The defining feature of criminal shadow banking is the separation of a visible payment from the obligation it settles [1]. A domestic cash deposit in Los Angeles, a genuine invoice payment to a Guangzhou exporter, a banknote serial-number handoff in Chicago, and a Tether (USDT) transfer in Dubai can belong to a single cross-border arrangement even when no bank statement links them directly [2][3]. A broker collects value in one country, directs a partner to pay out in another, records the resulting debt on a private ledger, and settles the balance later through offsetting customer flows, commercial goods, gold, or cryptocurrency [4][5]. The absence of a matching cross-border wire is a hypothesis to test, not proof that value stayed domestic.
Detected activity spans both narcotics laundering and state sanctions evasion. When the Financial Crimes Enforcement Network (FinCEN) reviewed 137,153 Bank Secrecy Act (BSA) reports filed from January 2020 through December 2024 on suspected Chinese money laundering networks (CMLNs), those filings covered roughly $312 billion in suspicious activity [6][7]. Separately, FinCEN reported in October 2026 that Russia's A7 sanctions-evasion network ran at least $179.1 billion in transactions using its ruble-pegged A7A5 token between February 2025 and June 2026 through hundreds of companies holding accounts at roughly 435 financial institutions in more than 83 countries [8]. In the United Kingdom, the National Crime Agency (NCA) exposed Russian-speaking networks under Operation Destabilise that collected street cash for drug syndicates in over 30 countries, paid out equivalents in cryptocurrency, and purchased a regulated bank in Kyrgyzstan to support Russian sanctions evasion [9][10].
Every underground network touches the regulated financial system at its edges. Brokers need ordinary bank accounts to place bulk cash, pay commercial suppliers, settle real estate closings, and clear third-country invoices [6][8]. Those touchpoints create severe institutional exposure when controls fail: TD Bank pleaded guilty in October 2024 and agreed to $3.09 billion in combined penalties net of credits ($1.8 billion to the Department of Justice (DOJ), a record $1.3 billion to FinCEN, $450 million plus a U.S. banking asset cap to the Office of the Comptroller of the Currency (OCC), and $123.5 million to the Federal Reserve) after three laundering networks moved more than $670 million through its branches [11][12][13]. On 13 October 2026, FinCEN assessed a $1.2 billion penalty against Bank of America alongside a $750 million OCC penalty and an $11.6 million Office of Foreign Assets Control (OFAC) settlement for willful BSA and sanctions failures tied to Chinese money laundering networks and southwest border illicit finance [14]. Investigating shadow banking requires looking past isolated account alerts to reconstruct the service network: who accepted value, who promised delivery, who supplied local liquidity, how balances were recorded, and whose obligation a payment discharged [1][15].
1. Three Meanings of Shadow Banking: Credit, Remittance, and Crime
The phrase "shadow banking" carries distinct meanings in central banking, payment regulation, and criminal enforcement. Conflating those meanings distorts both risk assessments and evidentiary analysis.
In financial economics, shadow banking refers to credit intermediation involving maturity, credit, and liquidity transformation outside conventional depository banks [16]. Zoltan Pozsar and co-authors at the Federal Reserve Bank of New York mapped this system in 2010 across finance companies, asset-backed commercial paper conduits, money market funds, and securitization vehicles that lack direct access to central bank liquidity or public deposit insurance [16]. Their concern was funding fragility, not illicit finance. In 2018, the Financial Stability Board (FSB) replaced the label "shadow banking" in its global stability work with "non-bank financial intermediation" (NBFI), reporting that the narrow measure of nonbank credit intermediaries held $51.6 trillion in assets in 2017 [17]. By December 2025, the FSB's monitoring exercise covered 29 jurisdictions representing over 90 percent of global GDP, tracking how funds and nonbank lenders connect to commercial banks through deposits, repo exposures, and credit lines [18]. Those sector totals measure capital markets, not the size of a global laundering market [18].
In financial crime analysis, shadow banking describes informal value transfer systems (IVTS), underground banking, and professional money laundering (PML) networks that move or settle value outside, alongside, or through conventional banking channels [1][19]. Nikos Passas, in his 2003 report for the National Institute of Justice, defined IVTS as any system or network of people facilitating, on a full-time or part-time basis, the transfer of value outside conventional regulated financial institutions, identifying 16 distinct forms [19]. The Financial Action Task Force (FATF), in its September 2026 report drawing on 46 jurisdictions, separates the transfer mechanism from the criminal service: hawala and other similar service providers (HOSSPs) often operate as community remittance channels, whereas professional money laundering networks supply financial infrastructure to criminal clients for compensation [1][15].
| Category | Core question | Legal or regulatory lens | Investigative task |
|---|---|---|---|
| Nonbank financial intermediation (NBFI) | Who funds the credit and bears the liquidity or maturity risk? | Prudential supervision, securities law, and customer anti-money-laundering (AML) rules [16][18] | Examine investors, borrowers, collateral, related parties, and transaction purpose. |
| Informal value transfer (IVTS / HOSSP) | Who receives value in one location and arranges an equivalent payout elsewhere? | Money services business (MSB) registration and state licensing [4][20] | Identify instructions, counterpart brokers, balances, and later settlement [21]. |
| Professional money laundering (PML) | Who knowingly supplies a service to conceal or move criminal proceeds? | Money laundering statutes (18 U.S.C. 1956/1957; UK Proceeds of Crime Act (POCA) sections 327 to 329) [22][23] | Connect the service, criminal property, fee or benefit, and mental state [15]. |
| State shadow banking and sanctions evasion | Whose involvement, ownership, or benefit is concealed across borders? | IEEPA, OFAC blocking rules, Section 311, and FEND Off Fentanyl orders [24][25] | Establish jurisdiction, ownership or control, front companies, and strict-liability nexus [26][27]. |
A licensed remitter or commercial trader can facilitate crime, and an unregistered hawaladar can commit a federal licensing felony under 18 U.S.C. 1960 even when every customer dollar derives from lawful wages [20][28]. Describing the concrete act matters more than attaching a label: documenting that an electronics exporter received $1.4 million from unrelated domestic accounts and paid overseas factories at a broker's direction gives prosecutors and compliance counsel a testable proposition, whereas calling the company a "shadow bank" without mapping the obligation does not.
2. How Value Moves Without a Cross-Border Wire: Netting and Mirror Settlement
Every informal transfer system rests on netting and mirror settlement rather than point-to-point international wires [4][21]. FinCEN's November 2002 Section 359 report to Congress and its March 2003 Advisory Issue 33 explain the accounting [4][21]. A customer in Country A hands funds to Broker A and receives an authentication code. Broker A messages Broker B in Country B, who pays the recipient in local currency out of Broker B's local pool [4]. The customer's transfer is complete before any value crosses a border between the two brokers. Broker A now owes Broker B on their interbroker ledger [5].
Separating customer payout from interbroker settlement makes the service fast, inexpensive, and resilient where formal banking is costly or absent, as the International Monetary Fund (IMF) and World Bank documented in their 2003 analysis of the informal hawala system [29]. Over time, Broker A and Broker B settle their net balance through five channels [5][4]:
- Reciprocal customer flows. Reverse remittances from Country B to Country A cancel out opposing obligations without a cross-border transfer [5].
- Commercial trade settlement. Broker A pays a supplier in Country A (or a third country) for goods shipped to Broker B or to an importer who pays Broker B locally [5][2].
- Cash, gold, or commodity couriers. Physical currency, gold bullion, or gems move across borders to clear residual balances [4][30].
- Consolidated wires or sub-agents. Bank transfers move between trading fronts or third-country payment agents [8][31].
- Stablecoins and virtual assets. Brokers transfer USDT or tokens such as A7A5 to settle running ledger balances in minutes [32][8].
Because customer delivery and interbroker settlement are separate events, neither the amount nor the date of a settlement transfer must match any single customer's original payment [5].
| Record type | What it can establish | What it cannot establish alone | Key preservation details |
|---|---|---|---|
| Receipt or collection | Value came under a courier's, mule's, or broker's control [33]. | Criminal source of funds, or that the collector knew the origin [22]. | Banknote serial numbers, deposit timestamps, branch video, and custody chain [3]. |
| Instruction or token | A person requested payment or authenticated a handoff [4][3]. | That payout occurred, or who authored an unattributed message. | Native chat exports, voice notes, group IDs, timestamps, and language context. |
| Local payout | A beneficiary received cash, bank credit, or crypto locally [2]. | Which specific upstream receipt funded a commingled pool. | Beneficiary account logs, withdrawal records, exchange rates, and fees. |
| Settlement entry | Brokers recognized, netted, or discharged an interbroker debt [5]. | That every underlying customer or trade counterparty was complicit. | Debtor vs creditor sign conventions, reference currency, and balance checkpoints. |
Reading a seized broker ledger requires verifying its sign convention first: a positive entry can mean money owed by the broker or money owed to the broker. Where funds are mixed across lawful and criminal clients, investigators must separate the accounting reconstruction from the legal tracing theory required for charges or forfeiture [22][34].
