Enforcement turns to the infrastructure of crime

This Week in Financial Crime

This is a catch-up edition covering the three and a half weeks since Lab Report #23, and the period has a clear shape. One thread runs through almost every story: enforcement is moving away from the visible offender and towards the infrastructure that makes offending repeatable. That means the airport check-in desk that waves cash couriers through, the stablecoin wallet that converts oil revenue into usable value, the tanker registered to a Marshall Islands shell, the professional launderer who quotes a five per cent fee, and the director who never verified their identity at Companies House. A second thread is the internationalisation of scam-centre disruption. The US-UK partnership signed in early September has now produced its first visible operation, with more than 130 people detained in Ghana. A third is the UK's own reckoning with victim protection, as mandatory APP reimbursement turns two and its boundaries come under pressure. Taken together, the picture is of states learning to target the conditions of crime rather than only its perpetrators. The question that runs through this edition is whether those conditions can be closed faster than offenders can rebuild them elsewhere.

US-UK scam-centre partnership reaches Ghana

On 8 October, FBI Director Kash Patel announced that more than 130 people had been arrested or detained in Ghana under Operation Blackout, with nearly $10 million in identified losses, 89 victims and more than 300 devices seized. Patel said those detained include trafficked workers who will be repatriated. US Attorney Jeanine Pirro travelled to London with members of the Scam Center Strike Force to work alongside the National Crime Agency, the first visible product of the DOJ-NCA-CPS memorandum covered in edition #22. Ghana's communications minister, Samuel Nartey George, pushed back on claims that the FBI had executed the operation alone, saying Ghanaian agencies led the raids with NCA support.

Two points deserve emphasis. First, the presence of trafficked workers among those detained is not incidental. Scam compounds increasingly operate on a spectrum of coercion, and the research highlighted below shows that West African fraud “academies” use movement restrictions, debt and spiritual threats to secure compliance. Arrest counts therefore tell us little until we know who among the 130 is an offender, who is a victim, and who is both. Second, the dispute over credit matters for displacement. Compound operators move to wherever local enforcement capacity is weakest, so an operation that strengthens Ghana's own investigative institutions has more lasting preventive value than one that is seen as externally imposed. Arrests without prosecution, asset recovery and victim support simply reset the opportunity structure.

Operation Economic Outcast: from banks to factories and tankers

Treasury's Iran campaign widened considerably over the period. On 1 October, OFAC issued new sectoral determinations under E.O. 13902 for Iran's automotive and rail sectors, designating Iran Khodro and SAIPA (together over 90 per cent of the domestic car market), the national railway company, heavy-equipment manufacturer HEPCO and its Shanghai procurement arm. It also designated foreign suppliers in Indonesia, the UAE, Türkiye, Hong Kong and Germany, and a Hong Kong shell-company network that allegedly received tens of millions of euros and dollars from Iran's shadow-banking system. A week later, on 8 October, Treasury designated 17 tankers and their owning companies, claiming the action “effectively neutralizes the vast majority” of Iran's remaining shadow fleet. Reuters reported one analyst's view that the impact may be muted because Iran had already delivered virtually all of its oil at sea.

The fleet designations are a useful lesson in the structure of sanctions evasion. Almost every vessel is owned by a single-ship company registered in the Marshall Islands, Hong Kong or the British Virgin Islands, and flagged in Comoros, Cameroon, Panama, Vanuatu or San Marino. This is corporate anonymity and flag-of-convenience arbitrage working together, and it shows why designating a vessel without dismantling the corporate wrapper only buys time. Notably, OFAC also delisted two tankers that had been sold to non-sanctioned operators. Delisting is the least discussed part of situational prevention through sanctions: if the state offers a credible route back into licit trade, it changes the rational-choice calculation for owners deciding whether to keep a ship in the dark fleet.

$61m in Iranian oil proceeds traced through Binance accounts

The same campaign produced a significant crypto case. On 15 September, the Southern District of New York filed a civil forfeiture complaint against more than $61 million in USDT held in Binance accounts controlled by two Chinese companies, Blessed Trust and Hexa Whale. Prosecutors allege the funds were proceeds of black-market Iranian oil sales destined for the regime and the IRGC, within a wider network that handled more than $1.5 billion. AML Intelligence reported that the funds sat across ten Tron addresses frozen in 2025, and that Binance has not been accused of wrongdoing. The following day, FinCEN convened global financial institutions in Washington to share intelligence on the facilitators giving Iran access to US correspondent banking.

Blessed Trust allegedly presented itself as a wealth-management or virtual-asset custody firm. That self-description is the analytical point. Laundering intermediaries succeed by adopting a legitimate occupational identity that places them just outside the registration perimeter, a modern form of the trust exploitation that Sutherland identified in white-collar offending. The enforcement response is equally telling. The choke point was not the exchange's willingness to refuse business but the ability to freeze a stablecoin balance. Stablecoin issuers are becoming the capable guardians of the on-chain economy, whether or not they wanted the role.

