blockintAI · Research blog

FATF's New Scam Compound Report: What It Says About Crypto, USDT on TRON, Guarantee Markets and the 24–72 Hour Window

BlockintAI · 2026-11-05T15:21:33.898Z

On Thursday, November 5, 2026, the Financial Action Task Force (FATF), the global standard-setter for anti-money-laundering rules, published Combating End-to-End Illicit Financial Flows Linked to Scam Compounds. The 90-page report follows the money through scam compounds, from recruiting workers and victims to cashing out and reinvesting. Alongside it, FATF released a set of principles for countries.

The report covers banks, mules, cash, telecoms and social media as well as crypto. This post pulls out what it says about virtual assets, because that's where most pig-butchering money ends up.

Key facts
Published November 5, 2026 (FATF, Paris)
Led by United Kingdom and United States, with a project team from all FATF regions plus observers such as INTERPOL, UNODC, Europol and the IMF
Evidence base A questionnaire answered by 60 jurisdictions and almost 120 case studies and good practices from more than 60 jurisdictions, FATF says
Scale Fraud estimated at about USD 500 billion a year worldwide; scam compound losses "estimated to be in the tens of billions of USD" a year
People People from at least 80 countries and territories identified in Southeast Asian scam compounds; at least 120,000 people across Myanmar may have been forced to carry out online scams (2023 estimate the report cites)
Main fraud type "Investment fraud, often preceded by romance or confidence-based grooming", including "fake online trading schemes using fabricated dashboards, apparent initial returns and obstructed withdrawals"

What the report says about crypto

Virtual assets are central. The report says that "VAs remain a central ML channel for scam compound proceeds". It lists offshore exchanges, peer-to-peer transfers, OTC brokers and crypto ATMs as channels "repeatedly identified" in scam compound cases.

USDT on TRON stands out. Citing UNODC, the report says USDT issued on TRON is "particularly prominent in scam-related laundering", because it is widely available, liquid, relatively stable in price and usable across crypto platforms, wallets and jurisdictions. It also describes Telegram-advertised "U-merchants" that swap USDT, other crypto and cash for launderers, "through arrangements that may bypass standard know-your-customer (KYC) controls".

OTC desks inside compounds. Countries reported "dedicated OTC counters" operating inside compounds for crypto exchange and domestic transfers. The report says this shows the conversion step "may in some cases be physically embedded within compound operations rather than wholly outsourced".

Speed. Wallet-to-wallet and crypto transfers can move funds onward "within minutes, in some reported cases within two minutes". The report's laundering stage lists stablecoins, DeFi bridges, mixers, chain-hopping, crypto ATMs and online gambling as ways to hide the trail.

Cash still matters. In the questionnaire, cash was the most widely observed channel linked to scam compounds, followed by informal transfer services and underground banking. Crypto is central, but it isn't the only route out.

Guarantee markets and a stablecoin built to dodge freezes

Two boxes in the report deal with infrastructure that BlockintAI has written about before.

  • Box 4, guarantee marketplaces. The report describes the September 2026 US action against Xinbi Guarantee, a Chinese-language Telegram marketplace. It says US authorities seized Telegram channels and wallets and restrained more than USD 52 million tied to Xinbi and its vendors, and that the US Treasury reports Xinbi processed more than USD 24 billion since around 2022. The report adds that "criminal activity shifted towards Xinbi following US action against Huione Pay". BlockintAI's earlier post on the sanctioned Xinbi wallet follows that money on TRON.
  • Box 3, a freeze-resistant stablecoin. The report describes a Cambodia-based conglomerate that launched its own USD-backed stablecoin, "promoted as resistant to freezing", together with its own blockchain, wallet, exchange and payment services. It says FinCEN in June 2026 extended its restriction to H-Pay Service PLC and future successor entities. FATF calls this "a unique documented case rather than evidence of a broader trend".

Freezes work, and recovery is harder

The report's case examples show freezing at the stablecoin issuer can reach self-custody wallets:

  • Brazil. Authorities gathered transaction IDs from victims through an open online form. A centralised stablecoin issuer then froze "approximately 1.43 million USDT across about 60 addresses associated with self-custody wallets". Brazil confirmed in September 2026 that the addresses were still blacklisted, "although no subsequent confiscation or restitution was reported".
  • Namibia and Seychelles. Tracing linked part of the proceeds of a suspected Namibia-based operation to two exchange accounts associated with Seychelles. That led to account restriction and a Namibian forfeiture order covering 112,334.50 USDT.
  • China. Two professional laundering gangs serving compounds in Myanmar's Kokang region converted proceeds between cash and USDT. Police established that more than RMB 400 million (about USD 59.6 million) was laundered and ultimately recovered RMB 370 million (about USD 55.1 million).

FATF's principle on speed is blunt: "the first 24–72 hours after detection or reporting are particularly important for tracing, recovery and restitution."

The principles, in plain terms

FATF's new principles ask countries to:

  • Target the wider network, not just the building: leaders, recruiters, launderers and service providers.
  • Disrupt the money end to end, before and after victims pay.
  • Connect the networks: banks, crypto services, tech, telecoms and authorities sharing what each one sees.
  • Act fast across borders, inside that 24–72 hour window.
  • Put victims at the centre, both scam victims and people trafficked into compounds.
  • Adapt and measure outcomes, because operations "decentralise, relocate, rebrand and replace disrupted infrastructure", including "changing domains and new payment channels".

What this means on the ground

That last principle describes what BlockintAI sees every day. Fake trading sites change domains constantly, while the wallets behind them often stay the same. A BlockintAI report filed today lists deposit addresses shown on four fake trading sites. One of them, on a domain registered October 30, 2026, has been receiving USDT since June 2023. BlockintAI has also followed the FXO fake broker across 14 domains.

For victims, the report's message is about speed. Report fast, and include the transaction hashes and the addresses you paid. Brazil's case shows that victim-supplied transaction IDs were what let authorities reach the issuer.

Sources

Lost money? Report it to IC3 (FBI) at ic3.gov and the FTC at reportfraud.ftc.gov, and file at https://blockint.ai/c3?mode=file