HIDTA and HIFCA areas in a customer risk rating, from the public maps

HIDTA and HIFCA areas are two federal designations of places where crime concentrates: High Intensity Drug Trafficking Areas, designated by the White House Office of National Drug Control Policy, and High Intensity Financial Crime Areas, designated by the Treasury. FinCEN's map lists seven HIFCA regions, from all of New York and New Jersey to the Southwest border counties; ONDCP counts 33 HIDTAs covering parts of all 50 states. The FFIEC BSA/AML Examination Manual treats location in, and transactions involving, these areas as geographic risk. The difficulty for a BSA team is that the areas are large, so a flat "located in a HIDTA" point lands on a big share of almost any book and tells the rating little. Botminds' Customer Risk Rating weighs geography through the customer's actual flows, keeps every area list versioned in the bank's method, and explains each geographic point in the sentence a person signs.

Sample figures come from a fictional institution, Norrell Federal Credit Union, as it runs through the solution. The lists are taken from FinCEN and ONDCP pages as published in October 2026.

What are HIDTA and HIFCA areas?

They are law enforcement designations, made for law enforcement purposes, that banks borrow as risk indicators. A HIDTA directs federal, state and local drug enforcement resources to a region; a HIFCA concentrates money laundering enforcement. Neither designation was created to rate bank customers, which is why using them well takes care.

The FFIEC manual brings both into BSA examinations through its quantity-of-risk matrix, where a bank "not located in a High Intensity Drug Trafficking Area (HIDTA) or High Intensity Financial Crime Area (HIFCA)" with "no fund transfers or account relationships" involving them is low risk on that line, and a bank "located in an HIDTA and an HIFCA" with "a large number of fund transfers or account relationships" involving them is high (FFIEC Appendix J). The matrix describes the bank, not the customer, but the manual says the factors for a customer risk profile are "substantially similar" to the bank's risk categories, and geographic locations are one of them (FFIEC, CDD overview).

What is a HIFCA? Seven regions on FinCEN's map

A HIFCA is, in the FFIEC glossary's words, "a program that concentrates law enforcement efforts at the federal, state, and local level to combat money laundering in designated high-intensity money laundering zones," each with a money-laundering action team of "all relevant federal, state, and local enforcement authorities, prosecutors, and financial regulators" (FFIEC glossary). The legal basis is 31 U.S.C. 5342, which lets the Secretary of the Treasury designate any area "in which money laundering and related financial crimes are extensive or present a substantial risk" (31 U.S.C. 5342).

The statute's designation factors explain why the regions are so large: population, the number of bank and nonbank transactions, whether the area is "a key transportation hub with any international ports or airports or an extensive highway system," whether it is "an international center for banking or commerce," and the volume of suspicious activity and currency reports originating there (31 U.S.C. 5342(d)). Those factors pick out commercial centers, which is where many legitimate customers are too.

What is a HIDTA, and how many are there?

A HIDTA is a region designated under ONDCP's High Intensity Drug Trafficking Areas program, which "coordinates and assists federal, state, local, and Tribal law enforcement agencies (LEAs) in each HIDTA-designated region to address regional drug threats." There are 33: "The HIDTA Program includes 33 regional HIDTAs in all 50 states, Puerto Rico, the U.S. Virgin Islands (USVI), and the District of Columbia" (ONDCP, 2024 HIDTA report to Congress).

Designation is by county, within a regional HIDTA, and the list grows. In September 2025 ONDCP designated two more counties, St. Joseph County, Indiana, joining the Indiana HIDTA, and Rogers County, Oklahoma, joining the Texoma HIDTA (White House, September 2025). Those additions changed the counties covered without changing the count of 33 regional HIDTAs. When designating, ONDCP must consider whether an area "is a significant center of illegal drug production, manufacturing, importation, or distribution," among other statutory factors.

Where is the HIFCA list, and where is the HIDTA map?

The HIFCA list is FinCEN's HIFCA Regional Map page, which lists each region and its counties. The HIDTA list is ONDCP's program map and county designations on the White House site; the FFIEC manual's Appendix J footnote points readers to "the White House's list of HIDTA initiatives." Both are public, both are maintained outside the banking agencies, and neither publishes a change log a bank can subscribe to.

