FinCEN just told banks how charities get abused. Here’s the check every grantmaker should run before the next payment.

On October 30, the Treasury Department’s Financial Crimes Enforcement Network (FinCEN) issued Notice FIN-2026-NTC2 on the use of charities and nonprofits for illicit activity. It is addressed to banks and other financial institutions, and it asks them to tag related suspicious-activity reports with the key term “FIN2026NPO.”

Grantmakers aren’t the audience, but they should read it anyway. The notice is a clear, current summary of how charitable money gets diverted, and most of its warning signs are things a funder can check before a grant goes out.

What the notice says

FinCEN sorts nonprofit abuse into three categories:

• Sham charities: organizations presented as legitimate that actually exist to move money elsewhere, in the most serious cases to terrorist groups.
• Nonprofit fraud: organizations run to enrich insiders, often by soliciting donations or government funding for services they don’t provide.
• Embezzlement: insiders at real organizations diverting funds for personal use.

The notice is careful on one point that matters for the sector: “the vast majority of U.S.-based NPOs present a low risk,” and the government doesn’t view the sector “as a whole” as high-risk. FinCEN asks institutions to evaluate “each NPO individually” instead of cutting nonprofits off wholesale. In other words, the expectation is risk-based checking, not blanket suspicion.

The red flags a grantmaker can actually check

Many of FinCEN’s red flags depend on bank-transaction data a funder never sees. But several can be checked from public records before a grant is paid:

• Little or no physical or online presence: a P.O. box, a residential address, an address shared by many nonprofits, or “no website or a dated or generic website.”
• A name similar to a well-known nonprofit with no apparent affiliation.
• Not registered with the relevant state regulator, or unable to verify its legal status.
• Officers or signatories with previous fraud convictions.
• A recently established organization that suddenly receives a large volume of donations or government payments.
• An organization focused on U.S. services that sends significant funds abroad.

The check that’s missed most often: IRS status

The most basic question about a grantee is whether it is still a tax-exempt organization. Any organization that fails to file a Form 990-series return for three years in a row loses its exemption automatically, without a hearing. This happens at a scale most funders don’t realize.

We matched every grant reported on 2023 Form 990 and 990-PF filings against the IRS revocation list. About 4,000 grants totaling roughly $45 million, made by about 1,400 funders to about 2,800 organizations, went to recipients whose revocation had been publicly posted before 2023 began and who weren’t reinstated by the end of that year.

Most of these grants were small: the median was $200. That’s the point. Large grants get reviewed; small, routine and renewal grants often go out on autopilot. But a grant to an organization that is no longer exempt can create real problems. For a private foundation, it may be a taxable expenditure unless expenditure-responsibility procedures were followed. For any funder, it’s money sent to an organization that has, at minimum, stopped meeting its most basic filing obligation.

Scrutiny is rising

The FinCEN notice arrives alongside other signs of closer attention to nonprofits. The IRS is reportedly considering an annual disclosure for organizations whose senior leaders have recent fraud, money-laundering or terrorism-related convictions; the proposal isn’t final. Lawmakers have asked the IRS to review the exemptions of specific organizations. Whatever one thinks of the politics, funders should expect more questions about what they checked, and when.

The 10-minute pre-payment check

None of this needs a compliance department. Before each payment, and not only at approval, a funder can confirm:

1. IRS status. The organization appears in the IRS Business Master File, isn’t on the automatic revocation list, or has been reinstated.
2. Deductibility. It’s listed in IRS Publication 78 as eligible to receive tax-deductible contributions, under the right status.
3. Sanctions. Neither the organization nor its officers match the OFAC Specially Designated Nationals list or Treasury’s other sanctions lists.
4. State standing. It’s registered and in good standing where required, and not on a state attorney general’s delinquent list (for example, California’s).
5. Recent filings. The latest 990 is recent, and its programs, leadership and finances match what the organization told you.
6. Identity. You matched by EIN, not by name. Look-alike names are a known abuse pattern.
7. Presence. The address, website and leadership make sense for an organization of this size and mission.
8. Geography. Funds sent abroad match the organization’s stated activities.

Then keep watching. Revocations, leadership changes and sanctions designations happen between grant cycles. A check at approval is a snapshot; ongoing monitoring tells you what changed before you pay.