The AML Benchmark typology register

Fraud proceeds gathered from many unconnected remitters into a cash-plausible front, then consolidated outward in amounts set below the reporting threshold.

Evidenced byNCA UK Financial Intelligence Unit, SARs in Action — Money Mules special edition (October 2023), covering mule networks as assessed by the National Economic Crime Centre; UK Finance, Annual Fraud Report 2026 (June 2026), recording authorised push payment fraud losses of £576.4m across 248,070 cases in 2025, a rise of 19 per cent in losses year on year. UK Finance figures are industry-reported: the direction is reliable, the totals are as reported by members rather than independently audited.

A genuine customer instructs a legitimate overseas remittance. A complicit remitter passes the beneficiary details to a criminal network, which pays criminal cash into the innocent beneficiary's account instead, and keeps the customer's clean funds abroad.

Evidenced byLordianto v Commissioner of the Australian Federal Police; Kalimuthu v Commissioner of the Australian Federal Police [2019] HCA 39, in which the High Court of Australia held that accountholders whose accounts received structured cash deposits could not establish the statutory exclusion for property acquired for sufficient consideration without reasonable suspicion, and so could not resist restraint under the Proceeds of Crime Act 2002 — the clearest authority on the position of the innocent accountholder; AUSTRAC, Detect and Report Cuckoo Smurfing financial crime guide (June 2021), produced by the Fintel Alliance, which describes criminals exploiting the legitimate accounts of individuals and businesses expecting genuine inbound funds from overseas, with the accountholder generally unaware; NCA typology material; European underground-banking takedowns combining cash-courier and settlement services.

A genuine cash trading business banks criminal cash alongside its own takings, using the trade's plausible cash profile as cover.

Evidenced byFCA v National Westminster Bank (2021): £264.8m criminal penalty over the Fowler Oldfield account, which took roughly £365m in deposits, around £264m of it cash, between 2012 and 2016. Reported red flags included Scottish notes deposited across England, notes with a strong musty odour, and a monitoring system recording cash deposits as cheques.

A real trading business is used as cover, but the laundered volume bears no relationship to what the business physically does.

Evidenced byAnalytic pattern rather than a single reported case: declared turnover tested against an independent physical measure of activity. Evidenced in practice by FCA v National Westminster Bank (2021), where deposit volumes far exceeded what the trade supported, and by FATF trade and cash-intensive business typologies.

One genuine cash business banks its real takings at Bank A, then opens cloned accounts for the same business at Banks B through E and pays in identical deposits at each.

Evidenced byEconomic Crime and Corporate Transparency Act 2023, sections 188 and 189, in force 15 January 2024, which disapply civil liability for breach of confidentiality where AML-regulated firms share customer information directly with one another to prevent or detect economic crime — the mechanism by which a pattern invisible at any single institution becomes detectable. The typology itself is a cross-institution deposit-pattern inference rather than a single reported case.

Accounts are opened or handed over by recruited individuals, increasingly sourced through social media and messaging platforms, and used for a short burst of receipt-and-forward activity before abandonment.

Evidenced byCifas Fraudscape: more than 22,000 money-muling incidents recorded to the National Fraud Database in 2025 following the introduction of a dedicated 'funds received — money muling' category, within over 106,000 misuse-of-facility cases, a 43 per cent rise on 2024, and filed across more than 14 product types rather than bank accounts alone; FCA multi-firm review of firms' use of the National Fraud Database and mule detection tools; UK Finance campaigns on recruitment of young people.

Value moves between brokers by settlement and offset, with no cross-border transaction for a bank to observe.

Evidenced byEuropol-coordinated action against a parallel-banking network, executed January 2025 and announced May 2025: 17 arrests across Spain, Austria and Belgium and over €21m laundered for organised crime involved in drug trafficking and migrant smuggling, the network supplying illegal hawala banking, cash collection, cash courier services and the exchange of cryptocurrency for cash, with cash collection run in Spain and international settlement handled separately — the settlement-and-offset structure operating alongside crypto rather than being displaced by it. FATF, Guidance for a Risk-Based Approach to Money or Value Transfer Services; FATF Recommendation 14 on MVTS registration or licensing; HMRC supervision of UK money service businesses under the Money Laundering Regulations 2017.

Small test transactions are run to establish where a firm's rules and thresholds sit, and activity is then shaped to stay just inside them. Automation makes the probing cheap and the adaptation continuous.

Evidenced byAnalytic pattern rather than a single reported case. Threshold structuring is a recognised offence in its own right in several jurisdictions, and the adaptation of behaviour once detection rules become known is documented across supervisory and academic literature on rule-based transaction monitoring. Automation lowers the cost of the probing rather than changing its logic.

Victims are exploited through labour or sexual services, and the proceeds are placed through cash-intensive front businesses or through the victims' own accounts, which the controller operates.

Evidenced byFinCEN Advisory FIN-2020-A008, Supplemental Advisory on Identifying and Reporting Human Trafficking and Related Activity (15 October 2020), which added 20 financial and behavioural indicators and four typologies to the 2014 advisory: front companies, exploitative employment practices, funnel accounts and alternative payment methods. See also UK Modern Slavery Act reporting obligations and NCA typology material.

Access to abuse material or live-streamed abuse is bought through small, repeated payments, frequently to high-risk jurisdictions and increasingly through virtual assets and prepaid instruments.

Evidenced byFinCEN Notice FIN-2021-NTC3 (16 September 2021) on identifying and reporting suspicious activity related to online child sexual exploitation; FinCEN financial trend analysis on child sexual exploitation and human trafficking; Internet Watch Foundation reporting on payment methods used for live-streamed abuse.

Fees are collected in the country of origin, frequently held by an intermediary until arrival, and settled through informal value transfer rather than any traceable cross-border payment.

Evidenced byEuropol-coordinated action executed January 2025 and announced May 2025 against a parallel-banking network laundering over €21m for organised crime engaged in drug trafficking and migrant smuggling: 17 arrests across Spain, Austria and Belgium, the network supplying illegal hawala banking, cash collection, cash courier services and cash-for-cryptocurrency exchange, with the investigation having begun in 2023 as an irregular-immigration enquiry — the settlement leg is what connected the smuggling to the financial system. FATF, Financial Flows from Human Trafficking (July 2018), and related FATF work on migrant smuggling; Europol reporting on migrant smuggling networks and their reliance on informal value transfer and escrow-style intermediaries.

Physical currency is consolidated and moved across borders by courier, vehicle or freight, avoiding the banking system entirely until it reaches a jurisdiction where placement is easier.

