Clean on Paper news and analysis

Funnel accounts: how banks spot them

Mon, 21 Sep 2026 00:00:00 GMT

A funnel account is a bank account that collects cash deposits in one region and is drained in a different region soon after. FinCEN, the US financial crimes regulator, defines it as an individual or business account in one geographic area that receives multiple cash deposits, often below the cash reporting threshold, and from which the funds are withdrawn in a different geographic area with little time between the deposits and withdrawals. Banks spot funnel accounts by looking at where the money goes in and where it comes out.

Why the pattern arose

In June 2010, the Mexican government announced rules limiting deposits of US cash in Mexican banks. Several months later it extended the limits to exchange houses (casas de cambio) and brokerages. FinCEN's 2014 advisory says that in 2011 and 2012 it had already warned banks about the rise of "funnel account" use (also called interstate or out-of-state funnel activity) after those restrictions.

The 2014 update added a second point. Mexico-related criminal groups were still using funnel accounts, and were also using them to pay for goods that were shipped abroad and sold, a version of trade-based money laundering. For that side of the story, see the black market peso exchange page.

How it differs from a money mule and from structuring

These three ideas overlap, so it helps to separate them.

Structuring is about the size of each deposit. Amounts are kept under a reporting threshold. A funnel account often involves that, but structuring alone can happen at a single branch.

A money mule is about the person. It is someone who lets criminal money pass through their own account. Mules usually receive electronic transfers from fraud victims. The money mules and funnel accounts page covers that in full.

A funnel account is about geography and speed. The defining feature is a gap: deposits land in one place and withdrawals happen somewhere far away, quickly. The account holder can be a mule, a business owner, or someone who was paid to open it. A single account can show all three traits at once.

The red flags FinCEN lists

The advisory lists red flags for a funnel account tied to trade-based laundering. Each one is a signal for a bank analyst, not proof of a crime:

An account opened in one state (typically along the Southwest border) receives multiple cash deposits under $10,000 from unidentified people at branches outside the region where the account is based.
For a business account, the deposits happen far from where the business operates. FinCEN's example is a Southern California produce company receiving small cash deposits at branches in Chicago, Indianapolis, and Minneapolis.
If questioned, the people opening the account or making deposits know little about the business, the account holder, or the source of the cash. FinCEN notes that criminal groups sometimes pay outsiders such as students, itinerant workers, or the unemployed to do this.
Payments out of a business account do not fit the stated business. FinCEN's example is a produce company's checks going to a leather goods seller, or a wire going to a textile maker in China.
Checks from the account appear to have different handwriting on the payee and amount lines than on the signature line.
Wires or checks from the account are deposited into, or clear through, the US correspondent account of a Mexican bank.

FinCEN also stresses that some of these flags can be legitimate activity. No single one is a clear sign of laundering, so banks should weigh them together with what they expect from that customer.

A bank's-eye view: how one gets found

Picture an analyst reviewing an alert. Here is the walkthrough, based on the advisory's red flags.

Start with the profile. What did the customer say they do, and where? A local business has a home footprint. Deposits well outside it are the first anomaly.
Map the deposits. Plot the branches where cash arrived. One account fed from many states, by people who are not the account holder, stands out on a map in a way a spreadsheet hides.
Check the clock. Look at the time between deposit and withdrawal. Ordinary accounts build up a balance and spend it. A funnel account balance keeps snapping back toward zero.
Test the outflows. Do the payments make sense for the stated business? Payees in unrelated industries, or checks that look pre-signed, are the kind of mismatch FinCEN describes.
Look for consolidation. FinCEN observed several funnel accounts sending money into a single consolidated account before withdrawal. That means one confirmed account can lead to others.
Decide and report. If the bank knows, suspects, or has reason to suspect the activity involves illegal funds or lacks a lawful purpose, it may be required to file a suspicious activity report (SAR). For this pattern, FinCEN asked banks to include the key terms "Funnel Account," "TBML," and, for the Mexico link, "MX Restriction" in the SAR narrative and information sections, so analysts can search for them later.

FinCEN also tells banks to manage the risk of taking cash deposits from non-customers and unidentified parties, which is the door funnel accounts use. Automated tools do steps 1 to 4 at scale; see transaction monitoring and suspicious activity reporting for how that works.

Related cases

Funnel accounts rarely appear under that name in enforcement records, so no case here is labeled one. Two cases on this site show related failures. In the TD Bank case, one network's US deposits were withdrawn quickly at ATMs in Colombia, laundering about US$39 million, and the DOJ said bank employees helped. In the Wachovia case, a 2010 deferred prosecution agreement followed the bank's failure to monitor large flows tied to Mexican exchange houses. Both show what happens when a bank does not examine where money enters and leaves.

Guarantee marketplaces: laundering for hire

Mon, 21 Sep 2026 00:00:00 GMT

Most laundering explainers describe a technique: structuring, shell companies, a trade invoice. The newest enforcement actions describe something different, a marketplace. Two names keep appearing in US actions: Cambodia's Huione Group and the Chinese-language Telegram marketplace Xinbi Guarantee. Neither is a single trick. Both are places where criminals could buy laundering as a service.

What a guarantee marketplace is

Criminals have a trust problem. A scam operator who needs proceeds cleaned, or a fake investment website built, is dealing with strangers who have no reason to be honest. The guarantee marketplace solves that with escrow. According to Treasury, Xinbi acted as an escrow service: a buyer's payment was held until the vendor finished the job, then released. That is the same model legitimate online marketplaces use, applied to services such as "washing" scam proceeds.

Treasury said Xinbi has processed the equivalent of more than $24 billion in digital assets and cash since it launched around 2022, mostly in Southeast Asia. Prosecutors say vendors on the platform advertised laundering, website building and recruitment for scam compounds under one roof. That concentration is what makes these hubs valuable to criminals and, for the same reason, valuable targets.

Why it works

Trust without contact. Escrow lets strangers transact without knowing each other.
One-stop convenience. A scam operation can buy several services from one storefront instead of building relationships with separate providers.
Fast, cross-border rails. Dollar stablecoins and OTC brokers move value across borders in minutes. See stablecoins and OTC brokers for how those conversions work.
Rebranding. When pressure builds, the business changes name, wallet or app. Treasury noted that Xinbi moved operations to a messaging app and launched its own wallet after law enforcement scrutiny in mid-2025.

The response: hit the hub, not the hop

Investigators cannot chase every transfer, so recent actions target the hub itself.

FinCEN's final rule of October 15, 2025 used Section 311 of the USA PATRIOT Act to cut Huione Group off from US correspondent banking. In June 2026 FinCEN proposed extending that measure to H-Pay Service PLC and any successor entity, aiming to make the designation follow the business rather than the brand.

On September 9, 2026, the Treasury designated Xinbi Guarantee as a transnational criminal organization, along with Singapore-based SafeW Technology and Cambodia-based Anwen Technology, which developed a wallet for the network. The same day the Justice Department's Scam Center Strike Force announced seizures and the restraint of more than $52 million in cryptocurrency. Treasury said the action was coordinated with the United Kingdom's Foreign, Commonwealth and Development Office.

What investigators look for

Wallet clusters that receive from many unrelated victims and forward funds in bulk.
Accounts whose activity matches an escrow pattern: a payment held, then released on a fixed schedule.
Links between a wallet and a known marketplace, including prior designations.
Stablecoin flows that reach a cash-out point such as an exchange or OTC desk, where identity checks apply. The chain-hopping page covers how investigators follow value across chains.

The takeaway

The lesson from these actions is structural. Laundering is increasingly an industry with storefronts, escrow and customer service, and the effective countermeasures are the ones that go after infrastructure: sanctions, banking cutoffs, seizures and cooperation between regulators and stablecoin issuers. For how those signals become cases, see the detection section.

How Investigators Follow Stolen Crypto

Mon, 21 Sep 2026 00:00:00 GMT

When a large crypto theft happens, the thief's address is public within minutes. Then the race starts. The thief tries to turn one asset on one ledger into something spendable before anyone can act. Investigators try to follow the value across every hop. The Bybit theft of February 21, 2025, about US$1.5 billion in ether, is the clearest recent example of both sides, and it shows how chain hopping works from the investigator's chair.

