Press briefing

On April 22, I delivered an Insight Briefing to the United Nations Counter-Terrorism Committee Executive Directorate (CTED) on something I’ve been developing for a while: the idea that propaganda ecosystems don’t just spread ideology, but function as financial infrastructure.

The session was titled Trust Networks and Parallel Financial Systems: How Propaganda Ecosystems Enable Terrorist Financing. The core argument was simple, and largely overlooked.

Terrorist financing begins with trust before a single transaction occurs.

The Missing Layer

Counter-terrorism finance has been built around transactions. Bank transfers. Crypto flows. Suspicious activity reports. Flag the movement, freeze the asset, disrupt the network.

The problem: by the time money moves, networks have already hardened into place.

Extremist propaganda ecosystems operate as trust infrastructure — authentication systems for intermediaries, coordination layers for decentralized finance. They allow geographically and ethnically dispersed actors to validate who receives money, coordinate without direct contact, and maintain financial continuity under sustained pressure.

This is why groups affiliated with the Islamic State and al-Qaeda keep functioning even when their formal financial access is systematically restricted. While transactions get disrupted, the underlying trust that makes them possible does not.

What Happens When You Apply Pressure

Most disruption frameworks assume financial systems behave like centralized structures. They don’t — and the distinction matters.

In a centralized system, authority enforces coordination. Remove a node, the system degrades. That’s the model most enforcement tools are built for.

In a distributed, trust-based system, something different happens. Apply pressure, and the network doesn’t collapse — it fragments, then reorganizes. Trusted intermediaries still exist. Validation pathways remain intact. Coordination resumes without central control.

Financial pressure produces temporary disruption, not systemic collapse. As long as the trust architecture endures, the system regenerates.

That shift — from centralized to distributed — is exactly where current disruption strategies fail.

What the Current Tools Miss

Existing frameworks are built to detect transactions, wallets, and known actors. But these are interchangeable tools. Rather, the system depends on the underlying trust layer — one that is mostly invisible to transaction-based detection models.

Moving upstream changes the picture. Identifying trust nodes. Mapping cross-platform validation patterns. Linking behavioral signals to financial emergence before coordination hardens into infrastructure.

Done correctly, this means surfacing high-risk intermediaries before they receive funds, identifying coordination hubs that never appear in transaction data, and anticipating how networks reconstitute after disruption — rather than rediscovering them afterward.

The Distinction That Determines Outcomes

Most systems are built to follow money. Very few are built to identify the trust systems that determine where that money can move.

That distinction is the difference between tracking activity and disrupting the system that produces it. This is the gap I presented to CTED — and one most current frameworks have yet to close.

Video Recording

Because the session included sensitive propaganda examples, CTED has kept the recording private. To request access, contact info@btl-research.com.

^ Link to original article

This is an article I recently wrote for the Global Network of Extremism and Technology (GNET). You can find the original link here.

Propaganda ecosystems function as parallel trust infrastructures, enabling extremist organisations to coordinate financial activity outside formal financial systems. While extremist propaganda is typically studied as a tool for recruitment or ideological dissemination, these ecosystems also perform a critical financial function as generators of the reputational legitimacy and interpersonal trust necessary for decentralised financial networks to operate.

Over the past decade, violent extremist groups—particularly those affiliated with the Islamic State and al-Qaeda—have leveraged digital propaganda ecosystems to construct increasingly sophisticated parallel financial systems. Through repeated messaging, reputational signalling, and networked communication, these ecosystems enable dispersed actors to authenticate intermediaries, coordinate fundraising, and move resources across geographically fragmented spaces.

This Insight argues that extremist propaganda ecosystems function as trust infrastructures that enable decentralised terrorist financing systems to operate outside formal financial institutions. If propaganda ecosystems generate the trust required for decentralised financial coordination, then disrupting these trust nodes may offer earlier intervention points than traditional transaction-level counter-terrorist financing measures.

The Role of Trust in Institutional and Extremist Financial Systems

Across economic theory, there is broad agreement that financial systems depend on trust. Whereas formal financial systems rely on institutional trust generated by legal frameworks and regulatory institutions that govern banks and financial intermediaries, extremist networks are formally excluded from these channels. This exclusion has forced terrorist groups to build parallel systems that generate trust, enabling the financial coordination required to sustain operations—beginning with propaganda ecosystems.

From a financial perspective, these trust-generating ecosystems enable groups to solicit funds directly while identifying supporters with fundraising potential or financial expertise. At the same time, the rapid expansion of financial technologies—including cryptocurrencies and other fintech tools—has reduced the friction associated with transferring funds across informal networks, allowing extremist actors to mobilise financial resources more rapidly across geographically dispersed stakeholders. Finally, the shared narratives and reputational trust generated within these propaganda ecosystems allow larger organisations to both co-opt local militant groups with independent revenue streams and coordinate financially across otherwise fragmented networks.

To these ends, extremists leverage network-based trust as a substitute for formal institutional trust, enabling financial coordination across informal systems.

Case Studies: Propaganda-Enabled Financial Systems

The following cases illustrate how extremist propaganda ecosystems have contributed to the rise of parallel financial infrastructures used by terrorist groups. While these examples are limited to IS- and AQ-affiliated groups, they are not exhaustive.

Islamic State: Global Financial Facilitation Networks

Although IS affiliates lost the vast majority of their territorial holdings and operational revenue between 2014 and 2019, the broader global organisation has remained resilient in large part due to the continued dissemination of online propaganda. Safe havens such as Afghanistan allowed the organisation’s most active branch—the Islamic State Khorasan Province (ISKP)—to produce and distribute videos, press releases, and its monthly magazine The Voice of Khorasan across platforms including Telegram, Rocket.Chat, Instagram, Facebook, X, and Pinterest.

Beyond ideological messaging, these propaganda ecosystems play a critical role in generating trust across geographically dispersed supporters and operatives. Repeated messaging, shared narratives, and reputational signalling help establish a sense of authenticity and legitimacy within the network. In the absence of formal financial institutions, this reputational infrastructure reduces uncertainty about potential intermediaries and collaborators across geographically vast networks.

With these trust networks in place, the Islamic State organisation has been able to construct sophisticated cross-border financial systems that sustain its global operations. Many of these financial activities were centred in the Cal Miskaad mountain range of Puntland, Somalia, where the group’s al-Karrar office coordinated fundraising and financial transfers across Africa and Asia before a 2025 series of U.S. airstrikes and local military operations disrupted the hub. Arrests of financial operatives in Europe and the United States suggest elements of this architecture were already operating across multiple jurisdictions, suggesting a move toward a more decentralised model of interconnected trust nodes.

Islamic State propaganda ecosystems support these parallel financial systems in three primary ways. The first is direct fundraising, with outlets such as The Voice of Khorasan and individual operatives soliciting donations directly from supporters, often through QR codes linked to cryptocurrency transfers. Because these appeals circulate within trusted propaganda communities, potential donors face fewer informational barriers when deciding whether to contribute. Evidence shows that financial and propaganda roles intertwine: for example, French police arrested a man in November 2025 in relation to financing and disseminating propaganda for the ISKP.

The second function is coordination and network formation. Cryptocurrency transfers and hawala transactions are frequently arranged through encrypted messaging platforms such as WhatsApp by operatives who likely initially connected through propaganda communities on other social media platforms. In this sense, propaganda ecosystems act as authenticators, helping participants identify trusted intermediaries and facilitating financial coordination across dispersed networks.

The third function is integration, with the broader organisation inspiring local jihadist groups with independent revenue streams to join and contribute. Examples include the Islamic State Southeast Asia Province (ISEAP) in the Philippines and Islamic State–Mozambique, both of which operate locally embedded revenue systems while maintaining ties to the broader Islamic State network. In such cases, joining broader financial networks allows these groups to receive funds to expand their attacks or revenue generation, and contribute back to the larger organisation.

Figure 1: Image from the ISKP’s Voice of Khorasan magazine soliciting crypto donations in Monero

Al-Qaeda: Legitimacy, Trust, and Decentralised Finance

Al-Qaeda’s (AQ) global propaganda ecosystem provides the ideological legitimacy and reputational signalling necessary to sustain parallel financial systems across geographically dispersed affiliates. Unlike the Islamic State’s more centralised attempts to coordinate global operations, AQ’s model relies heavily on regional trust nodes that maintain operational autonomy while benefiting from the broader legitimacy of the organisational banner and its propaganda channels. This structure allows locally embedded militant groups to generate revenue independently while remaining integrated into a wider transnational network.

Jama’at Nusrat al-Islam wal-Muslimin (JNIM), an AQ affiliate formed in 2017 through the consolidation of several militant factions operating across the Sahel, illustrates how this model co-opts disparate groups with multiple revenue streams under a parallel financial system. JNIM operates a patchwork of revenue-generating activities tied to illicit timber extraction, artisanal gold smuggling, cattle rustling, taxation of local populations, and narcotics trafficking.

These revenue streams are largely decentralised and embedded in local economies. However, the broader al-Qaeda narrative ecosystem provides legitimacy and cohesion across geographically dispersed factions, allowing multiple militant groups and revenue systems to operate under a shared organisational framework that enables its expansion as a single entity. This combination of propaganda-based legitimacy and locally embedded revenue streams has contributed to JNIM’s rapid expansion across the Sahel.

Open-source evidence demonstrates decentralised revenue generation under a shared JNIM/al-Qaeda framework. Rather than relying on a centralised treasury, these networks operate through a distributed network anchored by the broader al-Qaeda propaganda ecosystem. Through shared narratives, ideological legitimacy, and reputational signalling, this propaganda infrastructure allows geographically dispersed factions to generate and deploy revenue locally while remaining integrated within a wider militant network under the direction of key trust nodes.

JNIM’s decentralised structure resembles the model employed by the Italian ’Ndrangheta criminal network, in which semi-autonomous local groups generate large-scale revenue independently while remaining connected through shared structures rather than centralised financial control – allowing them to largely evade global enforcement for decades. While the scale of JNIM’s finances is far smaller, the comparison highlights how decentralised networks built on trusted intermediaries can sustain resilient financial ecosystems without centralised treasury structures.

A more centralised version of this model can be observed in Somalia through al-Shabaab (AS), which joined AQ in 2012 and generates approximately US $100 million in annual revenue, making it the wealthiest affiliate in the AQ network. AS has developed a structured financial system built around taxation, illicit charcoal trading, diaspora remittances, and intermediaries operating in Gulf financial corridors, East Africa, and Iran.

Despite stronger internal governance than many AQ affiliates, AS’s financial resilience still depends on trust networks reinforced through propaganda and reputational legitimacy. These networks facilitate revenue generation – particularly through diaspora remittances – while evidence also indicates AS reinvests a portion of proceeds into propaganda dissemination. In effect, propaganda functions not only as a communication tool but as a financial infrastructure, sustaining trust, reinforcing legitimacy, and enabling continued resource mobilisation across the broader AQ ecosystem.

Figure 3: AQ-aligned JNIM (red) has expanded rapidly since its 2017 formation, controlling more territory in the Sahel than all other militant groups in the region combined.

The Role of Propaganda-Based Trust in Parallel Financial Systems

Across these cases, propaganda ecosystems function as reputational infrastructures that allow decentralised financial systems to operate beyond formal institutions. While windfall events such as ransom payments or major criminal operations can produce large short-term inflows, these funds likely disperse rapidly due to corruption, competition, and operational fragmentation. By contrast, trust-based financial systems built around propaganda-generated legitimacy rely on repeated small transactions and trusted intermediaries. Although these flows may be lower in individual transaction volume, they often produce greater long-term financial resilience by sustaining continuous revenue streams across distributed networks. In these systems, propaganda does not merely support recruitment or ideological messaging; it also provides the reputational infrastructure that enables financial coordination across decentralised trust nodes.

That these groups’ propaganda frequently emulates the visual and stylistic conventions of mainstream media – videos with news-style watermarks and tickers, press releases, and glossy magazines – is not coincidental. Just as news organisations and commercial brands use such formats to signal legitimacy, extremist organisations deploy them to generate reputational trust among dispersed audiences. These audiences, in turn, form trust nodes that link media channels, influencers, and intermediaries, validating financial flows and enabling coordination across decentralised networks.

Figure 4: Proposed typology breakdown of trust node categories across IS and AQ propaganda ecosystems/financial networks.

Implications for Counter-Terrorist Financing: Targeting Trust Nodes

Current counter-terrorist financing strategies focus primarily on transaction-level disruption, including sanctions, asset freezes, blockchain tracing, and financial surveillance. While these approaches remain essential, they largely target late-stage financial activity after financial coordination has already occurred. The deeper structural vulnerability in many extremist financial systems may lie earlier in the lifecycle of these networks—within the trust relationships that enable decentralised actors to coordinate financial activity across dispersed environments.

Viewed through this lens, propaganda ecosystems function not only as ideological or recruitment platforms but also as trust infrastructures that authenticate intermediaries and enable financial coordination. Within these ecosystems, certain actors, channels, or accounts serve as trust nodes—points within the network that signal legitimacy, validate intermediaries, and facilitate coordination among otherwise disconnected participants. Recent assessments by the Financial Action Task Force (FATF) reinforce this dynamic, noting that groups such as ISKP increasingly embed crowdfunding appeals directly within propaganda ecosystems, including encrypted messaging channels targeting diaspora communities.

Recent research also highlights how emerging financial technologies are reshaping the landscape of terrorist financing. Digital assets, encrypted messaging platforms, and decentralised payment rails have created parallel financial infrastructures operating largely outside traditional regulatory oversight. Artificial intelligence tools are increasingly capable of clustering cryptocurrency wallets, identifying laundering typologies, and mapping financial networks that span multiple platforms and jurisdictions. Rather than simply tracing individual transactions, these technologies allow investigators to analyse financial ecosystems as interconnected systems of intermediaries and facilitators.

Amid the emergence of vast illicit financial service ecosystems—as highlighted in a February 2026 FATF report—the longer-term risk may lie in the convergence of decentralised extremist financial networks with these larger criminal service economies, underscoring the need to disrupt the trust infrastructures that sustain them earlier.

When combined with analysis of extremist propaganda ecosystems, AI-enhanced tracing and mapping capabilities may help investigators identify the trust nodes that anchor decentralised financial networks. Wallet addresses, donation links, and financial intermediaries that circulate repeatedly within propaganda communities can serve as indicators of trusted actors within these ecosystems. By linking online behavioural signals with blockchain analytics and financial intelligence, investigators may be able to map the financial networks that emerge from these trust nodes.

This perspective suggests an opportunity for greater collaboration between platforms and national financial intelligence units (FIUs), and financial intelligence tools like blockchain analytics. Social media platforms and messaging services are often the earliest environments where trust nodes emerge, as accounts that repeatedly disseminate propaganda, authenticate intermediaries, or promote fundraising campaigns gain reputational legitimacy within extremist ecosystems. Rather than focusing solely on content removal, platforms could prioritise identifying accounts and channels that function as trust nodes and sharing associated financial indicators—such as wallet addresses, donation links, or payment identifiers—with relevant investigative bodies.

Investigators and researchers may therefore benefit from prioritising several analytical questions:

• Where are the trust nodes within extremist propaganda ecosystems?

• Which actors authenticate financial intermediaries within these networks?

• And how do trusted propaganda channels enable decentralised financial coordination across geographically dispersed actors?

Integrating insights from propaganda analysis, platform data, and financial intelligence may allow investigators to map financial networks emerging from these trust nodes and identify earlier intervention points within decentralised extremist financing systems.

Image source

On October 10, 2024, Toronto-Dominion (TD) Bank agreed to pay approximately US $3.09 billion to U.S. regulators – the single largest penalty ever imposed under the Bank Secrecy Act (BSA). The financial consequences extended beyond the headline figure: compliance overhauls, independent monitors, legal expenses, and operational restrictions materially affected the bank’s U.S. business. Senior executives departed, compensation was reduced, and branch-level employees now face criminal charges.

According to the U.S. Department of Justice, between January 2018 and April 2024, TD’s transaction monitoring program failed to review approximately 92% of its transactions — representing activity collectively valued at more than $18 trillion. Within that same period, three criminal networks with ties to drug trafficking organizations transferred over $670 million in illicit funds through TD accounts.

But the magnitude of the penalty — and its ramifications for TD and the broader banking sector — underscores something more unsettling. If criminal networks were able to move over half a billion dollars through a major financial institution over multiple years – despite the presence of formal monitoring systems – the underlying laundering infrastructure was not opportunistic. It was operationally mature.

While the TD case represents a particularly egregious breach of a major financial institution by bad actors, the vast demand to enter these systems by an expanding global criminal services market makes it a powerful warning of the dangers posed by a lack of action amid a global surge in parallel financial activity.

Investigation and findings

Federal authorities began investigating cartel-linked laundering activity in the New York tri-state area in the early 2020s. In one instance, agents reportedly tailed a box truck transporting bags of bulk cash that were deposited across multiple bank branches, with TD locations featuring prominently. The ringleader of these activities was Da Ying (“David”) Sze, a Chinese-born resident of Queens, New York. According to court filings, Sze’s network laundered approximately $653 million, roughly $470 million of which moved through TD Bank. A subsequent congressional report noted the network moved funds to thousands of individuals and entities across the United States, China, Hong Kong, and other jurisdictions.

The Sze network did not rely on large-scale corruption to operate within TD. According to court documents, the organization provided approximately $57,000 in retail gift cards to multiple bank employees over a three-year period. In exchange for these gift cards, employees repeatedly ignored reporting standards, issuing official bank checks for accounts mostly filled with underreported cash. According to charging documents, one branch employee asked another “how is that not money laundering?” after a customer was permitted to buy more than $1 million in bank checks with cash. “Oh, it 100 percent is,” replied the second employee.

While multiple insiders were charged in connection with related laundering schemes, the only publicly detailed case tied to the Sze network is that of Wilfredo Aquino, an assistant store manager at a Midtown Manhattan TD branch. Aquino accepted more than $11,000 in gift cards between 2019 and 2021. In the context of a mid-level retail banking salary in Manhattan, and given Aquino had processed some 1,680 checks worth over $92 million, the inducements were modest — suggesting that the network’s strategy depended less on dramatic bribery than on sustained, low-friction facilitation at key review points.

At $57,000 in gift cards, total known inducements amounted to roughly 0.01 percent of the funds Sze passed through TD-linked accounts — a negligible input cost for a network operating at industrial scale. The vulnerability was not expensive corruption, but calibrated pressure applied to the right choke points.

While global financial institutions continue to struggle to improve their compliance systems, what is clear is that demand to inject illicit cash into capital markets via legitimate institutions has reached an unprecedented scale and scope.

Da Ying (“David”) Sze depositing bulk cash at a NYC-area TD branch. Image source

Supply and Demand — Laundering as a Service Market

Service-based alternative clearing networks have emerged amid unprecedented capital mobility, digitized payment velocity, and increasing geopolitical fragmentation. Over the past decade, these systems have expanded in ways that bypass and place strain on formal regulatory frameworks. They reflect a convergence of three structural forces: capital flight from high-pressure jurisdictions such as China, the steady supply of bulk cash generated by large transnational criminal enterprises, and the acceleration of cross-border value transfer enabled by fintech and digital assets.

Operationally, these networks integrate bulk cash collection, offshore credit balancing, digital asset conversion, and trade-based value settlement into a continuous clearing cycle. The result is a service-layered market for laundering and liquidity conversion, scaled by the sheer volume of capital seeking movement across jurisdictions. The objective is not merely concealment, but transformation — converting trapped or illicit value into deployable capital within stable financial systems.