Evidenced byNCA press release of 28 May 2026 on a cross-border investigation across the island of Ireland: six arrests in Cookstown and the Republic of Ireland, connected to November 2025 arrests in Newry where €450,000 and £258,000 in cash was seized, with a further £176,000 seized in searches — described by the NCA as organised crime groups working together to recycle cash from criminality. NCA Operation Destabilise (December 2024), which exposed a network collecting criminal cash across 28 UK cities and led to 128 arrests worldwide and over £25m in cash and cryptocurrency seized in the UK. FATF and MENAFATF, Money Laundering Through the Physical Transportation of Cash (2015), a joint report drawing on submissions from more than 60 countries, and FATF Recommendation 32 on cash couriers, which requires declaration or disclosure systems at the border and powers to stop or restrain currency and bearer negotiable instruments; European underground-banking takedowns combining cash courier and settlement services.

Funds are staked and withdrawn with minimal play, or bet across correlated outcomes so that losses are accepted as the cost of converting cash into documented winnings.

Evidenced byGambling Commission, Money laundering and terrorist financing risks within the British gambling industry (2026 assessment, covering April 2023 to October 2025), which rates remote and non-remote casinos and betting at the highest risk and flags AI-driven pressure on customer due diligence controls; the Commission's periodic emerging-risks bulletins; and its enforcement actions against operators for AML failings.

Deceased individuals are recorded as directors, officers and shareholders, and accounts opened by the living are run on after death. There is no accomplice who can be pressured, because the nominal principal is dead.

Evidenced byICIJ Panama Papers investigation (2016) into Mossack Fonseca, which reported the firm working with banks to register deceased individuals as company directors in order to conceal the true owners of offshore companies. Compounded in the UK by the absence of any routine death-record check against existing account mandates.

A company is dissolved or struck off the register yet continues to bank, invoice and transact, because registry status is checked at onboarding and never again.

Evidenced byNCA, 16 July 2025: 11,500 UK companies struck off the Companies House register following a multi-agency operation with Companies House, HMRC, the Insolvency Service, the FCA, OPBAS, the Home Office and police forces. One company had registered between 4,000 and 5,000 businesses at a single London address while the businesses themselves operated elsewhere in the UK and overseas, and officers found no real business activity at eleven premises where 30 high-risk trust and company service providers were operating. Companies House gained identity-verification and registry-integrity powers under the Economic Crime and Corporate Transparency Act 2023. Dissolved-company balances vest as bona vacantia via the Treasury Solicitor. The FinCEN final rule of 11 August 2026, effective 14 August 2026, ends beneficial ownership reporting for US-formed companies and, on the point that bears directly on this typology, provides that FinCEN 'will delete previously reported information by U.S. persons—now exempt from the reporting requirements—from the beneficial ownership information database'. A struck-off company leaves behind whatever the registry retained, so withdrawing filings already made removes the one record that would ordinarily outlive the entity. The UK is re-verifying who is behind a company while the US is deleting the answer it already held.

Layered holding structures across free-zone and offshore jurisdictions terminate in a corporate nominee, so the declared beneficial owner is asserted rather than evidenced.

Evidenced byThe two largest beneficial ownership regimes moved in opposite directions within a year, and a structure is now easier to hide in the United States than in the United Kingdom. FinCEN final rule of 11 August 2026, effective on publication in the Federal Register on 14 August 2026, which 'permanently removes the requirement for U.S. companies and U.S. persons to report beneficial ownership information to FinCEN under the Corporate Transparency Act'. FinCEN also announced it 'will delete previously reported information by U.S. persons—now exempt from the reporting requirements—from the beneficial ownership information database'; foreign entities that are reporting companies must still report beneficial ownership information for foreign individuals. A US-formed company is therefore no longer a filer, and the disclosures already made by US persons are being removed rather than retained. Against that: identity verification at Companies House became mandatory on 18 November 2025 under the Economic Crime and Corporate Transparency Act 2023, applying immediately to new director appointments and PSC registrations and phased across existing directors and PSCs over the following twelve months — a direct countermeasure to nominee-fronted structures, and the point at which an asserted beneficial owner starts to carry a verified identity behind it. NCA, 16 July 2025: 11,500 companies struck off following a multi-agency operation, in which one company had registered between 4,000 and 5,000 businesses at a single London address and officers found no real business activity at eleven premises operating 30 high-risk trust and company service providers. FATF Recommendation 24, revised March 2022, and Recommendation 25, revised February 2023; FATF Guidance on Beneficial Ownership of Legal Persons (March 2023) and Guidance on Beneficial Ownership and Transparency of Legal Arrangements (March 2024).

Statements, identity documents and supporting evidence are generated rather than obtained, and are internally consistent in ways genuine documents are not.

Evidenced byFinCEN Alert FIN-2024-Alert004 (13 November 2024) on fraud schemes using generative AI to circumvent identity verification, authentication and due diligence controls, including its red-flag indicators and the SAR key term FIN-2024-DEEPFAKEFRAUD.

Rather than holding a fake face up to the camera, the attacker bypasses the camera entirely: virtual-camera software injects a pre-rendered or real-time face-swapped video stream directly into the onboarding app, so the liveness check is validating a video file rather than a person.

Evidenced byGroup-IB, Weaponized AI (January 2026), documenting 8,065 biometric injection attempts against the digital loan onboarding of a single financial institution between January and August 2025; iProov threat intelligence recording a sharp year-on-year rise in iOS injection attacks across 2025 and dating the point at which injection attacks overtook presentation attacks to 2024; World Economic Forum testing of virtual-camera injection against live selfie flows. Vendor-published figures: treat the direction as reliable and the precise numbers as indicative.

A person who does not exist is assembled from a mixture of real and fabricated data, passed through onboarding, allowed to build a credit and transaction history, and then used as durable laundering infrastructure rather than for a single fraud.

Evidenced byUS Federal Reserve payments-improvement material on the transformation of synthetic identity fraud by generative AI; industry fraud reporting describing synthetic identity as the fastest-growing fraud type globally in 2025 and present in roughly a fifth of detected first-party fraud. The quantitative claims are vendor-published: direction reliable, precise figures indicative.

An entity that does not trade is given everything a due diligence check looks for: a website, product imagery, a founder with a biography and video presence, filed documentation and a digital footprint, all generated rather than earned.

Evidenced byDue diligence industry reporting on generative AI lowering the cost of fabricating a corporate identity — website, product imagery, founder biography and video — to the point where it clears checks designed for a different threat model; security research identifying over 18,000 newly registered domains with seasonal keywords ahead of the 2025 retail season, of which at least 750 were confirmed malicious. Emerging typology: vendor and security-research sourced, with no concluded enforcement case yet.

Cloned voice defeats the control the firm added to catch impersonation: the callback. Voice biometrics and telephone banking authentication are attacked with audio generated from publicly available recordings.

Evidenced byFinCEN Alert FIN-2024-Alert004 (13 November 2024), whose red flags cover GenAI-assisted impersonation used to circumvent identity verification and authentication controls; FATF horizon-scanning material on deepfake impersonation of senior staff and customers to pressure payment authorisation. The video-call variant is evidenced by the Arup case; the voice-only attack on callback and telephone-banking controls is documented by supervisors and vendors rather than by a concluded case.

