. Describing guarantee marketplaces generally, FinCEN lists "online social media account creation and verification", social media targeting and mass phishing. On Xinbi Guarantee specifically, DOJ alleges vendors offered custom scam investment websites, money washing and recruitment of trafficking victims for scam compounds. The UK Foreign, Commonwealth and Development Office said, when it became the first country to sanction Xinbi, that its services include selling stolen personal data used to target victims.
FinCEN describes three stages. Victims pay, often in digital assets bought through money services businesses, or into US bank accounts and shell companies controlled through money mules. Professional money launderers then obfuscate the funds on chain, for example by swapping USDT from Ethereum onto the Tron blockchain. Finally, proceeds re-enter the formal system through money mule networks, stablecoin transfers to exchanges outside the United States, and peer-to-peer exchangers and OTC brokers in Chinese underground banking.
The OFAC action also reaches the technology layer. Treasury says Xinbi began migrating its merchant and money laundering networks to the SafeW messaging app around June 2025 and launched a wallet called XinbiPay, also known as NewPay, built by Anwen. Both developers were designated for materially assisting the marketplace.
What changes for sanctions screening, SAR and CDD obligations?
The Xinbi Guarantee listing creates no new rule, but it changes what existing duties catch. Four sets of obligations move for US financial institutions and virtual asset businesses, and one for UK firms, with sanctions blocking the most urgent because OFAC may impose civil penalties on a strict liability basis.
Blocking and OFAC reporting
Any Xinbi property in a US person's possession or control must be blocked. Under 31 CFR 501.603, an initial blocking report is due within 10 business days, and rejected transactions must be reported within the same window under section 501.604. The annual report due each 30 September covers property held as of 30 June, so assets blocked on 9 September first appear in the 2027 annual report, not this month's.
Wallet screening and the 50 percent rule
The 52 Xinbi Guarantee addresses belong in on-chain screening today. Name screening alone will not catch a wallet. Entities owned 50 percent or more, directly or indirectly, individually or in the aggregate, by Xinbi, Anwen or SafeW are blocked too, even unnamed. FinCEN's red flags go further, pointing to customers transacting with unattributed address clusters that share infrastructure with a known guarantee marketplace.
Suspicious activity reporting
FinCEN asks filers to use the key term "FIN-2026-SCAMCENTERS" in SAR field 2 and the narrative, to select "Fraud-Other" in field 34(z) with the description "Scam Centers", and to include wallet addresses, transaction hashes, social media usernames and chat logs. Form 8300 filers reporting a related suspicious transaction should tick box 1b and put the key term in Comments. The mandatory Suspicious Activity Report thresholds are unchanged at 5,000 dollars for banks and 2,000 dollars for money services businesses. FinCEN also encourages voluntary information sharing under section 314(b) of the USA PATRIOT Act.
Customer and business due diligence
The alert turns scam laundering into a CDD problem as much as a screening one. FinCEN flags payment providers that appear to operate in Burma, Cambodia or Laos while obscuring location or structure, and warns that scammers have registered fraudulent MSBs with FinCEN to look legitimate. Anwen's SDN entry carries a Cambodian tax ID and business registration number, so KYB checks should match registry identifiers, not names alone.
UK firms
The UK froze the assets of Xinbi Company Limited, listing Xinbi Guarantee as its subsidiary, under the Global Human Rights Sanctions Regulations 2020 on 26 March 2026. Cryptoasset exchange providers and custodian wallet providers are relevant firms under regulation 26, so regulation 25 requires them to inform the Treasury as soon as practicable of a designated customer, stating the funds held. Separately, regulation 25(4A) requires any person who knows or suspects they hold funds of a designated person on 30 September to report them by 30 November, so Xinbi funds still frozen on 30 September 2026 belong in this year's report.
The two lists do not match. In the UK Sanctions List dated 11 September 2026, the Xinbi entry carries 40 TRON addresses, every one of them among OFAC's 52. Anwen and SafeW were not named in the UK's March announcement. A firm screening only against UK data would miss 12 listed wallets and both developers, and a name-only match must bridge "Xinbi Company Limited" and "Xinbi Guarantee".
What is still uncertain about the Xinbi Guarantee action?
The biggest open question is displacement. Treasury itself documents that users fled Huione for Xinbi, and FinCEN warns that guarantee marketplaces "can quickly reconstitute after takedowns" by opening new chat groups. A designation disrupts one brand. It does not remove demand from the scam economy that funds it.
Address lists age quickly
Fifty-two listed addresses is a snapshot. DOJ sought restraint of 47 wallets tied to Xinbi's network and vendors, and none of the releases says whether all of them appear on the SDN List. New wallets cost criminals almost nothing, and the UK and US entries already diverge by 12 addresses, so list matching is a floor and exposure analysis carries the real weight.
