FinCEN's September 2026 southwest-border Geographic Targeting Order is not a general rule that every $1,000 cash transaction needs a new report. A transaction enters the order only after several gates align: a money services business is located in one of 304 listed ZIP codes in Texas or New Mexico, no applicable court injunction excludes that business, and the deposit, withdrawal, exchange, payment, or transfer involves currency from $1,000 through $10,000.
The reporting mechanics mostly continue the March order, but the scope representation changes sharply. The earlier order named counties in Arizona, Texas, and New Mexico plus 11 California ZIP codes. The September order lists 210 Texas ZIP codes and 94 New Mexico ZIP codes and names no Arizona or California locations. It also creates two compliance cohorts: businesses already covered continue when the order takes effect September 3; businesses newly covered by the September geography have until October 3.
The question this map answers
How does a money services business determine whether the September order applies to a location and transaction, which duties follow, and which dates and exceptions cannot be collapsed into one rule?
MyMap compared the March and September 2026 orders at 4:03 AM Pacific Time on September 5. The September order was dated September 2, took effect September 3, and was published September 4. It runs through March 1, 2027. The March order ended September 2, so the stated periods meet without a calendar gap, but that continuity does not make the two geographic lists identical.
In this map, a covered business is a money services business as defined by the referenced regulation and located in the new order's covered geographic area, subject to the injunction exception. A covered transaction is a specified transaction in currency worth at least $1,000 and no more than $10,000. A continuing business was covered under the March order; a newly covered business was not. Those labels determine the compliance date, not whether a particular customer is suspicious.
Geography is the first executable rule
The September order enumerates 304 ZIP codes associated with five Texas counties—Cameron, El Paso, Hidalgo, Maverick, and Webb—and three New Mexico counties—Bernalillo, Doña Ana, and San Juan. MyMap counted the source list as 210 Texas ZIP entries and 94 New Mexico entries.
That count is derived from the published enumeration. It does not say 304 post offices, municipalities, branches, or independently verified ZIP boundaries. A reproducible implementation should parse the order's tokens into a unique ZIP set, preserve the associated county and state labels, and match the physical location of each agent or business against that set. County name alone was enough to represent much of the March scope; the September source makes the ZIP list controlling.
Arizona and California were inside the March order's named geography but do not appear in the September order. MyMap therefore draws them outside the new enumerated set. That is a document comparison, not a claim that those states have no other Bank Secrecy Act duties, no other FinCEN order, or no future coverage.
The injunction exception is a second gate
The order excludes, while an applicable injunction remains in force, any MSB to which the government is enjoined from applying the March 14, 2025 GTO. A footnote says the government was enjoined as of the order date from applying that 2025 order to certain Texas MSBs.
“Located in a listed ZIP code” is therefore necessary but not sufficient. A compliance record needs the legal entity, agent location, relevant court order, protected party or class, effective dates, and present injunction status. The source does not provide a machine-readable roster of every exempt MSB inside the September document. MyMap does not infer which specific company qualifies.
The injunction is also not a global deletion of Texas from the map. The published exception applies only to businesses reached by an applicable court order and only while that injunction remains in force. A location-level system should preserve in geography and injunction applies as separate Boolean fields.
The transaction gate is narrower than a cash headline
After the business and geography tests, the order covers each deposit, withdrawal, exchange of currency, or other payment or transfer by, through, or to the business that involves currency from $1,000 through $10,000. Both endpoints are included.
“Currency” matters. The text does not convert every transfer, digital-asset trade, account balance, or aggregated customer relationship into a covered transaction merely because its value falls in that dollar band. The transaction type and medium must match the order and the incorporated BSA definitions.
Two express transaction exceptions stay on the map. A covered business need not file the order-specific report for a covered transaction between it and a commercial bank. For the U.S. Postal Service, the reporting obligation does not apply to payments or transfers solely for postage or philatelic products. These exceptions should be evaluated after the main transaction test so they do not erase other duties that may apply.
A positive match triggers identity, report, and retention states
Before concluding a covered transaction, the business must meet the identification requirements referenced in 31 CFR 1010.312. The order says the specific identifying information used for verification—such as a driver's-license or credit-card account number—must be recorded on the Currency Transaction Report. A notation such as “known customer” or “bank signature card on file” is not enough. Armored-car employees are exempt from that identification requirement in the stated context.
The business then files a Currency Transaction Report through the BSA E-Filing System within 30 days after the transaction day. It must put MSB0926GTO in field 45. The source warns that the system may flag a report below $10,000; the filer must ignore that warning and continue when the order requires the report.
Records and reports tied to compliance must remain accessible and be retained for five years from the last day the order is effective, including any renewals. That wording makes the retention endpoint dependent on later renewal history. March 1, 2032 is not a safe universal destruction date if the order is extended.
The two compliance cohorts prevent a false grace period
The September order is effective September 3. A business that was already covered by the March order does not receive the new October 3 onboarding date simply because a replacement order was published. The one-month compliance date belongs to persons that were not covered businesses under the March order.
That distinction requires a temporal join: compare each business location and legal status under the March scope, then evaluate it under the September scope. The resulting states are continuing, newly covered, no longer in enumerated geography, still outside, or potentially exempt by injunction. A single current-scope flag cannot reconstruct the correct start date.
Existing BSA duties continue alongside the GTO. The order says it does not otherwise alter the BSA or its regulations. Covered businesses still file ordinary CTRs for currency transactions above $10,000 and SARs when applicable. FinCEN encourages voluntary SARs where appropriate for attempts to evade the GTO's $1,000 reporting threshold, but that statement is not a new automatic SAR rule for every sub-threshold transaction.
Confirmed, derived, and still unknown
FinCEN confirms the 304-source-entry geography; covered-business and covered-transaction definitions; injunction, commercial-bank, postal, and armored-car exceptions; September 3 effective date; October 3 onboarding date for newly covered businesses; March 1, 2027 end date; identity, CTR, field-45, transmission, supervision, and retention requirements; and the continued operation of other BSA duties.
MyMap derives the 210/94 state counts, the comparison states between the March and September geographies, and the ordered decision procedure: location, injunction, business type, transaction medium and amount, exceptions, identity, report, and retention. Those are implementation aids, not additional regulatory text.
The sources leave unknown the real-time boundary behavior of every ZIP code; which specific Texas MSBs are protected by an injunction; whether an injunction changes; each business's March coverage state; how many transactions will be reported; whether any transaction is suspicious; whether the order will be renewed; and what obligations might follow from other law or orders.
The practical next step is to freeze the September ZIP list as a versioned reference table and run every agent location through both the March and September scopes. Assign a compliance cohort before evaluating transactions. For each positive transaction match, store the identity evidence, exception result, CTR filing timestamp, MSB0926GTO marker, and retention anchor. This map is a source-reading aid, not legal advice.