Synthetic video and voice impersonate executives on a live call to authorise urgent transfers, defeating the callback and video-verification controls firms adopted precisely to stop email-based impersonation.

Evidenced byArup, Hong Kong (January 2024): 15 transfers totalling approximately HK$200m (about US$25.6m) executed in a single day after a finance employee joined a video call on which every other participant was an AI-generated impersonation of a colleague.

An entity claims government ownership to attract the lighter due diligence applied to state bodies, sometimes trading on a name close to a genuine state-linked company.

Evidenced byOCCRP, The Azerbaijani Laundromat (September 2017): approximately US$2.9bn (€2.5bn) moved over two years through four shell companies registered in the UK, with the accounts hosted by Danske Bank's Estonian branch between 2012 and 2014 and funds reaching offshore companies, officials and European politicians.

Residence or citizenship is obtained through qualifying investment, converting funds of uncertain origin into a residency status that subsequently anchors banking relationships and asset holdings.

Evidenced byEuropean Commission v Malta (CJEU, Case C-181/23, judgment of 29 April 2025), holding that Malta's citizenship-by-naturalisation-for-investment programme is contrary to EU law because granting nationality in return for predetermined financial contributions amounts to the commercialisation of Union citizenship, contrary to Article 20 TFEU and Article 4(3) TEU — the scheme granted citizenship for contributions of up to €750,000 with a nominal residence requirement. FATF and OECD joint report, Misuse of Citizenship and Residency by Investment Programmes, which describes criminal exploitation of CBI/RBI schemes as a multi-billion-dollar route to launder proceeds of fraud and corruption, evade justice and obtain third-country access; European Commission work on investor citizenship schemes; the UK's closure of the Tier 1 (Investor) visa route in February 2022.

Funds are pushed into a recently authorised payment or e-money institution, which aggregates client money and breaks the visible chain of attribution.

Evidenced byFCA portfolio letter to payments firms (3 February 2025) on financial crime controls, governance and safeguarding; FATF guidance on nested and downstream relationships. The 2025 UK National Risk Assessment raised EMIs and payment services firms to high risk for money laundering.

A payment firm issues virtual IBANs that resolve to a pooled account, so the IBAN's country code and apparent identity do not correspond to the underlying accountholder, jurisdiction or supervising authority.

Evidenced byEuropean Banking Authority, Report on virtual IBANs, EBA/Rep/2024/08 (May 2024), which found no common industry definition, divergent national interpretation, and a risk of supervisory gaps and regulatory arbitrage where the master account sits in a different member state from the customer or the vIBAN carries a different country code; national supervisory warnings in France and Germany; FCA expectations that firms offering vIBANs hold adequate systems and controls.

A payment processor becomes the laundering channel, onboarding merchants that do not exist or sit in high-risk categories, generating settlement flows that read as ordinary card revenue.

Evidenced byWirecard AG: on 22 June 2020 the company announced that trust account balances of €1.9bn, said to be held by third-party acquiring partners in the Philippines, probably did not exist. BDO Unibank and the Bank of the Philippine Islands both denied any relationship and stated the documents bearing their letterheads were falsified. Wirecard filed for insolvency on 25 June 2020. See also FCA and BaFin supervisory findings on distributor and agent oversight.

A regulated firm's obligations are discharged through a long tail of agents and distributors, and the criminal relationship sits at an agent the principal has never meaningfully supervised.

Evidenced byFCA portfolio letter to payments firms (3 February 2025), which requires a robust and holistic approach to agent and distributor oversight and states that firms remain responsible for the actions of their agents and distributors and for ensuring outsourced functions remain compliant; recurring finding in MSB supervisory enforcement.

Proceeds are recycled as royalty income by paying for streams of content the launderer controls, or by licensing intellectual property between related parties.

Evidenced bySvenska Dagbladet investigation (2023) in which four Swedish gang members and a police investigator described converting proceeds of drug dealing and contract killings into bitcoin, then purchasing fraudulent streams of music released by artists connected to the gangs, a method reported as in wide use since 2019.

Value is loaded onto prepaid or gift instruments, moved physically or as codes, and redeemed or resold, breaking the account-to-account chain entirely.

Evidenced byHM Treasury and Home Office, National Risk Assessment of Money Laundering and Terrorist Financing 2025 (July 2025), paragraph 5.164, which records prepaid cards being used to deposit criminal funds into casino accounts, gambled, and withdrawn to a different payment method, 'potentially keeping the source of funds anonymous', and notes that prepaid cards are identified in the Gambling Commission's supervisory assessment as higher risk so that firms are required to implement controls in response — the instrument's value to a launderer is that it breaks the account-to-account chain at the point of redemption. The Money Laundering and Terrorist Financing (Amendment) Regulations 2026 (SI 2026/621), made 9 June 2026 and in force 30 June 2026, regulation 22, restate the electronic money simplified due diligence thresholds in regulation 38 of the Money Laundering Regulations 2017 in sterling, £150 in place of 150 euros and £50 in place of 50 euros; regulation 14(a) separately lowers the occasional transaction trigger in regulation 27(1)(b) from 1,000 euros to £800, which is below the euro figure it replaces rather than a straight conversion of it. FATF, Guidance for a Risk-Based Approach to Prepaid Cards, Mobile Payments and Internet-Based Payment Services (adopted in the 2012-13 Plenary year), which remains the standard-setting treatment of the product class; recurring feature of daigou and Chinese money laundering network cash-conversion activity.

A respondent bank provides correspondent services to further institutions, so the correspondent's real exposure is to a chain of downstream banks it has never assessed and whose customers it cannot see.

Evidenced byWolfsberg Group Principles for Correspondent Banking (2022) and the Correspondent Banking Due Diligence Questionnaire, the de facto global standard for inter-bank due diligence; BIS Committee on Payments and Market Infrastructures, Correspondent banking — final report (13 July 2016), covering KYC utilities, Legal Entity Identifier use, information sharing and payment message content.

A storefront lists high-value, low-bulk goods and sells to buyers the operator controls, so the platform's own payment rails convert criminal funds into documented sales revenue.

Evidenced byEuropol coordinated e-commerce fraud operations (the eCommerce Action series) and its takedowns of marketplaces trading illegally obtained data and fraudulent shopping infrastructure; Europol, European Money Mule Action EMMA 9 (2024), in which law enforcement across 26 countries arrested 1,013 people in phases run in June, October and November 2024, alongside Europol money muling material recording that over 90 per cent of mule transactions identified through these actions link to cybercrime including e-commerce fraud; FATF guidance on new payment products and services.

An autonomous agent executes the layering stage without a human in the loop: fragmenting funds into micro-transactions, selecting bridge and exchange routes on live liquidity, sizing transfers to stay inside observed thresholds, and adapting when a route stops working.