Indirect exposure has no bright line
Neither the Treasury release nor the OFAC notice says how many hops from a listed address a transaction must be before the exposure stops mattering. Strict liability for direct dealings is clear. For funds several transfers removed, firms are left to calibrate risk appetite themselves, which invites both over-blocking and missed exposure. FinCEN offers a partial test on the reporting side: a customer transacting directly or indirectly with a marketplace address, with no apparent economic purpose, is a red flag.
Allegations, not findings
The DOJ facts rest on allegations in a seizure warrant, and the release reports no forfeiture judgment or criminal charges. Institutions should treat the designation as binding and the criminal narrative as allegation, particularly when documenting why a customer relationship was exited.
Identity data as a commodity
The UK's description of stolen personal data for sale matters to KYC teams. A check that asks whether an applicant knows the right details, or holds a genuine document image, is weakest when those details circulate on criminal markets. When guarantee marketplaces sell account creation and verification, some mule accounts will pass onboarding as real people, which moves the burden to ongoing monitoring.
How does this compare with earlier guarantee marketplace actions?
Xinbi Guarantee follows FinCEN's Huione rule and its proposed extension to successors, with a different tool. The Huione rule cut off correspondent access, while the Xinbi Guarantee designation blocks property outright, and Treasury warns that other persons, not only US ones, may risk sanctions exposure for certain dealings.
| Date | Authority | Target | Instrument | Scale cited |
|---|---|---|---|---|
| 14 October 2025 | FinCEN | Huione Group, including Haowang Guarantee | Section 311 final rule | 4 billion dollars of illicit proceeds laundered, August 2021 to January 2025 |
| 26 March 2026 | UK FCDO | Xinbi Company Limited, the first national listing | Asset freeze under UK human rights sanctions | Not stated |
| 23 June 2026 | FinCEN | H-Pay and other Huione successors | Proposed amendment to the 311 rule | Not stated |
| 9 September 2026 | OFAC and DOJ | Xinbi Guarantee, Anwen, SafeW | E.O. 13581 designation and seizure warrant | Over 24 billion dollars processed |
The H-Pay proposal, covered in our note on the June 2026 Prince Group and H-Pay actions, shows the successor pattern: when one entity is cut off, another appears. FinCEN's own analysis of 33,904 BSA reports ties about 12.7 billion dollars in financial activity to suspected digital asset investment scams between September 2023 and December 2025.
How should compliance teams respond?
Compliance teams should load the 52 Xinbi Guarantee TRON addresses from OFAC's 9 September 2026 SDN update into wallet screening, then run a lookback on past deposits and withdrawals. Confirm your provider has ingested the Anwen and SafeW entries with their registry numbers, and recheck counterparties previously screened clear against Prince Group and Jin Bei entries.
Add FinCEN's guarantee marketplace red flags to transaction monitoring scenarios and SAR templates, using the FIN-2026-SCAMCENTERS key term. Next, review onboarding for payment providers and MSB customers with links to Burma, Cambodia or Laos, and verify registrations against source rather than self-declaration. Our sanctions screening guide and VASP KYC guide cover the control design in more depth.
Every stored copy of identity data is potential supply for markets like this one, and the dark web listing tied to the IDScan breach is a reminder that stored copies leak. Zyphe reads NFC document chips to ICAO 9303 and eIDAS standards with two-step liveness and no image upload, then shards the result so no single node holds a complete record, with a customer-held key and no central honeypot. It complements sanctions screening, which our AML software covers, rather than replacing it. Book a demo.
The bottom line
The Xinbi Guarantee designation is a sanctions story with a KYC core. Marketplaces like it sell the tools that let scam proceeds enter regulated finance: verified accounts, stolen personal data and laundering capacity. Screening the listed wallets is the immediate task. The durable one is building controls that assume identity data has leaked, that successor platforms will appear, and that evidence of genuine ownership matters more than a matching name.
Cited sources
- US Treasury, "Treasury Cracks Down on Transnational Criminal Organization Behind Cyber Scam Operations Targeting Americans", 9 September 2026
- OFAC, Transnational Criminal Organizations Designations, SDN List update, 9 September 2026
- US Attorney's Office, District of Columbia, Scam Center Strike Force seizures of Xinbi, 9 September 2026
- FinCEN, FIN-2026-Alert005, Money Laundering Activity Associated with Digital Asset Investment Scam Centers, 3 September 2026
- FinCEN, news release on nearly 13 billion dollars linked to suspected digital asset scams, 3 September 2026
- UK Foreign, Commonwealth and Development Office, sanctions on Xinbi and scam centre networks, 26 March 2026
- 31 CFR 501.603, reports of blocked, unblocked or transferred blocked property
- 31 CFR 501.604, reports of rejected transactions
- UK Sanctions List, full data file, report dated 11 September 2026
- The Global Human Rights Sanctions Regulations 2020, regulations 25 and 26
Michelangelo Frigo (Co-Founder at Zyphe) Michelangelo Frigo is a privacy and identity infrastructure expert and co-founder of Zyphe.