3. Participants, Division of Labor, and Where Shadow Banking Fits in the Ecosystem
FATF's 2018 professional money laundering study and its September 2026 underground banking report show that laundering networks divide functions across specialized roles so low-level participants cannot compromise the whole organization [15][1]. A single broker may serve drug cartels, cyber-scam compounds, capital-flight clients, and ordinary remitters without those customers ever interacting [9][2].
| Participant | Operational function | Evidence to seek |
|---|---|---|
| Criminal or sanctioned client | Supplies illicit proceeds or seeks prohibited cross-border settlement [2][8]. | Predicate crime records, fee agreements, serial-number tokens, and benefit [3]. |
| Broker or controller | Accepts obligations, sets rates, and directs counterparts [15][35]. | Chat threads, master ledgers, dispute resolution, and commission splits. |
| Liquidity provider | Supplies local cash, foreign currency, or stablecoins at payout [2][36]. | Capital sources, Chinese buyer pools, over-the-counter (OTC) wallets, and vault inventories [37]. |
| Collector or courier | Picks up bulk cash or gold and deposits or delivers it [38][39]. | Travel logs, cell-site data, banknote photos, and structured deposits [3][40]. |
| Account supplier or mule | Opens or lends personal, student, or shell accounts [41]. | Know-your-customer (KYC) files, shared device IDs, login IPs, recruitment chats, and branch escorts [41]. |
| Trader or settlement business | Issues invoices, ships goods, or pays suppliers to clear balances [42][43]. | Customs filings, bills of lading, inventory, tax records, and third-party mandates [44]. |
| Corporate intermediary | Supplies shell entities, nominees, or citizenship-by-investment passports [27][15]. | Formation files, retainers, ownership declarations, and communications proving knowledge. |
| Regulated institution | Executes transfers, clears correspondent wires, or holds pooled accounts [18][14]. | Statements, wire logs, alert histories, and Section 314(b) exchanges [45]. |
Participants often advance across roles. In August 2026, the DOJ announced a 15-year sentence and $25 million forfeiture order in the Western District of North Carolina against Jianfei Lu, who moved from collecting drug cash and depositing over $20 million into shell accounts to managing other couriers inside a Chinese money laundering organization that laundered more than $92 million in illicit drug proceeds [33]. Because underground banking rests on confidence that a partner will deliver, controllers generate balance reconciliations and dispute messages that identify the organizer more reliably than nominal account titles [1].
How Shadow Banking Connects to the Wider FinCrime Ecosystem
Shadow banking acts as the cross-border movement and settlement layer connecting five adjacent conduits across the FinCrime ecosystem.
| Conduit | Connection to shadow banking | Documented example |
|---|---|---|
| Money mules | Open the domestic personal, student, and shell accounts that receive cash and pay for goods or property [41]. | 20,000+ suspicious activity reports (SARs) (~$13.8B, 2020 to 2024) on purported Chinese students; one UK network controlled 600 accounts at a single bank [41]. |
| Crypto rails | Settle interbroker balances in USDT or A7A5 and supply cash-to-crypto storefronts [32][36]. | Shift from fei qian ("flying money," traditional Chinese informal value transfer) to stablecoins [32]; Operation Destabilise cash-for-crypto swaps [9][46]. |
| Telegram markets | Guarantee marketplaces broker escrow and OTC liquidity for underground bankers [47][48]. | Huione Group severed under Section 311 in October 2025 [47]; Xinbi Guarantee sanctioned by OFAC after >$24B in volume in September 2026 [49]. |
| Scam compounds | Use casino junkets, gambling fronts, and underground banks to launder fraud proceeds [50][51]. | October 2025 Eastern District of New York (EDNY) indictment of Prince Group Chairman Chen Zhi alongside a 127,271 bitcoin (BTC, ~$15B) forfeiture action [51]. |
| Drug cartels | Supply bulk U.S. dollars to Chinese and Colombian underground brokers [2][38]. | Sinaloa Cartel, Jalisco New Generation Cartel (CJNG), and Gulf Cartel laundering alliances charged by DOJ in 2024 and 2026 [52][3]. |
4. Scale: What Detection and Reporting Numbers Show
Underground banking is built to avoid cross-border reporting, so published figures capture only what reached a regulated institution, triggered a BSA filing, appeared on-chain, or surfaced in an enforcement action [1].
| Measure | Figure | Source | Caveat |
|---|---|---|---|
| U.S. BSA reports tied to Chinese laundering networks (2020 to 2024) | 137,153 reports, ~$312 billion (~$62B/year) | FinCEN (August 2025) [6][7] | Reported suspicious activity, not proven laundering [7]. |
| Real estate subset of CMLN reports (2020 to 2024) | 17,389 reports, >$53.7 billion | FinCEN (August 2025) [6][7] | Often routed through shell LLCs or mules. |
| NY adult and senior day care subset in CMLN reports (2020 to 2024) | 43 reports, ~$766 million across 83 centers | FinCEN (August 2025) [6][7] | Suspicious healthcare-front filings requiring corroboration. |
| SARs on purported Chinese students (2020 to 2024) | 20,000+ SARs, ~$13.8 billion | Institute for Financial Integrity (December 2025) [41] | Mule recruitment indicator, not convicted headcount [41]. |
| Russian A7A5 token transactions (Feb 2025 to Jun 2026) | At least $179.1 billion | FinCEN Alert FIN-2026-Alert007 (October 2026) [8] | Russian state-backed sanctions-evasion network [8]. |
| Russian A7 network footprint (June 2026) | Hundreds of companies; accounts at ~435 institutions in 83+ countries | FinCEN (October 2026) [8] | Shows reliance on commercial and correspondent banks [8]. |
| Iranian shadow banking foreign-currency volume | Tens of billions of dollars in trade per year | U.S. Treasury / OFAC (May 2026) [27] | Official Treasury estimate across exchange fronts [27]. |
| Chinese-language laundering networks on-chain (2025) | $16.1B direct CMLN inflows (~$44M/day across 1,799+ wallets; ~20% of 5-year illicit crypto laundering); >$100B ($103B adjusted) when escrow/guarantee services are included within $158B total illicit crypto flows | Chainalysis & TRM Labs (January 2026) [32][53] | Chainalysis excludes guarantee-platform pass-throughs [32]; TRM includes Chinese escrow services [53]. |
| Land casinos in Southeast Asia (early 2022 baseline) | 340+ licensed and unlicensed land casinos | United Nations Office on Drugs and Crime (UNODC) Regional Office for Southeast Asia and the Pacific (ROSEAP) (January 2024) [50] | Alongside rapid shift to online gambling and e-junkets [50]. |
| TD Bank laundering network flows | $670 million+ across three networks (> $470M by Da Ying Sze); 92% ($18.3T) unmonitored activity; $3.09B penalties (net of credits) | DOJ / FinCEN / NBC News (October 2024) [11][12][13] | Admitted criminal plea facts at one banking group [11][12][13]. |
Two rules govern these numbers. First, gross throughput is not original predicate proceeds: repeated transfers of the same $1 million across couriers, funnel accounts, exporters, and wallets can generate multiple reports for one underlying crime [1][7]. Second, because the same brokers handle cartel cash, scam proceeds, and sanctions trade, sector estimates overlap and cannot be summed into a single global total.
5. Core Typologies: Cartel Cash Swaps, Hawala, Peso Brokers, and Trade
Chinese Money Laundering Networks and Cartel Cash
FinCEN's August 2025 advisory (FIN-2025-A003) describes Chinese money laundering networks (CMLNs) as decentralized, compartmentalized, trust-based operations often run by current or former Chinese nationals serving Mexico-based transnational criminal organizations, including the Sinaloa Cartel, CJNG, and the Gulf Cartel [2]. Their model matches two mirror-image currency problems: Mexican cartels hold bulk U.S. dollars in American cities that they cannot easily wire or ship across the border, while Chinese citizens and businesses want U.S. dollars outside China beyond Beijing's $50,000 annual individual foreign-exchange quota [2][52].
