Treasury takes on the scam economy’s service layer

This Week in Financial Crime

Two threads run through the week, and each targets a layer of the system that end-user enforcement rarely reaches. The first is the horizontal service economy that scam ecosystems depend on: the marketplaces, escrow layers, and cross-border launderers that make individual frauds fungible and repeatable. Treasury's designation of the Xinbi Guarantee marketplace, alongside a same-day Scam Center Strike Force operation, moves the enforcement frontier from scammer to enabler and continues the “guarantee marketplace” framing FinCEN opened last week. The second is the aviation corridor as a sanctions frontier. Operation Economic Outcast expanded from bank designations into a comprehensive grounding of the entire Iranian commercial aviation network and its UAE, Turkish, Malaysian, and Kazakh general sales agents. Both moves are, in effect, situational crime prevention scaled to the transnational service economy: raise the cost of the enabling layer and the downstream frauds become harder to run.

Xinbi Guarantee Marketplace: Treasury attacks the horizontal service layer

On 9 September, OFAC designated Xinbi Guarantee, SafeW Technology and Anwen Technology under the newly amended cyber-enabled sanctions authority, while the Scam Center Strike Force restrained approximately $52 million in stablecoins in a single day. The Chainalysis analysis places Xinbi's throughput since 2022 at roughly $24 billion in digital assets and fiat, with 52 designated wallets alone receiving more than $8.4 billion in stablecoins. Vendors within Xinbi's ecosystem laundered proceeds from the $1.5 billion Bybit breach and the $235 million WazirX theft, and moved tens of millions on behalf of DPRK-linked actors using a technique the analysis names “Black U”, which swaps traceable stolen crypto for stablecoins earned from pig-butchering and romance-scam operations. On 7 September, DOJ separately seized the marketplace's Telegram channels under a federal court warrant.

The criminological point is structural. Xinbi is not a scam, it is the horizontal service that scams buy. Guarantee marketplaces solve the trust problem that would otherwise limit collaboration between geographically dispersed offenders: escrow, vendor rating, dispute resolution. In situational crime prevention terms, Treasury has removed a key facilitator rather than a proximate offender. The design consequence is that Xinbi's vendors do not simply pause, they migrate; the strategic question is whether the successor marketplaces inherit the same wallet infrastructure and vendor list, in which case designation cascades follow easily, or whether they fragment into smaller, harder-to-designate services. FinCEN's parallel treatment of “Guarantee Marketplaces” as a distinct typology suggests the enforcement architecture is being built with that fragmentation in mind.

Operation Economic Outcast: grounding the Iranian aviation network

On 8 September, Treasury sanctioned 36 targets across Iran's commercial aviation network, designating 27 Iranian airlines under E.O. 13902, suspending three aviation-related authorisations, and adding third-country enablers in the UAE, Türkiye, Egypt, the UK, Malaysia, and Kazakhstan. The designations catch the Mahan Air network, Air Shiraz, Ata Airlines, Iran Air Tour, Qeshm Air, and Zagros, alongside general sales agents such as ECT Aviation Support LLC (UAE), Sky Phoenix (Türkiye), Aerobravo Airplane Management (UAE), Icargo SDN BHD (Malaysia), and Tour Invest LLC (Kazakhstan). Treasury notes that Mahan Air received at least three Boeing 777 aircraft in summer 2026 via UAE and Omani intermediaries. FinCEN issued a concurrent alert, FIN-2026-Alert006, directing financial institutions to identify and report Iranian aviation procurement networks. Two days later, OFAC modified its Iran-related specific licensing policy to a presumption of denial except where legally required or where risk to life, limb, or environmental safety applies, tightening the administrative funnel around any residual authorised activity.

The move follows displacement theory almost precisely. Prior enforcement pressure on Iranian banking pushed illicit value onto aviation as a mobile physical corridor, and Treasury has now closed that corridor at both the airline and general-sales-agent layer. The alert is the operationally significant part: by naming the enablement patterns, FinCEN converts the designations into ongoing SAR obligations for any US-touching institution, which raises the reputational and correspondent-banking cost of the third-country intermediaries even before secondary designations arrive. The strategic risk is that aviation displacement into truly closed maritime or overland corridors becomes the next node, particularly where sanctioned tonnage can be routed through Central Asia.

