Narco Traffickers in the Classroom—and Whistleblowers at the Gate

On 12 February 2026, the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) announced a US$1.72 million civil settlement with a Florida-based elite boarding school and athletic training complex.¹ The settlement resolved apparent violations of the Foreign Narcotics Kingpin Sanctions Regulations² from routine tuition enrollment and payment activity involving sanctioned individuals. The following day, the Treasury Department’s Financial Crimes Enforcement Network (FinCEN) announced the launch of a new, dedicated whistleblower portal to receive confidential tips relating to fraud, money laundering, and sanctions violations.³

Viewed together, these developments underscore a coordinated enforcement strategy: broaden the universe of regulated actors subject to sanctions risk, and simultaneously expand the government’s ability to learn about violations through incentivized whistleblowers. Institutions that historically viewed sanctions compliance as peripheral—and that rely heavily on third-party payment arrangements—now face heightened regulatory and whistleblower reporting risk. These risks are further amplified where business activity touches Latin America, a region that remains a focal point of US counter narcotics, anti-money laundering, and sanctions enforcement efforts.

Indeed, as US authorities intensify their efforts against drug cartels and transnational criminal organizations, the risk of sanctions violations extends beyond traditional “high‑risk” industries. It can arise from unexpected sectors and routine business relationships—especially when payments are routed through higher‑risk jurisdictions or structured through third‑party intermediaries. The newly launched FinCEN whistleblower portal creates powerful new channels for authorities to detect violations—incentivizing insiders to report misconduct that might otherwise remain hidden.

The OFAC Enforcement Action

What Happened

On 12 February 2026, OFAC announced a US$1.72 million civil settlement with IMG Academy, LLC, a Florida based boarding school and athletic training complex, to resolve apparent violations of the Foreign Narcotics Kingpin Sanctions Regulations. The violations arose from IMG Academy’s enrollment of two students whose parents were designated as Specially Designated Nationals (SDNs) for supporting a sanctioned Mexican drug trafficking organization, and from the school’s acceptance of tuition payments made on those parents’ behalf.

Between 2018 and 2022, IMG Academy entered into annual tuition agreements with the SDN parents and processed tens of thousands of dollars in tuition payments per student each year, often routed through nondesignated third-parties in Mexico or paid by credit card. OFAC identified 89 apparent violations across six enrollment agreements and 83 payment transactions. OFAC emphasized that the conduct did not involve sophisticated evasion: the parents’ names matched entries on the SDN List, IMG invoiced and communicated with them directly, and basic sanctions screening or third-party payor diligence would have identified the issue. The case underscores OFAC’s willingness to pursue nonfinancial institutions where sanctions screening and third-party payment controls are absent or inadequate.

The Penalty Analysis: Aggravating and Mitigating Factors

OFAC classified the violations as nonegregious but concluded that IMG Academy’s disclosure was not voluntary because OFAC had already opened an investigation prior to IMG disclosures. In assessing aggravating factors—particularly relevant for entities with Latin America exposure—OFAC cited the school’s failure to conduct basic sanctions screening despite exact SDN name matches, its knowing participation in transactions with the sanctioned individuals, and its facilitation of those individuals’ access to US services and the financial system through third-party payment arrangements. OFAC emphasized that liability does not depend on intent and that routing payments through nonsanctioned parties does not mitigate sanctions exposure.

Mitigating factors included the absence of prior OFAC penalties, the school’s substantial cooperation, and the remedial measures taken after an ownership change in June 2023, including hiring a new Chief Legal Officer who conducted a comprehensive compliance review and implemented a risk-based sanctions program.

The Deeper Lesson: Organized Crime Operates in the Open Economy

The IMG Academy case shows that transnational criminal organizations participate in the ordinary economy—sending children to school, purchasing real estate, and investing in businesses. As a result, institutions that do not view themselves as “sanctions‑relevant” may nonetheless find themselves in direct contact with cartel‑linked individuals through routine commercial activity.

OFAC emphasized that institutions face risk when payments come from parties other than the nominal customer. This applies across sectors with third‑party payments: healthcare, law firms, real estate, and professional services. OFAC expects institutions to screen all parties with control over financial obligations, not just the named customer.

The New FinCEN Whistleblower Portal

One day after the IMG Academy settlement, FinCEN announced the launch of a new webpage and intake portal designed to confidentially accept whistleblower tips related to fraud, money laundering, and sanctions violations. FinCEN’s Office of the Whistleblower will receive and triage information and share it with enforcement components within the Department of the Treasury and the Department of Justice (DOJ), including OFAC and DOJ’s Money Laundering, Narcotics and Forfeiture Section.

This announcement is not merely cosmetic. It reflects Treasury’s intent to operationalize the whistleblower authorities enacted under the Anti‑Money Laundering Act of 2020 and expanded by subsequent legislation, and to actively solicit actionable intelligence from employees, counterparties, and other insiders who observe misconduct in real time.

FinCEN Whistleblower Program—Key Basics

The newly launched FinCEN Whistleblower Program provides incentives and protections for individuals who voluntarily provide original information concerning violations of certain statutes enforced by Treasury and DOJ. As described by FinCEN, the program covers violations or conspiracies to violate, among others:

• The Bank Secrecy Act
• The International Emergency Economic Powers Act
• The Trading With the Enemy Act
• The Foreign Narcotics Kingpin Designation Act

These authorities encompass a wide range of anti-money laundering, sanctions, and related national security violations.