Recent enforcement actions and reporting demonstrate the scale and operational capacity of this underground services market. In Southeast Asia, the Huione Chinese language marketplace and corporate networks associated with Prince Group have been identified as providing services used by criminal actors tied to scam compounds and gambling rings. According to Chainalysis, Huione-linked addresses processed more than $70 billion in crypto-denominated transactions between 2021 and 2025. In October 2024, the U.S. Department of Justice announced a civil forfeiture action involving over $15 billion in bitcoin connected to activity tied to Prince Group–associated entities — the largest digital asset seizure in history. In North America, FinCEN reporting has identified Chinese money laundering networks (CMLNs) as key facilitators of bulk cash clearing. Suspicious Activity Reports referencing such networks reflected approximately $312 billion in flagged transactions between 2020 and 2024. The Da Ying Sze network likely represented only one operational node within this broader clearing architecture.

These figures illustrate that the networks in question are not marginal or episodic; they are structured, capitalized, and globally integrated. Their continued operation depends not on remaining entirely outside the formal financial system, but on accessing it selectively at key integration points. This is where regulated financial institutions enter the equation.

Banks as Entry Points for Illicit Capital

Banks sit at the final integration point between parallel financial systems and formal capital markets. At its core, this is a supply-and-demand equilibrium: illicit or trapped capital seeks conversion; regulated capital markets offer absorption capacity and safety; intermediaries profit from the spread. As enforcement actions over the past decade demonstrate, financial institutions exposed to these flows face escalating compliance, reputational, and sanctions-related risks.

Court documents reveal the extent to which TD Bank’s compliance team failed to monitor suspicious transactions and the Department of Justice cited systemic weaknesses in the bank’s AML infrastructure, including gaps in transaction monitoring coverage and risk escalation. But while the TD example may be extreme in scope, the bank is not alone.

Over the past several years, major financial institutions — from HSBC to Danske Bank — have faced significant penalties tied to AML deficiencies valued in the billions of dollars. In less extreme cases – such as Capital One or USAA Federal Savings Bank – penalties have still reached hundreds of millions of dollars. The recurrence of multi-billion-dollar penalties across traditional banks and digital asset platforms underscores a systemic compliance lag rather than isolated institutional failure. Industry analyses and regulatory reports repeatedly warn that compliance systems often lag behind transaction complexity and adversary adaptation. The recurring pattern is not episodic misconduct, but structural misalignment between institutional monitoring models and industrial-scale laundering services.

As banks increasingly integrate digital assets into their payment and settlement systems, risk exposure expands rather than contracts. Beyond retail deposits and digital asset channels, trade finance instruments and correspondent banking relationships provide additional integration pathways between shadow liquidity networks and formal capital markets.

Existing AML evaluation frameworks primarily assess compliance with reporting and supervisory standards; they are less equipped to measure institutional resilience against coordinated, service-based clearing models. As parallel liquidity systems scale, institutions calibrated to detect isolated transactional anomalies — rather than sustained throughput facilitated by dispersed nodes within otherwise profitable client relationships — will remain structurally exposed.

Recalibrating compliance from anomaly detection toward throughput risk management may become one of the banking sector’s defining challenges in the years ahead. National supervisory regimes remain fragmented, while clearing networks operate transnationally, exploiting jurisdictional seams faster than coordination mechanisms can align. In this environment, the question is no longer whether parallel clearing systems can penetrate formal institutions, but whether supervisory models can evolve quickly enough to recognize that they already have.

Conclusion

The TD enforcement action highlights more than episodic compliance breakdown. It reflects the growing sophistication of parallel clearing systems that now function as service-based liquidity providers, capable of sustained access to regulated institutions. These networks do not depend on dramatic corruption, but instead rely on consistent access to friction points — human, procedural, or technological — where transaction flow can continue with minimal interruption.

As illicit and constrained capital continues to seek conversion into stable financial markets, pressure on these integration nodes will increase. Monitoring systems calibrated to detect irregular spikes may struggle to identify persistent throughput dispersed across routine activity. The resulting vulnerability lies less in individual misconduct than in structural misalignment between institutional oversight models and industrial-scale clearing operations. Reorienting supervision toward throughput risk — rather than isolated anomaly detection — may become essential as shadow liquidity systems continue expanding alongside formal capital markets.

Image from a previous police raid on Deutsche Bank that occurred in 2018

On January 28, German police prosecutors raided the Berlin and Frankfurt offices of Deutsche Bank, the largest financial institution in the country. The surprise raid came just one day before the company was set to release its 2025 earnings report, causing share prices to immediately plummet by around 3%. At least 30 plainclothes investigators entered the offices around 10am local time, targeting a “yet unknown” number of employees. According to prosecutors, their investigation surrounds companies suspected of money laundering on behalf of entities tied to sanctioned Russian oligarch, Roman Abramovich.

This raid is illustrative of a much broader trend.

The last few years have delivered a steady slew of headlines about major law enforcement actions against banks suspected of money laundering and falling prey to criminal influence. Last year, the U.S. Treasury made the unprecedented move of sanctioning three Mexican banks as a primary money laundering concerns in connection with opioid trafficking. In 2024, Canada’s TD Bank agreed to pay a record $3 billion in fines in connection with money laundering for the Sinaloa and other Mexican drug cartels; Canada’ FINTRAC imposed nearly $10 million in additional fines against the bank. Crypto exchanges are at the front lines of such punitive measures, with Binance agreeing to pay a $4.3 billion in fines and restitution in a 2023 deal with US regulators enforcement. Last year, FINTRAC imposed a record $177 million in fines against crypto exchange Xeltox in connection with darknet markets, child abuse, fraud, and ransomware.

These are not compliance failures, but failures of perception. Institutions are operating with risk models built for a world in which illicit finance was episodic, traceable, and external to core liquidity systems. That world no longer exists.

While laundering techniques evolve incrementally, detection regimes evolve retroactively. Capital that clears today under acceptable assumptions is increasingly reclassified tomorrow as sanctionable, tainted, or facilitative. Institutions that do not adapt in advance are not merely exposed — they are accumulating latent enforcement risk they cannot unwind. Evidence suggests the consequences are increasingly unaffordable, prompting the need for proactive measures.

Shwe Kokko, Myanmar: built in a civil war and financed through Chinese state investment, the multi-billion-dollar militant-backed city now serves as a notorious hub for cyber scammers.

Parallel financial infrastructures

Massive, parallel liquidity architectures now operate alongside regulated global financial markets. These systems emerged to serve actors excluded from the formal financial system and have proliferated amid rapid fintech innovation, tightening sanctions regimes, and rising geopolitical polarization.

Strict capital controls, combined with sustained political and economic instability, have generated large and unregulated capital outflows from high-stress jurisdictions such as China, Russia, and Iran. These outflows create primary demand for parallel financial infrastructure, supplying the early liquidity needed to establish and scale shell companies, grey-market digital exchanges, trade-based money laundering mechanisms, and over-the-counter (OTC) crypto brokerage networks. Under sanctions pressure, state-linked actors within these jurisdictions also rely on such channels to export goods and procure restricted or dual-use technologies beyond formal oversight.

These parallel architectures are not used exclusively by state-linked elites or individuals engaged in capital flight. Organized criminal groups—including Latin America drug cartels, Chinese-run scam syndicates operating across Southeast Asia and Africa, and European networks such as the ’Ndrangheta—exploit the same ungoverned financial rails to move and launder proceeds.

The systemic risk lies not in any single actor, but in the laundering capacity of these parallel systems themselves. Although designed to operate outside regulatory oversight, these infrastructures ultimately interface with—and depend upon—safe, well-regulated financial markets. Capital originating in capital flight, sanctions evasion, and organized crime frequently converges at the same intermediaries and settlement points before being absorbed into Western asset markets.

For example, Chinese money laundering networks (CMLNs) facilitate the laundering of bulk cash generated by Mexican drug cartels, with funds ultimately settling into U.S. asset portfolios held by wealthy Chinese households seeking capital externalization. Similarly, infrastructure projects financed under the Chinese state-run Belt and Road Initiative have, in certain jurisdictions, contributed to permissive governance environments that organized criminal groups exploit to establish large-scale cyber-scam operations, ultimately moving wealth out of the country and into private hands elsewhere. Once laundered through the region’s vast ecosystem of casino gambling hubs and international shell corporations, these funds may be invested in Western markets like Australia or the United States.

Elsewhere, Iranian regime-linked elites have accumulated extensive international property portfolios in Western countries using shadow financial infrastructure associated with the Islamic Revolutionary Guard Corps and its affiliated networks. In Europe, criminal organizations such as the ’Ndrangheta rely on the same real-estate-based laundering channels in Turkey and offshore banking access points in Cyprus that have long been used by Russian elites to externalize wealth and sustain financial activity under sanctions pressure. Recent evidence also indicates that Russian state-owned factories increasingly supply Italian mafia groups with unmarked weapons via shadow fleet vessels, demonstrating that these informal networks can produce violent consequences.

Across these cases, the common denominator is not coordination between actors, but the repeated reuse of resilient parallel financial infrastructure that channels capital back into regulated Western markets. Funds associated with criminal or terrorist activity are placed through multiple layers—including casinos, online gaming platforms, real estate, and front companies—before being progressively cleaned and integrated. The result is not a segregated illicit economy, but deep structural integration between unaccountable liquidity systems and the global financial core.

Exposure

The three-tiered architecture clarifies the exposure to Western banks and other institutions:

Figure 1 illustrates a three-tier liquidity architecture showing how parallel financial systems interact with regulated Western capital markets.

• Tier 1 captures upstream capital outflows from high-stress jurisdictions shaped by capital controls, sanctions pressure, and regime instability. Driven primarily by elite asset externalization and state-linked value movement, these outflows provide much of the initial liquidity that seeds parallel financial systems due to the volume of demand they represent.

• Tier 2 represents the midstream laundering infrastructure that enables these flows to move and settle outside formal regulatory oversight. This layer includes OTC brokers, trade-based money laundering, shell companies, grey-market digital exchanges, and related facilitators that function as shared financial rails used by state-linked elites, criminal networks, and sanctioned actors alike.

• Tier 3 encompasses downstream threat actors. Including organized crime groups, militant organizations, and terrorist networks. These groups frequently exploit the same infrastructure to move and launder illicit proceeds.

The diagram highlights the bidirectional interaction between tiers, reflecting how upstream capital flight sustains laundering infrastructure while downstream criminal activity reinforces its profitability and resilience.

The right-hand node illustrates the final stage of the cycle: integration into Western capital markets. Despite originating in parallel systems designed to evade oversight, laundered capital ultimately seeks stability and legal protection within regulated financial systems, creating systemic exposure for financial institutions, real estate markets, and investment products.

The core risk lies not in any single actor, but in the durable infrastructure that links capital flight, illicit finance, and regulated markets into a continuous financial circuit. Most importantly, as global sanctions regimes increasingly target state-linked actors at Tier 1 and non-state actors at Tier 3, exposure concentrates in Western capital markets where funds moving through this infrastructure are ultimately integrated.

Global enforcement vigilance

Global regulators and law enforcement agencies are under accelerating pressure to identify, disrupt, and prosecute financial activity linked to illicit finance. This pressure is no longer cyclical or reputational; it is structural and driven by two converging forces.

First, geopolitical escalation and sanctions enforcement

In an increasingly polarized international environment, illicit financial channels used by adversarial states to bypass export controls and procure restricted or dual-use goods are now treated as matters of national security rather than compliance oversight. As sanctions regimes expand in scope and severity, enforcement agencies are increasingly compelled to pursue not only upstream actors but also the financial institutions through which such activity ultimately settles.

Examples include Russia’s sanctioned war economy, Iran’s shadow banking networks, and China’s underground procurement of restricted military and dual-use technologies.

Second, the trans-nationalization of organized crime

Modern criminal networks are increasingly post-sovereign, operating across jurisdictions and establishing parallel financial systems that erode state authority and undermine global governance. These systems are no longer peripheral; they intersect directly with regulated markets.

Examples include militarized Mexican cartels such as Sinaloa and CJNG, as well as large-scale scam-center enclaves in Myanmar and Cambodia.

Across all domains, political tolerance for inaction is collapsing. Regulatory and law enforcement agencies are increasingly expected to demonstrate tangible results, often through high-profile investigations, raids, and retroactive enforcement actions. In the United States, recent sanctions guidance has materially expanded this exposure: the Treasury Department’s Office of Foreign Assets Control now applies a ten-year enforcement lookback, extending liability to conduct that cleared under acceptable assumptions years earlier. Parallel developments are underway in Europe, where the European Union has moved to harmonize criminal penalties for sanctions violations across member states, signaling a broader shift toward more aggressive and coordinated enforcement.

Because Western banks and capital markets represent the terminal integration point for most large-scale laundering activity, they are not incidental to this process, structurally exposed to it. Capital that once cleared under acceptable assumptions is increasingly reclassified as sanctionable, tainted, or facilitative. Institutions that treat these dynamics as external threats rather than embedded risks are not merely vulnerable to future scrutiny; they are accumulating enforcement exposure that cannot be unwound once political thresholds are crossed.

Technological advances risk further investigatory disruption

Technological advances in machine learning and artificial intelligence are rapidly expanding investigators’ ability to retroactively identify illicit financial networks after they have already entered Western capital markets. While global organized crime syndicates adopted crypto early to bypass traditional regulatory controls, the underlying structure of blockchain systems — which preserve immutable transaction records on public ledgers — has paradoxically made illicit liquidity more traceable over time. As a result, capital that once appeared safely integrated can later be reconstructed, mapped, and reclassified. Blockchain analytics platforms are already deploying advanced AI-driven pattern detection, and DARPA’s A3ML program aims to make large-scale money laundering economically unviable by disrupting these networks at scale.

At scale, AI adoption favors actors with capital depth, institutional expertise, and the protection of the rule of law. While criminals may experiment with tactical obfuscation, these advantages compound over time in favor of investigators rather than illicit networks. Banks and other financial institutions should therefore assume that today’s undetected exposure may become tomorrow’s enforceable liability, rather than relying on money launderers’ ability to permanently conceal financial activity.

Conclusion

The dynamics described here are not temporary distortions or episodic compliance challenges. They reflect a structural shift in how illicit, gray, and state-linked capital moves, settles, and ultimately integrates into the global financial system. Parallel financial infrastructures have matured into durable liquidity systems that operate continuously alongside regulated markets, not at their margins.

Western banks and asset markets sit downstream of these systems. They are not incidental endpoints but the terminal nodes where capital originating in sanctions evasion, and criminal enterprise ultimately seeks stability, legal protection, and yield. As enforcement priorities expand from reputational misconduct to national security risk, and as sanctions regimes increasingly target both state and non-state actors across this spectrum, exposure concentrates precisely where this capital is absorbed.

Crucially, enforcement is no longer prospective. Detection, attribution, and liability are increasingly retroactive, enabled by improved data integration, cross-border coordination, and advancing analytical technologies. Capital that cleared under acceptable assumptions in the past is now subject to reclassification, scrutiny, and enforcement years later. Once political thresholds are crossed, this exposure cannot be unwound.

Institutions that continue to treat illicit finance as an external threat, rather than an embedded feature of modern liquidity systems, are not merely vulnerable to future action. They are accumulating latent enforcement risk that will surface on timelines and terms they do not control. In this environment, resilience depends less on incremental compliance improvements than on a fundamental reassessment—at the board, supervisory, and enterprise-risk level—of how parallel financial infrastructures intersect with regulated markets and where, within that system, exposure is truly accumulating.

This problem is not cyclical, but structural. Western financial markets sit downstream of parallel liquidity systems that are already embedded. Enforcement is increasingly retroactive, not preventive. Institutions that fail to adapt now are not merely exposed to future scrutiny — they are accumulating liabilities that cannot be unwound once political thresholds are crossed.

Part I:

Part II:

This piece is more technical than much of my prior work. It is intended as a conceptual and analytical framework rather than a narrative essay, and is written for readers interested in understanding the structural mechanics of unregulated capital flows and their downstream security implications.

I am publishing it openly in the belief that clearer analytical tools are necessary if institutions are to anticipate and disrupt emerging threats more effectively. Readers who find this work useful, or who are working on related problems, are welcome to contact me directly at info@btl-research.com.

In work published over the past several months, I have emphasized that unregulated capital flows I term “shadow liquidity” consistently manifest as powerful downstream threats. Whether terrorist groups in Sub-Saharan Africa leveraging illicit networks to smuggle resources and procure weapons, or scam centers and drug cartels exploiting complex liquidity architectures, the global shadow financial ecosystem has become markedly more dangerous.

I developed a three-tier framework to explain how these parallel financial architectures operate and why they generate persistent downstream harm. Tier 2 consists of a vast layer of globally connected financial intermediaries that move value outside formal legal and regulatory oversight. Tier 3 sits downstream of these flows and includes criminal organizations, militant groups, and terrorist networks that exploit Tier 2 infrastructure to finance operations and project predation and violence.

Tier 1 is where the threat ultimately originates. At this level, large pools of wealth—often held by corrupt officials, politically exposed persons, and other elites in tightly controlled capital markets—seek to externalize assets to safer jurisdictions. This demand for offshore mobility creates the economic foundation for Tier 2 networks, which are then leveraged by Tier 3 actors, with or without direct state involvement.

These dynamics likely involve hundreds of billions of dollars annually, much of which fuels instability, entrenches criminal economies, and contributes to the impoverishment and coercion of millions of people worldwide. In recent work for the New Lines Institute, I documented how militarized scam syndicates in Southeast Asia and Latin American drug cartels (Tier 3) tap into Tier 2 infrastructure that moves billions of dollars annually in response to Tier 1 demand originating in the tightly controlled Chinese capital market. My most recent work for Between the Lines shows how Iran leverages a similar three-tiered structure to finance its proxy networks and externalize elite wealth.

Each of these systems is inherently destabilizing, not only for downstream societies targeted by criminal and militant activity, but also for the states at the origin point, where capital flight erodes economic resilience and governance over time. For this reason, understanding the origin of unregulated capital flows at Tier 1 is imperative for global security.

The three-tier framework illustrates how unregulated capital flight and its facilitators at Tier 1 and Tier 2 translate into downstream criminal and militant threats at Tier 3.

Unprecedented Speed

This danger is magnified by the unprecedented speed at which unregulated wealth now moves. Since the collapse of Bretton Woods in the early 1970s, global finance has become increasingly interconnected, with cross-jurisdictional transfers occurring in hours—or seconds—rather than days or weeks. Compliance and enforcement frameworks remain largely reactive, disproportionately focused on individual transactional disruption rather than sustained action against underlying networks, ownership, and control structures. The proliferation of shell corporations and offshore banking has further obscured attribution and accountability, while crypto-based decentralized financial systems introduce parallel liquidity channels that operate largely outside the regulatory assumptions underpinning the modern financial order.

Over the past decade, the consequences of these dynamics have become severe and self-reinforcing. Armed militant groups sustained by global shadow liquidity from resource theft and drug trafficking have destabilized large swaths of the Sahel. Industrial-scale scam operations in Southeast Asia and parts of Africa rely on coerced labor, embedding vulnerable populations in criminal economies that prey disproportionately on the elderly in aging industrial societies. Other multinational laundering networks sustain transnational cartels that distribute lethal products while recycling billions in illicit proceeds.

In both underregulated jurisdictions and advanced economies, the downstream effects are increasingly visible: criminalized local ecosystems, degraded infrastructure, housing market distortion, and the erosion of demographic resilience essential to long-term social stability.

If left unchecked, these illicit flows have the power to destabilize and degrade modern life at a systemic level. For this reason, network-level disruption—not merely transactional interdiction—is imperative.

Toward Networked Disruption

Regulators and enforcement professionals are beginning to grapple with the scope of the challenge. Financial institutions, insurers, manufacturers, and other exposed sectors have devoted increasing resources to understanding global financial risk, giving rise to specialized internal teams and a growing ecosystem of external advisory firms of uneven quality. Enforcement authorities have also come to rely more heavily on the emerging blockchain analytics sector, but often as a partial substitute for deeper structural investigation.