A mirror transaction runs in three domestic legs without a cross-border wire [2]:
Figure 2
In a mirror transaction, value crosses borders while the money stays inside each domestic system
Red outline: leg leaves records inside a domestic bank, trade, or closing control point
- 1U.S. cash pickup and serial-number authenticationA cartel operative and a CMLN broker set a pickup location and rate. To authenticate the handoff between strangers, the broker uses banknote serial-number verification: a photo of a $1 bill showing its serial number acts as a physical token when the courier meets the operative [3].Control pointSeized phone photos, cash deposit monitoring, and Geographic Targeting Orders
- 2Peso or stablecoin payout in MexicoOnce the U.S. courier confirms receipt of the cash, the broker's counterpart in Mexico transfers equivalent pesos (or USDT) to the cartel minus a commission [2][52].Control pointMexican financial institution supervision, FEND Off Fentanyl orders, and wallet tracing
- 3Dollar disposal and renminbi settlementThe CMLN sells the U.S. dollars to Chinese buyers who pay equivalent renminbi into broker-controlled accounts inside China [2][52]. Placed into U.S. banks through structured deposits, mules, or shells, the dollars fund the Chinese buyers' U.S. real estate, tuition, adult and senior day care centers, or electronics and luxury goods exported via daigou personal shoppers [6][2].Control pointU.S. bank structuring and funnel-account alerts, real estate closing wires, and customs records
To open and run accounts, CMLNs recruit diaspora members, homemakers, and international students [2][41]. The Institute for Financial Integrity's December 2025 Debt & Duty report shows how handlers recruit students through community chat groups, obligation, or rigged gambling debts at illegal casinos, sometimes escorting recruits into branches as a "translator" [41]. In the UK, one Chinese underground network controlled 600 accounts at a single bank [41]. U.S. prosecutions track every tier of this hierarchy. In June 2024, a Los Angeles superseding indictment in Operation Fortune Runner charged 24 defendants (led by Edgar Joel Martinez-Reyes) in a conspiracy that moved more than $50 million between Sinaloa Cartel associates and San Gabriel Valley Chinese underground exchanges [52], and an unsealed May 2026 Eastern District of Virginia (EDVA) indictment charged Chinese nationals Ruhuan Zhen and Hongce Wu with laundering Sinaloa Cartel and CJNG proceeds from 2016 to 2025 for a 1 to 2 percent commission via mirror transfers, banknote tokens, and trade-based money laundering (TBML) [3]. In North Carolina, courier-turned-manager Jianfei Lu was sentenced in August 2026 to 15 years in prison with a $25 million forfeiture order as part of a Chinese money laundering organization (CMLO) that laundered over $92 million [33], followed in October 2026 by co-conspirator Shu Jun Zhen from that same $92 million organization, who received nine years in prison and a forfeiture order of nearly $23 million for collecting bulk cash in hotel parking lots and depositing roughly $23 million into shell accounts using fake passports [39].
Hawala and Informal Value Transfer
Hawala and other similar service providers (HOSSPs) serve millions of legitimate migrants sending remittances where banking is weak or costly [4][29]. Criminal groups and unlicensed brokers exploit the same channels because funds clear rapidly without wire records [5]. In April 2025, Mohanad Al-Zubaidi and Shaker Saleh Mohammed Hauter were each sentenced in the Southern District of New York to three years in prison for running an unlicensed hawala moving more than $65 million between the United States and Yemen, Turkey, Iraq, the UAE, and Jordan for a 1 to 6 percent commission [28]. In September 2026, prosecutors in New Hampshire indicted Chichester resident Ramzi Al-Shawafi under 18 U.S.C. 1960 for operating an unlicensed hawala that moved over $25 million to Yemen through dozens of accounts in the names of convenience stores and trading firms he controlled, including Razl Trading and RA Broker [43].
The Black Market Peso Exchange
The Black Market Peso Exchange (BMPE) is the Colombian ancestor of the Chinese mirror swap [38][32]. Cartels sell U.S. drug dollars at a discount to a peso broker, who pays the traffickers in Colombian pesos. Couriers collect the U.S. street cash, structure deposits into personal or business accounts, and wire dollars across U.S., Caribbean, and European banks to pay for goods ordered by Colombian importers, who reimburse the broker in local pesos [38][35]. In May 2025, Jamaican couriers St. Devon Anthony Cover and Dennis Raymond Rowe were sentenced in Boston to 42 months and 52 months in prison for delivering bulk cash for a Barranquilla-based BMPE organization that laundered more than $6 million and was tied to nearly 3,000 kilograms of cocaine [38], followed in June 2025 by a 115-month sentence for Colombian peso broker Jaime Humberto Mejia-Bencardino, with over $1.95 million attributed to his personal conduct [35].
Trade-Based Money Laundering
Trade-based money laundering (TBML) hides value movement inside commerce through over- or under-invoicing, multiple invoicing, phantom shipments, and third-party settlement [42][44]. Banks processing open-account wires rarely see shipping or customs records, and the U.S. Government Accountability Office (GAO-22-447) found in 2022 that U.S. agencies lacked a formal interagency mechanism to share trade data [44]. FATF and the Egmont Group organize TBML risk indicators across business structure, trade activity, documents and commodities, and account behavior [42]. In a landmark 2011 U.S. action analyzed by the Foundation for Defense of Democracies (FDD), Lebanese financial institutions wired at least $329 million to U.S. used-car buyers; cars were shipped to West Africa and sold for cash, which was mixed with drug proceeds and returned to Lebanon via couriers, hawaladars, and brokers for Hezbollah's benefit [54]. In April 2015, FinCEN issued a Geographic Targeting Order (GTO) lowering cash reporting to $3,000 for roughly 700 Miami electronics exporters suspected of laundering proceeds for the Sinaloa Cartel and Los Zetas [55][56].
6. Casinos, State Shadow Banking, Parallel Banks, and Crypto Convergence
Casinos, Junkets, and Cross-Border Underground Banks in Asia
In East and Southeast Asia, casinos, VIP junkets, and underground banks (dixia qianzhuang, 地下钱庄) form an interconnected cross-border financial network [50][57]. UNODC's January 2024 report counted more than 340 licensed and unlicensed land casinos in Southeast Asia as of early 2022, alongside rapid growth in online gambling, "e-junkets," and operations in Myanmar armed-group zones [50]. In January 2023, former Macau junket leader Alvin Chau (founder of Suncity Group) received an 18-year prison sentence for illegal gambling, fraud, and leading a triad after courts found Suncity ran undeclared under-the-table "side bets" and cross-border underground banking between mainland China and Macau [58]. Earlier, in January 2018, Treasury sanctioned the Zhao Wei Transnational Criminal Organization (TCO) over its Kings Romans Casino hub in Laos [59], and in October 2025 EDNY indicted Prince Group Chairman Chen Zhi for Cambodian forced-labor scam compounds and gambling fronts while filing a record civil forfeiture complaint against approximately 127,271 bitcoin (then worth roughly $15 billion) alongside parallel OFAC and UK sanctions [51]. In late September 2026, China's Ministry of Public Security announced the results of coordinated May 2026 raids with Hong Kong police against a cross-border underground bank (dixia qianzhuang) that used shell companies, mirror settlement, fictitious trade, cash and gold smuggling, and virtual currency: mainland police arrested more than 170 suspects and froze over 15 million yuan (RMB, about $2.23 million), while Hong Kong police arrested five suspects and seized assets worth roughly HK$170 million (about $21.7 million) [30][57].
State-Run Shadow Banking: Iran, Russia, and Venezuela
Sanctioned states run sovereign shadow banking systems built on the same mechanics as criminal brokers:
- Iran. Iran settles most oil sales in Chinese renminbi and relies on exchange houses and offshore fronts to convert revenue into usable currency, moving tens of billions of dollars annually [27]. In May 2026, OFAC designated Opal Exchange, Radin Exchange, and Arz Iran Exchange alongside fronts whose owners used citizenship-by-investment passports (such as Saint Kitts and Nevis) to hide Iranian ties [27]. In August 2026, in its eighth action of the year against Iranian shadow banking, Treasury targeted rahbar ("trustee" or "leader") companies serving sanctioned lender Shahr Bank, a Dubai exchange-house front holding tens of millions of dollars, and shells in Hong Kong and Singapore [31].