Scam Center Strike Force expands to Madagascar

The Xinbi action was not the whole of the week's Strike Force activity. On the same day, the Scam Center Strike Force targeted 13 scam compounds in Madagascar, extending its geographic footprint beyond Southeast Asia. This matters because scam-compound operators have consistently displaced across national borders in response to enforcement pressure, and Madagascar signals the establishment of a second-tier hub with weaker institutional capacity to prosecute. From a routine activity standpoint the compound model is portable: the essential inputs are cheap real estate, coerced or migrant labour, and reliable payment rails, and each of those is available in multiple jurisdictions. The corollary is that infrastructure-level disruption at the guarantee-marketplace layer will do more sustained damage than a compound raid because it degrades the shared services all compounds rely on.

India's FIU issues PMLA notices to 15 offshore crypto platforms

On 9 September, India's Financial Intelligence Unit issued Section 13 notices to 15 offshore virtual digital asset service providers for non-compliance with the Prevention of Money Laundering Act, and sought application and website takedowns. The Press Information Bureau confirms the action, which targets smaller platforms rather than the household names. The compliance architecture is the same as FinCEN's, in that the state defines a domestic perimeter and treats offshore VASPs as either registered or excluded, with no third option. The interesting criminological question is whether this pushes Indian users towards fully unregulated peer-to peer venues, which would fragment the market and complicate BSA-equivalent reporting rather than consolidate it. Regulatory design that closes visible venues without a legitimate substitute typically produces exactly this displacement.

SEC charges $16M affinity Ponzi targeting the Ghanaian diaspora

On 10 September, the SEC charged Ernest Ossei Boateng and two New Jersey companies with running a $16 million Ponzi scheme targeting Christians of Ghanaian heritage in New York and New Jersey. The complaint alleges Boateng promised guaranteed fixed returns and a low-risk strategy, misappropriated $5.8 million for personal use, made $6.6 million in Ponzi-style repayments, and lost more than $750,000 in speculative day trading. This is a textbook affinity fraud in the Madoff mould: shared religious and ethnic identity substituted for due diligence, and community trust functioned as the primary marketing channel. The pattern points to the “shadow” of social capital documented in the criminological literature, in which the same dense in-group ties that enable pro-social cooperation also enable within-group predation. Prevention is difficult precisely because the trust structure is itself the vulnerability, and community-based education has to compete with community-endorsed credibility signals.

New Research Worth Reading

Rasmus Munksgaard (2024), Marketness and Governance: A Typology of Illicit Online Markets, in Deviant Behavior. Munksgaard builds a two-axis typology, marketness and administrative governance, that separates illicit online markets by how deeply they use market mechanisms and how much platform-level rule enforcement they impose. Directly applicable to reading Xinbi Guarantee as a high-governance, high-marketness node rather than a plain marketplace, and helpful for anticipating which successor architectures displaced vendors will migrate towards.

Fabian Teichmann (2026), Organized Crime in the Digital Age: The Convergence of Traditional and Cybercrime Networks, in International Criminology. A framework paper identifying three convergence vectors between traditional organised crime and cybercriminal networks, including darknet marketplaces and the crime-as-a-service economy. Directly relevant to the guarantee-marketplace typology now being sanctioned.

Diana Bociga, Elisa Bellotti and Nicholas Lord (2025), The Network Architecture of Anti-money Laundering: Strategic and Tactical (Dis)Connections in the UK's Policy, Supervision, and Enforcement Landscape, in The British Journal of Criminology. Uses social network analysis on the UK AML regime to expose structural disconnections between policy, supervision, and enforcement. Useful counterpoint to the outward-facing enforcement wave, given that most of the described disconnections apply equally to US, EU, and Australian regimes.

What I Am Watching

• Whether the FinCEN aviation alert triggers a second wave of general-sales-agent designations in the coming weeks, particularly across Kazakhstan and Malaysia where Treasury has now identified named enablers.
• Whether Xinbi's designated wallet cluster shows migration into a successor marketplace, which would allow the Strike Force to run designation cascades along the same vendor list.
• How Indian users respond to the FIU's offshore platform action, and whether volume moves to peer-to-peer venues rather than to compliant domestic exchanges.
• The scope of the next tranche of Iran-related designations under the new presumption-of-denial licensing policy, which effectively converts the specific-licence regime into a compliance signal rather than an operational channel.