For criminal organizations and malign state actors, blockchain has proven to be a double-edged sword. While it enables near-instantaneous, low-friction value transfer across jurisdictions, the permanent recording of transactions on public ledgers creates cumulative exposure once investigators begin reconstructing networks. Advances in machine learning and artificial intelligence – as I chronicled for an October article at GNET – have further accelerated the ability to cluster, trace, and contextualize these datapoints at scale, offering meaningful advantages over traditional investigative methods.

Regulatory efforts to bring key enablers—such as stablecoins—more fully within existing compliance frameworks are a necessary step forward. But transactional visibility and downstream disruption alone are insufficient. Achieving durable, network-level impact in a way that meaningfully improves global security requires a deeper understanding of how unregulated capital forms, aggregates, and moves at its source—before it is laundered, weaponized, or embedded into resilient criminal and state-aligned illicit infrastructures.

Why Timing Capital Outflows Is Essential

Understanding why timing matters requires close examination of where unregulated capital flows originate. In an increasingly polarized global financial environment, states seeking to operate outside the dollar-denominated system—often due to sanctions or anticipation of future sanctions—have enabled parallel financial architectures to sustain economic activity.

When these systems function as intended, they pull liquidity inward toward core institutions – especially central banks – reinforcing local currencies and supporting essential state functions under stress conditions such as wartime sanctions. As long as confidence holds, capital movement within these systems remains predominantly centripetal, stabilizing rather than eroding the domestic financial base.

But opacity of these parallel systems is both a feature and a fault. Because they are unaccountable by design—even to the states that authorize them—these systems enable insiders to quietly extract and offshore wealth. When confidence begins to fracture, elite incentives shift rapidly. Pressure to externalize capital compounds, transforming inward-facing financial mechanisms into outward-facing extraction channels. At this inflection point, operators increasingly seek offshore liquidity through any available means, including partnerships with transnational criminal networks and, in some cases, the financing of terrorism. When the financing of other states or proxy groups through these opaque networks becomes a state directive, the rate of elite pilfering often accelerates, as illicit capital movement is shielded by national security justifications and subjected to even less internal oversight.

Importantly, Tier 2 capacity is not unlimited. As unregulated capital outflows accelerate, intermediary networks can become congested, creating observable bottlenecks before capital fully disperses downstream. In several recent cases, unusually large pools of digital assets appear to have stalled within intermediary structures rather than being rapidly laundered onward, suggesting constraints in conversion, layering, or off-ramping capacity.

One widely reported example involves Prince Group, which has been linked in open-source reporting to the custody of a multibillion-dollar bitcoin balance. Regardless of ultimate attribution or intent, the scale and persistence of such holdings are difficult to explain by benign delay alone. More plausibly, they reflect saturation at the Tier 2 level—where capital has exited its origin environment but cannot yet be safely or efficiently absorbed into downstream structures.

Such congestion is analytically significant. It indicates that Tier 1 outflows are already stressing intermediary networks, even before full centrifugal dynamics take hold. For analysts and enforcement bodies, these stalled pools may therefore function as early warning indicators of impending cascade behavior rather than isolated anomalies.

This dynamic is already visible across multiple jurisdictions. Unregulated capital outflows from China are enabling multibillion-dollar transnational scam networks, casino-based laundering nodes, and drug trafficking organizations. Opaque outflows from Iran provide direct financial services to proxy groups and, indirectly, to terrorist organizations operating beyond Tehran’s stated strategic interests, including al-Qaeda-aligned actors in Somalia. Russia, meanwhile, relies on opaque financial channels to source physical gold and sanctioned inputs through criminal facilitators and private military companies operating abroad, sustaining its war effort under mounting external pressure.

When systemic trust in these environments deteriorates, capital outflow pressures compound. Iran’s parallel systems have already shifted into a centrifugal phase of capital flight, one likely to generate escalating downstream threats as stress persists. Russia continues to attract liquidity inward, but sustained trade contraction and reserve drawdowns increase the risk of a similar inflection. China, while still appearing stable on paper, has experienced persistent capital leakage for several years—producing some of the most severe downstream criminal and security effects observed to date.

These systems are inherently brittle. The strategic question is not whether they will fracture, but when. Once that threshold is crossed, vast pools of liquidity move rapidly through opaque channels that intersect with criminal and militant actors, producing destabilizing effects that are difficult to reverse. Understanding when these outflows are likely to accelerate—and at what scale—is therefore essential to planning any form of pre-emptive, network-level disruption of illicit liquidity systems.

A simplified diagram of centripetal vs. centrifugal liquidity flows through unregulated Tier 2 channels.

Understanding Capital Logic

In a post–Bretton Woods system, dollar-denominated capital tends to concentrate in jurisdictions that offer:

• Credible protection of property rights through predictable legal and regulatory institutions

• Stable, transparent, and non-punitive tax regimes

• Deep, liquid, and internationally integrated financial systems

• Political and currency stability sufficient to preserve real value

• Credible exit optionality, allowing capital to move without arbitrary restriction or penalty

• Broad-based asset appreciation that rewards passive capital over time

These conditions largely explain why, over the past fifty years, global wealth has been reinvested disproportionately into Western financial markets—particularly the United States, which combines deep capital markets with unmatched legal and currency credibility.

In highly controlled jurisdictions with adversarial or semi-adversarial relationships to Washington—such as China, Russia, and Iran—capital behavior is governed by a different logic. In these systems, jurisdictional prudence becomes a critical X-factor shaping whether capital remains onshore or seeks exit.

In such environments, capital can rationally remain domestic despite restrictive controls if two conditions hold:

• The domestic economy continues to offer returns that exceed the cumulative cost and risk of outward transfer

• Regime behavior remains bounded and predictable, such that capital faces managed exposure rather than sudden or arbitrary appropriation

Where these conditions are met, capital inertia is often the rational outcome—even in jurisdictions that lack many of the features typically associated with capital-attracting environments. But when these conditions go away, typically as a feature of economic downturns borne of deep structural flaws, capital takes flight, even at enormous cost to its owners. However, the adoption of cryptocurrencies, including central bank digital currencies, reduces the cost and increases the speed of capital mobility, reducing the time it takes for downstream threats to manifest.

There is no universal formula for precisely timing or quantifying Tier 1 capital outflows. What is increasingly clear, however, is that the velocity of modern unregulated finance causes downstream threat formation to accelerate rapidly once cascading dynamics are triggered. Conventional country risk frameworks have consistently misread these systems as more stable than they are by ignoring the behavior of elite capital under stress. Effective security intervention therefore depends on identifying and disrupting Tier 1 outflows before they metastasize into downstream criminal and militant activity.

A mathematical simplification

I have formalized this logic into a simple decision rule governing capital outflows from tightly controlled jurisdictions. The formulation builds on John T. Cuddington’s 1986 treatment of capital flight as a portfolio response, updated to reflect the substantially lower costs and reduced barriers to entry created by contemporary Tier 2 facilitators.

In this formulation, Rd denotes the expected return on domestic assets, adjusted for political and regime risk. This adjustment, A, captures the probability and severity of arbitrary state intervention, expropriation, capital freezes, or discretionary enforcement that reduces the effective value of onshore wealth.

Ro denotes the expected return available in offshore jurisdictions, reflecting both asset performance and institutional credibility abroad. The term C represents the cumulative cost of externalization, including capital controls, transaction and intermediary fees, time delays, enforcement exposure, and operational risk associated with moving capital across borders.

Capital remains onshore when the risk-adjusted domestic return (Rd minus A) exceeds the offshore alternative net of externalization costs (Ro minus C). Capital flight becomes the rational outcome once this inequality reverses.

Technologies that reduce transfer friction—most notably cryptocurrencies and related settlement infrastructures—operate by lowering C, thereby compressing the time between deteriorating domestic conditions and large-scale capital outflows and accelerating the emergence of downstream threats.

Bridging the siloes

One of the primary reasons these dynamics continue to be misread is that the systems responsible for monitoring finance, trade, sanctions, and security risk remain analytically siloed. Capital flight is treated as a macroeconomic concern. Trade distortions are assessed separately from illicit finance. Criminal and militant threats are examined downstream, long after the financial conditions that enable them have already taken shape.

This fragmentation obscures the timing problem at the center of modern illicit liquidity. By the time financial and/or political instability registers in conventional economic indicators—or downstream threats become visible to security services—the critical window for upstream intervention has often already closed as Tier 2 intermediaries have scaled. Capital has dispersed. Criminal and militant actors have embedded themselves into resilient networks that are costly and difficult to unwind.

Bridging these siloes is therefore not a matter of institutional reorganization, but of analytical integration. Understanding when and how Tier 1 capital begins to externalize—across financial, trade, and geopolitical domains simultaneously—is essential to disrupting Tier 2 networks before they mature and preventing downstream threats from metastasizing at scale.

Conclusion

Modern illicit liquidity systems move faster than the frameworks built to monitor them. As capital mobility accelerates and parallel financial architectures grow more opaque, downstream threats will continue to emerge faster than reactive enforcement can contain them.

The central challenge is no longer attribution after the fact, but anticipation. Identifying when Tier 1 capital begins to externalize—how quickly it moves, where it encounters friction, and when intermediary capacity begins to saturate—has become the decisive variable in preventing the downstream consolidation of criminal and militant power.

Meeting this challenge requires analytical integration across finance, trade, sanctions, and security domains. Without that integration, institutions will continue to misread stability, intervene too late, and confront threats only after they have embedded themselves into resilient networks.

Protests have erupted across multiple Iranian cities, with demonstrators chanting “death to the dictator.” Such unrest is not new: major waves occurred in 2009, 2017–2018, and 2022–2023. What appears different in the current cycle is its socioeconomic base. Reporting suggests mobilization began in poorer and working-class communities that have historically provided key regime support, before extending into more familiar youth dissident ranks. This pattern points to economic stress as the primary catalyst for the current wave of unrest.

Iran’s economic deterioration has sharpened the underlying drivers of these ongoing protests. Inflation and currency depreciation have eroded purchasing power, while chronic underinvestment has compounded basic-service failures, including acute water stress. With limited fiscal room to stabilize living conditions at scale, the state has increasingly relied on coercive containment—reinforcing incentives for households and elites alike to externalize wealth.

Iran’s accelerating economic crisis is not solely the product of sanctions or mismanagement. It is increasingly driven by capital flight embedded within the same networks initially developed to foster state resilience—networks that now operate beyond effective control. Under pressure, opaque networks built for sanctions resilience and regional power projection now function as conduits for capital flight.

Subscribe now

A siege economy overseen by a multidimensional security actor

Iran is among the world’s most heavily sanctioned states, and has been for nearly five decades, severely constraining its access to formal financial systems and conventional trade finance. To function, the Iranian state and economy rely on a fragmented but resilient ecosystem of informal, semi-formal, and illicit channels to sustain trade, preserve value, and maintain currency stability.

Within this environment, the Islamic Revolutionary Guard Corps (IRGC)—a multiservice institution with paramilitary, intelligence, and economic roles—has emerged as a central coordinating actor. While not the sole driver of sanctions evasion, the IRGC plays a critical role in overseeing and stabilizing the networks that enable Iran to operate under prolonged economic pressure. The Quds Force, IRGC’s elite external operations arm, oversees these foreign facing networks.

These networks include shadow tanker fleets moving discounted Iranian crude to global markets, procurement channels sourcing dual-use components for domestic weapons production, and trade and logistics firms facilitating the movement of high-value commodities such as physical gold, and informal financial institutions. In several cases, Iranian proxy organizations participate directly in these systems, often in exchange for financing, logistical support, or political backing facilitated by the IRGC.

For example, Hezbollah-linked networks in Venezuela have participated in gold smuggling operations connected to Venezuelan supply chains, while Houthi-linked facilitators have played roles in brokering oil shipments to independent refiners in China. Across these pathways, IRGC-affiliated actors frequently provide coordination, protection, or logistical oversight, giving them visibility into — and influence over — critical flows of capital and goods.

By anchoring these networks, the Quds Force does not merely facilitate sanctions evasion; it effectively underwrites the movement of value into and out of the Iranian economy. This role has helped sustain economic functionality under extreme external pressure – driving export revenue and necessary imports while arming regional proxies – but it has also enabled significant capital outflows. In this sense, the Quds Force operates not only as a military or intelligence institution, but as a central node in Iran’s siege-economy infrastructure — one that governs access, risk, and continuity across otherwise fragmented financial and trade networks. Because these networks operate through opaque and compartmentalized channels, and because the IRGC ultimately answers only to the Supreme Leader - an 86-year-old man who frequently avoids the spotlight amid health speculations - they are structurally vulnerable to elite capture and internal rent-seeking.

Within Iran, the broader IRGC organization has consolidated control over much of the domestic economy. Companies such as Khatam al-Anbiya, an IRGC-linked engineering firm, have vast interests across the Iranian economy ranging from fuels and hydrocarbons to agriculture, mining, real estate, and infrastructure. IRGC functionaries have even intervened to prevent a major tech company from going public last year, presumably as a means of managing control over it. Major defense contractors such as Shahed Aviation – responsible for Iran’s Shahed drone program – also fall under the control of the IRGC’s vast portfolio of domestic assets.

The IRGC also captures a large share of state spending through defense and infrastructure procurement. Estimates suggest it receives roughly 34% of total military expenditure, which rose sharply in 2025 (to an estimated $23.1 billion). Given the IRGC’s influence over key suppliers and contractors, a significant portion of this spending flows into opaque channels it controls.

Taken together, these dynamics form the architecture of a vertically integrated siege economy. The broader IRGC consolidates and captures liquidity domestically through control of procurement, infrastructure, defense production, and budgetary flows, while the Quds Force manages the external channels that move value across borders, absorb sanctions risk, and interface with deniable networks. Under conditions of sustained pressure, this division of labor preserves regime functionality but also facilitates capital flight, as assets accumulated within the domestic system are routed outward through opaque, compartmentalized pathways beyond effective oversight.

Stress Test Conditions

Iran’s economic system is undergoing a sustained stress test shaped by three converging pressures: intensifying sanctions, escalating regional conflict with Israel, and accelerating capital flight. The latter of these has been enabled by informal financial mechanisms and weak regulatory enforcement, and comes in response to the former two. Together, these forces are pushing the country beyond episodic economic strain and toward a deeper crisis of economic governance, resulting in widespread capital flight and the erosion of monetary stability.

Regional Conflict, Military Costs, and Collapsing Revenue

The financial burden of Iran’s expanding regional confrontation has grown sharply. Analysts estimate that the country’s direct and indirect costs from its recent 12-day conflict with Israel alone were $24 - $35 billion, a figure that does not account for the ongoing and open-ended costs of proxy warfare across Lebanon, Iraq, Syria, and Yemen. Even conservatively assessed, this level of expenditure represents a meaningful share of national output—exceeding 6% of GDP—at a time when Iran’s economy is already contracting under sanctions pressure.

These military outlays are colliding with mounting stress on the state’s primary revenue base. Petroleum and mineral fuel exports—historically comprising over 30% of government revenue, and some 80% of export earnings—have come under increasing strain. Demand for Iranian crude has softened as Chinese buyers grow more cautious amid escalating foreign pressure and enforcement risk. Moreover, the discounted oil market became more saturated after 2022 as sanctioned Russian crude expanded supply, compressing margins.

Compounding these pressures, recent seizures of oil tankers linked to sanctioned networks—particularly off the Venezuelan coast—have cast doubt on the long-term viability of shadow tanker fleets. While some speculate that Chinese buyers will purchase Iranian crude to make up for their recently disrupted Venezuelan supplies, this ongoing enforcement against shadow tanker fleets could further impact these shipments. With a Russian-flagged tanker seized by US forces in the Atlantic on January 7, ship owners and crews may become unwilling to transport sanctioned oil supplies, especially amid questions of whether Chinese and Russian state-owned and shell company insurers will cover losses from vessel seizures. These developments raise concerns that Iran could face a sharp disruption in export capacity as early as 2026, undermining one of the last remaining pillars of fiscal stability.

Weaponized Fintech: Digitalizing the Siege Economy

Under prolonged sanctions, Iran emerged as an early adopter of crypto and alternative digital payment systems designed to bypass formal banking channels. What initially functioned as a tool of sanctions resilience has increasingly devolved into a dual-use financial infrastructure—supporting both state procurement and large-scale capital outflows. While crypto does not replace trade-based channels in volume, it compresses settlement time, reduces visibility, and lowers exit friction for elite capital flight.

Iran’s largest domestic exchange, Nobitex, illustrates this dynamic. Investigations by blockchain analytics firms have linked the platform to wallet clusters and transaction patterns consistent with IRGC-aligned financial activity, suggesting that it functions not merely as a commercial exchange, but as a critical node within Iran’s cross-border sanctions-evasion architecture. These channels have reportedly been used to facilitate procurement of dual-use components for Iran’s drone and weapons programs, particularly where conventional trade finance is unavailable.

At the same time, this infrastructure has facilitated massive capital flight. Transaction data indicate that crypto outflows surged sharply during periods of heightened geopolitical tension—including a reported 150 percent spike in mid-2025 amid escalating confrontation with Israel—highlighting how digital financial tools simultaneously enhance regime resilience and accelerate elite asset externalization.

In this sense, fintech is the digital extension of Iran’s siege economy—one that further erodes state visibility, weakens monetary control, and compresses the boundary between sanctions evasion and private capital flight. As pressure on physical export channels has intensified, Iran’s reliance on non-physical and digitally mediated settlement mechanisms has increased in parallel. Without regulatory accountability, these digital channels give elites an unprecedented opportunity to hollow out the Iranian economy while their assets come under stress.

Capital Flight and Monetary Erosion

At the same time, capital flight has accelerated through informal channels operating beyond effective state oversight. In 2024, Iranian capital outflows reached $20.7 billion, triple what they were in 2020: estimates for 2025 could place these at $36 billion, roughly 10% of GDP. These movements reflect not only popular distrust in the rial, but also growing elite efforts to externalize wealth amid political uncertainty, inflation, and deteriorating public services. Iran’s widespread adoption of crypto has become a dual-use enabler, allowing the regime to purchase critical components outside sanctions controls, but also permitting wealth to flow out of the country with minimal restriction – all through loosely regulated IRGC-managed channels.

The monetary and social consequences have been severe. Central bank assets have continued to decline as the government increasingly relies on monetary expansion to cover rising debts and budget shortfalls created by falling export revenue. This dynamic has accelerated the depreciation of the rial, fueled persistent inflation, and eroded household purchasing power. Rising living costs—combined with structural stresses such as water mismanagement and infrastructure decay—have triggered repeated protest waves, further reinforcing elite incentives to offshore capital rather than reinvest domestically.

A Governance Crisis, Not a Liquidity Shock

What is emerging is not a temporary liquidity squeeze, but a deeper crisis of financial governance. The Iranian state increasingly struggles to manage the very systems it once used to project power, enforce political control, and buffer external pressure. Informal mechanisms that once enhanced resilience—shadow trade, opaque financial channels, and coercive enforcement—are now amplifying instability by enabling capital flight, weakening fiscal discipline, and reducing the state’s visibility over its own economic base.

Under these stress-test conditions, Iran’s economic challenge is no longer simply sanctions survival. It is the erosion of the state’s capacity to govern liquidity, allocate resources, and retain elite confidence—an imbalance that becomes progressively harder to correct the longer it persists.

Three-Tier Financial Architecture

Understanding Iran’s capital flight dynamics requires moving beyond linear models that separate state finance, sanctions evasion, and proxy activity into discrete domains. In practice, these functions are integrated through a three-tier financial architecture that deliberately separates control, mobility, and utilization of capital. This structure has enhanced Iran’s resilience under sanctions, but it has also accelerated elite capital flight. These factors externalize financial risk onto regional and global markets, and security risk into the broader global community.