Evidenced byTRM Labs, Autonomous AI Agents and Financial Crime (2026), identifying layering as the stage most susceptible to automation because route selection, transaction sizing and swap execution can all be optimised without human input; GNET (Global Network on Extremism and Technology), 'Agentic Smurfing: How AI-Autonomous Micro-Laundering is Outpacing Traditional Terrorist Financing Detection' (28 January 2026), on automated high-frequency micro-transaction laundering by extremist fundraising networks; reporting on state actors applying agents to sanctions evasion and automated shell company creation. Emerging typology: the mechanism is documented by analysts and vendor research, and there is not yet a concluded enforcement case to cite.

Assets are swapped rapidly across blockchains and between tokens using bridges and decentralised exchanges, so that following the trail requires a new tool, a new dataset and a new analyst judgment at every hop.

Evidenced byElliptic, The State of Cross-Chain Crime 2025, which places cross-chain crime at approximately US$21bn, roughly triple the 2023 figure, and records that 33 per cent of investigations now span more than three blockchains, 27 per cent more than five and one in five ten or more, with around 12 per cent of the total attributed to DPRK-linked activity. Commercial analytics, so treat the direction as reliable and the precise figures as indicative.

Dollar-denominated stablecoins, predominantly on low-fee chains, have become the settlement layer between criminal enterprises, replacing correspondent banking for cross-border criminal value transfer.

Evidenced byFATF, Targeted Report on Stablecoins and Unhosted Wallets (3 March 2026), attributing 84 per cent of illicit virtual asset transaction volume in 2025 to stablecoins; UNODC reporting describing USDT on the Tron network as settlement infrastructure for organised crime across Southeast Asia; the Tether, Tron and TRM T3 Financial Crime Unit, which reports freezes exceeding US$450m since September 2024.

Escrow-style online marketplaces broker laundering, stolen data, scam infrastructure and trafficking services between criminal counterparties, holding funds until both sides perform.

Evidenced byFinCEN finding that Cambodia-based Huione Group is a foreign financial institution of primary money laundering concern under section 311 of the USA PATRIOT Act (1 May 2025), alleging at least US$4bn laundered between August 2021 and January 2025, including proceeds of North Korean cyber heists and pig-butchering investment scams. Final rule imposing Special Measure 5 issued 15 October 2025, effective 17 November 2025.

Long-form investment and relationship frauds, frequently run from trafficked-labour compounds, collect victim funds through mule accounts and convert them into stablecoins for onward settlement.

Evidenced byUS and UK joint action of 15 October 2025 against the Cambodia-based Prince Group transnational criminal organisation: OFAC designated 146 individuals and entities including chairman Chen Zhi, citing online investment fraud, human trafficking and money laundering, while the UK designated six and froze 19 London properties worth over £100m, alongside a record bitcoin seizure; FinCEN alerts on pig-butchering typologies; UNODC reporting on scam compounds and their settlement infrastructure.

Funds are pooled and redistributed by a mixing service, or swapped into a privacy coin whose ledger does not expose amounts or counterparties, breaking deterministic tracing.

Evidenced byOFAC designation of Blender.io (May 2022) and of Tornado Cash (8 August 2022), the latter cited as having been used to launder more than US$7bn in virtual currency since 2019, including proceeds of the Ronin Bridge theft attributed to the DPRK-linked Lazarus Group, itself designated in September 2019. The legal position then changed: following the Fifth Circuit's November 2024 ruling that Tornado Cash's immutable smart contracts are not 'property' capable of being blocked under IEEPA, OFAC delisted Tornado Cash on 21 March 2025 and a Texas court subsequently enjoined enforcement of the designation. The mechanism is unchanged; what changed is whether the tool itself can be sanctioned, which moves the control burden back onto firms at the off-ramp.

Extortion payments received in bitcoin are converted rapidly into stablecoins or swapped through decentralised protocols, often within hours, before distribution to affiliates.

Evidenced byOFAC designation of 2 June 2026 of Nobitex, Iran's largest virtual currency exchange, together with Wallex, Bitpin and Ramzinex, for sanctions evasion and terrorist financing — the action records the exchange processing transactions for ransomware actors affiliated with the IRGC and giving the Central Bank of Iran access to hundreds of millions of dollars in stablecoins, which is the conversion leg of this typology at state scale. OFAC, Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments (21 September 2021), directed at victims and also at financial institutions, cyber insurers and incident-response firms; OFAC designation the same day of the SUEX OTC virtual currency exchange, over 40 per cent of whose known transaction history was associated with illicit actors across at least eight ransomware variants.

Cash is converted to crypto through machines or over-the-counter brokers who accept cash and settle on-chain, providing a placement route that bypasses bank deposit controls entirely.

Evidenced byR v Osunkoya: the FCA's first criminal prosecution for unregistered cryptoasset activity under the Money Laundering Regulations 2017. The defendant operated crypto ATMs at 28 UK locations through GidiPlus after registration was refused, pleaded guilty on 30 September 2024 and was sentenced to four years' imprisonment on 28 February 2025; FinCEN and US state-level actions on kiosk operators and elder-fraud conversion.

An unregistered or high-risk service obtains market access through an account at a compliant exchange, so the compliant firm's customer is in reality a downstream book of unknown customers.

Evidenced byFATF, Updated Guidance for a Risk-Based Approach to Virtual Assets and VASPs (October 2021); FATF, Understanding and Mitigating Risks from Offshore VASPs; FATF Seventh Targeted Update on Implementation of the Standards on Virtual Assets and VASPs (2026), which calls for closure of remaining regulatory gaps.

Value is held in self-custody between hops and cashed out in many small amounts across multiple venues and individuals, so no single off-ramp sees an amount worth investigating.

Evidenced byFATF, Targeted Report on Stablecoins and Unhosted Wallets: Peer-to-Peer Transactions (3 March 2026), which records over 250 stablecoins in circulation by mid-2025 with a market capitalisation above US$300bn, and attributes 84 per cent of illicit virtual asset transaction volume in 2025 to stablecoins, frequently moved peer-to-peer via unhosted wallets.

A digital asset with no objective value is traded between wallets under common control at escalating prices, manufacturing a sale record that converts funds into apparent trading profit.

Evidenced byChainalysis analysis of NFT wash trading (2022), which identified 262 users who had each sold an NFT to a self-financed address more than 25 times — one of them 830 times — with 110 of those traders profitable to a combined US$8.9m; Chainalysis, 2026 Crypto Crime Report (2026), which excludes wash trading from its illicit-volume totals on the basis that it generates on-chain volume without introducing new capital, and assesses roughly 34 per cent of the trading volume of one sanctioned-linked token as likely artificially inflated; FATF and national FIU material on virtual asset market abuse. Commercial analytics throughout, so treat the figures as indicative and the direction as reliable.

Advisory, market-access and logistics consultancy invoiced in round sums with no hours, rates, deliverables or dates. Services carry no customs reference value, which is why the typology migrated from goods.

Evidenced byFATF and Egmont Group, Trade-Based Money Laundering: Trends and Developments (December 2020), and the companion FATF Trade-Based Money Laundering: Risk Indicators (March 2021), which sets out indicators for private-sector detection.

