At first, nothing about the transactions raised alarms. Arroyo Terminals, a U.S.-based company operated by the Jensen family, had for years imported what it declared to be “waste oil” through ports in Texas. On paper, it looked like a legitimate business. In reality, it seems the shipments were crude oil stolen from Mexico’s state-owned energy company, Pemex. The large-scale, highly profitable operation was one link in an illicit supply chain designed to skirt cartel sanctions.
According to the U.S. Attorney’s Office, the Jensen operation relied on a network of shell entities and intermediaries spanning both sides of the U.S.-Mexico border. At its core was a connection to the Cártel de Jalisco Nueva Generación (CJNG), one of Mexico’s most powerful criminal organizations, whose operatives facilitated access to stolen fuel and managed bribes, logistics and protection.
The individuals processing these transactions were not on sanctions lists. The companies involved did not initially trigger obvious alerts, yet the flows themselves were embedded in cartel activity.
Cases like this are no longer outliers, and regulators are sounding the alarm.
FinCEN recently issued a supplemental Alert (SBO545) advising financial institutions and compliance teams to be vigilant as cartel-linked smuggling schemes increasingly move through legitimate businesses, cross-border trade and financial intermediaries, often without any named or designated actor involved.
RELATIONSHIP-BASED RISK SIGNALS
The FinCEN notice makes clear that cartel risk has entered a new phase.
Groups such as CJNG and factions of the Sinaloa Cartel, including Los Chapitos and La Mayiza, have expanded beyond traditional trafficking. Their activities now span diversified revenue streams, from fuel theft and extortion to human smuggling and other predicate crimes, all of which generate proceeds that must ultimately pass through legitimate financial systems.
The mechanics of these money laundering operations increasingly resemble legitimate commerce because they are intermingled with it. Goods are shipped, invoices are generated, companies are registered and payments are formally processed through legal channels. The illicit activity is not always visible in the transaction itself. Instead, it lies in the relationships behind it.
That’s what made the Jensen operation viable for so long. The data was available, but not the context to interpret it.
Source: U.S. Immigration and Customs Enforcement
Where TRADITIONAL SCREENING STRUGGLES
Financial institutions are accustomed to detecting risk through structure. Sanctions programs define entities. PEP lists identify exposure. Adverse media provides narrative signals that can be linked to names.
Cartel ecosystems rarely present themselves so attributably.
Even when enforcement actions occur, as in the Jensen case, they tend to identify a narrow slice of the overall network. The individuals and entities named are often those closest to the point of prosecution, rather than those operating across the broader ecosystem.
The implication is significant. A customer may pass every traditional screening control—no sanctions hit, no negative media profile—yet still be part of a network enabling cartel activity. The signals are present, but distributed across actors, jurisdictions and open-source environments that do not naturally converge in a screening workflow.
FinCEN’s Alert underscores the challenge. Institutions are being asked to detect a type of risk that is not neatly codified into lists.
THE NETWORK BEHIND THE TRANSACTION
Understanding cartel exposure today requires shifting from the entity to the network.
The Jensen case illustrates this clearly. The operation depended on more than a single-family business. It relied on a layered structure of intermediaries, transport operators and facilitators moving oil across borders and through customs systems. At various points, different actors appeared to function independently, while still contributing to a coherent supply chain connected to CJNG.
This structure is not unique. Groups such as Carteles Unidos, which operate as alliances of multiple organizations, and splinter factions such as Cártel del Noreste (CDN) demonstrate how fluid and decentralized cartel ecosystems have become.
Many participants in these networks do not identify as members of a cartel. They operate businesses, provide services and participate in economic activity that, in isolation, appears legitimate. The risk emerges through their connections—who they transact with, who they coordinate with, and how they relate within a wider system.
For a financial institution, this creates a fundamental challenge. At any given point, only a fragment of that network is visible.
A GLOBAL SYSTEM, NOT A BORDER ISSUE
Although the Jensen case centers on cross-border fuel theft, the underlying dynamics apply beyond any single geography or typology.
Cartel-linked activity increasingly intersects with global supply chains. Synthetic opioid networks, for example, rely on precursor chemicals sourced through international actors operating online and across jurisdictions, feeding into distribution networks controlled by organized crime groups.
Similarly, revenue generated through these activities is layered through financial systems that may span multiple countries before re-entering legitimate markets.
The result is a form of exposure defined less by location than by connectivity. A low-risk customer in one jurisdiction may sit only a few transactional steps away from a high-risk network elsewhere.
This is the environment FinCEN’s advisory is addressing.
TURNING NETWORKS INTO SIGNALS
Though FinCEN has not prescribed a method, the regulatory message is clear. Financial institutions must be able to identify activity linked to cartel ecosystems, even where no formal designation exists.
Open-source intelligence, or OSINT, has long provided pieces of the puzzle, such as names, affiliations, social media indicators or investigative reporting. But those pieces have rarely been structured to support systematic screening.
This is where the concept of network-based intelligence becomes critical. Fivecast LUNEX bridges the gap by curating datasets on threat actors, including transnational criminal organizations such as CJNG, Sinaloa-affiliated factions and groups like CDN. Rather than focusing solely on widely known individuals, these datasets capture the broader ecosystem, surfacing associations, connections and digital indicators that link people to known networks. These datasets are built by Fivecast’s intelligence analysts and enriched with AI-powered risk insights.
As of July 2026, Fivecast LUNEX CJNG dataset captures 119,657 entity connections.
Of course, cartel networks are not static. As new front companies, intermediaries and digital identifiers surface across social media, publicly available information (PAI) and commercially available information (CAI), Fivecast LUNEX datasets are continuously expanded and refined. This allows investigators to leverage a near-real-time view of the financial crime ecosystem as it evolves; instead of a flat, binary match against a list.
AN INTEL SHIFT IS ALREADY UNDERWAY.
The Jensen case did not begin with a sanctions match. Only by connecting disparate signals (transactions, entities, relationships) could the underlying network be exposed.
With Fivecast LUNEX, investigators can situate individuals within a visual representation of a network. This clarifies the structure of the network itself, showing how a person or entity connects—directly or through several degrees of separation—to individuals, front companies and digital identifiers already tied to CJNG. Names that initially appeared benign can be evaluated in context and connected to a broader pattern of risk.
Contextual screening with Fivecast LUNEX reveals the alleged connection between the Jensens and CJNG.
Achieve Network Visibility, Now.
The FinCEN alert reflects an understanding that this investigative approach should be emphasized moving forward. As cartels continue to embed themselves within legitimate commerce, the ability to detect risk will depend less on detecting predefined entities and more on monitoring how their illicit networks operate at scale.
For financial institutions, this does not mean abandoning existing controls. The goal is to extend those controls by bringing new forms of intelligence into environments that have traditionally relied on structured lists.
To power that shift, Fivecast LUNEX gives compliance and investigative teams the network-level visibility that names and lists alone cannot provide, delivered directly into the digital intelligence workflows they already run.
SB0545 leaves little doubt. Stopping financial crime is far more than a contest to screen the most names. Prevention depends on peering into the networks behind them.
About Fivecast
Fivecast delivers intelligence solutions built for clarity, powered by AI, and trusted to surface what matters. Engineered to solve complex intelligence challenges our platform cuts through digital noise to help those protecting nations, borders, businesses, and communities uncover critical insights – before risk becomes reality.
Trusted by agencies and enterprises across national security, law enforcement, defense, corporate security, and financial crime, Fivecast was born from collaboration between governments and research institutions. Headquartered in Australia with a global footprint, we support the world’s most critical missions.
Fivecast. Engineered for Intelligence.