A model of the three-tiered framework applied to Iran

Tier 1: Iran

At the apex of this system sits Tier 1, composed of state and private institutions, politically connected elites, and intermediaries who generate, authorize, or appropriate economic value. This tier includes state-linked corporations, import–export firms, and wealthy individuals with preferential access to foreign exchange, trade licenses, and protected commercial channels – all increasingly under the influence of the broader IRGC organization. Under sustained sanctions pressure, Tier 1 actors have increasingly prioritized wealth preservation over domestic reinvestment. Rather than functioning as anchors of economic stability, many now behave as rational extractors, externalizing capital while maintaining nominal alignment with the system.

Loosely regulated and opaque by design, this tier leaks much more liquidity out of the country than is sustainable under current stress conditions. This leakage creates downstream threats at the Tier 3 level. Importantly, this tier does not move capital efficiently on its own. It depends on Tier 2 intermediaries capable of operating in opaque environments where formal institutions cannot function.

Tier 2: IRGC-Quds Force-linked Networks

That intermediary role is fulfilled by Tier 2, the facilitation and mobility layer. This tier converts domestically constrained or politically sensitive value into mobile, sanctions-resilient capital. It encompasses logistics firms, ports, trade companies, crypto exchanges, and financial intermediaries that operate at the boundary between legality and informality. Within this layer, the IRGC-Quds Force plays a central structural role. Rather than acting as a universal operator, it functions as a guarantor of enforcement, protection, and continuity. Through its influence over logistics corridors, customs chokepoints, and security arrangements, it underwrites the reliability of transactions that would otherwise be too risky to sustain. As a result, Tier 2 infrastructure processes state funds, elite capital, and proxy-generated revenue through the same channels, blurring distinctions that once separated these streams.

Although not the sole agent, the Quds Force serves as the operational backbone of this layer, underwriting vast networks linked to domestic institutions such as logistics and trading firms as well as exchanges such as Nobitex. This shadow banking system extends to foreign brokers in places such as the Persian Gulf and Hong Kong: some of these run over the counter (OTC) crypto trading desks and many more are nodes in vast informal hawala networks – all operating outside formal and regulated banking channels.

Tier 3: Proxies and other downstream threats

At the downstream end of the architecture sits Tier 3, composed of Iran’s proxies and other threat actors. Often mischaracterized as passive recipients of state financing, many of these groups now operate as semi-autonomous financial entities, enabled by Tier 2 facilitators. Through trade, logistics, smuggling, construction, and real estate activity, they circulate capital across regional markets and embed themselves within local commercial ecosystems.

Several proxies have diversified beyond reliance on Tehran’s fiscal health, reducing exposure to Iran’s domestic instability while increasing financial independence from the state. Examples include the Houthis’ use of Southeast Asia’s gray finance networks and Iraqi militias’ manipulation of local cash economies. Proxy revenues, however, are not fully externalized. Capital is frequently cycled back through Tier 2 infrastructure, where IRGC-linked facilitators provide conversion, protection, and partial normalization under state cover. Once processed, these funds are redeployed into longer-term assets, particularly high-end real estate and commercial investments in Iraq and the Gulf. This circular flow collapses traditional distinctions between state finance, proxy finance, and private capital flight.

The risks extend beyond Iranian proxies themselves. Tier 3 networks are opaque by design and difficult to control, generating spillover effects. The Houthis maintain ties with Somalia’s al-Shabaab, which sells illegally exported charcoal through Iranian-linked ports and logistics firms. Al-Qaeda retains a residual presence inside Iran under nominal state protection, while the Taliban launder funds through Iranian Tier 2 channels. In one example, an Iranian official in the pharmaceutical industry warned that underground exports of Iranian medicine to Taliban-controlled Afghanistan could lead to critical shortages at home.

Together, these linkages illustrate how Tier 3 actors increasingly function as connective tissue between sanctioned states and transnational militant economies, amplifying risk well beyond Tehran’s nominal strategic intent.

Implications: Why the three-tiered model matters

This three-tier structure explains why Iran’s economic stress manifests not as sudden collapse, but as progressive governance erosion:

• Tier 1 extracts value faster than it reinvests.

• Tier 2 optimizes mobility rather than oversight.

• Tier 3 diversifies and entrenches capital beyond the state’s reach.

The architecture that once enhanced sanctions resilience now amplifies capital flight, reduces monetary visibility, and exports financial and security risk into neighboring markets. Over time, the state shifts from governor of liquidity to one participant among many—struggling to reassert control over systems it helped build but can no longer fully supervise.

China’s role as the primary buyer of smuggled Iranian oil extends this architecture beyond Iran’s control space. Revenue routed through Tier 2 facilitators returns to state-linked channels, with evidence that portions leak into proxy finance. If Houthi-linked oil sales and the subsequent movement of at least $39 million through the Chinese-language Huione platform in Cambodia are connected to Iranian oil revenue streams, they suggest that Tier 2 infrastructure enables not only cross-tier proxy funding but also intra-tier diversion of state-linked proceeds.

Crucially, this infrastructure is not exclusively used by Iranian proxies. The same Tier 2 channels that facilitate proxy finance also provide liquidity, laundering, and settlement pathways for non-proxy militant actors operating in proximity to Iranian networks. Taliban-linked actors have laundered funds through Iranian facilitation channels, while residual al-Qaeda networks have exploited Iran-based logistics, transit, and financial intermediaries under varying degrees of state tolerance. These interactions need not reflect unified strategic intent to generate risk: they emerge from the availability of deniable, sanctions-resilient infrastructure operating beyond effective oversight.

The cumulative effect is the emergence of shadow financial systems that are increasingly more resilient than the state structures that enabled them. These networks adapt quickly, move capital efficiently, and operate across jurisdictions with minimal accountability—shaping regional security dynamics regardless of regime outcomes and, in some cases, enabling coercive or violent activity well beyond Iran’s nominal strategic priorities.

A model of how Tier 1 Iranian oil smuggling indirectly facilitates Tier 3 proxy funding through Tier 2 facilitators.

Conclusion

Capital outflows are not the sole cause of Iran’s economic crisis, but they serve as a critical accelerant. By weakening monetary stability, empowering unaccountable actors, and eroding institutional authority, they deepen systemic fragility. What remains is an economy increasingly governed by survival logic rather than policy, where financial power resides not within the state but within the shadow structures that have grown around it.

This article was published in conjunction with the New Lines Institute. You can find the original link here.

Chinese money-laundering networks (CMLNs) have quietly become the financial engine of Latin America’s drug cartels. What once appeared as isolated headlines – Chinese gambling junkets washing millions through U.S. casinos, luxury real-estate loops, suspicious bulk cash deposits at West Coast banks – now forms a single system linking Chinese capital flight to cartel profit cycles.

Regulators continue to grapple with the scale. In late 2024, the U.S. Treasury’s Financial Crimes Enforcement Network (FinCEN) issued a record $3 billion penalty against TD Bank for failures tied to cartel-linked laundering. Less than a year later, in August 2025, FinCEN followed with a national advisory flagging $312 billion in suspected CMLN-related transactions tied to Mexican cartels between 2020 and 2024 – a figure that suggests the headlines are only the surface of a much deeper architecture.

Cartel money laundering through Chinese networks is not an isolated phenomenon. While public attention often centers on downstream effects of cartel operations such as violence and addiction, these impacts are structurally enabled by China’s internal demand to move capital offshore – a demand amplified by digital technologies that now move value faster than any regulatory system can track. The same financial and political dynamics driving Chinese elites to expatriate wealth have also produced the infrastructure powering Southeast Asia’s scam compounds, regional insurgencies, and a shadow digital economy that increasingly behaves like a self-reinforcing network. Taken together, China’s internal financial pressures have produced a shadow liquidity architecture that connects its domestic financial instability to the expansion of criminal and insurgent activity worldwide.

In the Americas, that architecture has taken on a new shape, giving Mexican cartels access to Chinese capital-outflow mechanisms perfectly adapted to their needs. These mechanisms provide criminal groups the means to expand their operations and legitimize illicit gains by tapping into the financial reach of the world’s second-largest economy. From fentanyl precursors and pill presses to consumer goods sold through semilegitimate front companies, China’s industrial machine empowers the criminal-paramilitary networks driving insecurity and mass violence across much of the Americas. Meanwhile, CMLNs legitimize the profits of a multibillion-dollar addiction problem in a way that contributes to inflated prices in an increasingly unaffordable housing market.

The result is a shared financial ecosystem linking capital flight from China to fentanyl profits on either side of the U.S.-Mexican border. It is a convergence that transforms a domestic Chinese financial problem into a global security threat with the potential to upend the traditional power structure behind the North American drug trade, putting globalized CMLNs at its center. Traditional enforcement models were not designed to address this level of complexity, forcing the emergence of a new generation artificial intelligence and machine learning-enabled tools to combat global illicit finance. With criminal actors evolving in parallel, the world is entering a technological contest between shadow capital and the institutions charged with constraining it.

The Liquidity Cascade

CMLNs transform bulk U.S. dollars from narcotics sales into both onshore renminbi purchasing power in China and offshore dollar liquidity for Chinese clients seeking capital flight. Through shadow banking, mirror swaps, crypto-settlement, and cash laundering businesses, these networks have created a financial architecture that allows cartel proceeds to fuse seamlessly into China’s capital-flight mechanisms. What appears from the outside as cartel money laundering is, in reality, the downstream face of a much larger imbalance: the accelerating pressure among Chinese elites to move wealth beyond the reach of domestic controls.

Advances in digital technology underpin this new paradigm: a parallel architecture that operates independently of the SWIFT financial payments system, formal banks, or Western oversight. Mirror transfers (对敲 duìqiāo), over-the-counter cryptocurrency brokers, and gray-market crypto exchangers link Chinese elites, intermediaries, and transnational criminal syndicates into a single global liquidity ecosystem. Cartels have tapped into this infrastructure because it gives them what traditional laundering cannot: frictionless conversion, instant settlement, and access to the world’s largest industrial economy.

Mirror transfers are the primary way Chinese capital outflows are operationalized into cartel laundering infrastructure. The process works thusly:

• Cartels deposit bulk drug cash with Chinese brokers in the Americas, who launder the physical notes locally through cash-intensive businesses such as casinos and massage parlors. These funds pass between shell companies and nominee entities through multiple transactions that obscure their origin.

• U.S.-based brokers then pay Chinese clients in dollars and dollar-denominated assets using laundered funds, thus satisfying their need for offshore funds.

• Simultaneously, China-side brokers settle the other half of the swap by using renminbi pools – paid in by Chinese clients seeking capital flight – to generate export credits or payments for cartel-linked importers in Mexico.

In this arrangement, value moves, but no formal cross-border transfer ever occurs. Because the literature tends to isolate individual pieces, the full architecture is best understood through a three-tiered framework that traces how elite wealth in China becomes operational fuel for fentanyl networks in Mexico and the United States.

Tier 1: Capital Flight Reservoirs in China

The CMLN–cartel relationship begins inside China. For decades, the rise of the world’s largest property bubble created a demand for credit that state-owned banks could not satisfy, fueling the expansion of a vast, unregulated financial sector. At the same time, strict capital controls and political pressure drove elite Chinese households to move money offshore – a dynamic that intensified dramatically after the property bubble’s 2020 deflation. The convergence of these forces produced enormous capital flight pressure, creating vast renminbi pools among China’s underground financiers, waiting to be converted into offshore dollars – a domestic imbalance upon which the entire CMLN system rests.

In this way, Beijing’s failure to regulate its property market not only inflated the bubble but also facilitated the rise of a pervasive parallel financial system.

Tier 2 – CMLNs as Liquidity Infrastructure

Tier 2 is where China’s internal capital-flight pressures are transformed into a global facilitation system. CMLNs sit at the operational middle of mirror-transfer swaps, which allow value to move offshore without ever crossing a border. Operating out of hubs such as Los Angeles; Vancouver, British Columbia; and Mexico City, brokers rely on loosely connected networks of cash-intensive front businesses to launder cartel bulk currency and convert it into clean dollars. Their China-side counterparts in Tier 1 settle the mirrored leg of the transfer using renminbi accumulated from elites seeking to offshore wealth, bypassing both China’s formal banking system and SWIFT entirely. Brokers use laundered cash ATM deposits, and increasingly stablecoins and shell company real estate purchases, to make Chinese clients whole in offshore dollars – often with the help of Chinese students enrolled in Western universities working on behalf of family members and associates back home.

For cartels, the same mechanism delivers renminbi-denominated purchasing power inside China. Early iterations relied partly on gray-market daigou arbitrage – purchasing luxury goods in the United States and reselling them inside China through informal retail channels – but this vector has been constrained by slowing demand and Beijing’s crackdowns to protect domestic consumption and control capital flows. Fortuitously for cartels, rising pressure among Chinese elites to move wealth offshore has created large renminbi reservoirs within the underground banking system, more than meeting the China-side obligations of the mirror-transfer process.

By servicing both Tier 1 Chinese clients and Tier 3 cartels, Tier 2 CMLNs collect enormous fees and have become the structural hinge of the entire system – the brokers who connect global criminal economies to the industrial and financial power of China.

Tier 3 – Cartels as End Users

Tier 3 is where cartels receive value from the system, not in renminbi itself but in the purchasing power it represents. By depositing bulk cash with Tier 2 brokers, cartels gain access to renminbi-denominated value inside China’s commercial ecosystem, allowing them to buy the inputs that scale their operations – fentanyl precursors and pill presses to resell in North America for dirty cash and electronics and other goods for clean liquidity. Trade-based money-laundering (TBML) pipelines and front companies provide the commercial cover that turns mirrored value into export credits and legitimate invoices. In effect, CMLNs give cartels a backdoor into China’s industrial economy, enabling them to convert drug proceeds into operational power, hard assets, and legitimacy that would otherwise be inaccessible.

Cartels are not the architects of this system, but they are destructive end users, empowered by a financial architecture built thousands of miles away and far beyond the reach of traditional enforcement.

Upstream Architecture vs. Downstream Effects

The choke point in this system is the CMLN operators at Tier 2 – brokers who convert, settle, and transport value across gray-market channels that long predate cartel involvement. North American banks and payment platforms are not willing participants; they are intrusion targets exploited through shell companies, falsified invoices, identity-laundering tactics, and mule accounts used to obfuscate the origin of illicit funds moving through them. Laundering occurs before funds interact with the formal financial system, which is why Tier 2 remains the operational center of gravity.

This is not the only global threat vector stemming from Chinese capital flight. Although the immediate focus here is the Americas, underground renminbi reservoirs in China anchor an entirely separate but structurally similar ecosystem across Southeast Asia’s scam compounds, gray-market gaming hubs, and illicit digital-finance corridors. There, too, a three-tiered cascade links onshore Chinese RMB pools to offshore facilitators and downstream criminal end users – a parallel architecture that mirrors the CMLN-cartel system. This broader pattern underscores the core point: China’s shadow-finance engine generates global liquidity structures whose downstream expressions differ by region but whose underlying mechanics remain consistent. These dynamics set the conditions for global threats to manifest.

Despite rising public attention on cartel violence and fentanyl overdoses, enforcement agencies and much of the media continue to misdiagnose the architecture behind cartel liquidity. Tier 2 CMLNs are still described as if they were auxiliary cartel partners or offshore laundering boutiques. In reality, they are the globalized expression of China’s internal financial disorder, and the cartels are simply the most dangerous beneficiaries of a system that predates them.

This misdiagnosis has consequences. Policy responses remain locked on downstream symptoms – bulk cash seizures, courier networks, transactions structured to evade reporting thresholds, front companies – while the upstream liquidity cascade stemming from inside China regenerates unabated. Each high-profile enforcement win removes a node, but not the system. The architecture adapts, reroutes, and strengthens, precisely because the underlying demand signal does not come from cartels at all.

Four factors become impossible to ignore:

• Chinese elites are the primary liquidity source, driving the demand for offshore dollars that fuels CMLN operations. Cartel cash is a convenient supply, not the engine of the system.

• Cartel integration is opportunistic, not foundational. Cartels inserted themselves into a pre-existing outflow network designed for capital flight, not criminal finance, because it is more efficient than legacy laundering methods.

• Cartels are downstream clients. CMLN infrastructure does more than launder cartel cash – it supplies the purchasing power that underpins their business model, giving them access to industrial-scale chemical precursors and equipment inside China. With these synthetic drugs now far more profitable than cocaine or cannabis produced in the Americas, this dynamic risks shifting the operational center of gravity toward CMLNs themselves, much as it once shifted from Colombian cartels as exporters to Mexican cartels as global distributors.

• Enforcement wins remain tactically impressive but strategically insufficient. Seizing accounts or shutting down front companies rarely touches the structural incentives that bind Chinese capital flight to cartel proceeds. The architecture is left intact, and the system improves through adaptation.

The strategic blind spot is not a lack of enforcement capacity. It is the persistent belief that cartel laundering is a cartel-led enterprise, when in fact the cartels are downstream actors plugged into an ecosystem shaped by a much larger set of financial pressures. Until policymakers treat CMLNs as part of a global capital-flight infrastructure – not a narco-adjacent novelty – the enduring three-tiered cascade will continue to reproduce itself faster than it can be disrupted.

Strategic Implications

What emerges from this architecture is not a cartel-finance anomaly but another iteration of an emerging global liquidity order. An interconnected and globalized ecosystem of tech-enabled shadow banks, cryptocurrency intermediaries, and laundering networks – operating across mainland China, Hong Kong, and the Americas – now functions as an informal central bank for illicit and gray-market capital. Their balance sheets are vast, opaque, and fed by the constant demand for offshore dollars among wealthy elites under tight capital controls.

China’s domestic weakness is the system’s strength. As long as elite capital-flight pressures persist, CMLNs will remain stable, adaptive, and indispensable. Because renminbi pools inside China feed multiple downstream economies – militant-backed scam compounds in Southeast Asia and militarized drug cartels in the Americas – the threat becomes increasingly globalized.

For Beijing, CMLN mirror transfers represent a deeply problematic, structurally persistent, and critically under examined vector of capital flight. Although renminbi never formally leaves the country, the value of that money exits China through offshore dollar pools controlled by brokers. Exporters are paid in renminbi with no dollars entering the Chinese banking system, depriving the state of foreign-currency inflows and undermining capital-control integrity. The result is a silent erosion of China’s foreign exchange management architecture – a slow hollowing-out effect similar to other forms of elite capital exfiltration, but with even higher opacity and fewer policy levers available for Beijing to control.

For North America, the implications are severe. CMLNs form the financial spine of a system that channels cartel drug proceeds into the offshore renminbi pools used by Chinese elites seeking dollar access. This fusion of cartel cash and capital-flight demand pushes billions of dollars into Western real estate, luxury assets, and private-market vehicles – particularly in Canada and key U.S. cities – at a time of record unaffordability. The same liquidity architecture that fuels fentanyl-linked deaths in the United States and Canada, and enables escalating cartel violence in Mexico, also accelerates opaque trans-Pacific capital inflows that distort markets and weaken financial governance.

For enforcement agencies, the asymmetry is structural. Downstream interventions, no matter how aggressive, cannot meaningfully disrupt a system whose incentives are upstream and whose architecture is distributed. The persistent enforcement gap is not a failure of policing but a failure of framing: the problem is liquidity infrastructure, not individual criminal actors.

Moving Beyond Human Enforcement Capacity

Technology has rewritten the physics of money. What once required suitcases, offshore accounts, and months of coordination can now move through encrypted chats, offshore OTC desks, and digital payment platforms in minutes. Liquidity has slipped out of state control and into networks never meant to wield it, producing a technologically accelerated destabilization that can only be countered with tools operating on the same scale.