Invoices are raised on customers sharing a registered office, a director or ownership with the client, so the receivables being financed are the client's own money circulating.

Evidenced byFATF and Egmont Group, Trade-Based Money Laundering: Trends and Developments (December 2020), covering the use of related parties and circular trade flows; FATF Trade-Based Money Laundering: Risk Indicators (March 2021).

Professional laundering networks settle obligations by offsetting: cash is delivered to a criminal group in one country while an equivalent sum is credited in another, with no cross-border transfer. Purchasing agents buy luxury goods on cards and settle the balances with criminal cash.

Evidenced byFinCEN advisory on Chinese Money Laundering Networks (28 August 2025), identifying mirror transactions, money mules and trade-based laundering as the three principal typologies, and flagging approximately US$312bn in suspected CMLN-related transactions connected to Mexico-based cartels between 2020 and 2024.

A document of title is endorsed from party to party to settle obligations. Value transfers repeatedly with no payment crossing any bank, and the goods need not move or exist as described.

Evidenced byFATF, Money Laundering Vulnerabilities of Free Trade Zones (March 2010), identifying inadequate AML/CFT safeguards and relaxed domestic oversight within FTZs; European Parliament research on money laundering and tax evasion risks in free ports.

A real export at a real price leaves surplus foreign currency offshore, which is then sold domestically at a premium against a cover purchase, moving value out of a capital-controlled currency.

Evidenced byGlobal Financial Integrity research on trade misinvoicing, which identified an estimated US$1.6tn of potential misinvoicing across 134 developing countries and value gaps in reported international trade of approximately US$8.7tn over 2008-2017; customs reporting on container misdescription.

Illegally sourced timber, minerals, fish, wildlife, waste or oil is commingled with legitimate product early in the supply chain, after which the two are indistinguishable and the proceeds enter the financial system as ordinary commodity trade.

Evidenced byUS Treasury (OFAC) press release of 25 June 2026 designating Gasabo Gold Refinery LTD of Kigali, its chairman and general manager, and three Rwandan mining companies, over the smuggling of at least 60kg of gold out of M23-controlled eastern DRC into Rwanda in early 2026 for refining — illegal mining proceeds entering the financial system as ordinary mineral trade, with the refining step performing the commingling. Part of a sequence of Treasury actions on the same conflict dated 2 March, 30 April and 2 June 2026. FATF, Money Laundering from Environmental Crime (July 2021), analysing 230 cases across forestry crime, illegal mining, waste trafficking, illegal wildlife trade, illegal extraction of oil and fisheries crime, estimating annual criminal gains of roughly US$110bn to US$281bn and identifying commingling and anonymous shell and front companies as the dominant concealment methods.

Tobacco, alcohol and fuel are diverted from duty-suspended movement or manufactured illicitly, and the proceeds are placed through wholesale and retail businesses that plausibly handle the same goods.

Evidenced byHMRC alcohol strategy and enforcement against inward diversion fraud, in which genuine branded consignments are exported without VAT and duty and smuggled back into the UK untaxed. UK alcohol duty receipts were around £12.6bn in 2024-25, with an estimated 8 per cent — roughly £1.2bn — uncollected each year through fraud and error; enforcement is coordinated across HMRC, Border Force and the NCA. See also Europol and OLAF reporting on illicit tobacco supply chains.

Counterfeit product is sold through online marketplaces and social channels, with proceeds settled through payment service providers and consolidated by aggregators before repatriation.

Evidenced byEUIPO and OECD, Mapping Global Trade in Fakes 2025, which estimates global trade in counterfeit and pirated goods at approximately US$467bn in 2021, including around US$117bn entering the EU, equal to 4.7 per cent of total EU imports; EU customs reporting on counterfeit detentions.

Cash buys gold, gold crosses borders as scrap, jewellery or dore, and refining resets its origin. Bars are also used to move value physically, sometimes with counterfeit cores.

Evidenced byUS Treasury (OFAC) press release of 25 June 2026 designating Gasabo Gold Refinery LTD of Kigali, its chairman Jean Malic Kalima and general manager Bosco Kayobotsi, together with Bugambira Mines LTD, Wolfram Mining and Processing LTD and Rwinkwavu Mining Corporation LTD, over the smuggling of at least 60kg of gold out of M23-controlled eastern DRC into Rwanda in early 2026 for processing — the refining step is what severs the metal from its origin. Part of a sequence of Treasury actions on the same conflict dated 2 March, 30 April and 2 June 2026. Historic comparator: Operation Polar Cap (concluded 1989), in which the 'La Mina' network laundered approximately US$1.2bn of cocaine proceeds over two years through Los Angeles jewellery businesses using a bogus scrap-gold trade and falsified certificates, with charges brought against 127 people and two Latin American banks; the scheme surfaced when a guard noticed cash bundles through a tear in a box declared as gold. See also Swissaid and UN Group of Experts reporting on undeclared African gold flows.

An object of unverifiable age is commissioned or acquired, given a provenance story, consigned through a trust and bought back by its own beneficial owner through competing bidders, converting funds into an auction settlement.

Evidenced byThe Money Laundering and Terrorist Financing (Amendment) Regulations 2026 (SI 2026/621), made 9 June 2026 and in force 30 June 2026. Regulation 9 substitutes '£10,000' for '10,000 euros' in each place it occurs in regulation 14 of the Money Laundering Regulations 2017, the provision bringing high value dealers, casinos, auction platforms and art market participants into scope, and regulation 14(f)(i) and (g)(i) and (ii) align the customer due diligence transaction-based triggers for art market participants with those already applying to high value dealers. The practical effect is that an intermediary is in scope on a sterling figure rather than a converted one, which removes the exchange-rate calculation a dealer previously had to perform to know whether a sale was caught at all; US Senate Permanent Subcommittee on Investigations, report of 28 July 2020 following a two-year inquiry, which described the US art market as the largest legal unregulated industry in the country and found that sanctioned Russian businessmen Arkady and Boris Rotenberg spent more than US$18m on art in the US within months of designation; UK art market participants were first brought into the regulated sector by the 2019 amendments to the Money Laundering Regulations.

Property is nominally lost to a creditor while beneficial ownership never changes, or is held through a dissolved foreign entity that remains the registered owner.

Evidenced byFinCEN's Anti-Money Laundering Regulations for Residential Real Estate Transfers Rule, in force 1 March 2026 after a postponement announced on 30 September 2025 from the original 1 December 2025 date. It requires a report on non-financed residential transfers to a legal entity or a trust, which is the route this typology depends on: where no lender is involved there is no institution performing due diligence, and the transfer leaves no bank record to review. Geographic Targeting Orders remained in effect during the postponement. Young v Young [2013] EWHC 3637 (Fam), Moor J, 22 November 2013: the husband maintained he was penniless and bankrupt; the court found he had concealed assets of roughly £45m gross and £40m net, and awarded the wife a £20m lump sum. Widely reported claims of a £700m concealed fortune reflect the wife's case, not the court's findings. See also UK Register of Overseas Entities disclosures on offshore-held property.

