How money laundering actually gets detected

As of September 2026: The Panama Papers money laundering trial ended in acquittals in June 2024, as reported by ICIJ; check for any later appeal before treating that as final. The other cases described here concluded with the resolutions cited.

Detecting money laundering is rarely one clever alert. Real cases get caught in very different ways: a paper trail, an insider, a leak, a public ledger, an undercover agent. Here are five, each with a different route, and what each one teaches. Each is a real case with a public record. None is a how-to: the point is what investigators looked at, and why it worked.

1. A reporting rule made the pattern visible

In the US, banks must report cash transactions over $10,000. The structuring page explains why it is also a crime to shape withdrawals to dodge that report. The best-known conviction involved no drug money. Dennis Hastert, a former Speaker of the US House, was charged in May 2015. According to the indictment, he withdrew about $1.7 million in cash between 2010 and 2014 to conceal earlier misconduct. From about July 2012 he kept withdrawals under $10,000 to avoid a CTR. Prosecutors put the structured total at $952,000.

The public record says what was charged, not what first raised an alert. What it does show is that in December 2014 the FBI questioned him, and he falsely said he was keeping the cash. He pleaded guilty to structuring and was sentenced on April 27, 2016, to 15 months in prison. The lesson: reporting rules do not need to know why money moves. They make the shape of the movement a record that investigators can read later. See reports and filings.

2. An insider raised the alarm

Danske Bank’s Estonian branch served customers who lived outside Estonia. The US Department of Justice said the branch processed $160 billion through US banks for them, and that employees helped shield the true nature of the transactions, including through shell companies that hid who owned the funds.

The DOJ says that by at least February 2014 Danske knew of suspicious transactions through internal audits, information from regulators, and an internal whistleblower. Instead of fixing the problem in the open, it told its US banks that its controls were sound. In December 2022 Danske pleaded guilty in the US and agreed to forfeit $2 billion. The lesson: an insider can see what a monitoring system cannot, but only if the institution listens. The full story is on the Danske Bank case page, and the whistleblowers and journalists page covers the wider picture.

3. A leak became a public investigation

In the Panama Papers, an anonymous source gave the German newspaper Süddeutsche Zeitung more than 11.5 million records from the law firm Mossack Fonseca. The paper shared them with the ICIJ, and reporters in nearly 80 countries spent a year working through them. Publication began on April 3, 2016. The files listed 214,488 offshore entities, with records that revealed the secret owners of companies and accounts, the beneficial owners behind them.

ICIJ says countries have recouped more than $1.36 billion in back taxes, fines and penalties from inquiries the reporting sparked. It also says its long-standing policy is not to turn its documents over to governments. And a leak is not a verdict: in June 2024 a Panamanian court acquitted all 28 defendants in the money laundering trial. See the Panama Papers case.

4. The blockchain never forgot

In 2016 a hacker moved 119,754 bitcoin out of the Bitfinex exchange. The couple later charged with laundering it used fake identities, darknet markets, chain-hopping, mixing services and gold coins, according to the DOJ. Yet the stolen coins sat in a wallet that anyone could watch.

In February 2022 agents arrested Ilya Lichtenstein and Heather Morgan. Search warrants of online accounts turned up files containing the private keys to the wallet, and agents seized more than 94,000 bitcoin, then worth over $3.6 billion. Both pleaded guilty in 2023, and Lichtenstein admitted the hack. The lesson: cash can be spent and forgotten, but a public ledger keeps the trail. Read more about blockchain analytics and the Bitfinex case.

5. An undercover operation joined the network

Operation Polar Cap did not start with a bank alert. In 1989, US officials said federal agents had set up an undercover laundering operation in Atlanta two years earlier. Drug clients complained it was too slow and told the agents to look at La Mina, a Los Angeles operation that could launder drug profits and wire them to Latin America in 48 hours.

Officials said La Mina had laundered $1.2 billion, and the operation ended with charges against 127 people and two Latin American banks. Attorney General Dick Thornburgh called it a “hostile takeover”. Undercover work reaches a network from the inside, where records alone may not. See the La Mina case.

What still gets missed

None of these routes is a wall. A GAO review found that of more than 167 million currency transaction reports filed in fiscal years 2014 to 2023, about 5.4 percent were accessed through FinCEN’s portal. In Danske’s case, the warning came years before the flows stopped. Europol’s estimates, discussed on the why detection still mostly fails page, suggest that only a small share of criminal proceeds is ever recovered, though the figures are rough.

The five cases share a pattern. Every one of them was solved after the money had moved, and several took years. That is the honest limit of detection today: it is strong at building evidence and weaker at stopping money in real time.

Most detection is after the fact: an insider, a leak, or a public ledger, then years of work. For how the routine tools fit together, start at the detection hub, then see transaction monitoring.