Criminal actors grasped this new paradigm before policymakers could react. Bulk cash, once a liability, can now be converted into purchasing power inside China through networks that merge capital flight with cartel liquidity needs. What appears to be a laundering service is, in fact, shared financial infrastructure.

Chinese money-laundering networks sit at the center of that infrastructure. They are not peripheral fixers but the architecture linking China’s internal financial pressures to the expansion of cartel power. They endure because the incentives that produced them remain intact, and because enforcement continues to target the edges rather than the structure itself.

At the structure’s core is liquidity. The ability to move value faster than states can detect has become a force of sovereignty – determining who can project power, absorb shocks, outlast pressure, and operate within the blind spots of the global system. Cartels did not defeat states through ideology or insurgency, but by mastering liquidity, building a financial nervous system more adaptive than the one meant to contain them.

Until CMLNs are recognized not as peripheral laundering boutiques but as the infrastructure of a new liquidity order, the gap between state capacity and illicit capability will only widen. At this point, the limits of human enforcement become unavoidable. Task forces can seize cash, shutter front companies, and arrest intermediaries – but humans can only see snapshots of a system that evolves in real time. A liquidity network built on mirror swaps, diaspora brokers, synthetic trade chains, and offshore renminbi reservoirs cannot be mapped manually. Its architecture is too distributed, too adaptive, too fast.

The shift on the enforcement side has already begun. As recent analysis shows, blockchain-analytics firms and financial-intelligence units are quietly layering machine-learning models into their detection systems – clustering wallets, mapping laundering networks, and identifying anomalies across stablecoin flows, escrow logs, and commercial-invoice patterns. These are prototype architecture-level tools, the first enforcement systems designed not to chase criminals but to map the infrastructure that makes crime possible. The most advanced of these models already operates across jurisdictions and asset classes, revealing relationships that traditional investigative methods could never uncover.

Artificial intelligence is not an adjunct to enforcement; it is the first form of enforcement capable of operating upstream. Only systems that learn as quickly as the networks they track can identify the structure beneath the transactions – the neural architecture of shadow liquidity itself. In a world where liquidity behaves like a distributed neural network, enforcement will require its own neural network in response, guided by humans who can see the system at a structural level.

This is not futurism. It is the logical extension of the world we already inhabit. The liquidity order described above will not be disrupted by more seizures, more arrests, or more border checks. It will only be countered by humans wielding tools capable of recognizing the system for what it is: distributed, multilayered, resilient, and evolving faster than traditional governance can respond.

This is an article I recently wrote for The Diplomat with the help of Brett Erickson - who aided immensely in reaching out to and interviewing the AUSTRAC CEO Brendan Thomas. You can find the original link here.

Australia’s top financial-crime official has sounded the alarm on the worrying transformation of his country’s economy. Behind the rhetoric of fintech innovation lies an expanding shadow liquidity network linking Canberra’s financial sector to the grey market capital circuits of Asia and Latin America – a system now testing the limits of regulatory sovereignty itself.

What began as a permissive environment for digital experimentation has quietly evolved into a regional clearinghouse for unregulated money.

“Digital-currency transactions are major financial-crime risks in Australia,” said Brendan Thomas, chief executive of the Australian Transaction Reports and Analysis Centre (AUSTRAC). “We currently have around 450 digital-currency exchanges and a sector characterized by rapid growth and very poor AML [Anti-Money Laundering] compliance.”

Today, Australia has hundreds of registered digital-currency exchanges and crypto-related operators, many of which, regulators say, are at increasing risk of exploitation for money laundering, scams and fraud, offering the potential for large value flows between criminal syndicates, grey market actors, and legitimate institutions. Stablecoins and over-the-counter (OTC) desks offer frictionless dollar exposure to actors evading capital controls and sanctions, while trade-based laundering networks now tie Sydney and Melbourne directly to illicit and semi-licit actors across Latin America, Hong Kong, and Southeast Asia.

This architecture hides in plain sight. Crypto exchanges double as proxy banks for offshore wealth; illicit proceeds from online fraud and cartel operations mingle with speculative inflows; and regulators struggle to distinguish legitimate liquidity from laundered funds. What appears to be fragmented compliance failure is, in fact, the emergence of a parallel financial infrastructure – one eroding the boundary between licit and illicit capital and exposing Australia to systemic risk on a global scale.

The evidence of that erosion is already visible. The same digital corridors that once promised innovation now facilitate narcotics finance, illicit tobacco syndicates, and Southeast Asian scam networks. In the space of a decade, the promise of frictionless money has matured into something far more consequential: a liquidity system powerful enough to reorder economies, and elusive enough to escape the laws meant to govern it.

Drugs, Cigarettes, and Digital Liquidity

Australia is more flush with illicit substances than ever before. A recent study by the Australian Criminal Intelligence Commission (ACIC) found that Australians consumed over 22 tonnes of methamphetamine, cocaine, and MDMA between August 2023 and August 2024, up 34 percent compared to the previous year’s findings. These drugs had an estimated combined street value of US$7.5 billion – making Australia a high-value market for global drug cartels. Meanwhile, Australia’s record high tobacco excise has created an unprecedented surge in demand for underground alternatives, with industry data finding that illegal tobacco sales account for 64 percent of total consumption and 82 percent of total nicotine use.

Mexico’s Sinaloa and Jalisco New Generation (CJNG) cartels have become central suppliers in this ecosystem, embedding themselves through high-volume methamphetamine and cocaine routes that link Latin American production hubs to Australia’s premium end-market.

“Australians pay quite high prices globally for drugs… there is an increasing cocaine problem, especially in Sydney. This indicates significant supply links with cartels in South America, possibly linked through Asian-based money-laundering organizations,” said Thomas.

Indeed, significant overlap exists between cartel operations and entrenched Chinese and Southeast Asian syndicates that dominate the region’s chemical precursors, laundering networks, and scam-derived liquidity – suggesting that cartel drug profits blend with these systems before being injected into Australia’s capital markets at “clean” investments. AUSTRAC has previously noted how laundered funds often intersect with Australia’s high value property market, contributing to unaffordable prices for citizens across the country.

These growing illicit trades have facilitated the rise of an illegitimate financial ecosystem to service them.

“The narcotics and underground tobacco trades trade are the largest drivers of illicit finance in this country,” said Thomas. He also noted that important role digital currencies play in this financial system. “We have a (digital currency) market that isn’t regulated prudentially and therefore exposed to significant risk,” he added.

Thomas also noted that these illicit trades are not distinct criminal issues, but symptomatic of a maturing underground financial system.

“We believe the illicit tobacco and narcotics markets are controlled by the same entities,” he said.

Recent cases already show how digital currencies underpin the same financial circuits that move narcotics and illicit tobacco profits in Australia. In August 2021, Victoria Police seized AU$8.5 million in cryptocurrency from an online drug syndicate — the largest crypto-asset seizure in Australian history at the time — while AUSTRAC later documented a 2022 conviction in which an offender used cryptocurrency to purchase, import, and resell illicit drugs via dark-web markets.

What emerges is a hybrid criminal order: a system in which Latin American supply chains, Asian liquidity networks, and Australian demand converge into a single adaptive organism that mirrors the complexity of the licit economy while feeding off its infrastructure. Illicit proceeds move through offshore businesses and digital corridors before re-entering legitimate markets as investment capital. These convergent flows inflate asset prices — from property to logistics – and distort trade data once seen as reliable economic indicators.

The boundary between organized crime and legitimate enterprise is dissolving. What appears to be foreign investment may conceal criminal liquidity seeking legitimacy – embedding transnational finance and organized crime within the same bloodstream of the Australian economy.

This financial metabolism doesn’t end with narcotics. The same infrastructure now powers the region’s fastest-growing criminal enterprise: Southeast Asian scam centers.

On Australia’s Doorstep: Scam Centers and Massive Capital Outflows

Australia stands at the geographic doorstep of one of the world’s most pressing financial and humanitarian disasters: the vast Southeast Asian scam-industrial complex. As detailed in Rousselle’s recent article for The New Lines Institute, these compounds form part of a broader ecosystem primarily driven by Chinese organized crime – often state-linked – and built on capital outflows from China and neighboring economies. In countries such as Cambodia, Laos, Myanmar, and others, illicit and semi-licit funds are recycled through offshore financial hubs, cryptocurrencies, and digital payment infrastructure.

What began as a fringe phenomenon tied to telecom fraud and online gambling has evolved into a region-wide industry generating tens of billions of dollars annually, intertwined with human trafficking, narcotics proceeds, state-aligned shell corporations, and even armed militants and designated terror groups such as the Houthis.

Australia’s exposure to this ecosystem is twofold: as a lucrative victim market and as a destination for laundered funds. In 2024 alone, Australians reported nearly 495,000 scam incidents and losses exceeding AU$2 billion, according to the Australian National Anti-Scam Centre (NASC). These are not isolated acts of cybercrime but components of a regional financial system that drains consumer capital from high-income economies and reintroduces it into legitimate sectors via offshore layering and crypto-enabled laundering.

“We see crypto used as a source of major narcotic transaction and the source of much scam activity. The scam centers operating in South East Asia are also a major laundering risk for the Australian economy,” Thomas observed.

Australia’s role in this shadow network extends beyond consumer losses. The same digital corridors that move narcotics profits and scam proceeds now intersect with domestic financial infrastructure. As Thomas warned, “These illicit funds are entering the legitimate economy in a number of places and we need coordinated effort to shut that out. We also need coordination to stop the flow of recruitment of people into these centers and block their labor supply – targeting those human trafficking networks would be of great benefit.”

The nexus between financial exploitation and forced labor underscores the human cost of this liquidity system: victims in Australia are connected, through layers of deception and capital transfer, to victims across Southeast Asia whose exploitation sustains the machinery of fraud.

From Cambodia’s scam compounds to Australia’s financial sector, the circuit is closed by liquidity – money stripped of origin, nationality, and moral judgement. What appears as digital crime at the consumer level is, in practice, an extension of the same transnational financial order that Rousselle described: a shadow ecosystem born of unchecked capital outflows, institutional capture, and the global failure to distinguish dirty liquidity from economic vitality.

Coordination, Capacity, and the Enforcement Gap

Australia’s current regulatory architecture was built for an earlier generation of financial crime. The country’s first AML/CTF framework – Tranche 1, enacted under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 and implemented in 2007 – was revolutionary at the time. It brought banks, remitters, casinos, and bullion dealers under AUSTRAC’s supervision, embedding risk-based compliance into the financial sector.

Yet nearly two decades later, that framework has atrophied. Successive governments have failed to deliver the long-promised Tranche 2 reforms that would extend AML/CTF obligations to lawyers, accountants, real-estate agents, and company service providers. These extensions are essential: although digital assets such as cryptocurrencies have been regulated since 2018, the professional intermediaries who help conceal these flows remain largely outside enforcement. Tranche 2 is designed to close that gap, but years of delay have allowed those channels to become the principal on-ramps for illicit digital capital.

The rollout of Tranche 2 — which would bring these professional facilitators under the AML/CTF compliance regime — has been repeatedly delayed amid prolonged consultation and industry resistance, creating structural blind spots that now serve as conduits for illicit liquidity. The result is a bifurcated system: highly regulated financial institutions on one side, and semi-formal professional networks on the other, precisely the spaces through which scam proceeds, narcotics profits, and offshore capital outflows can be re-routed into legitimate assets.

The current regulatory gap will not close until July 2026, when Tranche 2 entities are scheduled to come under full compliance. Until then, most are only beginning to familiarize themselves with their new AML/CTF obligations.

As Thomas noted, “They are understanding the law and their legal obligations but still don’t properly understand money laundering – how people actually do it through law firms and accounting practices in particular.”

AUSTRAC and partner agencies are now preparing extensive case studies to build that operational literacy, but the knowledge gap remains profound.

Australia’s enforcement landscape compounds the challenge. AUSTRAC, Australian Securities and Investment Commission (ASIC), the Australian Federal Police (AFP), and state police each bring essential capabilities to the country’s financial-crime architecture, yet their mandates often intersect across complex and rapidly evolving typologies. Coordination has improved through initiatives such as the Fintel Alliance, but information sharing remains largely case-driven rather than systemic. The protracted rollout of Tranche 2 represents a strategic vulnerability, leaving key professional channels open to exploitation in the meantime.

When the reforms finally take effect in mid-2026, they will bring long-excluded gatekeepers into the AML/CTF regime and expand the country’s capacity to trace illicit flows through professional channels that have so far escaped scrutiny. But timing is everything. Every month of delay allows shadow liquidity to entrench itself further within Australia’s legitimate economy, laundered through legal practices, escrow accounts, property holdings, and offshore intermediaries. The effectiveness of Tranche 2 will depend not only on its legislation, but on whether the institutions charged with enforcing it can move from static compliance to dynamic intelligence, matching the speed and adaptability of the networks they seek to contain.

Conclusion

Blockchain analytics and AI-assisted transaction mapping have stripped away much of the mystery that once surrounded digitized illicit finance. The problem is no longer invisibility but inertia. Regulators and enforcement agencies now possess unprecedented data on cross-border fund movements, stable-coin settlements, and the interlocking wallets and shell entities that sustain shadow liquidity. The question is whether they can move fast enough to act on it.

Other jurisdictions already are. Europe’s MiCA framework, Hong Kong’s virtual-asset licensing regime, and the proposed U.S. GENIUS Act each signal a shift from reactive compliance to proactive financial-infrastructure defense. By contrast, Australia’s reforms remain stalled between consultation papers and industry pushback. Every month of delay leaves the country more deeply embedded in the regional circuits of criminal capital that its own analytics can now trace in real time.

Australia’s challenge is therefore strategic, not technical. The data exist; the patterns are visible. What remains undecided is whether the nation will use its visibility to close the enforcement gap – or continue to serve as the Indo-Pacific’s liquidity sink and laundering hub for offshore criminal finance.

Primer: How This Piece Got Here

This essay has already lived a small life of its own.

Since July, it circulated through several major legacy outlets. Some passed quickly and professionally; others expressed enthusiasm, requested time-consuming revisions, and ultimately stepped back for reasons that were never fully articulated. The responses varied, but the pattern was clear: uncertainty around unfamiliar frameworks, discomfort with material that sits outside conventional editorial lanes, and a broader hesitancy to publish work that challenges inherited assumptions.

The experience reinforced something that is only now beginning to shift. As recently as this past summer, traditional media still treated illicit liquidity as a peripheral issue. But the field is finally catching up. The traction my newer work has gained—across policy, enforcement, and analytical circles—reflects a broader recognition that liquidity is central terrain, not an auxiliary concern. The industry is evolving, even if the legacy editorial machinery has been slower to recognize the shift.

This piece was written to explain that evolution—how illicit liquidity systems now outlast militaries, sanctions regimes, and enforcement architecture itself—and why understanding this shift is no longer optional. Its publication journey ended up mirroring its own thesis: frameworks built for a previous era often struggle to accommodate the realities of the present one.

Since writing it, I’ve expanded and refined many of the concepts it introduced, but this remains the originating document. I am publishing it here in the form it was meant to take—not diluted, not retrofitted to an older template, and not reshaped to fit the boundaries of legacy formats. If those outlets revisit this space later, they can. My readers don’t need them to recognize the stakes.

Below is the full piece, unchanged except for minor clarity edits—the version that wasn’t designed to make anyone comfortable, but to make the problem clear.

In May 2025, FinCEN designated Huione Group and Huione Pay as a “primary money laundering concern”, citing $4 billion in proceeds tied to scams, human trafficking, and North Korean hackers. Despite global scrutiny, Huione remains operational.

This outcome is a strategic warning.

Huione’s resilience typifies a new global architecture of shadow liquidity that sustains conflict, corruption, and authoritarian influence from Southeast Asia to West Africa and beyond. These networks do not survive because they evade detection but because enforcement strategies continue to treat financial infrastructure as peripheral rather than primary terrain.

While U.S. and allied responses have prioritized weapons transfers, territorial control, and traditional alliance-building, adversaries have quietly focused on what actually sustains power: value mobility. The real vulnerability is our failure to treat financial infrastructure as battlespace—one that sustains adversaries and keeps them resilient against sanctions and other enforcement measures.

If adversaries can move value with speed, deniability, and scale, they do not need air superiority or territorial control. They can fund insurgency, project influence, and exploit crises faster than formal systems can adapt. The longer this architecture remains intact, the greater the threat to global stability.

To remain effective, national security thinking must evolve to treat financial infrastructure as core battlespace. This includes conceptualizing the purpose of tools currently under development, such as DARPA’s Advanced Analysis of Multinational Money Laundering (A3ML) initiative—not merely as forensic engines, but as platforms for pre-emptive disruption of shadow liquidity networks.

Defining the Battlespace

Shadow liquidity is a distinct category of capital movement—decentralized, broker-mediated, and designed for cross-jurisdictional convertibility beyond banking oversight. These networks—operating through over-the-counter (OTC) crypto brokers, stablecoin corridors, hawala-style settlement systems, and gray-market payment platforms like Huione—form a parallel liquidity architecture outside formal regulation. Shadow liquidity spans both licit and illicit nodes; Illicit Liquidity Networks (ILNs) are its subset devoted specifically to illegal flows.

Persistence makes shadow liquidity strategically significant. Traditional threat finance has generally been treated as episodic: discrete flows tied to specific actors, transactions, or events, which can be traced, disrupted, and prosecuted. Shadow liquidity systems, by contrast, behave like infrastructure. They are not pipelines serving a single organization or network but adaptive, self-reinforcing ecosystems that outlast individual actors.

The convergence of these systems with crypto rails has accelerated their reach and resilience. OTC brokers link fiat currencies to dollar-denominated stablecoins, serving not just as technical facilitators, but essential nodes in an informal financial network where trade settlement, investment flows, and other illicit capital flows blend into the same liquidity pools.

Treating shadow liquidity as just another typology of illicit finance misses its structural role: it is not a symptom of criminal activity but an enabler of hybrid state and non‑state operations. Whether used to sustain sanctioned economies, move capital into gray‑zone investment projects, or provide working liquidity to transnational criminal or militant networks, these systems create strategic depth for actors who would otherwise be constrained by formal financial architectures.

Understanding modern threat finance requires a shift from seeing illicit flows as isolated events to mapping the living infrastructure that sustains them. Shadow liquidity is not the side effect of a globalized economy; it is the battlespace in which financial sovereignty, hybrid conflict, and criminal enterprise now converge.

Case study cluster:

The following cases illustrate how shadow liquidity manifests across regions and conflict theaters, showing both its adaptability and its strategic impact. Taken together, these cases illustrate a convergence: shadow liquidity networks evolve into semi-sovereign systems once they achieve scale. Whether scam economies in Southeast Asia, Iran’s proxy liquidity, or Russia’s mercenary finance, the pattern is the same — financial autonomy emerges faster than enforcement adapts. This comparative view highlights why treating flows as isolated typologies misses the structural threat.

Southeast Asia – China’s Shadow Finance Ecosystem

Southeast Asia has become the epicenter of China’s offshore liquidity blowback. What began as state-managed capital outflows—meant to bypass controls and evade sanctions—has evolved into a parasitic financial ecosystem: scam compounds, gray casinos, and informal payment rails now operate beyond Beijing’s reach while draining billions from China’s own economy.

Across Cambodia, Laos, and Myanmar, Huione Pay and networks like it anchor scam hubs tied to Chinese-funded Special Economic Zones (SEZs) and armed actors. This reach extends beyond the region, as evidenced by the Houthis’ use of Huione as a money laundering service, underscoring how Southeast Asia’s shadow finance now fuels conflicts beyond the region. China’s offshore shadow finance systems are no longer just a laundering problem but a crisis of sovereignty. These systems persist not through evasion, but through structural autonomy.

Iran – Liquidity Proxies and Strategic Autonomy

Iran’s proxy liquidity system has become semi-sovereign—sustaining regional influence while eroding domestic control.

