The Financial Action Task Force (FATF) published a report on November 5 examining the financial flows behind scam compounds, alongside a set of principles for disrupting them. The FATF is the intergovernmental body that sets the anti-money-laundering standards member governments commit to implementing, which makes its reports working references for regulators, banks and cryptocurrency platforms rather than binding law. Its findings include dedicated cryptocurrency exchange counters operating inside some compounds, a wallet cluster tied to Myanmar's KK Park compound that drew more than $100 million in victim inflows, proceeds moved onward within two minutes in documented cases, and more than 515,000 scam-linked accounts blocked in Indonesia.

A Dealer's Counter Behind the Compound Walls

FATF found dedicated over-the-counter (OTC) counters inside some of the compounds, offering cryptocurrency exchange services and domestic fund transfers. In an OTC arrangement, a dealer executes the swap directly rather than matching orders on a public trading platform. The report does not claim that every compound operates one, and it does not identify the owners of the counters it documented.

The counter's location reshapes the paper trail. When cryptocurrency is converted into spendable money on site, that conversion does not have to pass through a platform obligated to identify its customers and report suspicious activity. The money still moves, but the records a regulated exchange would have kept may never come into existence.

The counters form one component of a broader structure. FATF characterizes scam compounds as networked criminal infrastructure: large physical sites, smaller decentralized cells and specialized service providers, tied together through common controllers. The report documents compounds or related activity across Africa, Europe, the Americas and Asia, and estimates annual victim losses in the tens of billions of dollars.

KK Park: A Trail That Began With Ransom Payments

One FATF case study centers on KK Park, a compound in Myanmar. Drawing on work by Chainalysis, a blockchain-analytics firm, and International Justice Mission (IJM), a human-rights nonprofit that works against violence and trafficking, the report links a wallet cluster — a group of addresses analysts attribute to a single controller — to the compound, and reports more than $100 million in victim inflows traced through laundering networks toward the points where cryptocurrency is converted into usable cash.

The trail's starting point was not on the blockchain. In Chainalysis' earlier public investigation, IJM supplied two addresses that families had been told to pay to free trafficked relatives; both were also linked to known scam wallets. That earlier analysis counted just under $100 million flowing into the two addresses, though it could not separate scam proceeds from ransom. FATF's figure covers a wider cluster. Neither number represents a current balance or an amount returned to anyone.

The overlap says something about who works inside. Ransom paid for trafficked people landed in the same wallets as money taken from scam victims, pointing to a single operation that both detains people and runs the fraud. The U.S. Treasury describes the Prince Group network in similar terms, saying many of its operations are linked to compounds that rely on trafficked and coerced workers. Pursuing organizers and beneficiaries, the report notes, has to come with protection for the people forced to do the scamming.

Wallet links carry inherent limits. An on-chain connection shows that funds moved between addresses; it does not show that every exchange or intermediary along the route knew what it was handling.

Why Every Institution Sees a Clean Transaction

A typical victim payment illustrates the detection problem FATF describes. A person buys real cryptocurrency on a regulated exchange and withdraws it to an address supplied by a supposed adviser. The bank transfer, the purchase and the withdrawal can all be genuine and personally approved, while the platform displaying the investment's growth is fake. The exchange's checks confirm who the buyer is — not whether the adviser is honest. Investigators group schemes of this shape under the label 'pig butchering' — a term Chainalysis used in the investigation cited above — describing frauds in which victims are groomed over time into sending money to what presents itself as an investment platform.

Each participant holds one fragment of the picture. The victim has the messages and the website; the bank has the transfer; the exchange has the identity checks and the withdrawal address; and the mobile operator may know the customer was on a call while approving the payment. In FATF's assessment, institutions see apparently legitimate transactions unless someone passes them the surrounding fraud indicators.

The GSMA, the global trade association of the mobile industry, connects operators and banks through its Scam Signal initiative, joining two of those fragments before the money leaves. It links mobile-network indicators to banks' fraud checks, allowing a bank to weigh whether a customer approving a transfer may be under a scammer's influence. A call is not proof of fraud, and the system does not require banks to receive what was said on it.

Two Minutes to Move, 72 Hours to Act

Speed sets the limits on all of this. FATF documents cases in which proceeds moved onward within two minutes, and its principles single out the first 24–72 hours after an incident is detected or reported for rapid cross-border action. That window is a reason to coordinate quickly — not a promise of recovery, nor a cutoff after which reporting becomes pointless.

Tracing the route and stopping the money are separate powers, and they sit with different parties:

Freezing funds also does not settle who gets them back. Ownership and restitution run on a separate track, as Coindoo has examined in its look at why seized scam funds can take time to reach victims.

What to Hand Over If You Have Been Targeted

The FBI's cryptocurrency-scam guidance asks victims for evidence that ties the payment to the deception: transaction hashes, wallet addresses, cryptocurrency type, amounts and timestamps; the exchanges or other services used to send funds; scam websites, applications, messages, phone numbers and account identifiers; and a timeline showing how contact began and how payment instructions were supplied.

Victims should contact the bank or exchange first, since those are the parties able to hold funds, then report to the authorities. In the United States, that route is IC3, the FBI's Internet Crime Complaint Center; elsewhere, it is usually the national police. The FBI encourages reports even when transaction details are incomplete, and warns that services offering to recover lost crypto can themselves be a second scam.

Where FATF Says the Response Is Weaker

FATF's own assessment is that countries are currently more effective at the downstream end — victim payments, proceeds and asset tracing — than at the infrastructure behind them. Indonesia's Anti-Scam Centre illustrates what the downstream end can produce: more than 515,000 accounts blocked and roughly $10.9 million returned to victims between November 2024 and May 2026.

The upstream problem surfaced in a U.S. action taken the same day the report was published. The Treasury Department's Office of Foreign Assets Control sanctioned four individuals and 41 entities supporting the Prince Group, a network it had already targeted in October 2025 and June 2026. According to Treasury, the newly listed people and companies helped keep the group operating after those earlier designations by managing offshore companies and concealing who owned them. One executive sanctioned in June had transferred his Tokyo mansion to his wife after the October 2025 action.

That is the gap FATF's principles aim at: removing a site, a wallet or a set of executives leaves the surrounding companies and service providers free to carry the business on. The principles call for upstream disruption alongside downstream recovery, for information sharing across sectors, and for a victim-centered approach. FATF also cautions that evidence of lasting effectiveness remains uneven. Published figures such as Indonesia's — counting accounts blocked, money returned and how quickly — are the kind of evidence that would show whether the end-to-end approach is working.

This article is based on reporting first published by Coindoo.