Step 1: Name the addresses

Bybit's own wallets made the starting point obvious. Analytics firms such as TRM Labs set up a dedicated label for the exploiter's wallets and watched them in real time. On February 26, the FBI attributed the theft to North Korea's "TraderTraitor" actors, the cluster tied to the Lazarus Group, and published the Ethereum addresses it linked to the laundering. The notice asked exchanges, bridges, node operators and analytics firms to block transactions with or derived from those addresses.

That request is the first real tool. A published list turns every regulated VASP into a checkpoint. It is the same logic as an SDN listing, applied to wallets.

Step 2: Cluster, then follow the fan-out

The funds did not sit still. TRM described them moving through many intermediary wallets, then cross-chain bridges and decentralized exchanges, with conversion largely into bitcoin. The FBI said the assets were spread across thousands of addresses on multiple blockchains. Bybit's CEO later put it at nearly 7,000 wallets holding about US$1 billion in bitcoin.

Tracers handle a fan-out by clustering: grouping addresses that behave as one operator, for example because they were funded by the same source, move in the same pattern, or consolidate into the same place. One label on the parent wallet then carries down to thousands of children. This is the core of blockchain analytics.

Step 3: Match the bridge deposit to the withdrawal

Here is where the hop happens. A bridge or swap protocol takes value in on one chain and pays out on another. The two sides are different ledgers, but each side is public. Analytics firms study how a given protocol records its transfers, so that a deposit event on chain A can be matched to a release on chain B by amount, timing and the protocol's own event data. When that mapping is solid, the trail continues. When it is not, the tracer has a gap and must say so.

For Bybit, the crossing point that mattered was a cross-chain swap protocol that turned ether into bitcoin. Once the value is on a bitcoin address, tracers switch tools and start again: new clusters, new labels, same target.

Step 4: Watch the exits

Freezes happen at the edges. A stablecoin issuer can blacklist its own token. A centralized exchange can hold a deposit. Neither can touch native bitcoin sitting in a private wallet. So investigators watch where value is likely to touch a regulated service, and mixers and OTC brokers are the places where the trail usually gets harder.

The Ronin Bridge case shows the method working. After a March 2022 theft, Chainalysis described tracing the funds through intermediary wallets, a mixer, conversion to bitcoin and a second round of mixing, then to cash-out services. Tracing to those cash-out points, plus coordination with law enforcement and industry, led to a seizure of more than US$30 million, about 10% of the haul, announced in September 2022.

What Bybit's trail actually yielded

Results were partial. On March 4, 2025, Bybit's CEO said about 77% of the funds were still traceable, 20% had "gone dark", and 3% (about US$42 million) had been frozen. Speed was the problem: TRM counted about US$160 million laundered within 48 hours and more than US$400 million by February 26.

The swap service eXch was one of the pieces investigators later pulled apart. German police (the BKA) and Frankfurt prosecutors seized the platform on April 30, 2025, securing about EUR 34 million in crypto. The BKA said the service required no registration or identity check. Press coverage of the announcement reported the BKA's estimate that about US$1.9 billion had passed through it since it began, and that Bybit proceeds were suspected to be among the funds. The operators face suspicion of commercial money laundering. A seizure like this matters less for the money than for the data: the servers and records can help trace funds that once looked anonymous.

The honest limits

Follow-the-money works on public ledgers, but it is not fast.

Speed. Chainalysis' analysis of 2025 North Korean laundering describes a cycle of about 45 days after a major theft, with the heaviest layering in the first five. Freezes must land in that window.
No one to call. A decentralized protocol has no compliance desk. Tracing tells you where value went; it cannot make a protocol reject a transfer.
Off-chain gaps. Chainalysis notes that OTC sales for cash are not visible on-chain. The trail can end at a broker's door.
Attribution is not arrest. Naming a state actor produces sanctions and address lists. It rarely produces defendants.

Update: 2026

The pattern has repeated. TRM Labs reported that the April 2026 KelpDAO theft (about US$292 million) was tied to North Korea, that roughly US$175 million was converted to bitcoin mostly through THORChain, and that about US$75 million was frozen on Arbitrum by that network's Security Council. TRM also linked the April 2026 Drift Protocol theft (US$285 million) to North Korean hackers, with funds bridged to Ethereum, swapped and left dormant. Those are TRM's findings, and they show both sides of the contest: fast hops, and a freeze that worked because a party with authority could act in time.

What to take from it

For readers, the lesson is not how to hide value. It is where detection works. Public ledgers, bridge records, address labels and quick calls between victims, exchanges and police can pull real money back. See detection for how these tools fit into the wider system.

How money laundering actually gets detected

Mon, 21 Sep 2026 00:00:00 GMT

Detecting money laundering is rarely one clever alert. Real cases get caught in very different ways: a paper trail, an insider, a leak, a public ledger, an undercover agent. Here are five, each with a different route, and what each one teaches. Each is a real case with a public record. None is a how-to: the point is what investigators looked at, and why it worked.

1. A reporting rule made the pattern visible

In the US, banks must report cash transactions over $10,000. The structuring page explains why it is also a crime to shape withdrawals to dodge that report. The best-known conviction involved no drug money. Dennis Hastert, a former Speaker of the US House, was charged in May 2015. According to the indictment, he withdrew about $1.7 million in cash between 2010 and 2014 to conceal earlier misconduct. From about July 2012 he kept withdrawals under $10,000 to avoid a CTR. Prosecutors put the structured total at $952,000.

The public record says what was charged, not what first raised an alert. What it does show is that in December 2014 the FBI questioned him, and he falsely said he was keeping the cash. He pleaded guilty to structuring and was sentenced on April 27, 2016, to 15 months in prison. The lesson: reporting rules do not need to know why money moves. They make the shape of the movement a record that investigators can read later. See reports and filings.

2. An insider raised the alarm

Danske Bank's Estonian branch served customers who lived outside Estonia. The US Department of Justice said the branch processed $160 billion through US banks for them, and that employees helped shield the true nature of the transactions, including through shell companies that hid who owned the funds.

The DOJ says that by at least February 2014 Danske knew of suspicious transactions through internal audits, information from regulators, and an internal whistleblower. Instead of fixing the problem in the open, it told its US banks that its controls were sound. In December 2022 Danske pleaded guilty in the US and agreed to forfeit $2 billion. The lesson: an insider can see what a monitoring system cannot, but only if the institution listens. The full story is on the Danske Bank case page, and the whistleblowers and journalists page covers the wider picture.

3. A leak became a public investigation

In the Panama Papers, an anonymous source gave the German newspaper Süddeutsche Zeitung more than 11.5 million records from the law firm Mossack Fonseca. The paper shared them with the ICIJ, and reporters in nearly 80 countries spent a year working through them. Publication began on April 3, 2016. The files listed 214,488 offshore entities, with records that revealed the secret owners of companies and accounts, the beneficial owners behind them.

ICIJ says countries have recouped more than $1.36 billion in back taxes, fines and penalties from inquiries the reporting sparked. It also says its long-standing policy is not to turn its documents over to governments. And a leak is not a verdict: in June 2024 a Panamanian court acquitted all 28 defendants in the money laundering trial. See the Panama Papers case.

4. The blockchain never forgot

In 2016 a hacker moved 119,754 bitcoin out of the Bitfinex exchange. The couple later charged with laundering it used fake identities, darknet markets, chain-hopping, mixing services and gold coins, according to the DOJ. Yet the stolen coins sat in a wallet that anyone could watch.

In February 2022 agents arrested Ilya Lichtenstein and Heather Morgan. Search warrants of online accounts turned up files containing the private keys to the wallet, and agents seized more than 94,000 bitcoin, then worth over $3.6 billion. Both pleaded guilty in 2023, and Lichtenstein admitted the hack. The lesson: cash can be spent and forgotten, but a public ledger keeps the trail. Read more about blockchain analytics and the Bitfinex case.