Groups like Hezbollah and the Houthis now operate independent financial architectures, built on regional taxation, smuggling, and crypto-mediated commodity sales. Stablecoins and hawala networks stretching from Cambodia to Venezuela allow these proxies to generate and deploy funds without central disbursement—blurring the line between state-backed operations and autonomous liquidity regimes.

Tehran’s leverage is now negotiated, not commanded. Even Iraqi militias once firmly under Iranian Revolutionary Guard Corps (IRGC) influence increasingly pursue self-financing agendas. Meanwhile, the IRGC has offshored vast capital through front companies, creating a shadow reserve system that sustains proxy operations but hollows out Iran’s monetary base.

Phantom gold accounting and offshore accounts conceal a liquidity collapse. The rial’s redenomination—slashing four zeros—signals a potential regime-induced currency failure. Sanctions that target banks or known intermediaries miss the mark; the true threat is not just the actors, but the parallel financial architecture sustaining them.

Russia – Mercenary Liquidity Infrastructure

The resilience of Wagner and its successor, the Africa Corps, reveals how deeply embedded shadow liquidity systems are in Russia’s expeditionary strategy. These networks bypass Moscow’s formal financial system, instead relying on resource smuggling, gold and diamond flows laundered through Dubai, and opaque third-party facilitators. Non-bank intermediaries and commodity traders provide both mobility and deniability, with indications that stablecoin rails bridge African resource wealth to operational accounts abroad.

Russian mercenary operations in Africa reveal how shadow liquidity enables sanctions evasion and strategic divergence. These networks can outgrow state control, making local deals that contradict official policy. The enforcement lesson is structural: targeting individuals fails when the network is modular, adaptive, and partially sovereign. Wagner’s liquidity architecture shows how private and state power converge through shadow finance

Synthesis:

Liquidity systems built for strategic depth have mutated into semi-autonomous infrastructures. Across Southeast Asia’s scam-finance belt, Iran’s proxy networks, and Russia’s mercenary plunder, a common feature emerges—adaptability and persistence. These are not episodic money trails but living financial architectures. Disrupting them requires more than transaction monitoring; it demands ecosystem-level mapping and structural interventions.

Institutional Blind Spots

Despite advances in threat finance, global security systems remain misaligned. The core challenge is conceptual inertia. National security and regulatory frameworks still treat illicit finance as a transactional problem despite shifting circumstances. The greatest threats now move not through isolated bank accounts or criminal actors, but through decentralized liquidity networks—adaptive, hybrid financial ecosystems that function beyond the reach of conventional enforcement.

These networks are not invisible. They are partially observed, persistently flagged, and yet structurally misunderstood. Financial surveillance tracks anomalies inside banks but misses liquidity outside them. What it cannot see, let alone disrupt, is the architecture of liquidity that exists outside its perimeter.

Today’s adversarial liquidity flows increasingly blend stablecoin corridors, over-the-counter (OTC) brokers, shell companies, nested exchanges, and informal value transfer systems like hawala. They straddle legality, often making use of mainstream platforms and payment rails while remaining structurally opaque. These flows do not behave like traditional laundering transactions, but rather like sovereign financial systems in miniature, operating under their own rules and norms. Current tools were built to find bad actors, not to identify financial sovereignty.

This actor-centric paradigm enables profound blind spots. Compliance tools detect transactions but fail to contextualize liquidity patterns across jurisdictions and asset types. As a result, regulators and intelligence agencies see fragments—but no infrastructure. The network remains intact, quietly evolving.

Legal constraints further widen the gap. Jurisdictional silos, lengthy mutual legal assistance treaty (MLAT) procedures, and fragmented beneficial ownership laws delay or block enforcement. Meanwhile, regulatory frameworks remain chronically outdated. Cryptocurrency policy is inconsistent across the U.S., EU, and Asia. Platforms offering liquidity-as-a-service—such as peer-to-peer (P2P) exchanges, stablecoin escrow markets, and anonymous crypto wallets—often fall through the cracks. Many operate in legal gray zones or under regulatory arbitrage, where no single state has oversight, and with little incentive to close the gap.

The result is not a lack of information, but an inability to act on what is already visible. Shadow liquidity does not thrive in darkness. It thrives in disconnection—between agencies, between legal systems, and between the visible and the actionable. This disjointedness is no longer an anomaly. It is the terrain upon which adversarial financial networks are built.

From Designation to Disruption: the Legal Infrastructure for Liquidity Warfare and A3ML

The proposed Anticipatory and Adaptive Anti-Money Laundering (A3ML) framework is designed to identify, designate, and dismantle illicit liquidity systems. Unlike traditional tools focused on compliance and anomalies, A3ML can become an AI-driven infrastructure mapping system. To be effective, it must be trained on deep, pattern-based financial research and empowered by cross-jurisdictional legal reform. Its targeting must focus not only on bad actors, but on the systemic architecture that sustains them.

The American legal architecture built to combat organized crime offers a blueprint for confronting today’s most urgent financial threat: illicit liquidity networks. The Racketeer Influenced and Corrupt Organizations Act (RICO) succeeded not by prosecuting criminals one by one, but by treating entire criminal enterprises as unified entities. It marked a doctrinal shift—from targeting individuals to dismantling infrastructure.

Illicit finance in 2025 demands a similar evolution of thought. What we face today are not merely networks of bad actors but global, adaptive liquidity ecosystems that serve as the financial backbone of transnational crime, proxy warfare, and authoritarian statecraft. These systems are durable, decentralized, and increasingly indistinguishable from legitimate financial activity. We must understand them not as criminal anomalies, but as sovereign financial organisms enabled by adaptive cross-jurisdictional infrastructure.

This is not about policing bad actors. It is about mapping and disabling the systems that allow bad actors to regenerate faster than enforcement can respond.

Civil Asset Forfeiture as Strategic Weapon

Time is the decisive variable in liquidity warfare. Prosecutions remain too slow to neutralize networks moving billions in real time. A3ML must therefore expand the civil asset forfeiture logic pioneered under RICO across global jurisdictions. Unlike criminal cases, civil forfeiture permits freezing assets on a preponderance of the very evidence A3ML is built to track in real time.

Civil forfeiture enables pre-emptive action against identified liquidity networks—especially when paired with new legal definitions that treat financial networks, not just individuals, as targets. This mechanism already exists. What is missing is the conceptual shift that elevates illicit liquidity to the level of strategic infrastructure.

To operate globally, this tool must be accompanied by jurisdictional harmonization. While A3ML does not currently establish mutual recognition protocols, its framework could build on existing international precedents—such as the Strasbourg and Warsaw Conventions—to enable partner states to enforce each other’s forfeiture orders against designated liquidity networks. The goal is speed: convert intelligence into disruption within days, not years.

Jurisdictional Leverage and Legal Hooks

The United States already has the legal foundation to operationalize A3ML. Statutes such as Section 311 of the USA PATRIOT Act and the Bank Secrecy Act provide hooks for systemic disruption, especially when combined with U.S. control over dollar clearing and correspondent banking access. A3ML’s contribution is not legal but conceptual: it unifies these authorities into a framework for targeting liquidity networks rather than isolated actors—and at speeds much faster than human analysis.

Global coordination is not just possible—it is already taking shape. The Financial Action Task Force (FATF), long the international standard-setter for AML/CFT compliance, has begun to acknowledge the complexity of illicit financial infrastructures beyond formal institutions. Initiatives like Operation Grafos—which targeted professional money laundering networks as coherent entities—represent a significant step toward structural thinking. Grafos – highlighted in the FATF’s 2025 report on terrorist finance - showed that the global community is starting to move from transactional enforcement to enterprise-level disruption.

But FATF’s core recommendations still focus primarily on institutional behavior: due diligence, beneficial ownership, and recordkeeping. They stop short of mapping or designating networked liquidity systems, and they lack the enforcement mandates required to neutralize them.

This is where A3ML fits—not as a competitor to established frameworks, but as their architectural complement and enforcer. It provides the conceptual framing and enforcement logic needed to extend current compliance standards into a cross-jurisdictional, structural response to liquidity-based threats. By aggregating and processing data in real time, A3ML can reframe illicit finance not as a series of reporting failures, but as a systematized battlespace—one that demands structural tools to navigate and dismantle. It must be trained on real data and paired with cross-border reform.

Defining the Target: Illicit Liquidity Networks

Illicit Liquidity Networks (ILNs) are the unlawful subset of shadow liquidity—persistent financial structures, whether criminal, corporate, or state-aligned, through which value moves beyond sovereign control. Where shadow liquidity describes the broader architecture, ILNs identify the specifically illicit nodes that A3ML is designed to dismantle.

A3ML could designate ILNs as systemic threats rather than fragmented cases. Phase I would map ILNs through public–private partnerships. Phase II would build on emerging stablecoin oversight to close gray intermediaries. Phase III would disable them through forfeiture, cutoffs, and coordinated sanctions. Implementing these phases would require no new agency, only integration of existing authorities. A3ML is not a silver bullet but a structural correction. Without it, security architecture will remain reactive—outpaced by networks that understand one truth: control liquidity, and you control survival. Operational success will depend on embedding liquidity mapping into existing security frameworks and building analytic partnerships capable of predictive disruption beyond the banking system.

Conclusion – Sovereignty and Strategy in the Age of Hybrid Liquidity

Sovereignty today is no longer defined by borders, flags, or deterrence, but by the ability to control the flow of capital—licit and illicit, digital and analog, state and shadow. In this battlespace, liquidity itself is sovereignty. Without tools to secure the circulatory system of finance, every alliance, sanction, and military asset is vulnerable to erosion by this new paradigm.

Illicit liquidity networks enable proxy wars, hollow out regulatory regimes, and entrench criminal ecosystems that feed on institutional weakness. And they do it faster than conventional enforcement can react. Treating financial architectures as an auxiliary domain of national security is no longer tenable. What A3ML offers is not just a legal instrument—it is a strategic reorientation. One that recognizes that power now flows through networks, not just weapons; through escrow chains and stablecoins, not just supply chains and ships.

If we fail to respond, we invite encroachment—not by military forces, but by liquidity systems we ignored. The choice is clear: keep reacting in fragments, or build the architecture to defeat liquidity insurgency systemically.

Image source

This is an article I recently published with the Jamestown Foundation China Brief Notes. It comes as a follow up to an article I wrote for China Brief last year, which was cited in a 2025 report by the U.S. Senate Foreign Relations Committee. You can find the link to the latest article here.

Executive Summary:

• Judicial cases in the Democratic Republic of the Congo and in Nigeria confirm that citizens from the People’s Republic of China (PRC) are active in both resource extraction and digital offshore laundering networks, connecting illicit resource economies and stablecoin settlement into value chains that sustain conflict.

• Gold, timber, and crypto flows move through the same corridors that carry PRC-manufactured weapons into embargoed zones. This integration creates a shadow liquidity system in which capital and material reinforce one another, allowing African militant economies to become self-financing and resilient to external pressure.

• Existing regimes treat arms diversion and money laundering as separate issues. They are not. Addressing this challenge requires collapsing the divide between arms embargo enforcement and financial crime intelligence into a single operational continuum.

The circulation of weapons manufactured in the People’s Republic of China (PRC) has become an increasingly visible feature of African conflicts. Earlier research by this author traced how Chinese small arms and light weapons appear in the hands of militant groups across the continent, often in ways that reveal the fragility of existing control mechanisms (China Brief, November 1, 2024; U.S. Senate, July 2025). That research underscored the scale of material leakage from licit trade into irregular markets. Since then, more evidence has come to light to suggest that the story does not end with the physical movement of arms.

Alongside weapons, Chinese illicit finance networks are spreading across Africa’s conflict zones and beyond. These networks have the capacity to enable militant actors to not only acquire weapons but also to sustain self-financing economies of violence and extraction. They tie the diversion of arms to capital flows that are deliberately routed through opaque offshore structures, informal value transfer systems, and state-aligned facilitators.

Illicit finance is not a peripheral concern. It is a structural enabler of militant economies and arms transfers. Understanding the fusion of financial and material supply chains is therefore essential for grasping how African conflicts are evolving, and how external actors shape them.

Chinese Criminals Embedded in Conflict Economies

In January, a court in Bukavu, a war-torn community in the eastern Democratic Republic of the Congo, handed down a rare and decisive judgment against three PRC nationals involved in illicit extractive activity. The defendants were convicted for operating illegal mining concessions and laundering proceeds through both cash and precious metals (South China Morning Post [SCMP], January 15). Authorities seized more than $400,000 in hard currency alongside a quantity of gold bars, establishing a direct evidentiary trail from resource extraction to illicit financial flows (Central News, January 16). Because this conviction was adjudicated in court, it created a judicially verified record of PRC actors engaging in illicit commerce within a conflict zone. The absence of PRC media coverage of this case is telling.

The defendants did not operate in a vacuum. The PRC maintains a visible commercial footprint across eastern Congo’s extractives economy, including Chinese-owned buying houses, traders, and small-scale gold operations in war-torn South Kivu (ECOFIN, December 30, 2024). PRC state media has even warned PRC nationals of the legal and security risks of doing such business in the war-torn region, explicitly mentioning mining activities (Xinhua; Consular Express WeChat Official Account, July 28). Congolese officials and local communities have repeatedly objected to illicit practices attributed to Chinese operators (ACP, November 15; Radio Okapi, August 8).

The Bukavu convictions confirm that Chinese illicit financiers are present inside eastern Congo’s conflict zones. A panel of UN experts reported to the press that minerals extracted from areas in eastern Congo controlled by the Congolese Rwandan-backed rebel paramilitary group M23 are being smuggled through Rwanda and Uganda before entering global markets (AfricaNews, January 10; Al-Jazeera, July 18). At the same time, M23 rebels have been documented with significant stocks of PRC-manufactured weapons and equipment, consistent with supply via their Rwandan and Ugandan backers (China Brief, November 1, 2024). The PRC is the world’s dominant processor of the ore coltan, gold, and other Congolese exports, and both Rwanda and Uganda ship far more of these minerals than they produce (Enact, May 3, 2022; Haitong, April 23, 2023; CASS West Asia and Africa Research Institute, March 2024; AllAfrica, December 18, 2024). Taken together, these facts make PRC end-use not speculative but structurally inevitable: illicit finance on the ground, smuggling through neighbors, and end-user demand in the PRC form a single chain that helps sustain this conflict economy.

These dynamics are not confined to eastern Congo. Across Africa, PRC nationals are embedded in commodity corridors that move value and provide logistics. In 2022, roughly 435 tonnes of gold were smuggled out of Africa, 93 percent of it bound for the United Arab Emirates (UAE), with PRC buyers active at both ends of the chain (SCMP, November 16, 2023; Swissaid, May 30, 2024; Africa Report, October 24, 2024). PRC-linked syndicates also dominate timber and rosewood exports from the Sahel, Central, and East Africa, often sourcing directly from insurgent-affected areas (African Development Bank, 2021). These gold and timber corridors easily provide the financial and logistical backbone for broader illicit trade, establishing flows of capital and transport capacity that could be redirected toward arms procurement or militant financing.

Chinese Criminals Laundering Crypto

In July, a federal court in Lagos, Nigeria ordered the forfeiture of approximately 223,000 Tether ($223,000)—the U.S. dollar-pegged stablecoin—from two PRC nationals convicted of fraud and money laundering (EFCC, July 21). The case was notable not only for the scale of the seizure but also for its judicial confirmation that PRC nationals were operating through crypto networks in Nigeria. It followed an earlier wave of enforcement in December 2024, when Nigeria’s Economic and Financial Crimes Commission (EFCC) carried out mass raids that led to the arrest of 792 suspects. Among those implicated were 148 PRC nationals accused of participating in coordinated crypto fraud and laundering schemes (Toutiao, April 27; African Mirror, December 19, 2024). Together, these cases establish a pattern of sustained involvement by PRC nationals in illicit digital finance across West Africa.

The pattern is clear: PRC illicit finance networks have embedded themselves into West African stablecoin rails. These rails enable frictionless cross-border settlement that can be directed toward extractive rents, arms procurement, or conventional fraud. Stablecoin rails in West Africa now provide the same frictionless settlement capacity increasingly favored by PRC-linked financiers in Southeast Asia (Sina Finance, May 26). In effect, stablecoins have become a structural enabler of transnational illicit finance tied to PRC nationals, providing cross-border transfer capacities beyond the reach of current regulatory controls.

Weapons Trafficking Completes the Supply Chain

In May, Amnesty International verified the presence of PRC-manufactured weapons in both Khartoum and Darfur, despite a standing United Nations arms embargo on Sudan. The investigation traced the weapons’ path through the UAE, confirming that PRC-manufactured weapons had been re-exported into an active conflict zone (Amnesty International, May 8; SCMP, May 9). The UAE—already identified as a primary destination for smuggled African gold and a key entrepôt for trafficked resources such as timber and wildlife—is now linked to weapons leakage into embargoed territories. A 2023 report by the PRC’s Ministry of Commerce (MOFCOM) highlights the country’s central role as a commodity logistics hub, while international investigations document its function as a distribution point for illicit flows ultimately bound for the PRC (The Sentry, February 2021; GITOC, December 2022; MOFCOM, 2023).

Extractive commodities and arms flows are not separate streams but parts of a single transnational infrastructural system. Gold and timber exports provide the financial base, often routed through opaque networks tied to PRC buyers. Stablecoin rails in West Africa supply frictionless cross-border digital settlement, as increasingly favored by PRC-linked illicit financiers in Southeast Asia (Sina Finance, May 26). The re-export of weapons through commodity hubs completes the circuit, bringing material support back into conflict zones. The convergence is the critical risk: financial, logistical, and military flows run along the same corridors, reinforcing each other and expanding the resilience of militant economies.

This configuration functions as a shadow liquidity system. Value extracted from African resources is continuously re-expressed as kinetic capability, ensuring that liquidity itself becomes a weaponized asset class. Each transaction in this system, whether a gold shipment, stablecoin transfer, or weapons re-export, amplifies the others, producing a feedback loop that stabilizes illicit power structures where governance fails.

Conclusion

The evidence now available establishes that the illicit involvement of PRC nationals in African conflict economies is neither incidental nor peripheral. Judicial convictions in Bukavu and Lagos confirm the presence of criminal actors from the PRC engaged in both extractive laundering and stablecoin-based fraud, while reporting from Sudan illustrates how weapons manufactured in the PRC reappear in embargoed theaters.

These cases reveal a common pattern. Illicit finance and logistics linked to PRC nationals run through the same corridors that sustain militant supply chains. Gold, timber, digital assets, and arms move along overlapping routes, creating a resilient system in which capital and material flows reinforce one another.

Recognizing this convergence is essential. The challenge is not simply weapons leakage or financial opacity in isolation but the way disparate supply chains combine to strengthen insurgent and criminal economies. PRC end-user demand and facilitation give the system scale and durability, tying local extraction and digital laundering directly to global markets. Addressing this challenge requires collapsing the divide between arms embargo enforcement and financial crime intelligence; and treating both as elements of one integrated system.

This is an article I recently wrote for the Global Network of Extremism and Technology (GNET). You can find the original link here.

Terrorist groups are increasingly using digital assets to move money outside traditional financial oversight. These same channels – blockchain networks, stablecoins, and encrypted apps – now underpin a wider illicit economy that spans cybercrime, sanctions evasion, and elite capital movement. Together, they form a shadow financial infrastructure that operates at a scale and velocity traditional enforcement cannot match.

As regulators struggle to keep pace, artificial intelligence (AI) is emerging as a force multiplier. From clustering wallets and detecting laundering networks to automating early detection, AI is transforming how investigators detect, map, and disrupt illicit flows. Yet technology alone cannot solve the problem. Effective countermeasures require human analysis and strategic framing – linking the rise of digital liquidity systems to the broader financial ecosystems that sustain both criminal and terrorist actors. This Insight will explore emerging regulatory and technological trends aimed at closing the global enforcement gap – showing how AI-enabled enforcement, systemic liquidity mapping, and multi-domain synthesis can shift counter-terrorist financing from reactive disruption toward proactive resilience.

