Takeaways
- New joint FinCEN advisory identifies payroll, tax, and labor-contractor practices that may be associated with unauthorized employment and related fraud.
- Employers using staffing companies and labor contractors should evaluate those relationships in light of the advisory’s red-flag indicators.
- The advisory particularly emphasizes agriculture, construction, domestic service, hospitality, and staffing.
Article
The Financial Crimes Enforcement Network (FinCEN), together with the FDIC, OCC, and NCUA and in coordination with the IRS, issued a joint advisory (FIN-2026-A002) addressing financial risks associated with the unlawful employment of individuals who lack U.S. work authorization. The advisory was issued pursuant to May 19, 2026, Executive Order 14406, “Restoring Integrity to America’s Financial System,” which directed the secretary of the treasury to address risks posed by non-work-authorized populations’ use of the U.S. financial system.
Although ICE did not participate in issuing the June 5, 2026, advisory, FinCEN draws extensively on ICE worksite-enforcement data, making the advisory directly relevant to employers subject to worksite enforcement.
The advisory describes 18 red-flag indicators of potentially suspicious activity and identifies identity theft and payroll fraud as two principal mechanisms used to conceal unauthorized employment. It focuses particularly on agriculture, construction, domestic service, hospitality, and staffing.
For employers, the most significant indicators include:
- Business operations or workforce levels that appear inconsistent with reported payroll;
- Payroll tax payments that are significantly lower than expected based on the employer’s operations;
- Cash or other off-the-books compensation arrangements;
- Labor brokers receiving substantial payments and using shell entities or other mechanisms to distribute worker compensation;
- Labor contractors with little apparent legitimate business activity; and
- Financial institutions identifying a company through ICE worksite-enforcement announcements or other public reporting as having a history of worksite violations.
FinCEN describes schemes in which employers use labor brokers or shell companies to pay workers outside the regular payroll system, potentially avoiding payroll taxes and workers’ compensation obligations. According to FinCEN’s analysis of Bank Secrecy Act (BSA) reporting, financial institutions identified more than $2.5 billion in suspicious activity associated with this type of payroll-tax fraud in 2025.
The advisory also has a third-party risk component. Legitimate staffing companies and labor brokers are not themselves viewed as suspicious. The concern arises where the financial structure, business operations, payment practices, and employment arrangements collectively suggest that a contractor is being used to facilitate off-the-books employment or related fraud.
For employers, several practical questions follow:
- Do payroll records and tax filings accurately reflect the employer’s workforce?
- Are cash compensation and other nonstandard payment practices properly documented and reported?
- Do staffing vendors and labor contractors have legitimate operations and appropriate compliance controls?
- Are responsibilities for employee hiring, Form I-9 completion, payroll, and wage reporting clearly allocated in third-party arrangements?
- Do records maintained by HR, payroll, finance, and procurement identify the same workforce and employment relationships?
The advisory does not modify the Form I-9 rules or establish a new employer immigration obligation. Its primary significance for employers is that financial institutions now have specific federal guidance directing them to identify and report financial activity associated with certain unauthorized-employment schemes — meaning that payroll irregularities, labor-contractor arrangements, or workforce discrepancies may independently trigger Suspicious Activity Report (SAR) filings. FinCEN has asked institutions to use “FINANCIALINTEGRITY-2026-A002” in related SARs, while separately encouraging reports of suspected knowing employment or exploitation of unauthorized workers to ICE.
For employers, the June 2026 advisory reinforces the need to treat worksite compliance as an organization-wide risk-management function — encompassing not only I-9 verification but also payroll integrity, third-party vendor oversight, and financial-transaction transparency — rather than solely an I-9 function.
Please contact a Jackson Lewis attorney with any questions.