FinCEN Files
What were the FinCEN Files, and what did they prove?
The FinCEN Files were more than 2,100 suspicious activity reports (SARs) leaked to BuzzFeed News and shared with ICIJ, published September 20, 2020. They described over US$2 trillion in transactions that banks flagged as suspicious between 1999 and 2017. A SAR is a bank's suspicion, not proof of a crime. The leak showed banks kept moving flagged money, and led to the AML Act of 2020, while the leaker went to prison.
As of September 2026: The Corporate Transparency Act now covers only foreign-formed companies registered in the US, under a final rule effective August 14, 2026. Verify current status before citing it as a working US ownership registry.
What happened?
On September 20, 2020, BuzzFeed News, the International Consortium of Investigative Journalists (ICIJ) and 108 other media partners in 88 countries began publishing the FinCEN Files. The core was more than 2,100 suspicious activity reports, or SARs, which banks file with the US Treasury’s Financial Crimes Enforcement Network (FinCEN) when they see a transaction that looks suspicious. ICIJ said the reports covered more than US$2 trillion in payments that banks deemed suspicious over 18 years.
Before publication, FinCEN issued a statement on September 1, 2020. It said media outlets planned to publish stories based on unlawfully disclosed SARs, called unauthorized disclosure a crime that can affect national security, and said it had referred the matter to the Department of Justice and the Treasury’s Inspector General.
SARs are meant to be secret. Banks file them with the country’s financial intelligence unit, or FIU, and are barred from telling the customer. That secrecy is why the leak was so unusual: outsiders rarely get to see what banks told regulators.
Which techniques did it use?
This case is not a laundering scheme. It is a set of bank warnings about many schemes. The recurring theme ICIJ found was the shell company: banks regularly processed payments for companies registered in secrecy jurisdictions without knowing who the beneficial owner was, and in about half of the reports the bank lacked information about one or more of the entities involved. The shell companies technique explains why that matters.
Another pattern was money moving through large banks that act as correspondent banks, passing dollars for foreign banks whose customers they never meet. ICIJ reported that Deutsche Bank alone flagged US$1.3 trillion in suspicious transactions between 1999 and 2017.
How was it found?
A government insider took the reports out. ICIJ identified the source as Natalie Mayflower Sours Edwards, a senior adviser at FinCEN. The Justice Department said she passed SARs and other sensitive files to a reporter between October 2017 and her arrest in October 2018. Journalists then spent 16 months organizing the material and adding thousands of other documents, court records and interviews.
What was the outcome?
What the leak showed. ICIJ reported that five banks, JPMorgan Chase, HSBC, Standard Chartered, Deutsche Bank and Bank of New York Mellon, kept moving money for suspect clients after earlier penalties and promises to reform. Examples it cited include more than US$1.2 billion moved for the financier Jho Low between 2013 and 2016, in connection with the 1MDB scandal.
What it did not show. ICIJ was clear that SARs “are not considered to be and do not purport to be proof of any violation of the law.” A SAR records a bank’s concern. A bank that files one is doing what the law asks. Many reported transactions may be innocent, and the leaked set is small next to the more than 2 million SARs FinCEN receives each year. The stronger finding was about the system: reports were filed, yet the money often kept moving.
The leaker. Edwards was sentenced on June 3, 2021 to six months in federal prison for conspiring to disclose SARs. She reported to prison in September 2021 and said her motive was accountability.
Why it matters for the public. The files gave a rare look at how the reporting system works in practice. Banks act as the first line of defense and file the reports. Government staff then decide which ones to pursue. If reports pile up without action, the filing itself protects no one, which is the gap ICIJ pointed to.
What were the warning signs?
The reports themselves list what compliance staff watch for:
- Payments to or from companies whose owners the bank cannot identify.
- Customers in secrecy jurisdictions with no clear business reason.
- Large flows through accounts of politically exposed persons or their associates.
- Continued activity after a bank’s own alerts, which suggests a bank kept a client it should have questioned.