A property portfolio reports rent from tenants who do not exist, giving illicit cash a documented income stream and a tax history.

Evidenced byLetting agency businesses were brought into the UK regulated sector by the Money Laundering and Terrorist Financing (Amendment) Regulations 2019, giving supervised visibility of rental flows; HMRC and NCA work on property-based laundering and fabricated income streams. The specific ghost-tenant pattern is an analytic inference from occupancy and utility inconsistency rather than a single reported case.

Watches, vehicles, gemstones and collectables convert cash into portable value that resells readily and carries no ownership registry, moving across borders as personal property.

Evidenced byHM Treasury and Home Office, National Risk Assessment of Money Laundering and Terrorist Financing 2025 (July 2025), paragraphs 5.132 and 5.133, which record the high value dealer sector shifting away from cash toward electronic payment methods including smartphone payments and gift cards, and observe that this 'has the potential to alter the regulatory landscape, as the UK's MLRs primarily focus on cash transactions' — the exposure moves out of the trigger the rules were written around. The same assessment notes the sector offers small objects of high value that move across borders without individual export licences and may not be checked by customs. The Money Laundering and Terrorist Financing (Amendment) Regulations 2026 (SI 2026/621), made 9 June 2026 and in force 30 June 2026, regulation 9, restate the high value dealer threshold in regulation 14 of the Money Laundering Regulations 2017 as £10,000 in place of 10,000 euros, with the matching customer due diligence trigger in regulation 27(3) restated the same way. The scope test is now a sterling figure rather than a converted one, but it remains a threshold on the transaction rather than on the payment method, which is the gap paragraph 5.133 identifies; FATF, Guidance on the Risk-Based Approach for Dealers in Precious Metals and Stones (adopted October 2008 Plenary); UK high value dealer registration requirements under the Money Laundering Regulations 2017.

A policy is used as a store and cleaning mechanism: a large single premium is paid, the policy is surrendered early at a deliberate loss, and the proceeds leave as an insurer payment, which downstream institutions treat as inherently clean.

Evidenced byFATF, Guidance for a Risk-Based Approach for the Life Insurance Sector (October 2018), developed with the private sector; and FATF's earlier typologies work on the insurance sector, which records that payments originating from insurers are widely assumed to be clean and attract little downstream scrutiny.

Borrowing is obtained on fabricated income, undisclosed deposits of criminal origin, or inflated valuations, and the loan both launders the deposit and generates a legitimate ownership record.

Evidenced byUK Finance, Mortgage Fraud: Good Practice Guidance Note; the FCA's mortgage fraud reporting scheme for lenders and advisers, and its thematic review of lenders' systems and controls against mortgage fraud; Council for Licensed Conveyancers, Acting for Lenders and Prevention and Detection of Mortgage Fraud guidance (January 2025); SRA warnings on source of funds in property transactions.

Capability is rented rather than built. Subscription platforms supply mule account provisioning, KYC-bypass tooling, synthetic identity generation, deepfake kits and end-to-end laundering, so an operator needs money rather than skill.

Evidenced byFATF, Professional Money Laundering (26 July 2018), describing professional launderers, organisations and networks that launder for a fee and setting out their characteristics and tools; FATF material identifying money-laundering-as-a-service with tiered service levels; threat-intelligence reporting on mule-as-a-service providers and messaging-platform channels advertising virtual-camera software, deepfake generators and KYC-bypass services.

Fabricated debt is guaranteed, defaulted, sued upon in a compliant jurisdiction and settled by court order, so proceeds arrive as a judgment rather than a payment.

Evidenced byOCCRP, The Russian Laundromat: approximately US$20bn moved between 2010 and spring 2014 through a core of 21 shell companies registered in the UK, Cyprus and New Zealand. Fabricated debt was enforced by more than 50 court orders issued by over 20 judges across 15 Moldovan courts, with funds routed through Moldindconbank. Higher figures circulating in secondary sources are not OCCRP's.

A regulated professional's client account is used as a banking facility, lending the transaction the firm's own reputational cover and obscuring the underlying parties.

Evidenced byThe Money Laundering and Terrorist Financing (Amendment) Regulations 2026 (SI 2026/621), made 9 June 2026 and in force 30 June 2026, which insert new paragraphs (10) to (18) into regulation 29 of the Money Laundering Regulations 2017 and put the obligation on the bank holding the account rather than only on the firm operating it. Where a relevant person provides a customer with a new pooled account it must 'take reasonable measures to understand the purpose of the pooled account and how the customer proposes to use it', be satisfied that the purpose and proposed use 'is consistent with the relevant person's knowledge of the customer, the customer's business and risk profile', conduct updated customer due diligence where it is not so satisfied, and then assess, manage and mitigate the money laundering risk arising from that use; the customer must keep written records and provide information about the account on request. Note the limit: the duty attaches to accounts opened on or after commencement, so an existing client account book is not brought into it. SRA Accounts Rules, rule 3.3 ('You must not use a client account to provide banking facilities to clients or third parties'), and the SRA warning notice on improper use of a client account as a banking facility, first issued 2014 and updated in 2018 and 2023. The National Risk Assessment 2025 (July 2025) carries the clearest recent case: an SRA forensic investigation found that a solicitor had allowed more than £28 million to pass through his firm's client account without any underlying legal transaction, in breach of the Solicitors Accounts Rules and the Money Laundering Regulations. He had separately tipped off a client under Serious Fraud Office investigation and supplied a fabricated letter of engagement in response to an SFO request; he was prosecuted for tipping off and sentenced in 2023 to nine months' imprisonment suspended for 18 months, and the Solicitors Disciplinary Tribunal suspended him from practice for 12 months on 25 February 2025.

Company formation, nominee director, registered office and trustee services are supplied at scale, assembling the structures other typologies depend on.

Evidenced byThe Money Laundering and Terrorist Financing (Amendment) Regulations 2026 (SI 2026/621), made 9 June 2026 and in force 30 June 2026. Regulation 7 inserts 'selling an off-the-shelf firm' into regulation 12(2) of the Money Laundering Regulations 2017 as a trust or company service provider activity, and regulation 4 amends regulation 4(2) so that supplying it counts as a business relationship rather than a one-off transaction, which brings ongoing monitoring with it. New regulation 12(3) defines an off-the-shelf firm as one that either 'does not carry on business' or 'carries on business but such business is not the main activity carried on by the trust or company service provider'. The gap this closes is the one the typology runs through: the sale of a ready-made company was the moment the structure changed hands, and it sat outside the list of services that put the provider in scope. Running the other way, the FinCEN final rule of 11 August 2026, effective 14 August 2026, 'permanently removes the requirement for U.S. companies and U.S. persons to report beneficial ownership information to FinCEN under the Corporate Transparency Act', and FinCEN is deleting the US-person data already filed. The product a formation agent sells in the United States therefore became materially more opaque in the same year the UK made the provider's own conduct more visible, and a customer presenting a recently formed US entity now arrives with less behind it than one formed in the UK. The 2025 UK National Risk Assessment, which records rising risk for trust or company service providers and professional enablers, particularly where services are supplied cross-border. FATF and the Egmont Group, Concealment of Beneficial Ownership (July 2018), which found lawyers to be the professionals most often involved in obscuring beneficial ownership, identified legal trust and client accounts as frequently used to disguise it, and named legal professional privilege as a barrier to recovering beneficial ownership information.