5. An undercover operation joined the network

Operation Polar Cap did not start with a bank alert. In 1989, US officials said federal agents had set up an undercover laundering operation in Atlanta two years earlier. Drug clients complained it was too slow and told the agents to look at La Mina, a Los Angeles operation that could launder drug profits and wire them to Latin America in 48 hours.

Officials said La Mina had laundered $1.2 billion, and the operation ended with charges against 127 people and two Latin American banks. Attorney General Dick Thornburgh called it a "hostile takeover". Undercover work reaches a network from the inside, where records alone may not. See the La Mina case.

What still gets missed

None of these routes is a wall. A GAO review found that of more than 167 million currency transaction reports filed in fiscal years 2014 to 2023, about 5.4 percent were accessed through FinCEN's portal. In Danske's case, the warning came years before the flows stopped. Europol's estimates, discussed on the why detection still mostly fails page, suggest that only a small share of criminal proceeds is ever recovered, though the figures are rough.

The five cases share a pattern. Every one of them was solved after the money had moved, and several took years. That is the honest limit of detection today: it is strong at building evidence and weaker at stopping money in real time.

Most detection is after the fact: an insider, a leak, or a public ledger, then years of work. For how the routine tools fit together, start at the detection hub, then see transaction monitoring.

Three Iran choke points

Mon, 21 Sep 2026 00:00:00 GMT

Sanctions evasion is money laundering with a political motive. The goal is the same: move value without the money trail leading to the people or state it belongs to. In September 2026 three US actions, all under Treasury's "Operation Economic Outcast," showed three different ways that trail gets built, and three ways it gets cut. Treasury Secretary Scott Bessent announced the campaign on August 24, 2026, aiming to map and sever the channels Iran uses for oil smuggling, sanctions evasion and terrorist financing.

Choke point one: a bank

On September 14, Treasury designated Russia's VTB Bank. It said VTB opened offices in Iran and built correspondent relationships with sanctioned Iranian banks, then set up correspondent accounts denominated in Iranian rials and Russian rubles to move billions of dollars in frozen Iranian assets and expand trade between the two countries. The action relied on Executive Order 13902, which covers Iran's financial sector. VTB was already sanctioned over Russia's war in Ukraine, in 2022 and again in 2025.

Why it works for evaders: trade settled in two non-dollar currencies never touches a US bank, so ordinary dollar screening never sees it. Why it gets caught: a bank of this size has other business, and the exposure it creates for everyone who deals with it is the lever. A foreign bank that keeps working with a designated one risks sanctions of its own.

Choke point two: an exchange

On September 17, Treasury designated BitBank, an Iranian digital asset exchange, along with its software developer and three associates of the already sanctioned financier Babak Zanjani. Treasury said Zanjani used BitBank between June and July 2026 to move "hundreds of millions of dollars' worth of Bitcoin" to the Islamic Revolutionary Guard Corps.

Why it works for evaders: coins can leave a sanctioned economy without a bank wire. Why it gets caught: coins must eventually be sold or spent somewhere. The exchange is the point where value crosses back into ordinary finance, and it is a small, nameable target.

Choke point three: the proceeds

Also on September 14, prosecutors in Manhattan filed a civil forfeiture complaint against about $61 million in cryptocurrency they allege came from black-market sales of sanctioned Iranian oil. The complaint names two Chinese firms, Blessed Trust and Hexa Whale. It alleges they posed as a wealth-management firm and a commodities broker while using exchange trading accounts to convert oil proceeds into crypto, and that a linked cluster of unhosted addresses received and distributed more than $1.5 billion. Binance is not named as a defendant, and its spokesperson said the company does not permit transactions with sanctioned individuals. These are allegations only.

What investigators look for: a business whose stated activity does not match its account flows, wallet clusters that keep receiving large sums and forwarding them in bulk, and payments that pass through several intermediaries before reaching a regime linked party. The chain-hopping page explains how value is followed across addresses and chains.

What the three have in common

Each action goes after a node that many transactions must pass through: a correspondent bank, an exchange, a set of accounts at a trading platform. Evasion networks are built from many cheap moves, but they need a few expensive, visible institutions to turn value into something usable. That is why designations and forfeitures aim at institutions rather than individual transfers. For the broader picture of how signals like these become enforcement, see the detection section.

Smart contract mixers: hard to police?

Mon, 21 Sep 2026 00:00:00 GMT

A smart contract mixer is a mixing service written as code on a blockchain instead of run as a business. People send coins into a public contract and later withdraw to a different address, and cryptography hides which deposit matches which withdrawal. It is hard to police because nobody runs it: once deployed, it keeps working with no owner to arrest, subpoena or shut down.

How is it different from a custodial mixer?

A custodial mixer, such as Bitcoin Fog, Helix or ChipMixer, is a company in practice. An operator takes your coins, pays out from a common pool and keeps servers, domains and bank or payment links. Every one of those is something police can seize. ChipMixer's domains and servers were taken in March 2023. Bitcoin Fog's operator was sentenced to 12 years and 6 months in 2024, and Helix's operator to three years.

A smart contract mixer moves those jobs into software. Tornado Cash, the best-known example, was a set of contracts that could not be changed once deployed. Our Tornado Cash case page has the full story, and the crypto mixers guide covers the mechanics.

Why is "no operator" such a problem for enforcement?

Most anti-money-laundering law works through intermediaries. Banks and exchanges hold customer funds, verify identities and file reports. A VASP that gets a subpoena can hand over records. Code holds no records and answers no letters.

That leaves two awkward options: go after the code itself, or go after the people who wrote it. Both have been tried, and both have run into limits.

What have regulators and courts done?

The record so far, in order:

August 8, 2022. OFAC sanctioned Tornado Cash, saying it had been used to launder more than US$7 billion since 2019. It was the first sanction on a decentralized protocol.
October 2023. FinCEN proposed treating crypto mixing as a class of transactions of primary money laundering concern, which would add record-keeping and reporting duties for US financial institutions. It is still listed as a proposal.
November 2024. Bitcoin Fog and Helix operators were sentenced, showing that custodial mixers carry ordinary criminal liability.
November 26, 2024. In Van Loon v. Department of the Treasury, the Fifth Circuit held that Tornado Cash's immutable smart contracts are not "property" under the sanctions statute, because no one can own or control them. OFAC had exceeded its authority.
March 21, 2025. OFAC removed Tornado Cash from its sanctions list.
August 2025. A jury convicted co-founder Roman Storm of conspiracy to operate an unlicensed money transmitting business and deadlocked on the money laundering and sanctions counts.
November 2025. Samourai Wallet founders Keonne Rodriguez and William Hill, who had pleaded guilty to the same unlicensed money transmitting conspiracy, were sentenced to five and four years.
August 2026. The judge set Storm's retrial for April 26, 2027. His acquittal motion remains undecided.

Notice the split. Sanctioning the code failed in court. Charging people has worked when they pleaded guilty or ran a custodial service, and remains open when a developer contests it.

What can investigators still see?

A smart contract hides the link inside the pool, not the edges around it. Blockchains are public, so investigators can still see which addresses deposited, how much and when. They can see where withdrawals went next, and whether one landed at an exchange. Blockchain analytics tools use that timing and those amounts to narrow the possibilities. A thief who empties a hacked wallet into a mixer within hours of an exploit, then sends matching amounts to a fresh address that reaches an exchange, leaves a pattern even if no single link is proven.

Investigators also rely on the rest of the chain. Mixing is usually one step among swaps across networks and cash-outs, and every step that touches a regulated service creates records.

What do exchanges do?

Exchanges are the choke point. Compliance teams screen deposits for exposure to mixer addresses and hacks, and may delay, refuse or report a deposit that shows it. Exposure alone does not prove crime, but it raises the risk score and the questions asked of the customer. Because these platforms must know their customers, a cash-out gives investigators a name where the mixer gave none.

Is privacy a legitimate reason to use one?