Tren de Aragua and the fraud-terrorism convergence

On 30 September, OFAC designated ten targets in a Tren de Aragua ATM-jackpotting network, including its alleged leader and malware engineer “Prometheus”, who is on the FBI's Ten Most Wanted list, and seven Tron addresses. The network allegedly used malware to force US cash machines to dispense money without debiting accounts, then laundered proceeds through cryptocurrency and Mexican front companies. Treasury cites reported US losses of $40.73 million across more than 1,500 attacks as of August 2025, and 98 people indicted for jackpotting since October 2025. Because Tren de Aragua is designated a Foreign Terrorist Organisation, the designations were made under counter-terrorism as well as cyber authorities.

This case shows the legal category of a crime increasingly following the identity of the offender group rather than the method. ATM jackpotting is technically a cyber-enabled theft, but once the proceeds fund a designated organisation it becomes terrorist financing, with all the secondary-sanctions exposure that entails. For financial institutions, the practical consequence is that fraud typologies and terrorist-financing typologies can no longer be monitored in separate silos. For criminologists, it is a reminder that organised crime groups diversify into whichever revenue stream offers the best return for the least risk, and malware-as-a-service has lowered the skill barrier considerably.

£30m in suitcases: the insider at the check-in desk

On 2 October, five members of a network that smuggled almost £30 million in cash from the UK to Dubai were sentenced at Bolton Crown Court, receiving terms of up to seven and a half years. Between 2017 and 2019, couriers collected cash from organised crime groups in Manchester, Liverpool, Sheffield and Huddersfield and carried up to five suitcases at a time on Emirates flights from Manchester, Birmingham and Brussels. One defendant, an Emirates check-in attendant at Manchester Airport, pleaded guilty to involvement. The investigation began after £788,455 was seized at UK airports on three occasions. The BBC reported that the alleged Dubai-based organiser awaits extradition.

The case is worth reading against the prevailing assumption that cash is a dying laundering method. Bulk cash smuggling persists because it leaves no digital trail at the point of placement, and the destination was chosen because cash could be declared on arrival with little friction. The check-in attendant is the most criminologically interesting figure. Insiders at control points are the classic weakness of situational prevention: a guardian who is compromised offers worse protection than no guardian at all, because they create a false sense of security. Couriers were also rewarded with luxury hotels and nightclubs, a recruitment pattern that echoes money-mule grooming and suggests the same young people may be targeted across both.

Inside a Lazarus laundering network

Two stories in early October illustrated the DPRK laundering pipeline. On 2 October, Chainalysis linked the $387 million Bitget hack to DPRK-linked actors, reporting 23 transactions across four blockchains within three hours of the exploit. On 6 October, the on-chain investigator ZachXBT described infiltrating a Chinese organised crime network that he says laundered more than $1 billion for Lazarus. By posing as a client and fronting 349,700 USDC at a five per cent fee per order, he says he gathered intelligence that identified a $12 million cluster of Bybit exploit funds and led Tether to freeze 442,000 USDT. He also traced $3 million to a hot wallet of Huione Guarantee.

Professional money laundering here looks like a service business: a vendor, a price list, turnaround times and customer relations. That is consistent with the organisational-economics research below, which shows launderers adapting their structure to the volume and urgency of the funds they handle. The Huione link also connects state-sponsored theft to the same guarantee-marketplace layer that served the scam compounds covered in edition #23. The more uncomfortable point concerns who is doing the investigative work. An unpaid private investigator risking his own funds produced actionable intelligence that public agencies had not. That says something about where specialist capability currently sits, and about the accountability gaps that arise when it sits outside the state.

APP reimbursement turns two, and its edges are contested

The UK's mandatory reimbursement regime for authorised push payment fraud reached its second anniversary on 7 October. Drawing on the Payment Systems Regulator's independent evaluation by Frontier Economics, Grant Thornton notes that in-scope losses fell by around 21 per cent, roughly £73 million a year, that 88 per cent of money lost to reimbursable scams (£316 million) was returned in the first 18 months, and that there is no sign consumers have become less careful. Which? warns that these protections face pressure from calls to exclude investment and crypto fraud, from proposals to narrow the Financial Ombudsman Service's “fair and reasonable” remit, and from inconsistency between banks, some of which reject 2 per cent of claims as civil disputes while others reject 20 per cent.

The evaluation offers rare evidence on a long-standing theoretical worry, namely that compensation creates moral hazard and makes victims careless. The data do not support it. What reimbursement has done is change incentives for payment firms, which now carry the cost of the fraud they fail to stop. That is situational crime prevention through liability. The proposed carve-outs would undo it in exactly the wrong place. Investment and crypto frauds are the high-value, long-duration schemes in which victims are most deeply groomed, and removing them from scope would put responsibility back on the person least able to detect the deception.