Eligibility and Awards

Individuals who voluntarily submit original information that leads to a successful enforcement action by Treasury or DOJ resulting in monetary penalties exceeding US$1 million may be eligible for a monetary award. FinCEN’s whistleblower statute authorizes awards within a percentage range of the collected penalties, subject to statutory requirements and implementing regulations.

Confidentiality and Protections

FinCEN has emphasized its statutory obligation to protect whistleblower confidentiality. The program also includes protections against retaliation, reinforcing that current and former employees of regulated entities may report suspected violations without forfeiting legal safeguards.

Scope of Reporting

Importantly for sanctions compliance, FinCEN expressly invites tips related to sanctions violations and sanctions evasion schemes, including conduct that may not yet have come to the attention of regulators. Information submitted through the portal may be routed to OFAC or other enforcement bodies for investigation.

key takeaways

Sectors at Elevated Risk

OFAC’s enforcement priorities have historically focused on financial institutions, and rightly so: banks are the arteries of the financial system. However, the IMG settlement reflects a broader shift toward pursuing nonfinancial sector actors—a shift now reinforced by FinCEN’s newly launched whistleblower program. Together, these developments increase both the likelihood that sanctions issues in nonbank settings will be detected and the risk that employees or other insiders will report compliance failures. Businesses in the following industries should take particular notice:

Education and Academic Institutions

Schools, universities, and training programs that recruit internationally, accept foreign students, or process tuition payments from overseas sources. Third-party payment arrangements are common in this sector.

Healthcare and Wellness

Medical providers, specialty clinics, and concierge health services that treat international patients or receive payment from foreign guarantors or insurance intermediaries.

Real Estate and Hospitality

Property developers, managers, and hotel operators with international clientele or third-party payment structures. Real estate has long been recognized as a preferred money-laundering vehicle for criminal organizations.

Professional Services

Law firms, accounting firms, and management consultancies serving international clients, particularly those whose fees may be paid by affiliated entities rather than the direct client.

Luxury Goods and Services

Retailers, auction houses, art dealers, and other high-value goods providers attracting international buyers. The Anti-Money Laundering Act of 2020 significantly expanded AML obligations in this space, and sanctions exposure follows the same vectors.

Practical Compliance Recommendations

Drawing on OFAC’s guidance in this enforcement release and its 2019 Framework for OFAC Compliance Commitments—and mindful of FinCEN’s new whistleblower program, which increases the likelihood that sanctions issues will be externally reported—we recommend the following steps for businesses assessing their sanctions risk posture:

Screen All Contractual Counterparties

Not just the nominal customer. When a parent, guarantor, employer, or affiliated entity bears financial responsibility for an account, that party should be screened against the SDN List and relevant consolidated sanctions lists at the outset of the relationship and at regular intervals thereafter.

Identify and Screen Third-Party Payors

When payments are received from parties other than the contractual counterparty—especially international wire transfers—the source should be identified and screened. Unusual payment structures from high-risk jurisdictions warrant heightened scrutiny.

Conduct a Risk-Based Assessment of Your International Touchpoints

Even businesses operating predominantly domestically may have sanctions exposure through international customers, overseas marketing offices, foreign referral networks, or cross-border payment flows. Map these touchpoints and calibrate your screening program accordingly.

Implement Ongoing and Periodic Rescreening

OFAC designations occur continuously. A customer or counterparty who was clean at onboarding may subsequently appear on the SDN List. Annual or event-triggered rescreening—particularly at contract renewal—is a basic and often neglected control.

Train Customer-Facing Personnel

Admissions officers, account managers, and billing staff are often the first point of contact with a sanctioned party. Training them to recognize red flags—unusual payment arrangements, third-party wires from high-risk jurisdictions, reluctance to provide identifying information—can surface issues that automated screening may miss.

Have a Disclosure Protocol in Place Before You Need It

The difference between voluntary and nonvoluntary self-disclosure can substantially affect penalty calculations. In this case, IMG Academy lost the opportunity for a reduced base penalty. If your compliance review uncovers a potential violation, act before OFAC acts first.

Actively Manage Internal Reporting and Hotline Mechanisms

With FinCEN’s new whistleblower program, complaints that are ignored, delayed, or inadequately investigated are increasingly likely to be reported externally as well. Organizations should ensure that hotlines are actively monitored, concerns are taken seriously, and potential sanctions issues are promptly escalated and documented—because odds are regulators may hear about them regardless.

Conclusion

The pairing of OFAC’s IMG Academy settlement with FinCEN’s launch of a new whistleblower portal reflects an enforcement environment that is simultaneously broader and more penetrating. Together, these developments reinforce the Trump administration’s all-of-government strategy against sanctions violations, in particular those with any connection to drug cartels and transnational criminal organizations, which actively seek to move illicit proceeds through family adjacent activity into the legitimate economy—often through routine, nonfinancial transactions. Sanctions enforcement now reaches well beyond banks and multinational exporters, while whistleblower incentives increase the likelihood that cartel linked activity and control failures will be surfaced by insiders. Institutions far removed from traditional sanctions targets—including schools, healthcare providers, real estate developers, and professional services firms—are therefore exposed, particularly where third-party payments or Latin America connected counterparties obscure the true source of funds. Organizations that have not recently stress tested their sanctions and AML controls—especially around third-party payors, customer due diligence, and internal escalation mechanisms—should do so with urgency.

Please contact our White Collar Defense and Investigations practice group with any questions about this enforcement release or your organization’s OFAC compliance program.