Yes, and that is why the law is unsettled. Public ledgers expose salaries, donations and purchases to anyone who learns an address. Developers and privacy advocates argue that writing privacy software should not make an author liable for what strangers do with it. Prosecutors answer that stolen funds, including hundreds of millions attributed to North Korea's Lazarus Group, flowed through these tools and that some builders knew it. Both positions are being tested in court, and a ruling on the Storm retrial could shape how far criminal law reaches the people who write privacy code.

News: DOJ returns $29.7m to Curacao after unlicensed lottery fraud and laundering scheme

Thu, 17 Sep 2026 00:00:00 GMT

The Justice Department announced on September 17, 2026, that it is transferring approximately $29.7 million back to the government of Curacao in three installments. The money is what remains of an eight-year scheme run by Robertico A. Dos Santos, who operated an unlicensed lottery and failed to pay taxes on the proceeds. Dos Santos deposited the illicit income into investment accounts at a Miami bank, opening those accounts in the names of companies he controlled rather than his own, a layering step that separated the money from its criminal source and made it harder to trace back to him.

The recovery followed a pretrial restraining order and a final forfeiture order issued by a Curacao court, which the department's Money Laundering, Narcotics, and Forfeiture Section enforced through a U.S. district court in Washington, D.C. Officials said the funds will be returned to Curacao under a regime of regular audits, with no disbursements allowed to Dos Santos or his family. The case illustrates a basic laundering technique: routing proceeds through company-held bank accounts to obscure the true owner, and how cross-border asset forfeiture cooperation can unwind it years later. More on how shell companies are used to hide ownership of illicit funds.

News: US sanctions Iranian crypto exchange BitBank over bitcoin flows to the IRGC

Thu, 17 Sep 2026 00:00:00 GMT

The US Treasury's Office of Foreign Assets Control designated BitBank, an Iranian digital asset exchange, on September 17, 2026. Treasury said Babak Zanjani, an Iranian financier who was already sanctioned, used BitBank between June and July 2026 to move "hundreds of millions of dollars' worth of Bitcoin" to the Islamic Revolutionary Guard Corps (IRGC). It also said Hormuz Safe Marine Services Authority, an entity sanctioned earlier, has used BitBank since June to transfer payments it received to the Iranian regime.

Treasury also designated BitBank's software developer, Pishtaz Simorgh Electronic Trade Company, and three Zanjani associates: Hossein Ali Zaker Hossein, Mohammad Mahdi Zaker Hossein and Seyed Adel Heidari. The action used Executive Order 13902, which covers Iran's digital asset sector, and is part of Operation Economic Outcast. Once an exchange is designated, US property tied to it is blocked, and foreign firms that keep dealing with it risk sanctions of their own. Investigators treat exchanges like this as choke points, because coins must eventually be converted or cashed out somewhere. See how detection works for the signals that lead to actions like this.

News: Maduro ally Alex Saab pleads guilty to laundering bribery proceeds, forfeits $195m

Tue, 15 Sep 2026 00:00:00 GMT

Alex Saab, a former Venezuelan industry minister and close financial ally of former president Nicolas Maduro, pleaded guilty on September 15, 2026, in Miami federal court to conspiring to launder monetary instruments. Prosecutors said Saab ran a near decade-long scheme built around CLAP, a Venezuelan government program meant to supply food and medicine to the poor. Companies secretly controlled by Saab and his associates won CLAP import contracts after paying bribes to officials, then billed for goods they never fully delivered. To move and hide the proceeds, Saab set up shell companies outside Venezuela and routed money into the United States and elsewhere, using fake invoices and false shipping records to make the payments look legitimate.

As part of the plea, Saab agreed to forfeit $195 million and cooperate with prosecutors, including in the ongoing federal case against Maduro. He faces a maximum sentence of 20 years, though prosecutors agreed to recommend the low end of the guideline range. Saab was pardoned by President Biden in 2023 as part of a prisoner swap, then indicted again in January 2026 for conduct the pardon did not cover. The case shows how shell companies with no real operations, paired with falsified trade paperwork, can turn bribery money into ordinary-looking import business revenue. More on how shell companies launder proceeds this way.

News: Mozambican network leader gets 11 years for laundering $500m in drug proceeds

Tue, 15 Sep 2026 00:00:00 GMT

Norolamin Gulam, a Mozambican national living in Portugal, was sentenced on September 15, 2026, to 135 months (more than 11 years) in federal prison by a judge in the Eastern District of Texas. He also has to pay a $7.5 million money judgment. Gulam pleaded guilty to conspiracy to commit money laundering after prosecutors identified him as the leader of a transnational laundering organization active since 2021, with reach across Europe, Africa, Southeast Asia, the United States, and Central and South America.

Investigators said Gulam laundered a minimum of $500 million in drug trafficking proceeds by running the money through multiple businesses and real estate ventures, a common way to turn illicit cash into assets that look like ordinary commercial income. The case was investigated under the Homeland Security Task Force initiative, which pooled resources from the FBI, ICE Homeland Security Investigations, the DEA, ATF, IRS Criminal Investigation, and other federal agencies. Cases at this scale usually break open when banks or title companies flag unusual property purchases or business transactions that do not match a buyer's known income, prompting the suspicious activity reports that give investigators a paper trail to follow. More on how real estate gets used to clean large sums.

News: UK unveils 500 million pound plan and 500 new officers to chase dirty money

Tue, 15 Sep 2026 00:00:00 GMT

The UK Home Office and HM Treasury unveiled a new Anti-Money Laundering and Asset Recovery Strategy on September 15, 2026, backed by 500 million pounds over three years from the Economic Crime Levy charged on regulated firms. The money funds 500 new officers spread across police forces, the National Crime Agency, and the Crown Prosecution Service, working alongside the Financial Conduct Authority and Serious Fraud Office to trace and seize criminal money, including proceeds moved through Russian-linked laundering networks.

Home Secretary Shabana Mahmood said the goal was to "break their grip on our communities" by going after the profits behind organised crime gangs. Treasury officials pointed to results from the past year as the model to scale up: authorities stripped nearly 350 million pounds from criminals, disrupted around 2,700 illicit finance operations, and secured almost 4,000 money laundering convictions, while a related crackdown called Operation Destabilise seized 25 million pounds in cash and crypto from networks that turn street cash into digital assets for organized crime. The government estimates around 100 billion pounds is laundered through the UK every year. How suspicious activity reports and asset seizure actually work is covered in how detection works.

News: DOJ seeks $61 million tied to $1.5 billion Iran oil crypto-laundering network

Mon, 14 Sep 2026 00:00:00 GMT

Federal prosecutors in Manhattan filed a civil forfeiture complaint on September 14, 2026, against approximately $61 million in cryptocurrency they allege are proceeds of black-market sales of sanctioned Iranian crude oil and petroleum products. The complaint names two Chinese companies, Blessed Trust and Hexa Whale, which prosecutors say posed as a wealth-management firm and a commodities broker but actually used trading accounts at the exchange Binance to convert oil-sale proceeds into cryptocurrency and move them toward the Iranian government and its Islamic Revolutionary Guard Corps.

Prosecutors say a linked cluster of unhosted crypto addresses, which they call "Entity A," received and distributed more than $1.5 billion in illicit oil proceeds, funneling money to IRGC-linked money services businesses and an Iranian cryptocurrency exchange through transactions designed to obscure who controlled the funds. Binance itself is not named as a defendant; a company spokesperson said it does not permit transactions with sanctioned individuals. As a civil forfeiture action, the complaint's allegations must still be proven in court before the government can keep the funds. The layered use of shifting crypto addresses and offshore exchange accounts to hide a money trail is explained on chain-hopping and cross-chain bridges.

News: US sanctions Russia's VTB Bank over Iran shadow-banking ties

Mon, 14 Sep 2026 00:00:00 GMT

The US Treasury's Office of Foreign Assets Control designated VTB Bank, one of Russia's largest financial institutions, on September 14, 2026, for helping Iran evade sanctions. Treasury said VTB opened bank offices in Iran and built correspondent banking relationships with sanctioned Iranian financial institutions, then set up a settlement system using correspondent accounts in Iranian rials and Russian rubles designed to move billions of dollars in frozen Iranian assets and expand trade between the two countries.