- Russia. FinCEN's October 2026 Alert (FIN-2026-Alert007) describes the A7 network, built by fugitive oligarch Ilan Shor and sanctioned defense bank Promsvyazbank, as a wholesale sanctions-evasion and laundering service [8]. Clients' obligations are recorded on network-controlled promissory notes (veksels), third-country "sub-agents" wire payments through commercial correspondent banks using falsified invoices, and the ruble-backed A7A5 token (issued in Kyrgyzstan and traded on Garantex and successor Grinex) mirrors fiat flows, logging at least $179.1 billion in A7A5 transactions from February 2025 to June 2026 [8][60]. Separately, under Operation Destabilise, the UK NCA exposed how the TGR network (headed by George Rossi, Elena Chirkinyan, and Andrejs Bradens) worked alongside the Smart network (run by Ekaterina Zhdanova) and used Rossi-linked Altair Holding SA to purchase a 75 percent controlling stake in Kyrgyzstan's Keremet Bank on 25 December 2024 to facilitate cross-border payments for Promsvyazbank and evade sanctions [9][10].
- Venezuela. Venezuela's state oil company has required spot-market buyers since early 2024 to pay for crude shipments in USDT, moving oil on shadow-fleet tankers to Chinese refineries [61].
Parallel Banks, Cash Desks, and Crypto Convergence
In January 2025, Europol-coordinated police across Spain, Austria, and Belgium arrested 17 people in a "parallel banking organisation" with Arabic-speaking (Syrian) and Chinese branches that moved over 21 million euros for migrant smugglers and drug traffickers via hawala, couriers, and crypto-for-cash swaps [62][63]. The International Consortium of Investigative Journalists' (ICIJ) November 2025 Coin Laundry investigation documented crypto-to-cash storefronts in Dubai, Hong Kong, Toronto, Istanbul, and Eastern Europe handing out cash for wallet transfers with little or no ID [36].
Across every corridor, stablecoins now serve as a primary interbroker settlement rail on crypto rails. Chainalysis documented Chinese-language money laundering networks (CMLNs) shifting from fei qian and BMPE to USDT and processing $16.1 billion in direct inflows in 2025 (roughly $44 million per day across more than 1,799 active wallets, or about 20 percent of known illicit crypto laundering over five years, excluding guarantee-platform pass-throughs) [32], while TRM Labs tracked a record $158 billion in incoming illicit crypto volume in 2025, including more than $100 billion ($103 billion adjusted volume, up from roughly $123 million in 2020) when Chinese-language escrow and guarantee services are counted alongside underground banking networks [53]. In the UK, Operation Destabilise disrupted the Smart and TGR networks, which swapped street cash in over 30 countries for cryptocurrency for clients including the Kinahan crime group and ransomware actors (with Smart leader Ekaterina Zhdanova linked to over $2.3 million in suspected Ryuk ransom laundering), progressing from 84 arrests and over 20 million pounds seized announced in December 2024 to 128 arrests and over 25 million pounds seized in the UK by November 2025 [9][10][46]. A September 2026 U.S. Senate Permanent Subcommittee on Investigations minority report (Tethered to Terrorism) detailed USDT adoption across Iranian shadow banking, the Islamic Revolutionary Guard Corps (IRGC) Quds Force, Hamas, Hezbollah, and the Houthis [64][65]. Georgetown Psaros Center researchers Yaya J. Fanusie and Isabella Terry cited a Circle estimate that crypto OTC brokers handle two to three times the daily trading volume of regulated exchanges and called for a 2000s hawala-style enforcement campaign against permissive OTC desks [37]. Against Telegram guarantee marketplaces that supply escrow and CMLN introductions for Southeast Asian scam compounds [48], FinCEN used Section 311 to sever Cambodia-based Huione Group from the U.S. financial system in October 2025 (effective 17 November 2025, 90 FR 48295, after Huione laundered at least $4 billion between August 2021 and January 2025, including $37 million from North Korean (DPRK) cyber heists, $36 million from crypto investment scams, and $300 million from other cyber scams) [47], issued a Notice of Proposed Rulemaking (NPRM) to expand the rule to successor H-Pay Service PLC in June 2026 (91 FR 38340) [66][67], and in September 2026 published Alert FIN-2026-Alert005 on scam-center laundering [48] six days before OFAC designated rival marketplace Xinbi Guarantee (alongside SafeW Technology and Anwen Technology) as a transnational criminal organization after it processed over $24 billion across digital assets and fiat currency [49].
7. The Shadow Banking Toolkit
| Technique | Pattern-level mechanic | Where it breaks | Source |
|---|---|---|---|
| Mirror transactions | Offsetting local payments in two or three countries replace a wire [2]. | Cash placement and third-party payments at the domestic bank edge. | [2][30] |
| Bulk cash and couriers | Couriers collect street cash and deposit it into business or personal accounts [38][39]. | Currency transaction reports (CTRs), structuring patterns, and targeting orders [68][40]. | [38][39][69][70] |
| Banknote serial-number tokens | A banknote's serial number authenticates a cash handoff between strangers [3]. | Seized phone photos, informants, and surveillance. | [3] |
| Mule and funnel accounts | Student, homemaker, or nominee accounts receive and forward deposits [41]. | Shared device IDs, common phones/addresses, and branch escorts. | [41][2] |
| Front and shell companies | Stores, trading LLCs, or day care centers hold accounts and issue invoices [43][6]. | Mismatch between business profile, tax filings, and counterparties. | [43][31][6] |
| Invoice manipulation | Over- or under-invoicing, vague descriptions, or phantom trade [42]. | Trade document review, price checks, and customs comparison. | [42][8][44] |
| Goods purchases and daigou | Illicit dollars buy electronics, luxury goods, or used cars for export [2][54]. | Retail purchase patterns, freight forwarders, and exporter GTOs. | [2][55][56][54] |
| Real estate | Property bought via shell LLCs, mules, wires, or cashier's checks [6]. | Title, escrow, and closing-wire provenance reviews. | [6][2] |
| Gold and commodities | Physical gold and gems settle net balances between brokers [4]. | Customs seizures and precious-metals dealer reporting. | [4][30] |
| Casino chips, junkets, side bets | VIP credit and undeclared side bets move value off the books [50][58]. | Gaming regulator audits and cross-border police raids. | [50][58] |
| Promissory notes and sub-agents | Value recorded on veksels while third-country sub-agents wire funds [8]. | Correspondent due diligence on nested third-country shells. | [8] |
| Borrowed IDs and CBI passports | Counterfeit or citizenship-by-investment (CBI) passports hide true owners [27][2]. | Beneficial ownership and place-of-birth verification. | [27][2] |
| Stablecoin settlement | Brokers settle in USDT or A7A5, or swap cash at OTC storefronts [32][8]. | On-chain analytics, issuer freezes, and cash-desk stings. | [53][8][36] |
8. Legitimate Nonbank Finance and Its Abuse
The formal nonbank financial sector (NBFI) monitored by the FSB provides lawful credit, investment, factoring, and payment services, yet professional launderers can misuse those structures to layer or integrate illicit wealth [18][15]. Financial-stability risks such as balance-sheet debt ratios and liquidity mismatch differ from money laundering risk: an institutional credit fund carrying high debt may hold clean capital, whereas an unindebted private lending vehicle can hold criminal proceeds [16][18].
| Nonbank structure | Abuse hypothesis to test | Evidence required to test it |
|---|---|---|
| Private fund investment | A concealed beneficiary supplies subscription money through a nominee or shell. | Source of funds, investor ownership, payer identity, side agreements, and redemption destination [18]. |
| Private lending or loan-back | A purported loan disguises the borrower's own criminal funds ("loan-back"). | Lender's funding source, common control, credit assessment, collateral, and repayment performance. |
| Factoring or receivables finance | Fictitious or duplicated trade receivables justify rapid cash disbursement [71]. | Underlying sale contract, independent debtor confirmation, delivery proof, and prior financing checks [42]. |
| Securitization or structured vehicle | Multi-tier complexity obscures asset provenance, related parties, or payment priority [16]. | Asset pool provenance, servicing records, waterfall distributions, and beneficial holders. |
| Payment or e-money arrangement | Nested customer activity is obscured inside pooled omnibus settlement accounts [72]. | Internal customer sub-ledger, contractual mandates, settlement accounts, and access logs. |
Statutory AML coverage remains uneven across nonbank actors. On 31 December 2025, FinCEN issued a final rule postponing the effective date of its AML and countering the financing of terrorism (CFT) program and SAR rule for covered investment advisers to 1 January 2028 [73]. That specific rule is not yet in force in October 2026, though banks, broker-dealers, and custodians servicing those funds remain subject to their own BSA and sanctions duties [73].