- Repeated SAR filings on the same customer with no visible follow-up.
Most of these are reasons to look closer, not proof of laundering.
What changed afterwards?
Lawmakers cited the leak as they moved reform. On January 1, 2021, Congress overrode a presidential veto of the defense bill, and its Division F, the Anti-Money Laundering Act of 2020, became law. It was described as the most significant revision of US anti-money laundering law since the USA PATRIOT Act of 2001. It included the Corporate Transparency Act, a whistleblower program, and yearly reporting on deferred prosecution agreements. After the leak, Treasury also asked for public comment on updating the Bank Secrecy Act and received 110 submissions.
The registry has since been narrowed. Treasury exempted US companies in 2025, and a final rule announced August 11, 2026 made that permanent, so only foreign-formed companies registered in the US report foreign owners. See the detection overview for how reporting is meant to work.
Frequently asked questions
What is a suspicious activity report?
A SAR is a confidential report that a US bank or other financial institution must file with FinCEN, the Treasury's financial intelligence unit, when it spots a transaction that looks suspicious. Under the Bank Secrecy Act, banks cannot tell the customer, and government employees who willfully disclose a SAR commit a felony.
Did the FinCEN Files prove that the banks committed crimes?
No. A SAR reflects the concern of a bank's own compliance staff. Filing one is what the law requires. ICIJ's finding was different: that banks kept moving flagged money for some clients and that authorities did too little with the reports.
What happened to the leaker?
Natalie Mayflower Sours Edwards, a former senior adviser at FinCEN, was sentenced to six months in prison and three years of supervised release. She has said her motive was accountability. ICIJ identified her as the source of the files.
What is the Corporate Transparency Act's status now?
The law passed in 2021 as part of the AML Act of 2020. Since 2025 Treasury has narrowed it, and a final rule announced August 11, 2026 exempts US-formed companies. Only foreign-formed companies registered in the US must report beneficial owners who are not US persons.
Techniques used in this case
- Shell companies and nominees · Companies with no real operations hold accounts and assets while nominee directors and stacked ownership across jurisdictions hide the true beneficial owner.
Related cases
- Panama Papers · A 2016 leak of 11.5 million files from Mossack Fonseca exposed 214,488 offshore entities and showed how shell companies hide who owns what.
- HSBC and the Sinaloa cartel · Weak controls let Mexican and Colombian cartels move at least $881 million in drug money through HSBC, which paid a then-record $1.92 billion in 2012 to defer prosecution.
- 1MDB · More than US$4.5 billion was diverted from Malaysia's state fund through offshore shell companies into luxury property and Hollywood films, toppling a prime minister and costing Goldman Sachs billions.
- Danske Bank Estonia · About €200 billion flowed through the Estonian branch of Denmark's biggest bank between 2007 and 2015, much of it suspicious non-resident money hidden behind UK shell companies.
Glossary
Sources
- What is the FinCEN Files investigation? (ICIJ, September 20, 2020).
- Global banks defy U.S. crackdowns by serving oligarchs, criminals and terrorists (ICIJ, September 20, 2020).
- Statement by FinCEN Regarding Unlawfully Disclosed Suspicious Activity Reports (FinCEN, September 1, 2020).
- Former Senior FinCEN Employee Sentenced To Six Months In Prison For Unlawfully Disclosing Suspicious Activity Reports (US Attorney's Office, Southern District of New York, June 3, 2021).
- As reforms sparked by FinCEN Files roll out a year on, key source is behind bars (ICIJ, 2021).
- Here's what is changing after the FinCEN Files shook the world of banking (ICIJ, 2020).
- Congress Overrides President's Veto, Clearing Way for Anti-Money Laundering Act (Ropes & Gray LLP, January 2021).
- FinCEN Permanently Ends Beneficial Ownership Reporting Requirements for Millions of Small Business Owners (US Department of the Treasury, August 11, 2026).