The designation came under Executive Order 13902, which targets Iran's financial sector, layering onto sanctions VTB already carries over Russia's war in Ukraine. Treasury Secretary Scott Bessent said the action was part of "Operation Economic Outcast," a campaign he announced in August 2026 to sever the financial channels that let Iran sell oil and access hard currency abroad. Any foreign bank that keeps dealing with VTB now risks its own US sanctions exposure, since correspondent accounts are the choke point US authorities use to cut a foreign bank off from the dollar system. That is the same mechanism, and the same kind of shadow-banking workaround, described in how detection works.

News: Bangladesh anti-graft agency opens Tk11,000 crore laundering probe into ex-adviser

Sun, 13 Sep 2026 00:00:00 GMT

Bangladesh's Anti-Corruption Commission (ACC) said on September 13, 2026 that it has opened an inquiry into Asif Mahmud Shojib Bhuiyan, a former adviser in the country's interim government, over allegations covering roughly Tk13,000 crore (about $1 billion) in bribery, embezzlement and money laundering. A citizen complaint reviewed by the ACC alleges Mahmud helped move about Tk11,000 crore (roughly $890 million) out of the country through relatives, including his brothers-in-law and a nephew: Tk4,500 crore to Dubai, Tk3,000 crore to Singapore, Tk2,000 crore to Australia and Tk1,500 crore to Switzerland. Investigators say the money was used to buy villas, invest in foreign businesses and hold funds in Swiss bank accounts.

The remaining allegations concern bribes for government appointments, promotions and contract tenders during Mahmud's tenure overseeing the Youth and Sports Ministry and local government projects. Mahmud, now a spokesperson for the National Citizen Party, has denied the claims as politically motivated and sent the ACC a legal notice demanding it retract a statement suggesting the allegations have "preliminary truth." The ACC says no findings are established yet and the inquiry will trace the funds and everyone's role. Moving bribe or embezzled money into foreign real estate and business investments to make it usable abroad is a classic laundering step; see how real estate purchases turn illicit cash into legitimate-looking assets.

News: Six accused Black Axe leaders extradited to US in romance scam laundering case

Fri, 11 Sep 2026 00:00:00 GMT

Six Nigerian nationals were handed over to FBI and U.S. Secret Service agents at Cape Town International Airport on September 11, 2026, five years after a federal grand jury in New Jersey charged them with leading the Cape Town chapter of the Neo Black Movement of Africa, known as Black Axe. Prosecutors say the men ran romance scams and advance fee schemes from 2011 to 2021, using fake identities on dating sites and social media to build relationships with victims, then inventing emergencies, often tied to a construction job gone wrong, to ask for money.

More than 100 American women, including retirees, were defrauded of over $6 million, South African police said. Court documents describe how the group laundered the proceeds: some victims sent cash directly overseas, while others were persuaded to open U.S. bank accounts that the conspirators then controlled and used to move stolen money before it left the country, a pattern typical of romance scam money muling. The men face wire fraud and money laundering conspiracy charges in federal court in Trenton. Investigators explain how these funnel accounts work on the money mules and funnel accounts page.

News: Colombian national indicted over $135 million drug-to-stablecoin laundering scheme

Thu, 10 Sep 2026 00:00:00 GMT

A federal grand jury in Greenville, South Carolina, indicted William Andres Holguin Mendez, 40, of Colombia, on a single money laundering conspiracy count. Prosecutors say an FBI investigation that began in August 2023 traced drug proceeds moving through shell company bank accounts in the Greenville area into a single account at a US-based cryptocurrency exchange, all controlled by Holguin Mendez under the exchange's Know Your Customer records.

From there, the indictment alleges, the cash was converted into stablecoin and moved to a foreign-based exchange, again registered to Holguin Mendez, before being converted to Colombian pesos and distributed across 207 Colombian bank accounts. Investigators say roughly $135 million passed through the scheme between March 2023 and May 2024. Holguin Mendez faces up to 20 years in prison if convicted and is detained pending trial; all charges remain accusations at this stage. The case was brought under the Homeland Security Task Force initiative, with the FBI, DEA, and Homeland Security Investigations involved. The stablecoin conversion step is explained on stablecoins and OTC brokers.

News: Treasury and DOJ dismantle Xinbi Guarantee, a $24 billion crypto laundering marketplace

Wed, 09 Sep 2026 00:00:00 GMT

On September 7, 2026, a federal court in Washington authorized the seizure of Telegram channels used by Xinbi Guarantee, a Chinese-language marketplace where vendors advertised "washing" scam proceeds, building fake investment websites, and recruiting workers for Southeast Asian scam compounds. Two days later, the Justice Department's Scam Center Strike Force and Treasury's Office of Foreign Assets Control moved together: OFAC designated Xinbi as a transnational criminal organization, along with Cambodia-based wallet developer Anwen Technology and Singapore-based messaging app developer SafeW Technology, and the Strike Force seized wallets and restrained more than $52 million in cryptocurrency linked to the network.

Treasury said Xinbi has processed the equivalent of over $24 billion in digital assets and cash since it launched around 2022, putting it among the largest "guarantee marketplace" laundering hubs identified so far, alongside Cambodia's Huione Group. Xinbi worked like an escrow service for criminals: it held a buyer's payment until a vendor's laundering or scam-support job was finished, letting strangers who would never meet trust each other. Stablecoin issuer Tether assisted the investigation. How these marketplaces move stolen money into cash is explained on stablecoins and OTC brokers.

News: Europol dismantles 'Dubai Bank' hawala-style network tied to cocaine trafficking

Tue, 08 Sep 2026 00:00:00 GMT

Spain's Policía Nacional, backed by Europol, arrested 21 people on July 22, 2026, tied to a clandestine money-transfer network investigators call the "Dubai Bank." Six more international arrest warrants were carried out afterward in the United Arab Emirates, Egypt, and the Netherlands. Authorities identified, seized, or froze about EUR 20 million: 48 properties worth over EUR 14 million, luxury vehicles worth over EUR 1.6 million, and 121 bank accounts holding EUR 2.3 million.

The case grew out of a 2021 cocaine seizure off the Spanish coast that led investigators up the money trail to the network's brokers. Rather than physically moving cash across borders, the network settled value through internal bookkeeping, trade transactions, and company accounts, matching each transfer with a token, often a banknote's serial number, so brokers could verify a handoff without ever meeting. A leading figure in the network was named a Europol High Value Target. The United States, Netherlands, and Sweden also supported the investigation. This is a modern, large-scale version of the broker network described in how hawala works.

News: Ringleader of $245 million crypto theft and laundering ring pleads guilty

Tue, 08 Sep 2026 00:00:00 GMT

Malone Lam, a 22-year-old Singaporean citizen who had been living in Miami, pleaded guilty on September 8, 2026 to a racketeering conspiracy charge built around stealing cryptocurrency from victims he met through online gaming platforms. According to the Justice Department, Lam and his co-conspirators used social engineering, and at times home break-ins, to get the information needed to drain victims' crypto wallets between October 2023 and May 2025. The largest single theft, almost $245.1 million taken from a Washington, D.C. resident targeted in August 2024, accounted for most of the scheme's proceeds.

Rather than banking the money quietly, the group spent it in ways meant to be seen: nightclub tabs running up to $500,000 a night, luxury watches and handbags handed out at parties, rental mansions in Los Angeles, the Hamptons, and Miami, private jets, bodyguards, and exotic cars worth up to $3.8 million apiece. That kind of visible, fast spending is a signature of the last stage of laundering, explained on integration. Lam is the eleventh defendant to plead guilty in the case; a status hearing is set for December 8, 2026.

News: FinCEN renews its Southwest border cash reporting order and narrows the map

Thu, 03 Sep 2026 00:00:00 GMT

FinCEN has reissued the geographic targeting order covering money services businesses near the Southwest border. The new order took effect on 3 September 2026, the day after the previous one lapsed, and runs to 1 March 2027. Inside the covered ZIP codes, a money services business must report currency transactions of $1,000 or more but not more than $10,000, and verify who is presenting them. That is a tenth of the ordinary $10,000 currency transaction report threshold, which still applies nationwide, as does the $2,000 suspicious activity report threshold for money services businesses.