9. Organizations, Corridors, and Geographic Roles
Named groups in shadow banking cases belong to different legal categories: predicate criminal organizations (Sinaloa Cartel, CJNG, Kinahan organization), professional laundering networks (CMLNs, Smart, TGR, BMPE brokers), state-directed sanctions networks (Iranian rahbar fronts, Russia's A7 network), and foreign financial institutions subject to special measures (Huione Group, CIBanco, Intercam, Vector Casa de Bolsa) [2][9][8][74][75].
| Organization | Type | Role | Key official action |
|---|---|---|---|
| Chinese money laundering networks (CMLNs) | Professional launderers | Mirror swaps for cartels; student mule, shell, real estate, and daigou channels [2]. | FinCEN Advisory FIN-2025-A003 and $312B BSA analysis (August 2025) [6][2]. |
| Sinaloa Cartel, CJNG, Gulf Cartel, Beltran-Leyva | Mexican cartels | Primary narcotics clients supplying bulk U.S. dollars [2][74][75]. | June 2024 and May 2026 DOJ indictments [52][3]; FEND orders [74][75]. |
| CIBanco, Intercam, Vector Casa de Bolsa | Mexican financial institutions | Processed cartel-linked transactions and Chinese chemical precursor payments [74][75]. | FinCEN FEND Off Fentanyl orders (June 2025) [74][75][25]. |
| Colombian BMPE organizations | Peso brokers | Buy cartel dollars in the U.S. and sell them to Colombian buyers [38][35]. | May and June 2025 Boston sentences [38][35]. |
| Hezbollah-linked networks | Terrorist organization | Used-car exports to West Africa, bulk cash couriers, and hawala [54]. | 2011 Lebanese Canadian Bank $329M case and Canadian auto-export cases [54]. |
| Opal, Radin, Arz Iran Exchanges, and rahbar fronts | State shadow banking | Convert Iranian oil revenue via UAE exchange houses and HK/Singapore shells [27][31]. | OFAC designations (May and August 2026) [27][31]. |
| A7 Network (Ilan Shor and Promsvyazbank) | Russian sanctions network | Veksel notes, third-country sub-agents, and A7A5 ruble token [8]. | FinCEN Alert FIN-2026-Alert007 (October 2026) [8][60]. |
| Smart (Zhdanova), TGR (Rossi, Chirkinyan), and Keremet Bank | Russian-speaking launderers | Cash-to-crypto swaps for drug gangs (including Kinahan) and elites; Altair Holding bought 75% of Keremet Bank [9][10]. | UK NCA Operation Destabilise (84 arrests in Dec 2024; 128 by Nov 2025) and OFAC sanctions [9][10][46]. |
| Suncity Group | Macau junket operator | Undeclared side bets and mainland-Macau underground banking [58]. | Founder Alvin Chau sentenced to 18 years (January 2023) [58]. |
| Zhao Wei TCO (Kings Romans Casino) | Laos casino syndicate | Golden Triangle casino laundering narcotics and trafficking proceeds [59]. | OFAC TCO designation (January 2018) [59]. |
| Prince Group | Cambodian scam conglomerate | Forced-labor crypto scam compounds and gambling fronts [51]. | EDNY indictment of Chairman Chen Zhi, 127,271 BTC (~$15B) forfeiture action, and OFAC TCO sanctions (October 2025) [51]. |
| Huione Group, H-Pay Service PLC, and Xinbi Guarantee | Guarantee marketplaces and payment groups | Huione laundered $4B+ (Aug 2021 to Jan 2025) [47]; Xinbi processed >$24B [49]. | Huione Section 311 final rule (Oct 2025) and H-Pay NPRM (Jun 2026) [47][66]; Xinbi OFAC TCO designation and DOJ seizure (Sep 2026) [49]. |
| European parallel bank | Syrian and Chinese syndicate | Hawala, couriers, and crypto-for-cash across Spain, Austria, Belgium [62][63]. | Europol takedown of 17 suspects (January 2025) [62][63]. |
Geographic Roles Across Documented Corridors
| Country or region | Documented role | Sources |
|---|---|---|
| United States | Cartel cash placement; student mule recruitment; real estate and luxury goods integration; Southwest Border and Miami GTOs [6][69][70]. | [6][14][11][12][13][55][56] |
| China and Hong Kong | Foreign-exchange demand ($50,000 quota); renminbi settlement; trading shells; joint mainland-HK underground bank raids [2][30]. | [2][30][57][31] |
| Mexico | Cartel clients receiving peso payouts; three financial institutions subject to FEND Off Fentanyl orders [2][74][75]. | [3][74][75] |
| Colombia, Caribbean, Europe | BMPE peso brokerage, intermediary banking conduits, and importer trade settlement [38][35]. | [38][35] |
| United Kingdom | Street cash collection for Smart/TGR and Chinese networks (600 accounts at one bank); POCA and HMRC/FCA perimeter [9][41]. | [9][41][76][23] |
| Russia and Kyrgyzstan | A7 network, veksel clearing, A7A5 token issuance, Grinex exchange, and TGR purchase of Keremet Bank [8][10]. | [8][60][10] |
| Iran, UAE, Singapore | Iranian oil-revenue conversion via exchange houses, Dubai fronts, and HK/Singapore rahbar shells; Dubai cash desks [27][31]. | [27][31][36] |
| Macau, Cambodia, Laos, Myanmar | Casino junkets, special economic zones, scam compounds, and guarantee marketplaces [50][47]. | [50][58][59][51] |
| Yemen, Turkey, Iraq, Jordan, Lebanon, West Africa | Unlicensed hawala corridors from U.S. fronts; Hezbollah used-car TBML corridor through West Africa [28][54]. | [28][43][54] |
| Venezuela, Spain, Austria, Belgium, Canada, St. Kitts & Nevis | Venezuelan USDT oil sales [61]; European parallel bank [62][63]; Toronto cash desks and stolen-car exports [36][54]; CBI passports [27]. | [61][62][63][36][27] |
10. Landmark Cases and Bank Enforcement Outcomes
Criminal prosecutions, sanctions actions, and bank penalties establish distinct legal outcomes: an indictment states allegations, a sentencing order reflects proven criminal elements, and a Section 311 rule or OFAC designation restricts access without a criminal conviction [67][26].
- Sinaloa Cartel and CMLN alliance: Operation Fortune Runner (June 2024) and EDVA indictment (May 2026). DOJ's June 2024 superseding indictment in Operation Fortune Runner charged 24 defendants (led by Edgar Joel Martinez-Reyes) in a conspiracy that moved more than $50 million in drug proceeds between Sinaloa Cartel associates and San Gabriel Valley Chinese underground remitters [52], followed in May 2026 by unsealed Eastern District of Virginia charges against Chinese nationals Ruhuan Zhen and Hongce Wu for laundering Sinaloa Cartel and CJNG proceeds via mirror transfers, banknote serial-number tokens, and TBML [3]. Application: a Chinese buyer's desire for U.S. dollars does not prove the buyer knew the cash derived from narcotics; investigators must separately prove the broker's knowledge and the instruction linking the U.S. cash drop to the cartel's payout [52][22].
- Jianfei Lu, Shu Jun Zhen, and courier-to-manager progression (August and October 2026 sentencings). In August 2026, Jianfei Lu received 15 years in prison and a $25 million forfeiture order in the Western District of North Carolina after pleading guilty in July 2025 to depositing over $20 million in drug cash into shell accounts and managing other couriers inside a CMLO that laundered over $92 million [33]. In October 2026, Shu Jun Zhen, the second defendant sentenced from that same $92 million organization, received nine years in prison and a forfeiture order of nearly $23 million after depositing roughly $23 million into shell accounts across multiple states [39]. Application: use courier arrests to reach the controller through tasking messages, account handoff logs, and dispute records [33].
- Colombian BMPE brokerage (May and June 2025 sentencings). Colombian peso broker Jaime Humberto Mejia-Bencardino was sentenced to 115 months in Boston in June 2025 for his role in a Barranquilla-based BMPE organization that laundered over $6 million across U.S., Caribbean, and European banks (with over $1.95 million attributed to his personal conduct) [35], alongside Jamaican cash couriers St. Devon Anthony Cover (42 months) and Dennis Raymond Rowe (52 months) sentenced in May 2025 [38]. Application: commercial wire recipients may appear ordinary until the broker's payment instruction shows whose drug debt the wire discharged [35].