Books and records are falsified to give criminal funds a documented commercial origin, and a professional accountant is then engaged to prepare financial statements from them. The resulting accounts carry the adviser's standing rather than the client's, and are what a bank, a lender or a registry subsequently relies on.

Evidenced byHM Treasury and Home Office, National Risk Assessment of Money Laundering and Terrorist Financing 2025 (July 2025), paragraph 5.208, which assesses the money laundering risk for accountancy service providers as high and describes them being used to 'provide the appearance of legitimacy to transactions that feature criminal funds, for example, through the use of accountant's certificates of confirmation to support the falsification of documents such as accounts and invoices', noting the risk is 'particularly high for clients with cash intensive businesses as this can disguise the real source of funds and allow for the easier mixing between legitimate and criminal earnings'. Paragraph 5.207 records approximately 50,000 accountancy service providers supervised by 13 professional body supervisors or by HMRC, the majority small firms. See also FATF, Professional Money Laundering (July 2018), on professional launderers maintaining shadow accounting records of transactions involving proceeds of crime.

Value is extracted from a company before it is wound up, and the liquidation then terminates scrutiny: the trade continues through a successor while the debts and the records stay with the entity that failed. The wind-up presents as ordinary commercial failure, which is the point.

Evidenced byHM Treasury and Home Office, National Risk Assessment of Money Laundering and Terrorist Financing 2025 (July 2025), paragraph 3.103: 'To avoid detection, the criminals may use phoenixing to continue their criminality without the bad reputation associated with the previous company', describing the same business carried on successively through companies each of which becomes insolvent in turn, with the business but not the debts transferred onward, and recording the use of nominee directors and pre-registered shelf companies to offset the obvious indicators. Paragraph 5.207 names insolvency services among the accountancy services that can be used for money laundering purposes. See also CCAB, Defence Against Money Laundering Guidance for Insolvency Practitioners (October 2021), and Insolvency Service enforcement outcomes reporting on director disqualification.

Assets pass through the administration of a deceased person's estate, where the party whose funds they were is beyond enquiry. Due diligence is performed on executors and beneficiaries; the deceased is not checked, and the estate's assets move through a firm's client account before distribution.

Evidenced bySolicitors Regulation Authority, thematic review of probate and estate administration (13 December 2024): 25 firms visited, three referred for investigation, one of them for anti-money laundering failures. The review records that where a firm acts as executor of an estate it is administering there is less external oversight of its actions than where it acts for a lay executor, and cites cases of probate practitioners misappropriating estate funds and being convicted of fraud offences; it also found firms carrying out identity checks on beneficiaries of will trusts only where they judged the risk heightened. Legal Sector Affinity Group, Anti-Money Laundering Guidance for the Legal Sector (2023), and the Law Society banking practices protocol for estate administration. The absence of any check on the deceased is a structural feature of the process rather than a reported failure at a single firm.

Matched opposite trades in the same securities are placed through two branches by commonly controlled entities, converting currency and moving value while appearing to be ordinary market activity.

Evidenced byNYDFS consent order with Deutsche Bank (30 January 2017), US$425m, and FCA Final Notice, £163m, concerning mirror trades that moved approximately US$10bn out of Russia between 2011 and 2014.

Subscribing for shares in a controlled vehicle is used as the payment mechanism for goods or obligations, with the security standing in for an invoice.

Evidenced byFINRA Regulatory Notice 23-08 (2023) on broker-dealer responsibilities in private placements, and FINRA Rule 3110 requiring supervisory systems and written procedures over private placement offerings before they are marketed or sold; FINRA, 2026 Annual Regulatory Oversight Report (December 2025), setting out the expectation that firms conduct a reasonable investigation of the issuer, its management, the claims made in the offering and the intended use of proceeds, respond to red flags and retain evidence of that diligence, and recording continuing deficiencies in due diligence on crypto-related private placements; FCA and SEC enforcement concerning placements used to settle unrelated obligations.

A campaign is funded by pre-arranged participants, run over several weeks and wound up, with the venture's failure removing any party with an interest in scrutinising it.

Evidenced byFATF, Crowdfunding for Terrorism Financing (October 2023), which sets out four abuse routes — humanitarian, charitable or non-profit causes; social media and messaging apps; the interaction of crowdfunding with virtual assets; and dedicated crowdfunding platforms — and identifies limited terrorist financing expertise within the crowdfunding industry as a core detection gap.

Improper payments are routed as consultancy fees, royalties, dividends or capital gains so the receipt reads as ordinary income.

Evidenced byOperation Lava Jato: in December 2016 Odebrecht and Braskem admitted paying approximately US$788m in bribes to officials across a dozen countries and agreed to pay US$3.5bn to resolve charges with US, Brazilian and Swiss authorities. 1MDB: the US Department of Justice alleges more than US$4.5bn was misappropriated from the fund between 2009 and 2015 through international money laundering and embezzlement, with roughly US$1.4bn repatriated to Malaysia to date.

Funding is raised in small amounts through appeals, crowdfunding and sham charitable structures, and moved in values individually too low to trigger monitoring. The concern is destination and intent rather than the size or origin of the funds.

Evidenced byFATF, Comprehensive Update on Terrorist Financing Risks (July 2025); RUSI, Reassessing the Financing of Terrorism (2025); blockchain analytics reporting on extremist fundraising, including appeals that raised several million dollars in virtual assets before designation and issuer-level freezing.

A charitable structure is created or captured to provide a legitimate-looking channel for funds, exploiting the sector's donation-based inflows and disbursement to high-risk jurisdictions.

Evidenced byFATF Recommendation 8, amended at the October 2023 Plenary to require risk-based rather than blanket measures, and the accompanying Best Practices Paper on Combating the Terrorist Financing Abuse of Non-Profit Organisations, which for the first time sets out examples of bad practice as well as good; FATF, Comprehensive Update on Terrorist Financing Risks (July 2025), describing a shift from abuse of legitimate charities toward sham non-profits and fraudulent appeals.

Clubs, sponsorship and image rights provide a channel for funds with weak valuation discipline, cross-border payments and a reputational shield that discourages scrutiny.