That last point is the operational one. A bank that copies the lists into a spreadsheet once has a geography factor that ages silently, as the FFIEC glossary's own count shows. The lists should be versioned in the method like any other rule input, with the source and the date each version was taken.

How do HIFCA areas affect AML risk?

They raise the geographic component of risk, most of all when money moves into, out of or through them in ways a customer's business does not explain. The FFIEC matrix grades the bank on whether it is located in such an area and on how many "fund transfers or account relationships" involve them. Translated to a customer, the relevant facts are where the customer deposits and withdraws cash, where its wires go and come from, and whether those places fit what it does.

FinCEN's funnel-account guidance shows why flows matter more than addresses: the pattern is cash deposited in one area and withdrawn in another with little time between, often below the reporting threshold. A customer domiciled outside any HIFCA can run a funnel account into one; a customer inside a HIFCA can bank there for decades without a single unusual deposit. Cash-heavy customers raise the same question, covered in whether a cash-intensive business is high risk.

Is a customer in a HIDTA high risk?

No, not on that fact alone. HIDTA counties span all 50 states and, by the FFIEC glossary's older count, held about two-thirds of the U.S. population; rating every customer there higher would push much of most books up a tier and spend due diligence where it buys little. The 2022 interagency joint statement's principle, that risk turns on the facts of each relationship rather than on the category it falls in, applies to geography as much as to customer type.

Location in a HIDTA or HIFCA is best treated as a modifier: a small number of points, or a factor that strengthens other evidence. Cash well above a customer's expected level is more concerning when it is deposited across several branches in a HIFCA region than when it is deposited at the customer's own branch, and a wire to a listed foreign jurisdiction from a customer in a HIDTA county reads differently from the same wire from a customer with an import business that explains it.

Weighting geography without rating a whole state

The way to avoid rating a whole state High is to let geography add to a reason, not be the reason. In the sample method, geography is its own family, and its points come from counterparty flows to listed jurisdictions (rule G-4) rather than from a customer's address, so they only appear when money actually moves. Rule G-2 already stops the customer-profile family from carrying a move into High on its own; a bank that wants the same protection for geography can write it the same way, as a rule that no move into High rests on geographic points alone.

Geography in a rating change, named in the sentence with its points

Keeping the area lists current

Lists change, and a rating method should change with them on purpose, not by accident. At the sample credit union, the senior analyst's draft of method version 4.3 includes the September high-risk list in rule G-4, alongside two other rule changes, and the whole revision is back-tested on every member before it scores anyone. The same night's re-scoring under the current version showed the other side of a list change.

A list change moves only the customers it affects, with the reason named

That is the property to look for in any rating system: a list update is a change to an input, it produces changes only for the customers whose flows touch the changed entries, and each of those changes says so. A list kept in a spreadsheet outside the method cannot do that; a versioned list inside it can. How such versions are validated is covered in whether a customer risk rating model is a model; to see geography weighed on your own book, start from Customer Risk Rating.

Questions people ask

What does HIFCA stand for?

High Intensity Financial Crime Area: a region designated by the Treasury, under 31 U.S.C. 5342, where money laundering and related financial crimes are extensive or present a substantial risk. FinCEN's map lists seven HIFCA regions.

How many HIDTA regions are in the US?

Thirty-three regional HIDTAs, according to ONDCP's 2024 report to Congress, covering counties in all 50 states, Puerto Rico, the U.S. Virgin Islands and the District of Columbia. The FFIEC glossary's figure of 28 is out of date.

Is every county in a HIFCA state covered?

Only for some regions. All counties of New York, New Jersey and Arizona are listed, and all of Puerto Rico and the U.S. Virgin Islands; in California, Texas, Illinois and Florida only named counties are, such as the Texas counties on and next to the Mexican border.

Does the bank's own location in a HIDTA matter?

For the bank's risk assessment, yes: the FFIEC quantity-of-risk matrix grades a bank located in a HIDTA or HIFCA as moderate on that line and one located in both, with many related transfers, as high. That is a statement about the bank's inherent risk, not a reason to rate each of its customers higher.

Are HIDTA and HIFCA lists the same as high-risk country lists?

No. HIDTAs and HIFCAs are domestic areas. Foreign jurisdictions come from other sources the bank chooses, and are usually weighed through wires and counterparties as a separate factor, as in the sample method's rule G-4.