The coverage map changed. This order lists ZIP codes in Cameron, El Paso, Hidalgo, Maverick and Webb Counties in Texas, and Bernalillo, Dona Ana and San Juan Counties in New Mexico. The order that ran from March to September 2026 also reached areas in Arizona and California, so the new one is a narrower and more targeted instrument rather than a straight renewal. Businesses newly brought in have until 3 October 2026 to comply. These orders exist because cash moved across a border in small, repeated amounts is hard to see in ordinary reporting, a pattern set out in structuring.

News: AUSTRAC opens enforcement investigation into Western Union

Tue, 01 Sep 2026 00:00:00 GMT

Australia's financial intelligence agency has opened an enforcement investigation into Western Union, one of the world's largest international payment businesses. AUSTRAC said on 1 September 2026 that the investigation covers Western Union Financial Services Australia and the parent company, The Western Union Company, and that it has serious concerns the firm has failed to manage the money laundering risks attached to high-risk payment channels, customers and affiliates. AUSTRAC chief executive Brendan Thomas said payment service providers are internationally recognised as high risk for criminal exploitation. Nothing is proven at this stage: the regulator says it will decide what action to take, if any, only once the investigation is complete.

The step follows an external audit of Western Union that AUSTRAC ordered in July 2025 after raising concerns about customer due diligence and late or missing suspicious matter reports. Investigators will now examine whether the company's AML program actually identifies and reduces risk, whether its transaction monitoring can recognise known laundering patterns, and how far the global head office shapes Australian compliance decisions. AUSTRAC said Western Union has committed to addressing the audit findings. Why transaction monitoring and suspicious activity reports carry so much weight is set out in detection and reporting.

News: US seizes $560,000 in crypto raised for Hamas and takes over its donation sites

Tue, 01 Sep 2026 00:00:00 GMT

The US Justice Department said on 1 September 2026 that the FBI has seized about $560,000 in cryptocurrency donations intended for Hamas and taken control of the domains and servers the group used to collect them. According to the department, a group chat on an encrypted messaging platform pointed supporters to a fundraising website that handed out a rotating set of donation addresses, so no single wallet stayed in use long enough to become an obvious target. Three unsealed seizure warrants, dated 25 March 2025, 25 June 2025 and 10 October 2025, covered the funds.

Rotating addresses is a layering move. It spreads incoming money across many receiving points and forces anyone following the trail to link those points together first. It did not work here. Investigators used information from human sources alongside blockchain tracing to identify the addresses, and once the FBI held the fundraising infrastructure it could intercept donations as they arrived. The department said it also obtained information about thousands of people who had contacted the group online about donating. Why splitting funds across many steps so often fails is set out in layering.

News: South Korea charges four over crypto sent to a Syrian group and vehicles shipped back

Tue, 01 Sep 2026 00:00:00 GMT

South Korean police disclosed on 1 September 2026 that four Uzbek nationals face charges under the country's terrorism financing law over cryptocurrency payments to Katibat Tawhid wal Jihad, a Syria-based armed group designated by the United Nations. Police say the main suspect sent 4,267 units of the stablecoin USDT, worth roughly 6.3 million won, in seven transfers between August 2024 and April 2025. He was arrested in April 2025 after being placed on an Interpol red notice, and has been indicted and detained. The other three were investigated without being held.

The return leg is what makes the case unusual. Police allege money from the group came back out as goods rather than as payments: 11 used cars and two excavators, together worth about 170 million won, bought in Korea and shipped to Syria. Police described it as the first case they have handled in which funds received from a terrorist group were turned into vehicles and supplied in return. Nothing is proven while the trial continues. Moving value as traded goods instead of transfers is the core idea behind trade-based money laundering.

News: Thailand plans tighter gold market rules to close laundering gaps

Sun, 30 Aug 2026 00:00:00 GMT

Thailand is preparing new rules for its gold market after officials said the trade has become a route for laundering criminal money. The Finance Ministry is working with the Bank of Thailand on legislation that would strengthen supervision of the industry and increase transparency over transactions, Vinit Visessuvanapoom, director-general of the Fiscal Policy Office and a ministry spokesman, told reporters on 28 August 2026. The plan covers physical bullion and online trading alike, and the government wants to move gold dealing toward a fully digital system so authorities can trace the source of the funds used to buy gold and where the proceeds go afterwards.

Gold attracts launderers for the same reasons it attracts savers: it holds its value, it sells quickly almost anywhere, and bars change hands without the record a bank transfer leaves behind. Rather than tax gold transactions for now, the ministry plans to bring the Gold Traders Association into a national committee that links financial data across the Finance Ministry and its Fiscal Policy Office, the Anti-Money Laundering Office, the Bank of Thailand and the Cyber Crime Investigation Bureau. Why high-value goods get used to carry value that cash cannot carry safely is explained in trade-based money laundering.

How the Bybit hack was laundered so fast

Fri, 28 Aug 2026 00:00:00 GMT

On February 21, 2025, attackers stole roughly $1.5 billion in ether from the exchange Bybit: about 500,000 ETH, the largest crypto theft on record. Five days later the FBI formally attributed it to North Korea's TraderTraitor operation, better known as Lazarus Group, and published the Ethereum addresses already busy moving the money.

What happened next is the part worth studying. Within about ten days, essentially the entire haul had been moved. For comparison: the 2016 Bitfinex thieves sat on their coins for years and still got caught. Lazarus treats laundering as a race, and in 2025 it ran the race in record time.

The pipeline

Step one: fragment. The ETH was immediately split across hundreds of fresh wallets, standard practice to multiply the tracing work before analytics firms can label addresses.

Step two: hop chains. The bulk was converted from ether to bitcoin using THORChain, a decentralized cross-chain swap protocol with no operator to serve papers on and no KYC to fail. Analysts tracking the flows reported THORChain processed over $5.5 billion in volume in that window, with roughly 86% of the stolen funds ending up as ~12,800 BTC spread across some 9,100 wallets.

Step three: wash through no-KYC services. A meaningful share passed through eXch, a swap service that openly declined to block the FBI-flagged addresses. That decision had a price: German federal police seized eXch's servers on April 30, 2025, taking 8 terabytes of data and €34 million in crypto, and stating the service had laundered about $1.9 billion overall.

Step four: cash out slowly. From thousands of BTC wallets, the funds drip toward OTC brokers and buyers: the patient retail end of the operation, where North Korea's networks convert coins into currency and goods.

Why it was so fast

Three structural reasons, each covered in depth in the technique pages linked below.

First, cross-chain infrastructure has no chokepoint: a decentralized protocol cannot freeze funds even when the FBI names the addresses on day five. Second, speed beats attribution: freezing requires a cooperative service holding the funds at the moment of the request, and Lazarus simply outran the paperwork, leaving only ~3% frozen. Third, state sponsorship removes the usual constraint: an ordinary criminal needs to cash out without being identified; Lazarus is already identified, indicted, and sanctioned, and simply does not care.

The Bybit laundering run is the strongest version of an argument that runs through the whole crypto section of this site: the ledger is public, the analytics are excellent, the attribution took days, and the money still left. Detection is not the same as recovery.

What TD Bank's guilty plea changed

Fri, 28 Aug 2026 00:00:00 GMT

On October 10, 2024, TD Bank's US subsidiary did something no American bank had done before: it pleaded guilty to conspiracy to commit money laundering. Not a deferred prosecution, not a consent order: a felony conviction, plus about US$3.09 billion in combined penalties across the DOJ (~$1.8 billion), FinCEN ($1.3 billion, its largest-ever penalty against a bank), the OCC ($450 million), and the Federal Reserve ($123.5 million).