- Operation Destabilise: Smart, TGR, and Keremet Bank (2024 to 2025). The UK NCA progressed from 84 arrests and over 20 million pounds seized in December 2024 to 128 arrests and over 25 million pounds seized by November 2025 across Russian-speaking networks Smart (led by Ekaterina Zhdanova) and TGR (led by George Rossi, Elena Chirkinyan, and Andrejs Bradens), which swapped street cash for crypto for organized crime (including the Kinahan group) and used Rossi-linked Altair Holding SA to acquire 75 percent of Kyrgyzstan's Keremet Bank on 25 December 2024 to evade sanctions [9][10][46]. Application: street cash couriers and regulated foreign banks can function as parts of a single laundering apparatus [10].
- Huione Group final rule, H-Pay proposal, and Xinbi Guarantee takedown (2025 to 2026). FinCEN severed Huione Group from U.S. correspondent banking under Section 311 in October 2025 (effective 17 November 2025, 90 FR 48295) [47] and proposed expanding the rule to successor H-Pay Service PLC in June 2026 (91 FR 38340) [66][67], while OFAC designated Xinbi Guarantee as a transnational criminal organization on 9 September 2026 alongside a DOJ seizure of Xinbi's Telegram channels and $12 million in crypto (with over $52 million restrained) [49]. Application: distinguish an operative final rule from a pending proposal on FinCEN's status table, and prove successor continuity through shared infrastructure, management, or wallet migration [67].
- TD Bank ($3.09 billion penalty, October 2024) and Bank of America ($1.95 billion BSA penalties plus $11.6 million OFAC settlement, October 2026). TD Bank pleaded guilty in October 2024 and agreed to $3.09 billion in combined penalties net of credits ($1.8 billion DOJ, $1.3 billion FinCEN, $450 million OCC plus a U.S. banking asset cap, and $123.5 million Federal Reserve) after three laundering networks moved over $670 million through its accounts (including over $470 million in cash deposited by Da Ying Sze's network, which bribed employees with over $57,000 in gift cards) while 92 percent of transaction volume ($18.3 trillion, including domestic Automated Clearing House (ACH) transfers) went unmonitored [11][12][13]. On 13 October 2026, FinCEN assessed a $1.2 billion penalty against Bank of America alongside a $750 million OCC penalty and an $11.6 million OFAC settlement for willful BSA and sanctions failures tied to Chinese money laundering networks and southwest border illicit finance [14]. In June 2025, FinCEN also issued its first FEND Off Fentanyl orders (21 U.S.C. 2313a) restricting U.S. correspondent access for Mexican institutions CIBanco, Intercam, and Vector Casa de Bolsa [74][75][25].
11. Legal and Regulatory Framework: US, UK, and International Rules
United States Statutory and Regulatory Authorities
| Authority | What it does | How it applies to shadow banking |
|---|---|---|
| 31 U.S.C. 5330 and FinCEN MSB rules [77][78] | Money transmitters must register with FinCEN and maintain AML programs [77]. | Covers hawaladars and informal remitters operating in the U.S., subject to agent exceptions [4][78]. |
| 18 U.S.C. 1960 [20] | Felony prohibition on unlicensed money transmitting businesses [20]. | Three distinct routes: state licensing failure (without requiring knowledge of the state requirement), federal registration failure, or moving funds known to derive from or intend to support crime [20][28][43]. |
| 18 U.S.C. 1956 [22] | Laundering of monetary instruments and conspiracy (1956(h)) [22]. | Requires specified unlawful activity (SUA) proceeds, knowledge, and promotion, concealment, reporting-avoidance, or international transfer elements [22][3]. |
| 18 U.S.C. 1957 [34] | Monetary transactions over $10,000 in SUA-derived property [34]. | The $10,000 threshold is an element of this offense, not a safe harbor for smaller laundering acts [34]. |
| 31 U.S.C. 5313 and 5324 [68][40] | Currency Transaction Reports (CTRs) over $10,000 and structuring prohibition [68][40]. | Primary tool against bulk cash couriers and student mules splitting deposits across branches [39][41]. |
| 31 U.S.C. 5326 (Geographic Targeting Orders) [79] | Lowers reporting thresholds in targeted geographic areas [79]. | Reissued September 2026 Southwest Border MSB GTO ($1,000 to $10,000 cash CTR threshold through 1 March 2027) [69][70] and 2015 Miami exporter $3,000 GTO [55][56]. |
| Section 311 (31 U.S.C. 5318A) [24] | Special measures against foreign jurisdictions or institutions of primary money laundering concern [24]. | Requires rulemaking for permanent fifth special measure prohibitions; used against Huione Group and proposed for H-Pay [47][66][67]. |
| FEND Off Fentanyl Act (21 U.S.C. 2313a) [25] | Special measures by order (without prior notice and comment) for opioid laundering [25]. | Used in June 2025 against Mexican institutions CIBanco, Intercam, and Vector Casa de Bolsa [74][75]. |
Foreign exchange-control breaches (such as evading China's $50,000 quota) do not automatically constitute a U.S. predicate offense under 18 U.S.C. 1956 [2][22]. Prosecutors must establish a qualifying U.S. predicate crime, an unlicensed transmission violation under 18 U.S.C. 1960, or a sanctions offense [20][22].
United Kingdom Supervision, POCA, and Sanctions Ownership Tests
In the United Kingdom, HM Revenue and Customs (HMRC) supervises MSBs for AML compliance and distinguishes money transmission from physical cash courier activity, while money transmission also requires Financial Conduct Authority (FCA) registration or authorization under the Payment Services Regulations [76]. Under the Proceeds of Crime Act 2002 (POCA) in England and Wales, Crown Prosecution Service (CPS) guidance governs sections 327 (concealing, disguising, converting, or transferring criminal property), 328 (arrangements facilitating another's acquisition or control of criminal property), and 329 (acquisition, use, or possession), alongside regulated-sector failure-to-disclose offenses under section 330 [23]. POCA applies a knowledge-or-suspicion standard (and reasonable grounds for suspicion under section 330), and filing a SAR is distinct from obtaining a Defense Against Money Laundering (DAML) consent [23].
Sanctions ownership rules also differ between the United States and the United Kingdom. Under OFAC's 50 Percent Rule (FAQs 398 to 402), an entity owned 50 percent or more in the aggregate by blocked persons is automatically blocked, whereas control alone does not trigger automatic blocking under that rule [26]. UK sanctions apply a broader test: as HM Treasury and the Foreign, Commonwealth and Development Office (FCDO) detailed in their 2026 Call for Evidence on the Ownership and Control Test in UK Financial Sanctions Regulations, UK rules examine both majority ownership or voting rights and whether a designated person can appoint a board majority or reasonably ensure the entity's affairs follow their wishes [80].
International Standards, Information Sharing, and Proportional De-Risking
FATF Recommendation 14 calls for countries to license or register all money or value transfer service (MVTS) providers, monitor agent lists, and sanction unlicensed operators [72]. Simultaneously, FinCEN's November 2014 Statement on Providing Banking Services to Money Services Businesses rejects wholesale termination of MSB accounts without individualized risk assessment [81], reinforcing FinCEN's 2002 Section 359 report and Passas's 2003 warning that blanket exclusion pushes remitters into unregulated channels [4][19]. To connect domestic bank legs lawfully, FinCEN's June 2026 Section 314(b) Fact Sheet outlines the conditional safe harbor allowing registered institutions to share information on suspected money laundering, terrorist financing, and predicate crimes while protecting SAR confidentiality [45].
