September: enforcement maps the supply chain

If April was the month enforcement dismantled the architecture of industrialised fraud, May the month sanctions bent towards outcomes, June the month enforcement attacked concentrations, July the month it reorganised around the service layer, and August the month the reporting perimeter went on trial, then September was the month the authorities stopped describing the scam economy as a set of crimes and started treating it as an industry, with a supply chain, a market layer, and a workforce.

Three editions of Lab Report covered the month. They ran from FinCEN's 3 September alert quantifying $12.7 billion in suspected digital-asset scam activity to OFAC's 30 September designation of a Tren de Aragua cash-machine hacking network under counter-terrorism authorities. Across those four weeks the same move recurred. Enforcement reached past the individual offender and the individual fraud to the infrastructure that makes both repeatable: the marketplaces that sell laundering as a service, the airlines and general sales agents that carry sanctioned cargo, the stablecoin wallets that turn oil revenue into usable value, and the corporate identities behind which offenders shelter.

A second movement ran alongside the first, and in some ways it was the more surprising. In September, trust itself became an object of enforcement. The FCA's non-financial misconduct rules came into force, the Upper Tribunal upheld a lifetime ban on integrity grounds, Companies House secured its first criminal convictions for unverified directors, and prosecutors pursued two frauds whose entire method was the exploitation of community and victim trust. The month followed four visible threads.

1. The Scam Economy Was Mapped as a Supply Chain

The month opened with a conceptual shift that will outlast any single case. FinCEN's Alert FIN-2026-Alert005, drawing on 33,904 Bank Secrecy Act reports filed between September 2023 and December 2025, introduced “guarantee marketplaces” as a distinct typology: online markets where scam operators buy modular services, from account creation and phishing kits to laundering pathways, from professional providers. This is the language of supply-chain analysis, not of offence description, and it reorients enforcement towards the intermediaries who serve every scam rather than the scams themselves.

Within a week, the typology had a target. On 9 September, OFAC designated Xinbi Guarantee, SafeW Technology and Anwen Technology, after the DOJ seized the marketplace's Telegram channels on 7 September. Chainalysis estimated Xinbi's throughput since 2022 at roughly $24 billion, with 52 designated wallets alone receiving more than $8.4 billion in stablecoins, and the Scam Center Strike Force restrained around $52 million in a single day. On the same day the Strike Force targeted 13 scam compounds in Madagascar, extending its footprint well beyond Southeast Asia.

The supply-chain reading explains why this matters more than another compound raid. Guarantee marketplaces solve the trust problem that would otherwise limit cooperation between anonymous, geographically dispersed offenders, by providing escrow, vendor ratings and dispute resolution. Rasmus Munksgaard's typology of illicit online markets, which separates markets by their degree of “marketness” and administrative governance, is the right lens: Xinbi was a high-governance node, and removing it degrades a shared service on which many compounds depend. Fabian Teichmann's framework for the convergence of traditional and cyber organised crime reaches the same conclusion from a different direction, arguing that effective responses require synchronised pressure on offenders, finances, infrastructure and criminal service providers.

The domestic evidence confirmed that the techniques have travelled. On 7 September, two US-based defendants were charged over a $1.3 million pig-butchering scheme targeting 26 women across four western states. Read through Sutherland's differential association, the case is not an anomaly but a consequence of commodification. When scripts, dashboards and laundering routes are priced and sold, the knowledge that once sat inside a compound becomes available to any offender willing to pay. The 26 scam manuals analysed by Asyalı, Frank and Hölzmer are the clearest evidence that the technique is trained and transferable.

Regulators elsewhere reached for the cheapest lever available, the register. AUSTRAC removed 45 businesses from its remittance and digital-currency registers on 7 September, and on 9 September India's Financial Intelligence Unit issued Prevention of Money Laundering Act notices to 15 offshore virtual-asset providers, seeking application and website takedowns. Removing an operator from a register requires no prosecution, yet it materially raises the effort of continuing to trade. It is situational crime prevention through administrative friction, and the open question, flagged in both editions, is whether it consolidates activity into compliant venues or pushes it into peer-to-peer channels that are harder still to see.

2. Cooperation Moved From Declaration to Operating Structure

If August produced the political declarations, September produced the plumbing. On 3 September, US Attorney Jeanine Pirro signed a memorandum of understanding with the Crown Prosecution Service and the National Crime Agency, committing the two systems to parallel investigations, intelligence sharing and joint decisions on jurisdiction in scam-centre cases. The figures anchoring the document were stark: reported cryptocurrency investment fraud losses rose from $4.57 billion in 2023 to $8.65 billion in 2025, an 89 per cent increase in two years. On the same day the European Commission proposed nearly doubling Europol's budget to €3 billion, with an expanded mandate for technology-enabled crime.