Figure 1: The three-tiered liquidity framework.

Understanding the Problem: A Three-Tiered Approach

The challenge today is not simply that terrorists seek money beyond regulatory and enforcement oversight, but that the methods they use to mobilise funds converge with a broader set of illicit and semi-licit flows. The rise of blockchain and digital currency ecosystems has provided bad actors with faster, cheaper, and less traceable means of moving value globally. These value transfer mechanisms, combined with encrypted messaging apps, offer the ability to move vast sums outside the global banking system, thus representing a structural alternative to it.

Terrorists are not alone. A much larger global criminal ecosystem – spanning cyber fraud, state-linked sanctions evasion, and elite capital flight – exploits the same digital corridors. On 14 October, U.S. authorities seized over $14 billion USD worth of Bitcoin tied to Cambodia-based and Hong Kong-registered Prince Group, which provided laundering services to Southeast Asia’s vast cybercrime industrial complex. It was the largest Bitcoin seizure in history, underscoring the scope of these illicit systems. These systems represent a financial substrate where actors with varied goals and ideological motives can rely on the same facilitators, which become more pervasive with each transaction.

The three-tiered liquidity framework explains this new paradigm. At the top, Tier 1 captures elite flows – shadow banks, high-net-worth individuals, and state-adjacent funds that seed the system – generally manifesting as capital outflows, although at times taking the form of strategic inflows in specific contexts. Tier 2 is the facilitation layer, comprising over-the-counter (OTC) brokers, underregulated exchanges, and laundering platforms that have grown from Tier 1 flows. These entities now rent their services to anyone with the means to access them. Tier 3 is where threats surface, as extremists and criminal groups exploit the same intermediaries to move money through unregulated corridors. By mapping this cascade, we see how funds that leave states at the top can ultimately end up financing terrorism and criminality at the bottom – with Tier 2 serving as the connective tissue with none of the accountability of regulated financial systems.

Tier 2 intermediaries take many forms, but Huione Guarantee in Cambodia, Garantex in Russia/Dubai, and Iran’s Derakhshan/ Alivand shadow banking network all show how digital asset facilitators operate at the intersection of offshore capital and terrorist finance. Huione’s illicit marketplace evolved into a laundering channel for ethnic Chinese criminal networks across Southeast Asia, with clear evidence of participation by Hong Kong facilitators – strongly suggesting its use by Chinese elites to evade domestic capital controls. U.S. authorities also flagged Huione for laundering $39 million USD tied to the Houthis, a clear example of terrorist financial usage. Evidence also suggests that Myanmar-based militant groups have accessed Huione and comparable networks, further illustrating how such financial ecosystems enable militant and terrorist funding structures.

Meanwhile, U.S. and European regulators sanctioned the Moscow-based crypto exchange Garantex for enabling Russian sanctions evasion and elite capital flows, as well as for processing transactions linked to Palestinian Islamic Jihad. Further analysis has also revealed that funds from Garantex flowed into wallets controlled by the Islamic State Khorasan Province (ISKP). Finally, in Iran, the Derakhshan/ Alivand shadow banking network operated as a crypto-enabled extension of the regime’s sanctions evasion architecture, moving billions through front companies and exchange houses. U.S. Treasury designations also show the network provided financial services to Hezbollah funding corridors, again demonstrating a clear cascade between Tier 1, 2, and 3 flows.

While the three-tiered framework currently captures only some terrorist organisations, groups such as those associated with the Islamic State and al-Qaeda also rely on intermediaries to move and launder funds on the blockchain. As these networks become more digitally sophisticated and financially liquid through their exploitation of high-value trades – including commodities such as gold and timber as well as narcotics trafficking – it is likely that they too will engage Tier 2 facilitators, further expanding their global financial reach and resilience.

Disrupting only the Tier 3 terrorist groups is insufficient, as these actors are symptomatic of broader systems. The real leverage lies in targeting the Tier 2 facilitators who profit from servicing everyone – oligarchs, sanctioned states, and militant/ terrorist groups alike. A strategy of networked disruption must therefore neutralise the brokers, platforms, and exchanges that systematically connect these flows. By constraining Tier 2, regulators and investigators can structurally disrupt the cascade before funds reach Tier 3, cutting off not just individual plots, but the infrastructure that makes global illicit liquidity possible. Although this challenge remains enormous in scope, new regulatory and technology-based solutions have begun to tip the scales in favour of global enforcement.

Regulatory Reforms and AI Advances

Emerging regulatory frameworks are bringing digital assets under formal oversight. In the U.S., the GENIUS Act would pull the issuers of and intermediaries behind stablecoins – the current lifeblood of large-scale illicit financial flows – into the existing anti-money laundering and combating the financing of terrorism (AML/CFT) system. In the European Union, the Markets in Crypto-Assets regulation (MiCA) sets harmonised standards for licensing and disclosure across the bloc. Financial hubs such as Hong Kong and Singapore, as well as Southeast Asian jurisdictions such as the Philippines, are also moving to regulate exchanges, OTC brokers, and other intermediaries. Together, these measures mark a decisive shift: digital assets are no longer a lawless frontier, with governments actively working to close the gaps that criminals, sanctioned states, and violent extremists exploit.

However, tens of billions of dollars move each year through the informal systems described above, and human analysts alone cannot keep pace with flows of this magnitude and velocity. Without advanced tools and coordinated enforcement, new regulatory frameworks risk becoming outmanoeuvred by the actors they seek to constrain. Recent AI advances increasingly address this enforcement gap – not by replacing human analysis, but by amplifying it through pattern recognition at scale. Leading blockchain analytics firms have already begun layering AI into their products in ways that concretely boost detection, attribution, and investigation speed.

Blockchain analytics platforms currently use machine learning to cluster addresses that belong to the same actor, trace funds that are deliberately split and rerouted to hide their origin, and flag unusual transaction patterns that suggest illicit flows. Some systems go further, automating the first level of triage, presenting investigators with likely leads rather than raw data. Others use advanced models to sift through vast webs of wallet interactions and highlight networks that resemble known money-laundering structures. While private analytics firms rarely disclose which AI modules are employed in specific investigations, recent rollouts of AI-enabled triage, clustering, and typology-detection tools suggest that such technologies are increasingly embedded in live enforcement workflows.

The effect on investigations is simple: machines take on the role of scanning and sorting, allowing human investigators to focus on context, judgment, and strategy. The combination makes it increasingly possible to confront illicit flows at volumes that have long exceeded the limits of manual enforcement. But the technology is still developing, coverage remains uneven, and determined actors continue to find ways to exploit the gaps. What AI offers today is not a finished solution, but an evolving opportunity to narrow the enforcement gap at the scale currently required.

Advances in AI disruption do not end with the private sector. The U.S. Military’s Defense Advanced Research Projects Agency (DARPA) has been developing a new programme called Anticipatory and Adaptive Anti-Money Laundering (A3ML). According to DARPA, the programme seeks to transform anti-money laundering from “manual, reactive, and expensive analytic practices” into a system that can proactively identify illicit financial activity by analysing transaction data at machine speed. The initiative aims to build adaptive models capable of detecting complex laundering behaviours and evolving with new threat patterns across global financial networks. In a recent interview, A3ML programme manager David Dewhurst claimed the goal of the project is to “raise the cost of money laundering so high that it becomes unsustainable.”

If realised, A3ML would represent a significant step toward closing the enforcement gap that today’s regulators and investigators struggle to manage in the realm of terrorist and illicit finance. Given DARPA’s 60-year track record of pioneering AI technology, as well as the core technologies behind the Internet itself, the fact that the agency is promoting A3ML publicly signals its potential as an emerging game-changer in countering terrorist finance and illicit liquidity networks as a whole.

Recommendations: Building Human–Machine Fusion Across the Enforcement Chain

Artificial intelligence will not replace human financial investigators; it will demand a new generation of them. As enforcement agencies integrate AI tools into financial investigations, the limiting factor will not be processing power but strategic judgment – the ability to interpret machine-generated signals in context. AI excels at pattern recognition, but it cannot discern intent, geopolitical linkage, or systemic consequence. These require human synthesis based on deep contextual understanding.

Three priorities follow from this reality:

1. Invest in human-machine fusion: Regulators, tech firms, and research institutions should prioritise training analysts who can interpret algorithmic outputs, question model assumptions, and integrate AI findings into broader geopolitical and financial-systems analysis.

2. Expand interdisciplinary research: The convergence of digital assets, sanctions evasion, and terrorist finance demands a research agenda that unites data science, economics, finance, criminology, strategic studies, and more. Understanding illicit liquidity networks at scale requires systems-level mapping and cross-domain synthesis, not siloed expertise.

3. Institutionalise feedback loops: AI detection models improve only when informed by real investigative experience and extensive research. Private firms and research institutions should create channels for case-based learning and publication, ensuring that enforcement outcomes continuously refine analytical models.

Additional priorities for technology platforms to consider:

4. Integrate financial signal detection into trust and safety operations: Social media, messaging, and other platforms are uniquely positioned to identify the early stages of extremist financing. Embedding financial intelligence cues such as patterns of wallet sharing, donation link reuse, or coordinated in-app transfers into existing moderation systems would enable early intervention without compromising privacy.

5. Create secure interoperability between financial and content-moderation ecosystems: Platforms can pilot controlled data-exchange frameworks that allow vetted enforcement partners and blockchain analytics firms to cross-reference on-chain data with online behavioural indicators. This would help surface the connective tissue between propaganda distribution, recruitment, and funding pipelines that rely on digital payment rails.

6. Promote collaboration on typology discovery: Major platforms can co-fund shared typology libraries that describe emerging laundering and fundraising behaviours across digital ecosystems. Building upon the precedent set by GIFCT’s hash-sharing database and other collaborative frameworks, as well as existing typology reporting by FATF and the Egmont Group, a complementary repository for financial signals could integrate structured input from public and private stakeholders, including blockchain analytics firms at the forefront of these trends. This would create a unified typology framework – linking regulatory, platform, and investigative perspectives – and provide a common analytical language for identifying new threats while ensuring that emerging AI models across companies learn from consistent signal categories.

AI is reshaping financial intelligence, but its success will depend on the people who wield it – analysts capable of seeing the system, not just individual outcomes. For the technology companies that host, route, and monetise digital interactions, this means examining how digital economies can be co-opted by illicit liquidity systems and disrupting them when possible. The next frontier in counter-terrorist finance will belong to those who can bridge the gap between computation and comprehension – between safeguarding platforms and preserving the integrity of the digital economy.

No one has ever accused me of being an optimist — especially if they’ve read Between the Lines.

However, today I’m staking out a position of cautious optimism on one of the hardest problems in financial intelligence: getting a handle on illicit crypto flows, especially when it comes to designated terrorist groups.

To be clear: nothing in this field will ever be perfect. Threat finance is adaptive by design. But after tracking this space for years, I’m convinced the scales are tipping in ways that make overwhelming pessimism harder to sustain.

Here’s why.

Data aggregation

Every crypto transaction leaves a digital trace. Even if pseudonymous, it’s still a ledger entry — vastly different from the opaque networks of hawala or bulk cash smuggling.

The successful takedown of illicit Monero transactions by Japanese National Police is proof that anonymity tech can be pierced when regulators and enforcement pair data with persistence. Practitioners in the blockchain analysis space have told me that anonymous tokens are not as anonymous as some would have you believe.

The problem right now is that it takes a lot of people to find and process the data needed to track illicit flows and the industry struggles to keep up. That’s where AI comes in — to turn the overwhelming volume of raw data into actionable detection.

AI development

Several blockchain analytics firms are already layering machine learning into their platforms — using AI to catch anomalies humans miss. But they are not the only ones.

The Defense Advanced Research Projects Agency (DARPA) is currently developing a programme called Anticipatory & Adaptive Anti–Money Laundering (A3ML). In a recent podcast, the A3ML project lead commented his team’s goal is to make money laundering “too expensive” by dramatically increasing the effectiveness, speed, and scale of detection using artificial intelligence (AI). Because money laundering is defined by scale, speed, and complexity — exactly the domains where human investigators are outmatched and algorithmic detection excels — AI could be a genuine gamechanger.

DARPA has been quietly promoting A3ML for months, meaning it is well past the idea stage. With leading analytics firms already incorporating AI into their products, the use of AI in this field is no longer hypothetical. Given the rapid speed of advancement in current AI technologies, the efficacy of these products is likely to improve dramatically in the coming months and years.

Regulatory reform

The European Union’s MiCA regime, the U.S. GENIUS Act, and Hong Kong’s stablecoin ordinance all point to a growing global consensus that crypto markets can and must be regulated. The traction my recent articles on unregulated crypto regimes have gained underscores that this isn’t just a policy shift — there’s real appetite across the field to understand and address these risks.

I believe enforcement will continue moving toward a preponderance standard — acting whenever aggregated signals indicate illicit activity is more likely than not, rather than waiting for airtight proof. In practice, that standard favors systems that can aggregate patterns, spot anomalies, and connect disparate signals faster than any manual investigation — exactly the kind of connective tissue that AI-driven systems can surface better than human investigators. Yes, gray jurisdictions will still exist, but in a world where dollar clearing still reigns supreme, the preponderance model will leave them increasingly isolated and deprived for non-compliance.

Terrorist finance: tip of the spear

Terrorist finance is likely to feel the impact of this enforcement shift before other domains. The reason is twofold. First, national security considerations ensure that counter-terrorism receives the highest priority for resources, political will, and legal innovation. Governments simply cannot afford to take a passive stance when designated groups are exploiting new technologies.

Second, counter-terrorism already has over two-decades-worth of laws, regulations, and intelligence cooperation to build upon — from FATF standards and UN Security Council resolutions to domestic tools like the U.S. Patriot Act and equivalent frameworks worldwide. That foundation makes terrorist finance the most immediate proving ground for applying aggregated data and AI-enabled detection under a preponderance standard, before those same methods expand into broader areas of illicit finance.

Conclusion

Progress in this field isn’t measured by perfection — it’s measured by whether the system gets harder for bad actors to exploit. And by every sign — data aggregation, AI adoption, and regulatory convergence — we’re moving in that direction.

Caution is still warranted; threat finance adapts. But the fatalism that says this space is uncontrollable no longer matches reality. There is much work to be done in mapping these systems moving forward, but on this issue at least, I am cautiously optimistic.

Note: This article is in part a preview of a bigger piece I’m currently working out. Also, stay tuned for the long-awaited Part II of my China military series.

Author’s Note: This article was originally written for the New Lines Institute (link).

The analysis was cited by Coinbase in an October 2025 Request for Comment submitted to the U.S. Treasury Department (link).

A soldier stands guard as workers cover their faces while authorities raid the offices of Central One, an alleged scam hub masquerading as a call center company, on Oct. 31, 2024, in Bagac, Philippines. (Photo by Ezra Acayan/Getty Images)

The explosive rise of Southeast Asia-based scam networks targeting victims globally is no accident; it is the byproduct of China’s vast offshore shadow liquidity systems. Scammers from the region have increasingly targeted victims in the United States, who lost at least $5 billion to such scams in 2024 alone. Scam hubs, some of which comprise entire cities built using offshored Chinese wealth, threaten stability across Asia by draining middle-class savings into a self-perpetuating parasitic ecosystem. These criminal enterprises are now actively expanding their operations in Africa and Latin America, positioning themselves closer to Western societies where aging populations are especially vulnerable to sophisticated cybercrimes. These systems also threaten regional stability, with recent military clashes between Thailand and Cambodia underpinned by rising scam activity and capital flows to the Cambodian side of their disputed border.

Over the past decade, China built a secret offshore capital reservoir to shield itself from an increasingly hostile outside world. That reservoir, combined with massive capital outflows, has spawned a vast criminal ecosystem that threatens social and economic interests the world over. Moreover, the networks constituting this ecosystem now serve their own ends, not merely those of Beijing. In the absence of safeguards, this pooled liquidity has fueled criminality that now threatens China despite Beijing’s ongoing efforts to reassert control over it. This offshored criminal ecosystem demonstrates a fundamental truth by its very existence: liquidity systems, once externalized beyond state oversight, become self-reinforcing, corrosive infrastructures.

In Southeast Asia, sprawling scam hubs now siphon an estimated tens of billions of dollars or more annually, turning a defensive buffer into a parasitic financial ecosystem threatening regional and global stability. This criminal ecosystem exposes a significant contradiction at the heart of China’s model: a regime built on centralized control increasingly entangled with systems it can neither regulate nor contain. These networks – once designed to strengthen China’s financial sovereignty – now threaten it, eroding domestic stability and undermining the very narrative of control the ruling Communist Party depends on to maintain legitimacy.

What Is Shadow Liquidity?

Shadow liquidity is a mobile layer of capital that exists outside standard regulatory frameworks. Unlike traditional illicit finance, which is explicitly criminal, it occupies a gray zone – part statecraft tool, part private escape valve, part opportunistic exploitation. Its core function is not to hide individual transactions but to maintain a resilient flow of value that can shift jurisdictions, instruments, or ownership structures as conditions demand.

China’s offshore liquidity systems emerged as a response to external pressures, including tariffs and sanctions. Initially structured as discreet channels to support trade and investment, these reserves evolved into conduits for elite capital flight and informal influence operations. A clear example is the $900 billion in offshore foreign currency assets held by China’s state commercial banks, funded by deposits made by state-owned enterprises and outside the official People’s Bank of China (PBoC) balance sheet. Designed as a buffer against external shocks, these pools of liquidity coincide with the rise of informal networks beyond Beijing’s direct control.

DeepSeek, an artificial intelligence product developed in close proximity to China’s state-owned military and defense sector, provided a striking example of how offshore liquidity pools serve Chinese state interests. In June 2025, U.S. officials accused DeepSeek’s parent company of using shell corporations in Southeast Asia to acquire banned Nvidia H100 chips – critical for training advanced AI models – thereby bypassing sanctions aimed at curbing Beijing’s military AI ambitions. Recent cases also show that Chinese firms leverage offshore entities to evade recently escalated U.S. tariffs. In this way, these networks created a parallel reservoir of liquidity designed to move outside Beijing’s formal financial architecture while remaining at least partly aligned with state objectives.

However, by unleashing vast sums of liquidity into loosely regulated financial systems, Beijing seeded a landscape where state-linked capital, private wealth, and criminal enterprise converge. According to a July 2025 report from the U.S.–China Economic and Security Review Commission (USCC), Chinese criminal networks in Southeast Asia “have built ties – some overt, some deniable – to the Chinese government by embracing patriotic rhetoric and supporting China’s Belt and Road Initiative (BRI).” The report further notes that “Chinese crime syndicates have expanded across the region with, at a minimum, implicit financial and political backing from elements of the Chinese government.” Murky state-linked investments in now-notorious scam hubs like the Golden Triangle Special Economic Zone (SEZ) in Laos and Myanmar’s Shwe Kokko SEZ are just some examples. What was meant to be a controlled instrument of resilience has instead become a porous, adaptive ecosystem – one increasingly beyond Beijing’s ability to discipline without destabilizing the very flows it relies on.

In China’s case, offshored “shadow reserves” have become a critical funding source for BRI projects, with state commercial banks channeling offshore foreign currency assets – often absent from official PBoC reporting – into overseas infrastructure. BRI has become the most visible expression of how shadow liquidity can be weaponized as both an economic and geopolitical instrument.

Because liquidity is inherently dynamic, these networks behave less like pipelines and more like living infrastructure. They adapt under enforcement pressure, migrate during crises, and often move faster than formal financial reforms can catch them. For China, this networked capital is both a pillar of external influence and a source of internal fragility: a system built to shield the state from outside constraint that has instead created an informal architecture of power – one Beijing now depends on but cannot fully control. Simultaneously, this informal architecture has proved resilient against Chinese and other global crackdowns, likely at least in part due to its entrenchment in Chinese elite power structures.