12. Three Lenses: Street Vocabulary, Practitioner Reality, and Academic Research
The Street View and Interview Practice
Underground brokers sell four things regulated banks restrict: speed, discretion, access to blocked or quota-limited currencies, and settlement without source-of-funds inquiries [2][4]. Because their trade runs on trust, reputation, and coded handoffs, intercepted chats and interviews feature vernacular terms whose meaning depends on context [1][41].
| Term | Corridor / language | Operational meaning | Investigative question |
|---|---|---|---|
| Hawaladar / hundi | South Asia, Middle East | Hawala broker or South Asian hundi transfer instrument/operator accepting value in one place and arranging payout elsewhere [4]. | Who accepted the obligation, who made the payout, and how were balances settled? |
| Code or banknote token | Global / CMLN / hawala | Reference string or $1 bill serial-number photo authenticating a cash handoff [4][3]. | Which physical delivery does the token verify, and who sent it to both sides? |
| Fei qian ("flying money") | Chinese corridors | Traditional and modern informal value transfer offsetting cross-border payments [32]. | Which counterparty pool inside China or abroad absorbed the offsetting leg? |
| Dixia qianzhuang (地下钱庄) | Mandarin Chinese | Illegal cross-border underground bank [57]. | Does the ring run shell accounts, mirror settlement, gold smuggling, or USDT pools [30][57]? |
| Mirror transaction | Global AML / CMLN | Offsetting domestic payments in two countries replacing a cross-border wire [2][30]. | What instruction or broker ledger connects the two domestic legs? |
| Daigou | Mandarin Chinese | Personal shoppers buying luxury or electronic goods abroad for clients in China [2]. | Were U.S. goods purchased with cartel cash to settle renminbi obligations [2]? |
| Peso broker | Colombia / Latin America | Broker who buys cartel dollars in the U.S. and sells them to Colombian importers [38][35]. | Whose Colombian import invoice did the U.S. or Caribbean wire pay off [35]? |
| Rahbar ("trustee") | Iran / Persian | Offshore front companies retrieving oil revenue for sanctioned Iranian banks [31]. | Which sanctioned Iranian bank directs the Hong Kong, Singapore, or Dubai account [31]? |
| Veksel and sub-agent | Russia / A7 network | Promissory note recording value, paired with third-country companies wiring funds [8]. | Which A7 entity issued the veksel, and which foreign sub-agent cleared the wire [8]? |
| Junket and side bet | Macau / Southeast Asia | VIP casino promoter and undeclared wager multiplying official table stakes [58][50]. | How were mainland gambling debts collected and settled across the border [58]? |
| Parallel bank / cash desk | Europe / Global OTC | Criminal bank or storefront swapping crypto for envelopes of cash [62][63][36]. | Who supplies the physical cash inventory and which OTC wallets clear the digital leg [36]? |
| "Clean funds" / OTC liquidity | Global brokerage | Claim about whether funds will trigger bank freezes or wallet blacklists [1][37]. | What did the speaker know about the predicate origin of the funds? |
Effective interviews walk the subject through one specific transaction from start to finish in their own words: who requested the payment, what service was promised, why funds went to that recipient, who set the rate or fee, what record showed completion, and what happened if payout failed. Testing that explanation against independent chat logs, shipping records, and device data separates a complicit broker from an unwitting merchant or coerced student mule [41][1].
The Practitioner View
- The predicate is invisible, but placement is not. Banks rarely see the drug sale or oil shipment, but they see the cash deposits, student funnel accounts, shells, and property wires [6][2].
- Trade documentation is a blind spot. Banks processing open-account wires seldom hold shipping bills, and agencies do not routinely share customs data [44][42].
- Legitimate remittance users are real. Millions of migrants rely on hawala [4][29]; blanket de-risking pushes communities into unregulated channels [81][19].
- Networks share infrastructure. The same brokers clear cartel cash, scam proceeds, and Russian or Iranian sanctions payments in cash, goods, or USDT [9][32][8].
The Academic View and Live Policy Debates
| Study or report | Core finding | Why it matters |
|---|---|---|
| Pozsar et al., Shadow Banking (NY Fed SR 458, 2010/2012) [16]; FSB NBFI Reports (2018, 2025) [17][18] | Mapped nonbank credit intermediation ($51.6T narrow measure in 2017; 29 jurisdictions in 2025) and replaced "shadow banking" with NBFI. | Separates regulated capital-market NBFI figures from criminal laundering totals [16][18]. |
| Treasury/FinCEN, Section 359 Report (2002) [4], Advisory 33 (2003) [21], and El Qorchi et al., IMF OP 222 (2003) [29] | Explained hawala netting and settlement; confirmed BSA registration applies; analyzed socioeconomic drivers of informal remittance. | Establishes the separation between customer delivery and interbroker settlement [4][29]. |
| Passas, IVTS, Terrorism and Money Laundering (NIJ NCJ 208301, 2003) [19] | Defined IVTS, identified 16 forms, and warned that outlawing informal channels pushes operators underground. | Anchors registration and targeted enforcement over blanket bans [19]. |
| FATF, Professional Money Laundering (2018) [15] and Underground Banking and HOSSPs (2026) [1] | Separated transfer mechanics from professional laundering services; prioritized obligation ledgers and controllers. | Shifts focus from isolated account closures to dismantling service networks [1][15]. |
| Fronzetti Colladon and Remondi, Social Network Analysis (arXiv, 2021) [71] | Analyzed 19 months of Italian factoring data showing relational centrality flags high-risk profiles alongside transaction rules. | Supports multi-link graph analysis to spot brokers bridging separate clusters [71]. |
| GAO, Countering Illicit Finance and Trade (GAO-22-447, 2022) [44]; UNODC, Casinos and Underground Banking (2024) [50] | Identified interagency trade-data gaps against TBML [44] and mapped 340+ Southeast Asian casinos, e-junkets, and crypto [50]. | Explains why trade and Asian casino channels remain durable settlement layers [44][50]. |
| IFI, Debt & Duty (2025) [41]; Fanusie & Terry, Stablecoin Markets (Georgetown Psaros Center, 2025) [37] | Documented 20,000+ student SARs ($13.8B) and gambling coercion [41]; cited a Circle estimate that OTC brokers handle 2x to 3x exchange volume and proposed a hawala-style OTC crackdown [37]. | Links student mule recruitment and unlicensed stablecoin OTC desks to hawala mechanics [41][37]. |
| Policy question | One view | The other view | Where the evidence points |
|---|---|---|---|
| Regulate or shut down informal transfer? | Networks move cartel, terror, and sanctions money [28][54]. | Shutting them pushes legitimate users underground [4][19][81]. | Register and supervise MSBs under 31 U.S.C. 5330 and FATF R.14 while prosecuting unlicensed brokers [77][72]. |
| Hold banks liable for network flows? | Willful failures enabled $670M+ at TD Bank and drew a $1.2B FinCEN penalty at Bank of America [11][12][13][14]. | Banks cannot see customs records or foreign broker ledgers [44][1]. | Strict liability for domestic AML/correspondent failures, paired with 314(b) and trade-data sharing [14][45]. |
| Is the Chinese model the main threat? | CMLNs generated $312B in suspicious activity filings [6][2]. | State shadow networks in Russia ($179.1B+ in A7A5) and Iran move comparable sums [8][27]. | Both; they share shell hubs, OTC liquidity, and trade settlement techniques [8][53]. |
| Does crypto replace shadow banking? | Brokers settle in USDT, A7A5, and guarantee escrow [32][8][47]. | Cash, property, daigou goods, gold, and trade remain indispensable [6][30]. | Stablecoins are a fast settlement rail layered onto cash and trade networks [9][32]. |
13. Investigator's Playbook: Red Flags, Evidence Building, and Choke Points
FinCEN's August 2025 CMLN advisory emphasizes that no single indicator proves illicit activity; analysts must weigh surrounding facts, business consistency, and lawful comparators [2][81].
| Domain | Red flag indicator | Plausible lawful explanation | Corroboration step |
|---|---|---|---|
| Student and mule accounts | Activity exceeding student/homemaker occupation; Chinese passports with mismatched photos; shared phones, addresses, or devices; "translator" escort [2][41]. | Family tuition support or language help for a new arrival. | Reconcile deposit sources (out-of-state cash vs parent wire), check device/IP clustering, and review branch video [41]. |
| Real estate and day care fronts | Wires or cashier's checks for property; rapid flows through adult and senior day care centers [6][2]. | Pooled family purchase or genuine healthcare reimbursement. | Verify wire originators' tie to buyer; audit day care payments against licensed capacity and payroll [6]. |
| Trade and daigou exports | Unrelated payers funding a trader before wires to HK/mainland suppliers; exports without inventory purchases; vague invoices [2][42][8]. | Marketplace aggregator, disclosed collection agent, or drop-shipping. | Request bills of lading, customs filings, and agency mandates; test unit prices and buyer orders [42][44]. |
| Unlicensed hawala fronts | Convenience stores or small trading LLCs wiring large sums to Yemen, Turkey, Iraq, Jordan, or the UAE [28][43]. | Ethnic grocery or regional wholesale import-export business. | Compare wires to store inventory and tax filings; verify FinCEN MSB registration and state licenses [78][20]. |
| Russian A7 sub-agents | Wires routed through third-country shells (especially in Kyrgyzstan) referencing veksels or vague goods [8][60]. | Legitimate Central Asian regional transit trade. | Screen paths against FIN-2026-Alert007 indicators and verify end-user delivery [8]. |
| Iranian rahbar fronts | HK, Singapore, or Dubai trading firms owned by holders of Saint Kitts and Nevis or other CBI passports [27][31]. | Dual-national international commodities merchant. | Check beneficial ownership, place of birth, and vessel data for Iranian bank control [27][26]. |
| Digital assets and OTC | Exposure to A7A5, Garantex/Grinex, or Huione/H-Pay wallets; sudden growth at OTC cash desks [8][47][66]. | Licensed market maker or treasury hedging. | Reconcile internal customer ledgers with on-chain clusters and check Section 311 / OFAC rules [47][67]. |
Three Ledgers and an Eight-Step Workflow
Complex shadow banking investigations rely on three distinct ledgers [1]: (1) a transaction ledger of observed cash, bank, trade, and token movements; (2) an obligation ledger reconstructing who owed whom, preserving chat exports, banknote tokens, and debtor/creditor sign conventions [4][3]; and (3) an attribution record separating nominal account holders from device operators and controllers, with person-by-person evidence of knowledge or suspicion [22][23][41].