Odey ban upheld: integrity as a conduct standard

The Upper Tribunal on 14 September upheld the FCA's lifetime prohibition on Crispin Odey, finding that all five allegations demonstrated a lack of integrity. They included breaching a final written warning about his behaviour towards female employees, bullying executive directors, twice dismissing Odey Asset Management's executive committee to halt an internal disciplinary process, and a lack of candour with the FCA. The Tribunal reduced the penalty from £1.83 million to £1.53 million by removing the FCA's uplift for aggravating factors, and the FCA's 2026 fines register records the Final Notice as issued on 30 September.

The significance lies in what the Tribunal treated as a regulatory matter. Odey's conduct did not involve market abuse or client money. What it involved was capturing the governance machinery meant to hold him to account. Read alongside the non-financial misconduct rules that took effect on 1 September, the ruling confirms that the FCA will treat the subversion of internal controls by a dominant individual as evidence of unfitness in itself. Criminologists will recognise the pattern from the corporate-crime literature: in owner-dominated firms, the most effective controls fail first because they depend on the cooperation of the very person they are meant to constrain.

Companies House identity checks become criminally enforceable

On 16 September, the Insolvency Service secured its first three convictions for director identity-verification offences under the Economic Crime and Corporate Transparency Act 2023, at City of London Magistrates' Court. Two directors of one company were fined, one for acting while unverified and one for failing to stop her doing so, along with a director of a second company. The fines were small (£80 to £307), but the principle is now established: since November 2025, identity verification has been a legal duty, and failing to comply carries personal criminal liability.

The modest fines should not distract from the structural importance of the case. The shadow-fleet designations above show what anonymous corporate vehicles make possible. Identity verification is the UK's attempt to remove anonymity at the point of incorporation, before a company can be used. Its preventive value depends entirely on whether non-compliance is consistently pursued once the twelve-month transition period ends. These first prosecutions are a signal. Whether they become a deterrent depends on scale.

Recovery-room fraud and the problem of repeat victimisation

On 14 September, Juliet Mora pleaded guilty to conspiracy to commit money laundering in the Eastern District of California, in connection with a $36 million scheme that defrauded more than 400 mostly elderly Americans. Fraudsters posed as lawyers and contacted timeshare owners and previous fraud victims, promised them restitution, and collected fees through shell companies whose accounts were repeatedly reopened after being closed for suspicious activity. Mora is said to have personally received more than $1.5 million. Arrests have followed in the US, Nicaragua and Mexico, and three defendants remain at large.

Recovery-room fraud deliberately selects people who have already been victimised, because the hope of getting money back is itself a powerful lever. For offenders, victim lists are a cheap and high-converting resource. The prevention lesson is that the point at which a fraud is first reported is also the point of greatest risk of a second one. Victim-support pathways, including those attached to the APP reimbursement process discussed above, should warn explicitly about follow-on recovery scams. The detail about reopened bank accounts also points to a familiar gap in onboarding controls: closing an account for suspicious activity does little if the same person can simply open another.

New Research Worth Reading

Suleman Lazarus, Adebayo Benedict Soares and Mark Button (2026), Degrees of entrapment in Hustle Kingdoms: the spectrum of coercion in cybercrime schools, in Evidence Base. Drawing on EFCC conviction files from a Nigerian cybercrime apprenticeship academy, the authors show learners' agency constrained by movement and communication bans, rationed money and information, and spiritual threats under a “Chairman”. They propose a spectrum model of coercion that rejects the binary between willing offender and enslaved victim. This is essential reading for interpreting the Ghana detentions.

Ruoran Lai, Wanlin Lin and Peng Wang (2026), Money laundering and its organizational variation in China: An organizational economics framework, in The British Journal of Criminology. Based on 52 interviews, the article explains when illegal entrepreneurs turn to professional money launderers, and how task variability and time pressure shape the structure of laundering operations serving drug traffickers, telecom fraudsters and gambling rings. It offers a theoretical lens for the vendor-style operation ZachXBT describes.

Jo Braithwaite (2026), Gross Negligence in Bank Payments Law, in Oxford Journal of Legal Studies 46(2). Braithwaite examines how the undefined gross negligence standard allocates losses across common law, EU-UK payments regulation and the UK APP reimbursement scheme, including how the Financial Ombudsman Service applies it. She argues for an express statutory definition grounded in fairness, transparency and customer vulnerability, which is timely as the scheme's boundaries are debated.

What I Am Watching

• The FATF October plenary in Paris, where decisions are expected on grey-list exits for Monaco and Bulgaria and on Pakistan's long-running status (Economic Times).
• Whether the Ghana detentions lead to prosecutions, asset recovery and victim repatriation rather than just headline arrest figures, as Ghanaian civil society has urged (Ground News).
• The extradition of the alleged Dubai-based organiser of the £30 million cash-smuggling network, and the remaining sentencing hearings in late October and November (National Crime Agency).
• Whether pressure to remove investment and crypto fraud from APP reimbursement, or to narrow the Ombudsman's remit, gains traction in government (Which?).
• Whether shadow-fleet owners respond to OFAC's delisting route by selling vessels into licit trade, or whether new single-ship companies replace those designated (US Treasury).