What the schemes looked like

Prosecutors said TD intentionally did not automatically monitor most check activity, domestic ACH transfers and other transaction types, so 92% of its transaction volume, roughly $18.3 trillion, went unmonitored from January 2018 to April 2024. Three laundering networks moved more than $670 million through its accounts between 2019 and 2023. One processed more than $470 million through nominee accounts using large cash deposits, and its operators gave TD employees gift cards worth more than $57,000 to keep transactions moving. In another scheme, five TD employees issued dozens of ATM cards so funds deposited in the US could be withdrawn quickly at ATMs in Colombia, laundering about $39 million.

None of the techniques were exotic. Bulk cash deposits nobody questioned, structured activity nobody aggregated, insiders nobody audited. The DOJ's theory was simple: years of flat compliance spending while the bank grew made TD the path of least resistance for cash that other banks would have flagged.

What actually changed

Three things distinguish this from the parade of bank AML settlements before it.

The guilty plea itself. HSBC (2012) got a deferred prosecution agreement. TD got a conviction. That matters less for punishment than for precedent: DOJ showed it will take a systemically important bank to a plea, ending a decade of assumptions that no such bank could be convicted without financial chaos.

The asset cap. The OCC capped TD's US retail assets, the first cap of its kind since Wells Fargo's in 2018. A fine is a cost of doing business; a growth cap is a strategy tax that compounds every quarter it stays on. It is the main reason TD's US expansion plans stalled.

The monitor and the lookback. Guidepost Solutions was approved as independent monitor in February 2025, and TD is spending on the order of a billion dollars on remediation, including re-reviewing years of transactions it should have flagged the first time. Suspicious-activity reports from that lookback keep feeding investigations, which is how bank penalties turn into downstream prosecutions of actual launderers.

What it didn't change

The incentives that produced the failure are industry-wide: compliance is a cost center, monitoring systems drown analysts in false positives, and the penalty, even at $3 billion, arrived a decade after the conduct began. Whether the first bank money-laundering conviction changes behaviour at other institutions, or just changes how carefully they write internal jokes, is the question the next case will answer.

For the mechanics the TD networks used, see the technique pages on structuring and money mules; for how reports and monitoring are supposed to work, see the detection section.

Why they call it the Vancouver Model

Fri, 28 Aug 2026 00:00:00 GMT

Most laundering techniques get generic names. British Columbia managed to get a typology named after its biggest city: the "Vancouver Model," a term used by academics and regulators for a specific triangle of drug cash, Chinese capital flight, and casino chips.

The triangle

Start with two groups who each have a problem. Drug networks in BC hold large amounts of Canadian cash they cannot bank. Meanwhile, wealthy Chinese citizens want to move savings out of China, past its annual foreign-exchange limits, money that is often perfectly legal at home but cannot lawfully leave.

An underground bank sits in the middle and solves both problems at once. The high-roller arriving in Richmond gets a suitcase of the drug network's $20 bills to gamble with, often delivered straight to the casino parking lot. In exchange, the gambler's family in China transfers the equivalent in yuan to an account the network controls there. The drug organization gets value in China it can use to buy precursor chemicals or goods; the gambler gets spendable money in Canada; nothing crosses a border, and the casino turns street cash into chips, cheques, and winnings.

In July 2015 alone, the River Rock Casino in Richmond accepted roughly C$13.5 million in $20 bills. Suitcases and hockey bags of cash appear throughout the inquiry testimony.

The collapse of E-Pirate

The RCMP's answer was E-Pirate, its largest-ever money laundering investigation, aimed at the Richmond underground bank Silver International, alleged to be moving hundreds of millions a year. In November 2018, prosecutors stayed all charges after the identity of a confidential informant was inadvertently disclosed to the defence. Canada's flagship laundering prosecution ended without a verdict, and one of the accused was later shot dead in a Richmond restaurant.

That collapse, as much as the suitcases, is why the story became a public inquiry.

What the Cullen Commission found

Justice Austin Cullen's final report (June 2022, roughly 1,800 pages, 101 recommendations) concluded that money laundering in BC ran to billions of dollars a year, that federal enforcement had been largely ineffective, and that the casino pattern was real and persistent. A separate 2019 expert panel had estimated about C$7.4 billion laundered in BC in 2018, a model-based figure Cullen treated with caution, but one that framed the debate.

Since then BC has built tools the rest of Canada watches: a public land-ownership transparency registry, unexplained wealth orders (added May 2023, first applications filed that December), and tighter casino source-of-funds rules that have largely ended the suitcase era at the cage.

Why the name matters

The Vancouver Model is really two techniques fused: casino placement and the mirror-transfer logic of Chinese underground banking, where value moves by matching two flows rather than by crossing a border. The same demand (capital flight meeting criminal cash) powers cartel laundering networks across North America. Vancouver just supplied the most vivid stage set, and, thanks to the inquiry, the best-documented one.

News: AUSTRAC starts issuing legal notices to firms that skipped Australia's new AML rules

Fri, 28 Aug 2026 00:00:00 GMT

Australia's financial intelligence agency has started compelling businesses to say whether they fall under the country's expanded money laundering rules. AUSTRAC said on 28 August 2026 that it has begun issuing section 167 notices to firms that appear to be providing designated services but have not enrolled with the regulator. The notices require real estate agents, accountants, lawyers and jewellers to hand over information so AUSTRAC can determine whether they are covered by the AML/CTF Act and whether they are meeting their obligations under it.

This is the first visible compliance step since Australia widened the regime on 1 July 2026 to cover sectors including real estate, legal, accounting, conveyancing, trust and company services, and dealers in precious stones and metals. Those professions sit at the point where large sums move into property, companies and other assets, which is why regulators treat them as gatekeepers rather than bystanders. AUSTRAC chief executive Brendan Thomas said enrolment is a basic legal requirement and that the time for preparation has passed. Why property purchases attract laundered money, and what the people handling those deals are expected to notice, is covered in real estate laundering.

News: Houston man gets 95 months for laundering $3.1m of scam money into used-car exports

Fri, 28 Aug 2026 00:00:00 GMT

The Justice Department announced on 28 August 2026 that Oluwasegun Baiyewu, 40, of Houston, Texas, was sentenced the previous day to 95 months in prison for conspiracy to commit money laundering. A federal jury convicted him in August 2025. According to court documents, between about May 2020 and October 2021 Baiyewu led a group of at least six co-conspirators in the United States and Nigeria that laundered more than $3.1 million taken from victims of business email compromise, romance and unemployment insurance fraud. Coordinating over encrypted messaging apps such as WhatsApp, they used the stolen money to buy used and salvaged cars in the United States, then arranged to ship the vehicles to Nigeria.

In one instance, prosecutors said a renewable energy company in Puerto Rico was tricked into wiring about $280,000 to accounts the group controlled, and that money went toward car purchases exported abroad. Turning fraud proceeds into goods and shipping them out moves value across a border without another suspicious wire, and the paperwork left behind looks like ordinary commerce. Investigators have traced the same used-car pipeline to West Africa in earlier cases, described in trade-based money laundering.

News: US moves to cut off Banque Misr's UAE branches as a money laundering concern

Fri, 28 Aug 2026 00:00:00 GMT

The US Treasury's FinCEN issued a proposed rule to designate the United Arab Emirates branches of Banque Misr, an Egyptian state-owned bank, as a primary money laundering concern under Section 311, which would cut them off from US correspondent banking. Treasury said the six UAE branches processed roughly $1.8 billion between January 2024 and June 2026 for 103 companies suspected of belonging to Iranian shadow-banking networks, and called the branches a critical node for Iran's access to US dollars.

The action is part of a broader push to isolate Iran economically, announced alongside sanctions on an Iranian bank manager in Dubai and a Hong Kong front company accused of laundering for an Iranian exchange house. Section 311 designations are among the most severe tools in the AML arsenal: rather than fining a bank, they threaten to sever it from the dollar system entirely, the same mechanism used against Lebanese Canadian Bank in 2011 and Huione Group in 2025. How reporting and correspondent-bank controls feed actions like this is covered in how detection works.

