FinCEN's Iranian Charity Alert: How to Detect Khums Diversion Without Debanking Legitimate Nonprofits

TL;DR

• On October 15, 2026, FinCEN issued Alert FIN-2026-Alert008 on Iranian abuse of religious charity networks, including diversion of khums payments through cash couriers and informal channels.
• FinCEN gives institutions four red flags and asks relevant SARs to use FIN-2026-IRANCHARITYABUSE in field 2 and the narrative.
• The control challenge is detecting rapid donation pass-throughs, unexplained cash conversion, and structuring without treating every religious charity or nonprofit as suspicious.
• BSA Officers should produce a documented coverage map, targeted customer review, investigator guidance, and SAR QA test—not a blanket nonprofit restriction.

FinCEN’s Iranian charity alert is a transaction-monitoring assignment wrapped in a three-page document. The hard part is not adding another SAR keyword. It is separating legitimate religious giving from a pattern in which donations move rapidly through nonprofits, become cash, and leave the regulated financial system.

FinCEN issued Alert FIN-2026-Alert008 on October 15, 2026 as part of Treasury’s Operation Economic Outcast. The alert focuses on potential Iranian abuse of religious charity networks, including diversion of khums—the Shi’a practice of donating one-fifth of surplus annual income to support religious and social purposes.

That qualifier matters. FinCEN explicitly recognizes the legitimate role of khums and tells institutions that one indicator alone is not determinative. This is not permission to code “religious nonprofit” as a prohibited customer type. It is a request to identify combinations of behavior that do not fit the customer’s stated purpose or historical activity.

What FinCEN’s Iranian charity alert actually says

The alert draws from Bank Secrecy Act data, open-source reporting, and law-enforcement information. It describes two earlier Treasury actions to establish the threat:

• In November 2020, OFAC designated the Islamic Revolution Mostazafan Foundation, or Bonyad Mostazafan. Treasury described it as an ostensibly charitable conglomerate whose holdings benefited Iran’s Supreme Leader and his network.
• In March 2020, OFAC designated the Reconstruction Organization of the Holy Shrines in Iraq. Treasury said the organization transferred millions of dollars to an IRGC-Qods Force-controlled company used for Iranian intelligence activity and weapons shipments to militias.

FinCEN then points to a U.S. criminal case that shows what the payment chain can look like. In May 2024, Muzzamil Zaidi and Asim Mujtaba Naqvi pleaded guilty to conspiracy and violations of the International Emergency Economic Powers Act. According to the Justice Department’s release, they collected tens of thousands of dollars—including khums and donations presented as aid for Yemen—and arranged to move the money to Iran without required OFAC licenses.

The operational detail is the useful part: DOJ said they enlisted friends, relatives, and associates to carry cash in amounts below $10,000. One transfer involved 25 travelers headed to Iraq on religious pilgrimage, who then hand-carried dollars to Iran.

A name-screening system would not necessarily catch that. The customers making sub-$10,000 withdrawals may not be designated. The charitable purpose may sound plausible. The control signal sits in the relationship among the donation source, nonprofit account, cash withdrawal, travelers, timing, and ultimate destination.

The four red flags—and the data each one needs

FinCEN provides four indicators. None works well as a stand-alone alert. Each requires customer context.

The third row needs special care. FIN-2026-Alert008 cites the agencies’ October 9, 2025 SAR FAQs, which say that activity at or near the $10,000 CTR threshold is not enough on its own. The institution must know, suspect, or have reason to suspect that the transactions were designed to evade reporting.

That means a rule such as “cash withdrawal between $9,000 and $9,999” will generate a pile of low-value cases. A stronger scenario combines repeated sub-threshold cash activity with a canceled or altered transaction, multiple locations, related customers, or a material deviation from expected account behavior.

The control perimeter is wider than the nonprofit account

A common implementation mistake is to monitor only accounts coded as charities. FinCEN’s fourth indicator explicitly reaches a recipient of nonprofit funds who converts the money to cash or sends it onward. The employee, contractor, traveler, fundraiser, or intermediary may hold a personal or commercial account at the same institution.

The detection design should therefore connect:

1. nonprofit-originated transfers;
2. recipient identity and known relationship to the organization;
3. time from receipt to cash withdrawal or onward transfer;
4. aggregate cash behavior across branches and channels;
5. destination, counterparty, and sanctions exposure; and
6. prior alerts, SARs, subpoenas, or negative information relevant to the parties.

This is where ownership gets messy. Customer Risk owns the nonprofit profile. Transaction Monitoring owns the scenarios. Sanctions owns OFAC escalation. Branch Operations may hold the notes showing that a customer changed a transaction after hearing about CTR reporting. If those artifacts remain in separate systems, the investigator sees four ordinary events instead of one suspicious chain.