Judicial cooperation continued to produce results at the level of whole schemes rather than single accounts. On 4 September, Eurojust announced coordinated Italian and German action against a group that used a sham sports association to divert €4.5 million in grants, with preventive seizures covering 83 bank accounts, 21 properties and four businesses. Grant flows to bodies outside the banking compliance regime are a textbook routine-activity target: recurring, predictable and lightly guarded.

The public-private dimension was formalised on 16 September, when FinCEN convened global financial institutions in Washington to share intelligence on the nodes and facilitators giving Iran access to US correspondent banking. This turns participating banks from reactive filers of suspicious activity reports into co-investigators mapping networks in advance. It is differential association in reverse: if offending depends on tradecraft learned from associates, disruption depends on defenders sharing tradecraft at comparable speed.

The research gives reason for caution. Diana Bociga, Elisa Bellotti and Nicholas Lord's network analysis of the UK anti-money laundering regime shows how structural disconnections between policy, supervision and enforcement persist even inside a single jurisdiction. Cross-border memoranda do not remove those disconnections; they add another layer at which they can occur. The test of the US-UK memorandum was always going to be operational output. That test arrived just after the month closed, when more than 130 people were arrested or detained in Ghana and Ghana's communications minister pushed back on claims that the FBI had acted alone. Who gets credit is not a trivial matter. Compound operators move to wherever local enforcement capacity is weakest, so partnerships that build host-state capability have more lasting preventive value than operations seen as externally imposed.

3. Sanctions Moved From Banks to Corridors, and Crime Categories Converged

Operation Economic Outcast, launched in late August, spent September working outward from the banking system into the physical and digital corridors that carry Iranian value. On 4 September, Treasury designated Golden Global Yatirim Bankasi and two subsidiaries, the first bank in a NATO member state hit under the current campaign. Four days later, on 8 September, it sanctioned 36 targets across Iran's commercial aviation network, designating 27 Iranian airlines and general sales agents in the UAE, Türkiye, Egypt, the UK, Malaysia and Kazakhstan, and noting that Mahan Air had received at least three Boeing 777s in summer 2026 via UAE and Omani intermediaries. FinCEN issued a concurrent alert on Iranian aviation procurement, and on 10 September OFAC moved its Iran licensing policy to a presumption of denial.

This sequence follows displacement theory almost exactly. Pressure on Iranian banking pushed value onto aviation as a mobile physical corridor, and Treasury closed the corridor at both the airline and the sales-agent layer. The FinCEN alert is what converts designations into continuing obligations: by naming the enabling patterns, it raises the reputational and correspondent-banking cost of third-country intermediaries before any secondary designation arrives.

The crypto corridor came next. On 15 September, the Southern District of New York filed a civil forfeiture complaint against more than $61 million in USDT held in Binance accounts controlled by two Chinese companies, alleged to be proceeds of black-market Iranian oil sales within a network that handled more than $1.5 billion. AML Intelligence reported that the funds sat across ten Tron addresses frozen in 2025, and that Binance has not been accused of wrongdoing. One of the companies allegedly presented itself as a wealth-management or virtual-asset custody firm. That occupational disguise is the analytical point: laundering intermediaries succeed by adopting a legitimate identity just outside the registration perimeter. The choke point was not the exchange but the ability to freeze a stablecoin balance. Liu, Ryan, Zhou and Berrang's study of evasion under blockchain sanctions shows why this matters: after the Tornado Cash designations, users routinely converted into stablecoins, which makes issuers, whether they like it or not, the capable guardians of the on-chain economy.

What made September distinctive was how often fraud, state-sponsored theft and terrorist financing turned out to share infrastructure. The Xinbi analysis documented vendors laundering proceeds from the $1.5 billion Bybit breach and the $235 million WazirX theft, and described a “Black U” technique that swaps traceable DPRK-linked funds for stablecoins earned from pig-butchering and romance scams. On 30 September, OFAC designated a Tren de Aragua ATM jackpotting network under both cyber and counter-terrorism authorities, citing reported US losses of $40.73 million across more than 1,500 attacks. Cash-machine malware is technically a theft offence; once the proceeds fund a designated organisation, it becomes terrorist financing, with secondary-sanctions exposure attached. Ruoran Lai, Wanlin Lin and Peng Wang's organisational-economics account of professional money launderers explains the convergence: launderers serve whichever client offers the volume, and they adapt their structure to the client's urgency, not to the legal category of the predicate offence. For institutions, the practical consequence is that fraud monitoring and terrorist-financing monitoring can no longer run in separate silos.