News: Two more sentenced over UK's largest criminal cash laundering case

Fri, 28 Aug 2026 00:00:00 GMT

Two more men have been sentenced over a Bradford operation that West Yorkshire Police call the largest investigation into criminal cash in UK legal history. Baqa Haider, 51, was jailed for six years and Nathan Rivers, 45, was given a 27 month term suspended for two years, both at Leeds Crown Court on 28 August 2026, after being convicted of money laundering at a trial that ended in July. Four other men were sentenced in March 2025 to terms ranging from ten years to eleven years and eight months, three of them in their absence after leaving the country.

The money moved through Fowler Oldfield Ltd, a long established scrap jewellery dealer that had legitimately bought gold for cash. Couriers delivered bags of notes to its Hall Lane premises, processed at times at a rate of £1.7 million a day. The company banked the cash and used it to buy high purity gold grain, which was shipped to Dubai under fake invoices. Police established that more than £200 million passed through the firm's bank account between 2014 and 2016. The bank that held it, NatWest, was fined about £265 million in 2021 after a Financial Conduct Authority prosecution over its monitoring of the account. Turning cash into goods and paperwork is covered in trade-based money laundering.

News: Five charged with laundering $7.4m of elder scam money through 21 Washington shell companies

Fri, 28 Aug 2026 00:00:00 GMT

Federal prosecutors in Seattle indicted five men on 28 August 2026 for laundering the proceeds of scams that targeted elderly people across the United States. According to the indictment, between October 2024 and March 2026 they registered 21 shell companies in Washington State, opened about 44 bank accounts under fake identities, and rented commercial mailboxes in the companies' names. Scammers posing as tech support, government or bank staff persuaded victims to mail cashiers' checks and money orders there. The five are accused of depositing them and wiring the money on to accounts in Hong Kong and mainland China: more than $7.4 million from at least 77 victims.

Each is charged with conspiracy to commit money laundering, ten counts of money laundering by concealment, and ten counts by spending. Those indicted:

Hung Chieh Kuo, 27, of Bellevue
Tung Wei Yeh, 31, of Bellevue
Hsin Chien, 31, of Bothell
You Wei Liew, 26, of Seattle
Chengpeng Zhang, 40, of Seattle

The charges are allegations, none of the five has been convicted, and trial is scheduled for 9 November 2026. Paper companies and rented mailboxes give the money a business-shaped path, so incoming checks resemble customer payments rather than fraud proceeds. How companies with no real operations get used this way is explained in shell companies.

News: Grain trading firm forfeits $5.2 million in UK laundering and sanctions probe

Thu, 27 Aug 2026 00:00:00 GMT

ENEX Premium Trading Limited, an agricultural trading company registered in St Kitts and Nevis and owned by Azerbaijani national Nadir Valiyev, agreed to forfeit more than $5.2 million (about £3.84 million) to settle a UK National Crime Agency civil recovery investigation into suspected money laundering and sanctions evasion. Reporting in 2024 alleged that Valiyev's companies had been involved in shipping stolen Ukrainian grain, and the NCA froze the money with an Account Freezing Order that November. Investigators traced the funds to ENEX accounts in China that took in tens of millions of pounds from suspected front companies between July and September 2024, part of a network that moved money through UK electronic money institutions to be converted into cryptocurrency. Some of the companies that paid ENEX were later sanctioned by the United States for helping sell illicit Iranian oil.

The settlement involves no admission of unlawful conduct, and Valiyev denies any criminal activity. The case shows why investigators treat opaque offshore trading firms as a warning sign: layers of front companies can make suspect commodity revenue look like ordinary trade. Read how the corporate layer works in shell companies.

News: Tornado Cash retrial of Roman Storm pushed to April 2027

Wed, 26 Aug 2026 00:00:00 GMT

The retrial of Tornado Cash co-founder Roman Storm has been pushed back to April 26, 2027, with a final pretrial conference set for April 20, 2027, in New York. Prosecutors had originally sought an October 2026 date for retrying the two counts his August 2025 jury could not resolve: conspiracy to commit money laundering and conspiracy to violate sanctions, which together carry roughly 40 years of maximum exposure.

Storm was convicted in August 2025 only of conspiring to operate an unlicensed money-transmitting business. He has not been sentenced on that count, and his motion for acquittal, argued in April 2026, remains undecided. The case is the central test of whether writing and deploying mixer code can support criminal liability, and its outcome will shape enforcement against privacy tools for years. Background on how mixers work and the full Tornado Cash saga is on the mixers, tumblers, and CoinJoin page.

News: Treasury sanctions 10 people over a courier network flying cash to Hizballah

Thu, 20 Aug 2026 00:00:00 GMT

The US Treasury sanctioned 10 people on 20 August 2026 over a network it says carried cash by hand to Hizballah. The Office of Foreign Assets Control said the couriers travelled on ordinary commercial airline flights between Lebanon, Turkey, the UAE and Iran, moving up to hundreds of millions of dollars between jurisdictions. Treasury named Turkish businessman Yunus Alper Yilmaz as the manager of the courier network and said he used Turkey-based exchange houses as business fronts, supplying companies and bank accounts for transfers connected to Iran's Islamic Revolutionary Guard Corps-Qods Force. The designations were made under Executive Order 13224, and Treasury re-designated Hizballah itself under the same order as an entity directed by the IRGC-QF.

The whole point of a courier network is that the money never touches a bank. Wire transfers leave records that sanctions screening can read, while a bag carried onto a scheduled flight leaves a ticket and little else. That is why physical cash smuggling survives alongside every digital method, and why it is fragile: cash is bulky, couriers are stopped and searched, and someone still has to convert the notes at the far end. Couriers paired with exchange houses are the same arrangement described in hawala.

News: FinCEN makes the domestic ownership-reporting exemption permanent

Tue, 11 Aug 2026 00:00:00 GMT

FinCEN issued a final rule on August 11, 2026, effective August 14, that permanently adopts the framework it introduced by interim rule in March 2025: US-formed companies and US persons are exempt from beneficial-ownership reporting under the Corporate Transparency Act. Only foreign-formed companies registered to do business in the United States must file, and even they need not report US persons as beneficial owners.

The practical effect is that the US, which enacted the CTA in 2021 to end anonymous domestic shell companies, now collects ownership data on only a thin slice of entities. A Supreme Court petition on the statute's constitutionality remains pending for the fall 2026 term. Why ownership registers matter to investigators, and how the US position now compares with the UK and Canada, is covered on the shell companies and nominees page.

News: UBS pays a record $125 million FinCEN penalty for broker-dealer AML failures

Mon, 03 Aug 2026 00:00:00 GMT

FinCEN assessed a $125 million civil penalty against UBS Financial Services on August 3, 2026, the largest it has ever imposed on a broker-dealer for Bank Secrecy Act violations. Between January 2019 and June 2023, the firm failed to monitor more than 50,000 foreign currency wires worth over $10 billion combined, ran inadequate due diligence on high-risk customers with ties to Russia and Latin America, and filed hundreds of suspicious activity reports late.

FinCEN called the conduct recidivist: UBS Financial Services had already paid a $14.5 million penalty in December 2018 for similar program failures. The case extends a pattern seen in banking enforcement, where the penalty that finally lands is for broken controls and missing reports rather than for any single laundering scheme. What those reports are supposed to catch, and why late filings matter, is explained in reporting: CTRs, SARs, and STRs.

News: US seizes Huione infrastructure and moves to add H-Pay to the ban

Thu, 25 Jun 2026 00:00:00 GMT

The campaign against Cambodia's Huione Group, the marketplace at the center of the pig-butchering scam economy, escalated in late June 2026. On June 23 the Justice Department announced the seizure of backend infrastructure used by Huione's money-laundering services. Two days later FinCEN published a proposed rule to amend its Section 311 special measure, which has severed Huione from US correspondent banking since November 2025, so that it also covers H-Pay Service PLC and any defined successor entity.

The successor-entity concept is the notable move. Laundering marketplaces respond to bans by rebranding, as Garantex did by re-emerging as Grinex after its 2025 takedown, and the proposed rule is designed to make the designation follow the business rather than the name. How guarantee marketplaces and dollar stablecoins move scam proceeds is covered on the stablecoins and OTC brokers page.