The BSA Officer should assign one accountable owner for the coverage assessment, but the evidence must come from all four functions. A memo that says “existing monitoring covers the alert” is not evidence. A defensible file maps each FinCEN indicator to data fields, rules, manual procedures, owners, test cases, and identified gaps.

Do not turn an Iran alert into blanket nonprofit de-risking

FinCEN closes the alert by reiterating that legitimate charities should have access to financial services. Its 2020 joint fact sheet with the federal banking agencies says the U.S. government does not treat the charitable sector as uniformly or unacceptably high risk. Banks should develop customer profiles using a risk-based approach.

FATF makes the same point in its 2023 best-practices paper on nonprofit organizations: controls should be focused and proportionate, protecting organizations from terrorist-financing abuse without unduly disrupting legitimate work.

For a nonprofit with elevated cross-border exposure, proportionate CDD might include:

• the organization’s legal status, governance, and controlling officials;
• its stated mission, beneficiary populations, and operating geographies;
• expected donation methods, fundraising cycles, and major donor concentration;
• expected grant recipients, partner nonprofits, contractors, and payment corridors;
• policies for cash, couriers, hawala, and other informal value-transfer mechanisms;
• sanctions screening for officials, counterparties, and relevant ownership or control; and
• documented refresh triggers when activity changes materially.

The key is tying diligence to actual exposure. A domestic food pantry with local card donations and payments to grocery suppliers presents a different profile from an organization collecting large cross-border donations, transferring funds to several foreign nonprofits, and reimbursing travelers in cash. Customer category alone cannot make that distinction.

This also connects to the larger Operation Economic Outcast control problem. The site’s analysis of the A7 Network alert and proposed rejection rule covers opaque sub-agents and payment infrastructure. The earlier Iranian aviation alert breakdown focuses on procurement fronts. FIN-2026-Alert008 adds a different channel: legitimate-looking charitable collection followed by diversion through people, cash, and informal settlement.

What a good alert disposition looks like

Investigators need a structured conclusion, not “activity appears consistent.” For a case involving nonprofit inflows and cash withdrawals, the disposition should answer:

• What was expected? State the customer’s documented mission, expected fundraising pattern, beneficiaries, geographies, and normal cash use.
• What changed? Quantify the donation spike, concentration, new counterparties, cash conversion, or onward transfers.
• Who are the parties? Document the relationship among the nonprofit, donor, recipient, officer, contractor, traveler, and foreign counterparty.
• What did sanctions review find? Record screening results, ownership/control analysis, and whether OFAC’s Disclosure Portal should be used for a potential violation.
• Why is the behavior explainable or suspicious? Tie the conclusion to the totality of facts—not one keyword, geography, religion, or dollar amount.
• What happens next? Record SAR, no-SAR, account restriction, enhanced monitoring, CDD refresh, or law-enforcement escalation decisions with named approvers.

If a SAR is filed because the activity relates to this alert, FinCEN asks for FIN-2026-IRANCHARITYABUSE in SAR field 2. The alert’s opening filing request also says to include the term in the narrative. The site’s SAR narrative guide can help investigators turn the chronology, parties, amounts, and control rationale into a usable filing rather than a data dump.

A 30-day implementation plan

Avoid invented universal thresholds. A workable starting point is to calibrate donation spikes, pass-through speed, and cash conversion against the institution’s own prior three to six months of nonprofit activity, then document why the selected thresholds distinguish unusual behavior. Validate that source transactions actually create cases; otherwise a clean dashboard may only prove that the data feed is incomplete.

So what?

The important sentence in FIN-2026-Alert008 is not the SAR keyword. It is FinCEN’s instruction to evaluate the totality of the facts while preserving legitimate charities’ access to financial services.

By Monday morning, the BSA Officer should ask for one artifact: a four-row coverage matrix matching each FinCEN red flag to data, detection logic, investigator steps, owners, and test evidence. That document will expose whether the institution can connect donation inflows to recipients and cash movement—or whether its controls stop at the nonprofit account boundary.

For teams refreshing documented customer, geography, channel, and sanctions exposure, the AML/BSA Risk Assessment Template provides a scored framework and control inventory instead of another unowned alert memo.

Sources

• FinCEN, Alert FIN-2026-Alert008, October 15, 2026
• FinCEN announcement, October 15, 2026
• U.S. Department of Justice, “Scheme to Transfer Money to Iran Results in Guilty Pleas,” May 1, 2024
• FinCEN and federal banking agencies, charity and nonprofit CDD fact sheet, November 19, 2020
• FATF, Best Practices on Combating the Abuse of Non-Profit Organisations, November 2023