- Start at the visible edge where cash deposits, student accounts, shell invoices, or property wires touch the bank [6][2].
- Classify the family (CMLN, hawala, BMPE, TBML, casino/junket, or state shadow network) [1][8].
- Map the domestic network using typed links so payment edges stay distinct from shared device, address, or phone edges [41][71].
- Identify the foreign leg and settlement rail (renminbi, daigou goods, used cars, gold, or USDT/A7A5) [4][2][8].
- Pull trade and loan records to verify shipping, debtor confirmations, and principal sources [42][44].
- Check registrations, GTOs, and sanctions including MSB registration [78], the Southwest Border MSB GTO (through 1 March 2027) [69][70], Section 311 final versus proposed rules [67], FEND orders [74][75], and OFAC 50-percent or UK control tests [26][80].
- File and share with precision using SAR key terms
CMLN-2025-A003[2],FIN-2026-A7NETWORK[8], andFIN-2026-SCAMCENTERS[48], and connect domestic bank legs via Section 314(b) [45]. - Target reusable broker capacity rather than closing isolated mule accounts while leaving the controller's liquidity pool intact [1][33].
| Choke point | Who can act | Tool | Example |
|---|---|---|---|
| Cash placement | Banks, MSBs, FinCEN | CTRs, structuring detection, targeting orders ($1,000 to $10,000) [68][40][79]. | Southwest Border MSB GTO to March 1, 2027 [69][70]; Miami $3,000 exporter GTO [55][56]. |
| Mule and shell accounts | Banks, financial intelligence units (FIUs) | KYC, shared-identifier clustering, 314(b) sharing [41][45]. | UK 600-account network [41]; Jianfei Lu prosecution [33]. |
| Correspondent banking | Banks, FinCEN | Due diligence, Section 311, FEND Off Fentanyl orders [24][25]. | Bank of America $1.2B penalty [14]; Huione rule [47]; Mexican bank FEND orders [74][75]. |
| Trade flows | Banks, customs, Trade Transparency Units (TTUs) | Invoice and price review, customs data sharing [44][42]. | Hezbollah $329M car-trade case [54]; A7 trade alerts [8]. |
| Fronts and exchange houses | OFAC, UK FCDO, partner states | Designations, 50-percent/control blocking, CBI passport checks [26][80]. | May and August 2026 OFAC Iranian actions [27][31]. |
| Casinos and underground rings | Gaming regulators, police | Junket bans, triad prosecutions, joint raids [50]. | Alvin Chau 18-year sentence [58]; May 2026 mainland-HK raids announced Sept 2026 (>15M RMB frozen, ~HK$170M seized) [30][57]. |
| Crypto settlement | Issuers, virtual asset service providers (VASPs), analytics | Wallet freezes, OTC enforcement, token sanctions [37]. | Operation Destabilise [9][46]; Garantex/Grinex and A7A5 [8][60]. |
14. Worked Offsetting Exercise and 2027 Outlook
A Fictional Offsetting Arrangement
A simplified two-broker scenario shows how netting separates bank records from underlying obligations. Broker A (in Country 1) and Broker B (in Country 2) record obligations in one reference currency, excluding fees and spreads. Broker A collects 120,000 units from Customer X and instructs Broker B to pay Beneficiary Y. Broker B pays Y locally. Separately, Broker B collects 90,000 units from Customer Z and instructs Broker A to pay Beneficiary W. Broker A makes that local payout. The two obligations partly offset, leaving Broker A owing Broker B a net 30,000 units.
| Event | Observed movement | Effect on interbroker obligation | Evidentiary limit of the bank statement |
|---|---|---|---|
| 1. X pays A | A receives 120,000 in Country 1. | Receipt alone does not prove B has paid Y. | Shows A received funds; does not show Y or prove illicit source. |
| 2. B pays Y for A | B disburses 120,000 to Y in Country 2. | A owes B 120,000 under their agreement. | B's bank sees a domestic transfer to Y with no link to X. |
| 3. Z pays B | B receives 90,000 in Country 2. | Receipt held by B pending A's payout in Country 1. | Does not show whether Z's funds are lawful or criminal. |
| 4. A pays W for B | A disburses 90,000 to W in Country 1. | B owes A 90,000, offsetting three-quarters of A's debt. | A's bank sees a 120,000 deposit and a 90,000 payout to W. |
| 5. Residual settled | A wires 30,000 to Supplier S for B. | Net 30,000 debt from A to B is discharged via trade [5]. | Looks like an ordinary 30,000 import wire without the ledger. |
If law enforcement independently establishes that X supplied 120,000 units of drug proceeds and chat logs show A knew that origin [22][33], three rules apply:
- Separate original proceeds from gross throughput. Observed movements across Steps 1 to 5 total 450,000 units, but original criminal proceeds are 120,000 units and the net interbroker residual is 30,000 units. Adding every leg exaggerates original proceeds.
- Prove knowledge person by person. Broker A's knowledge does not automatically establish that Customer Z, Beneficiary W, or Supplier S knew of X's drug proceeds [5][1].
- Genuine goods do not launder criminal provenance. Even if Y or S shipped real goods, the payment delivered value for X's criminal enterprise, though an innocent supplier's lack of knowledge governs criminal liability and recovery rules [42][23].
Before referring a case or restricting an account, nine evidentiary checks apply: describe the specific transfer service rather than relying on the label shadow banking [1]; separate customer receipt, local payout, and later interbroker settlement [4]; distinguish observed links from inferred connections [71]; establish who controlled each device and account [41]; document the proof of predicate origin and mental state [22][23]; test plausible lawful explanations [2]; report gross throughput, original proceeds, restrained funds, and forfeiture orders separately [33]; confirm that each cited legal rule was operative on the transaction date [67][73]; and identify the legal authority governing the next disclosure or asset action [45].
Signals to Watch Through 2027
- Intensified bank examinations. After TD Bank's $3.09 billion plea resolution and Bank of America's $1.2 billion FinCEN penalty (plus $750 million OCC penalty and $11.6 million OFAC settlement) in October 2026, examiners will test how banks detect CMLN, student-mule, correspondent, and southwest border activity [11][12][13][14].
- Sustained pressure on Russian and Iranian state networks. With eight OFAC actions against Iranian shadow banking by August 2026 [31] and FinCEN's October 2026 alert on Russia's $179.1 billion A7/A7A5 network [8], banks face strict-liability risk on third-country sub-agents and rahbar fronts [27][8].
- Faster special measures. Treasury's FEND Off Fentanyl authority (21 U.S.C. 2313a) allows immediate orders against foreign institutions [74][75][25], alongside Section 311 actions against guarantee marketplaces and successors like H-Pay [47][66].
- Standing Geographic Targeting Orders. The reissued Southwest Border MSB GTO keeps the $1,000 cash CTR threshold active through at least 1 March 2027 [69][70][79].
- Cross-border Asian enforcement. Joint mainland and Hong Kong operations like the coordinated May 2026 raids announced in September 2026 (more than 170 mainland arrests with over 15 million yuan frozen, and five Hong Kong arrests with roughly HK$170 million in assets seized) show intensifying police coordination against dixia qianzhuang rings [30][57].
- Deeper stablecoin integration and 2028 NBFI rules. Stablecoin settlement and cash-desk activity continue to expand across broker corridors [32][36], while private funds prepare for FinCEN's postponed investment adviser AML rule taking effect on 1 January 2028 [73].