Evidenced byHM Treasury and Home Office, National Risk Assessment of Money Laundering and Terrorist Financing 2025 (July 2025), paragraphs 6.15 to 6.21, which set out the channel in the terms this entry describes: clubs 'could be used as a vehicle both to launder funds, as well as a final destination for criminal money to be invested', through 'player transfers, falsification of ticket sales, falsification of services provided or received by high risk commercial sectors, merchandise sales and club or player sponsorship deals and image rights', and 'player values in particular are difficult to objectively determine which increases the risk of manipulation for money laundering'. The assessment records lower-league clubs in financial distress being lent criminal funds where traditional lenders will not lend, ownership structures using layered front and shell companies in low-transparency jurisdictions that obscure the ultimate beneficiaries of clubs and of sponsorship arrangements, and agents and 'fixers' operating outside regulatory supervision because they are employed in house rather than by way of business — while noting that the scale of criminality in football 'remains an intelligence gap'; FATF, Money Laundering through the Football Sector (July 2009), drawing on a questionnaire answered by 25 countries and over 20 case examples, remains the underlying structural study; Council of Europe work on the manipulation of sports competitions and related financial flows.

Criminal funds are placed offshore and then lent back to the launderer, so the money returns as borrowing, complete with a repayment schedule, an interest deduction and an apparently arm's-length lender.

Evidenced byFATF, Professional Money Laundering (July 2018), which documents loan-back arrangements among the techniques used by professional laundering networks; recurring feature of professional-enabler cases involving offshore structures.

Goods are traded through a chain of companies across borders. A trader collects VAT and disappears before accounting for it, while the goods may circulate repeatedly through the same chain.

Evidenced byEuropean Public Prosecutor's Office, 5 May 2026: a businessman was arrested in Italy for laundering and reinvesting the proceeds of a VAT carousel fraud, having 'travelled regularly from the United Arab Emirates to Italy to collect cash generated by the fraudulent scheme and transfer it abroad, mainly to Dubai, through transactions designed to conceal the criminal origin of the funds', with further layering through a Slovenian company that imported goods from suppliers in China, Türkiye and the UAE and resold them to complicit Italian companies; assets of more than €4.6m were frozen, including a cryptocurrency wallet of approximately €756,000 — the laundering stage, which is the part a bank sees; EPPO Investigation Nebula, 27 May 2026: seven members of an organised criminal group arrested over an estimated €78m of unpaid VAT, in which a network of companies bought hygiene and household products from Italian wholesalers and resold them 'only formally' to missing trader companies around Naples, which then 'sold the goods onward without paying the VAT due', the entities being registered to strawmen and continuously replaced; Axel Kittel v Belgian State (CJEU, C-439/04, judgment of 2006) remains the basis on which HMRC denies input tax where a trader knew or should have known its transactions were connected to VAT fraud — no proof of actual knowledge is required, and ignoring suspicious pricing, unusual payment terms or opaque supply chains is sufficient.

A workforce is fragmented across hundreds or thousands of small companies so each can claim employment allowances and VAT thresholds it is not entitled to, with companies replaced on a rolling basis before scrutiny arrives.

Evidenced byElphysic Ltd & Ors v HMRC [2025] UKUT 236 (TCC), 17 July 2025: the Upper Tribunal upheld HMRC's VAT deregistration of mini-umbrella companies under the Ablessio principle, holding that no requirement of director knowledge applies where directors being nominal was a design feature of the scheme. HMRC's case concerned a structure of over 18,000 MUCs with more than £260m of tax at stake.

Grants, loans and relief schemes are claimed by entities created or repurposed for the claim, with proceeds extracted before any repayment obligation crystallises.

Evidenced byInsolvency Service enforcement on Bounce Back Loan Scheme abuse: 1,036 directors disqualified in 2024-25, of which 736 related to Covid loan abuse, with an average ban of eight years; disqualifications exceeding ten years rose from 6 per cent in 2021 to 47.1 per cent in 2023-24, alongside bankruptcy restrictions and criminal prosecutions.

Ownership is diluted below control thresholds or transferred to non-designated relatives and managers after designation, leaving effective control unchanged.

Evidenced byOFSI and FCDO joint guidance on the meaning of ownership and control under UK sanctions, issued following Mints v National Bank Trust and Bank Otkritie (Court of Appeal, October 2023); OFAC's 50 per cent rule, which addresses ownership but not control, so an entity controlled without being 50 per cent owned is not automatically blocked. Note the UK applies 'more than 50 per cent', creating divergence from the US and EU tests.

Ageing tankers under opaque ownership carry sanctioned cargo, disabling or falsifying position reporting and conducting ship-to-ship transfers at sea so the cargo's origin is severed from its documentation.

Evidenced byThe G7 price cap on Russian crude, in force since December 2022, which bars Western shipping, insurance and related services above a set threshold and depends on attestation — the mechanism fraudulent paperwork is used to defeat. OFAC designated PAO Sovcomflot and associated tankers on 23 February 2024, and on 10 January 2025 designated over 180 vessels involved in transporting Russian oil and LNG alongside insurers, traders and oilfield service providers. Maritime intelligence reporting records AIS manipulation and elevated covert ship-to-ship transfers through 2025.

Controlled components are exported to an intermediary in a non-sanctioning jurisdiction and re-exported onward, with the end user misdeclared at the first hop.

Evidenced byUnited States v Mazulina: on 24 June 2026 a federal court in Brooklyn sentenced the former western regional manager of freight forwarder Delex Air Cargo LLC to 18 months' imprisonment after a guilty plea to conspiring to ship industrial oil and gas equipment to Russia through intermediary countries using falsified export documentation — the transhipment-and-misdeclaration mechanism in a single case. A federal court in Kansas separately sentenced a former vice president of KanRus Trading Company Inc to 32 months for exporting controlled avionics to Russian end users without licences. The Common High Priority Items List maintained jointly by the US, UK, EU and Japan, covering goods identified as critical to Russian weapons systems and military development, and expanded across successive updates from September 2023; US Bureau of Industry and Security and UK guidance to exporters on third-party intermediaries and transshipment points used to obscure end users, including the joint Commerce, Treasury and Justice tri-seal compliance note on third-party intermediaries.

State-sponsored groups steal digital assets at scale from exchanges and protocols, then launder them through mixers, cross-chain bridges and complicit over-the-counter brokers to fund state programmes.

Evidenced byBybit, 21 February 2025: approximately US$1.5bn in Ethereum stolen, attributed by the FBI to North Korean actors under the designation 'TraderTraitor' — the largest cryptocurrency theft recorded. Industry tracing places DPRK-linked thefts above US$2bn across 2025. See also OFAC designations of associated laundering infrastructure.

Operatives obtain remote technical roles using stolen or fabricated identities, often through intermediaries, and route salary payments onward to sanctioned regimes.

Evidenced byOFAC designations targeting DPRK IT worker facilitation, including Sim Hyon Sop of Korea Kwangson Banking Corporation (April 2023) and Chinyong Information Technology Cooperation Company with Kim Sang Man (May 2023); a further OFAC action of 12 March 2026 against six individuals and two entities, citing IT worker fraud against US businesses generating close to US$800m in 2024; US DOJ civil forfeiture proceedings over US$7.74m laundered on behalf of the North Korean government.