4. Trust, Identity and Integrity Became Enforceable

The fourth thread is the one that least resembles traditional financial crime enforcement, and it may prove the most consequential. On 1 September, the FCA's non-financial misconduct rule came into force, extending the conduct rules to bullying, harassment and violence across all FSMA Part 4A firms. Two weeks later, on 14 September, the Upper Tribunal upheld the FCA's lifetime prohibition on Crispin Odey, finding that all five allegations demonstrated a lack of integrity, including bullying and threats towards executive directors and twice dismissing his firm's executive committee when it did not accept his pressure. The Tribunal reduced the penalty from £1.83 million to £1.53 million but otherwise supported the regulator in full.

The doctrinal significance lies in what the Tribunal treated as a regulatory matter. The core of the findings was not a trading offence but the capture of governance machinery by a dominant individual. In owner-dominated firms, internal controls are only as strong as the willingness of the person at the top to submit to them. September's rule change and judgment together establish that such capture is itself evidence of unfitness.

Identity followed integrity. On 16 September, the Insolvency Service secured the first three convictions for director identity-verification offences under the Economic Crime and Corporate Transparency Act 2023. The fines were small, but the principle is established: verifying identity at Companies House is now a duty backed by the criminal courts, and directors who allow unverified colleagues to act carry personal liability. Kristin Surak and Johnathan Inkley's account of how offshore structures conceal property ownership explains why this is not administrative housekeeping. Anonymity at incorporation underpins many of the laundering structures discussed elsewhere in this article, including the corporate vehicles that recovery-room fraudsters and oil-sanctions evaders used to hold their accounts.

The NCA pursued the same logic in a different setting. Its £10 million freezing order over a Premier League Barclays account, linked to the first payment under the Sorare partnership, reached the receiving institution's account rather than the counterparty's balance sheet. The Premier League is not accused of wrongdoing. The enforcement posture is the point: institutions that host crypto-native revenue now carry a proceeds-of-crime exposure their risk calculations had treated as negligible.

Meanwhile, the month's frauds were reminders of why trust needs protecting. On 10 September, the SEC charged a New Jersey founder over a $16 million Ponzi scheme targeting Christians of Ghanaian heritage, many with no investing experience. Four days later, Juliet Mora pleaded guilty to conspiracy to commit money laundering in a $36 million recovery-room scheme that defrauded more than 400 mostly elderly Americans by posing as lawyers and promising restitution for earlier losses. One scheme exploited community affinity and the other prior victimisation, and both converted trust into a marketing channel. Hu, Andrade and Chen's multilevel study of later-life fraud finds prior fraud experience associated with subsequent exposure. The prevention lesson is uncomfortable but clear: the moment a fraud is reported is also the moment of greatest risk of a second one.

The Structural Picture

Four threads. One structural argument.

The 2026 enforcement architecture spent April dismantling industrialised fraud, May bending sanctions towards outcomes, June attacking concentrations, July reorganising around the service layer and August contesting the reporting perimeter. In September it began treating financial crime as an economy. It named the market layer, through FinCEN's guarantee-marketplace typology and the Xinbi designations. It built the cooperative machinery to act across borders, through the US-UK memorandum, the FinCEN Exchange and Eurojust's scheme-level casework. It followed sanctioned value out of the banking system into aviation, stablecoins and the infrastructure shared by fraudsters, state-sponsored thieves and designated terrorist organisations. And it began enforcing the conditions of trust itself: the integrity of senior individuals, the identity of company directors, and the exposure of the institutions that host suspect revenue.

The risks to this direction of travel are real, and they are mostly risks of displacement. Designating a marketplace degrades a shared service, but if Xinbi's vendors migrate to smaller, lower-governance successors, the next round of designations becomes harder rather than easier. Grounding an airline network closes one corridor and invites the use of maritime and overland routes through Central Asia. Register removals in Australia and India may consolidate activity into compliant venues or may push it into peer-to-peer channels that sit below every supervisor's line of sight. Partnerships carry their own fragility: they depend on host-state legitimacy, and the Ghanaian response to the October arrests shows how quickly a joint operation can become a dispute over ownership.

The trust thread is the most promising, and also the most dependent on persistence. Three small fines at City of London Magistrates' Court will not remove anonymity from the UK company register; consistent prosecution after the transition period might. An integrity finding against one hedge fund founder will not change owner-dominated governance; repeated application across similarly situated firms might. The research on coercion in West African cybercrime academies adds a final caution. Many of the people found in scam compounds sit somewhere on a spectrum between offender and victim, and an enforcement architecture that counts arrests without distinguishing the two will misread its own success.

What September confirmed is that the enforcement architecture of 2026 now sees the scam economy in the way criminologists have long described it: as an organised market with suppliers, intermediaries, labour and customers, embedded in legitimate infrastructure. Seeing the market is the necessary first step. Whether enforcement can make that market less profitable faster than offenders can rebuild it elsewhere is the question for the final quarter of the year.