The Southeast Asia Inflection Point

In Southeast Asia, China’s shadow liquidity strategy has mutated into something far more volatile. Scam compounds in Cambodia, Laos, and Myanmar, sprawling online gambling hubs in the Philippines, and a dense web of informal crypto-asset brokers now act as powerful magnets for Chinese capital outflows. Funds slip past Beijing’s formal controls through domestic underground banking networks, gray-market over-the-counter (OTC) brokers based in Hong Kong, and payment platforms such as Huione and other similar underground systems. These actors often facilitate capital flight disguised as trade settlement or investment outflows, converging powerfully with state-led outflows.

Investigations have tracked billions of dollars flowing through OTC desks in Bangkok and Ho Chi Minh City into scam operations and laundering networks. What began as pass-throughs for capital flight is now self-reinforcing. Reports indicate that Chinese middle-class investors have lost tens of billions of dollars to newer forms of crypto fraud – particularly pig-butchering scams – often facilitated by border OTC networks in Southeast Asia. According to Wired, global losses due to scam operations exceeded $75 billion in 2023, with China-origin capital feeding scam compounds and high-risk gambling zones in Cambodia, Laos, Myanmar, and beyond. These systems no longer route funds back into China; they feed their own expansion, siphoning ever-larger volumes of Chinese wealth to sustain illicit economies.

This dynamic has created a parasitic financial architecture. Chinese liquidity designed to circumvent external constraints is now trapped in feedback loops, comingling with and empowering nonstate actors and criminal organizations. For example, the Yemen-based al-Houthi rebel group has used Huione to transfer $39 million in illicit proceeds. Militant groups in Myanmar have been linked to similar funding schemes. These networks have proven resilient in the face of global pressure, such as recent revelations that Huione remains operational despite its formal shutdown in the wake of U.S. sanctions.

Scam centers now threaten regional stability in Southeast Asia, draining middle-class savings while embedding themselves into the broader gray-zone economy. For example, ethnic Chinese-run scam centers in Cambodia routinely target middle-class victims in neighboring Thailand. Thai authorities report that since 2022, these operations have defrauded domestic investors of roughly 80 billion baht (about $2.5 billion), while regional estimates variably suggest the industry now generates nearly tens of billions of dollars annually. These scam centers became an important point of tension between Thailand and Cambodia in the months leading up to the July border clashes between the two countries that killed at least 35 people and displaced more than 260,000.

The result of China’s shadow liquidity outflows is a network that serves state, private, and criminal interests simultaneously – but answers fully to none. In this Southeast Asian crucible, China’s shadow liquidity has crossed an inflection point: from strategic tool to autonomous ecosystem, eroding the very stability it was meant to secure.

How It Backfires on China

The explosion of scam-driven liquidity drains in Southeast Asia produces visible social and economic consequences inside China. Hundreds of thousands – possibly millions – of Chinese citizens have lost savings to cross-border fraud schemes linked to scam compounds and gray-market payment platforms. While reliable data on those losses is scarce, early documented cases point to hundreds of millions of dollars stolen through pigbutchering scams – long con frauds where perpetrators groom victims online before convincing them to hand over large sums of money. Today, estimates claim scam compounds generate tens of billions of dollars annually, most extracted from Chinese households – an ongoing bleed of domestic savings that represents a vastly underestimated long-term erosion of national capital.

This state-facilitated ecosystem has bred distrust within China’s middle class – the demographic Beijing relies on most for social stability. Recent unemployment and failed investments have fueled unrest and rising violence – potential harbingers of things to come as scam losses mount. The scale of loss from cross-border scams is not merely individual but systemic. As illicit networks siphon billions annually, they erode China’s internal capital coherence – the ability of the state to direct domestic savings into strategic investment. Instead of reinforcing national resilience, these shadow channels are diverting household wealth into offshore criminal ecosystems that recycle capital outside Beijing’s control.

Although Chinese authorities have made efforts at cross-border crackdowns, Southeast Asia’s scam economy continues to flourish. It is likely that Beijing cannot fully disavow these operations due to how embedded they have become within elite circles. For example, organized crime figures such as the 14K Triad’s Wan Kuok Koi (aka “Broken Tooth”) reportedly hold close political ties to the Chinese Communist Party (CCP), with Wan allegedly stating that although he used to fight for the cartels, he now fights for the CCP. In 2018, Wan launched the World Hongmen History and Cultural Association, an entity U.S. authorities sanctioned two years later for its alleged criminal activity, including close ties to Southeast Asian scam operations. Washington also claims that Wan is a senior member of the Chinese government, holding a position on the Chinese People’s Political Consultative Conference – an assertion Beijing denies.

Another Chinese gangster, Zhao Wei, has benefited from extensive BRI investment in his Laos-based Golden Triangle SEZ, where he owns and operates the infamous Kings Romans Casino, which allegedly maintains extensive ties to scam operations in the SEZ. Such cases indicate that the Chinese regime maintains deep ties to the very scam operations that consistently undermine its public image despite attempts to rein them in. As ensuring capital outflows likely plays a key role in maintaining loyalty within the CCP’s opaque patronage networks, these scam operations may benefit from protection by the very officials meant to regulate them.

This dynamic sharply inverts the original aim of China’s offshore liquidity systems. What began as an effort to secure financial sovereignty and shield the economy from external shocks has instead produced an internal liquidity leak. It undermines the narrative of centralized control – the cornerstone of party legitimacy – as the population sees their own savings flow into unregulated, foreign-run criminal networks backed by state-led investments. In this way, the social cost of shadow liquidity is not just economic dislocation but also the corrosion of the trust Beijing needs to sustain its model of governance.

Policy and Security Implications

Current anti-money laundering and counter-terrorist financing frameworks focus on shadow liquidity as a criminal threat on a case-by-case basis rather than a systemic one. Compliance systems emphasize wallet-level monitoring and red-flag thresholds, but as the Financial Action Task Force (FATF) warns, the decentralization of financial operations “may further complicate efforts to disrupt larger financial networks.”

There is a clear imperative for disrupting and dismantling these shadow liquidity systems. The human cost is already visible – from human trafficking rings sustaining scam operations to the growing number of victims in the United States and globally whose wealth is funneled into opaque offshore corridors. With Western populations aging, Chinese illicit financial infrastructure already embedded within Western societies, and scam centers expanding into geographically, linguistically, and culturally proximate regions such as Africa and Latin America, the risk of a structurally entrenched global scam economy is rising. Evidence that these same corridors are exploited by terrorist and militant groups such as the Houthis to launder and transfer funds beyond the reach of traditional enforcement only underscores the urgency for decisive action.

At the state level, China’s BRI has become a dual-use platform – advancing Beijing’s geopolitical objectives while quietly facilitating elite capital flight and enabling shadow liquidity systems under the cover of infrastructure investment. In this way, BRI simultaneously spreads and undermines Beijing’s influence globally but doubly harms U.S. and other global interests by simultaneously furthering Chinese military expansionism while enabling parasitic organized criminal infrastructure. Until Beijing demonstrates a genuine commitment to dismantling these offshore shadow liquidity networks, global regulators and enforcement agencies should treat its financial initiatives with maximum caution.

Scam compounds, OTC desks, and gray-market payment networks are no longer discrete criminal enterprises; they are embedded in shadow capital infrastructure originally tied to Chinese state objectives. Treating them as isolated criminal enterprises misses their role as autonomous reservoirs of capital capable of sustaining proxy influence and destabilizing economies.

Addressing this requires ecosystem-level targeting. FATF’s 2025 report highlight “Operation Grafos,” where real-time intelligence sharing, blockchain analysis, and cross-jurisdictional coordination was employed to disrupt a virtual asset-based terrorism finance network. Those methods must become standard practice, not isolated cases.

Hybrid threat frameworks must integrate liquidity analysis alongside kinetic and cyber domains. The Basel Framework’s network-based supervision and the Organization for Economic Cooperation and Development’s beneficial ownership models offer practical templates for this. Pressure on Southeast Asian jurisdictions hosting scam enclaves must also escalate. Cambodia, Laos, Myanmar, and the Philippines are now structural nodes; carrot-and-stick approaches could force structural change.

Stablecoin and OTC-specific controls are essential. Hong Kong’s virtual asset service provider OTC regime and International Monetary Fund guidance on stablecoin flows provide blueprints for containing these pipelines. The recent announcement that stablecoin issuer Tether will fully comply with Washington’s Guiding and Establishing National Innovation for U.S. Stablecoins (GENIUS) Act over a period of 36 months is a positive step in this direction. Without systemic measures to regulate and contain these flows, shadow liquidity will continue to metastasize beyond state control, embedding itself as a structural layer of global capital flows. Given the primacy of U.S. regulatory and enforcement bodies in the global financial system, Washington will have to anchor any serious effort to contain these high-risk and unregulated flows.

By mapping these flows as an ecosystem rather than isolated incidents, enforcement bodies can identify structural chokepoints where targeted interventions may have disproportionate disruptive impact.

Conclusion

Shadow liquidity is more than a byproduct of illicit finance; it is a strategic architecture. China’s experience shows how systems built to project resilience can evolve into autonomous networks draining wealth and feeding actors beyond state control.

This is the central warning: once liquidity is externalized into unregulated systems, it no longer necessarily serves the state or actor that created it. Financial sovereignty is not just reserves; it depends on controlling the conduits of trust – the pathways through which value moves. Without discipline over these flows, even the most carefully engineered financial architecture can become a vector of decay, eroding the very stability it was built to secure. The real question is whether these systems can be contained in time – before they permanently erode the foundations of the global financial order.

Image source

FinCEN’s new advisory on Chinese Money Laundering Networks (CMLNs) underscores a truth often missed in enforcement reporting: these are not isolated laundering schemes but components of a parallel financial architecture, a shadow liquidity system now entrenched across the Americas and around the world.

The advisory contains staggering numbers: over 137,000 suspicious activity reports (SARs), $312 billion in suspicious flows, and the same trade-based, over-the-counter (OTC), and insider-driven mechanisms. The underlying systems that set off these alerts are the connective tissue that allow sanctioned states, cartels, and elites to thrive despite formal financial controls.

FinCEN frames this as “Chinese money laundering.” And when it comes to cartel finance, Chinese enablers are indeed the most visible. Yet they are only part of a parallel financial architecture — a global ecosystem where Chinese actors are central, but not alone. Other state and non-state players drive and exploit these flows as well. Until regulators and analysts treat shadow liquidity as infrastructure, rather than a collection of anomalous SARs, enforcement will remain reactive while the networks evolve faster than the tools meant to stop them.

Subscribe now

Bigger than you think, and more chaotic

These laundering networks are diffuse, but global. They service multi-billion-dollar scam operations in Southeast Asia, terrorist groups like the Houthis, and emerging criminal enclaves in Africa and Latin America. The FinCEN advisory highlights just some of their embeddedness in Western societies, underscoring the scope of this problem.

The sort of networks FinCEN highlights aren’t just laundering for cartels — they’re tapping into a much larger reservoir of Chinese shadow capital. Crypto-enabled, OTC-driven liquidity rails emerged first to move elite wealth offshore, but over the past decade they’ve evolved into a parallel financial architecture. These flows no longer sit neatly under Beijing’s command; they form a sprawling ecosystem of brokers, gray banks, scam centers, and informal clearinghouses that operate beyond the reach of both Western enforcement and the Communist Party itself.

This is what makes the threat so destabilizing: it’s not simply “Chinese laundering,” but a decentralized liquidity system born from state and elite outflows that now finances everything from fentanyl supply chains to dual-use tech procurement. In other words, what started as controlled leakage has become a global shadow infrastructure — chaotic, adaptive, and only partially answerable to any state.

Drug cartels, scammers, and terrorists are just the visible tip of this hidden architecture. They set off SARs and grab headlines, but they are a symptom, not the disease. To understand how we got here, Between the Lines has developed a three-tiered model that tracks the money cascade from its source.

The Three-Tiered Liquidity Approach

Drug cartels, scammers, and terrorists are the visible tip of this hidden architecture. They set off SARs and grab headlines, but they’re only the final chapter in a much longer story. To understand how we got here, Between the Lines has developed a three-tiered model that tracks the money cascade from its source.

• Tier 1: The Seed Money. Vast capital outflows from countries like China, Russia, and Iran fund alternative criminal ecosystems outside global jurisdictions. The true danger of these countries lies not in their strength, but in their weakness — an inability to stem elite graft and offshore leakage that fuels shadow economies worldwide. Although these governments rely on offshored liquidity, they cannot control it once it’s outside the country - leaving them ultimately vulnerable.

• Tier 2: The Enablers. Operating in a legal gray zone, these brokers and businesses aren’t quite illegal enough to shut down without hard evidence. They thrive in lax regulatory environments, running OTC crypto desks, gray exchanges, and shell firms. They provide the escape valves for Tier 1 elites, and the laundering services that Tier 3 bad actors depend on.

• Tier 3: The Headline Grabbers. These are the actors you see in FinCEN advisories and blockchain analytics reports. Southeast Asian scammers, Iranian proxies, Mexican cartels — all exploit this ecosystem. Some build entire operations on Tier 1 outflows; others simply tap it for laundering. They kill, rob, and enslave, but remain only the tip of the iceberg. Authorities shut down one operator, while the deeper pool of shadow liquidity ensures they always resurface somewhere new.

  • Some Tier 3 operators, like Southeast Asian scammers were built directly on Tier 1 capital outflows enabled by Tier 2 operators.

  • Others, like Mexican cartels, came to the game later, accessing Tier 2 channels to legitimize their ill-gotten gains.

  • What they all have in common is that they are the dirtiest players in the game: terrorists, drug traffickers, slavers, and thieves on a massive scale.

Reports highlighting asset seizures are comforting. So are those on the shutdown of gray exchanges like Russia’s Garantex. But in every case, the real operators reconstitute somewhere else with impunity. Until we find a way to go after these cascades systematically, the cycle will continue unabated, threatening global security on practically every level.

Between the Lines’ proprietary Predictive Intelligence Pipeline

What Between the Lines Offers

Before we can disrupt these networks, we need to understand them. Between the Lines exists to map the shadow liquidity systems that underpin global crime, state corruption, and geopolitical instability.

Where others focus on symptoms — the cartels, the scams, the terror groups — we dig into the architecture: the hidden financial scaffolding that sustains them. Our analysis blends geopolitics, macroeconomics, open-source intelligence, and financial investigation with years of institutional memory tracing capital outflows from Beijing, Moscow, and Tehran to scam compounds in Southeast Asia and fentanyl traffickers in Mexico. Beyond mapping the networks, Between the Lines is developing models to anticipate and time these flows with as much precision as possible.

We share the doctrine publicly — models like the three-tiered liquidity approach that explain how capital moves, why enforcement fails, and where interventions could succeed. But we can’t afford to give it all away for free. The real value lies in tailoring this framework to specific risks: a bank’s exposure to shadow liquidity, a government’s vulnerability to illicit flows, or a regulator’s blind spots in enforcement. Those require bespoke reports and private briefings, built to solve problems no generic red flag can.

For policymakers, compliance officers, and investigators, Between the Lines provides more than headlines — it delivers the clarity and strategy needed to actually disrupt these networks. For readers, it offers a rare vantage point on the hidden infrastructure reshaping global security and finance.

A screenshot from the movie Hotel Rwanda, in which a Hutu warlord shows off his PRC-made machete. (Source: Douban)

This article was published on November 1, 2024 in the Jamestown Foundation China Brief. It has since been cited in a July 2025 report by the U.S. Senate Committee on Foreign Relations. You can find the original article here.

Executive Summary:

• Weapons manufactured in the People’s Republic of China (PRC) are increasingly falling into the hands of militant groups across Africa, with key contributors being state-owned defense contractors like Norinco. However, it is unclear how the weapons reach these groups.

• Militant groups such as Mali-based JNIM and the Democratic Republic of Congo’s M23 are employing PRC-manufactured arms in their operations, with evidence suggesting the potential involvement of Chinese criminal syndicates and corruption within PRC defense firms and African militaries.

• Extensive access to PRC-manufactured weapons by countries like Rwanda and Uganda, both of which support rebel groups, underscores the growing influence of PRC defense contractors in Africa, potentially contributing to regional conflicts.

• Beijing’s experience in Myanmar, where it supports both the government and rebel groups, may offer insights into its role in African conflicts, raising concerns about how escalating conflicts could strain Beijing’s partnerships and jeopardize its regional investments.

Weapons manufactured in the People’s Republic of China (PRC) are increasingly falling into the hands of militant groups across Africa as PRC defense contractors expand their influence in the region. Many African governments have signed arms deals with Beijing, with the PRC becoming the continent’s leading supplier of weapons this year. It is unclear how weapons are falling into the hands of militants, though corruption is likely playing a part in the influx of PRC-manufactured arms on the continent. Corruption has been rampant in recent years within the PRC’s military-industrial complex, reaching right to the top of the system. At the same time, the likelihood of corrupt activities by PRC arms companies in Africa—that operate far from regulatory oversight by Beijing—is high, as is the involvement of Chinese criminal groups that are also active in the region.

In late September, the Mali-based, al-Qaeda-affiliated Jama’at Nasr al-Islam wal Muslimin (JNIM) continued to escalate its presence in Africa’s Sahel region, executing attacks that claimed over 70 lives in Bamako (Xinhua, September 18; September 20). JNIM has access to large numbers of PRC-manufactured weapons. This is one of several instances of non-state actors having access to substantial quantities of PRC military equipment—Myanmar constitutes another prominent case.

Mali-based Terrorist Group Maintains Extensive Arsenal of PRC Weapons

Propaganda videos and footage released by the Malian military reveal substantial stockpiles of weapons produced by PRC state-owned defense contractor Norinco (中国兵器工业集团; 北方工业), including a Type 80 machine gun, a Type 81-1 assault rifle, and at least two Type 69 rocket-propelled grenade (RPG) launchers equipped with high-explosive anti-tank projectiles (Militant Wire, September 22). While the images also display weapons from other countries such as Russia, Romania, and older Soviet Union models, most of the arms pictured are of PRC origin.

Norinco has increasingly expanded its role in supplying militaries throughout the Sahel, particularly in Mali. A video released last summer shows Malian special forces outfitted with a broad array of PRC-manufactured weapons and equipment, including Norinco-produced CS/VP11 Lynx all-terrain vehicles equipped with W85 anti-aircraft machine guns, as well as JS 9mm submachine guns produced by Jianshe Industries (云南建设工业集团) (BiliBili, August 27, 2023). Last month, during the Forum on China–Africa Cooperation (FOCAC) in Beijing, Mali secured another contract with Norinco to provide additional weapons to its military (Embassy of the PRC in India, September 2; Military Africa, September 3).

In recent years, JNIM has funded much of its expansion by running a protection racket associated with the illicit harvesting and trade of southern Malian rosewood, a highly valued tropical hardwood prized for its distinctive color and durability (ISS Africa, June 19). In 2018, Malian whistleblower Amadou Traoré exposed the extensive deforestation and criminal activities tied to Mali’s rosewood trade, prompting several international investigations (Corruption Anonymous, September 13, 2023). Reports suggest that most of Mali’s exported rosewood ends up in the PRC, with PRC criminal syndicates operating in Mali and Senegal playing essential roles in the trade (South China Morning Post, May 22, 2022; PPLAAF, September 11, 2023). In the PRC, the trade of illegally exported Malian wood is so widespread that several online retailers sell it on Aicaigu (爱采购), a business-to-business platform operated by PRC tech giant Baidu (Aicaigou, October 10). However, the origin of JNIM’s vast cache of PRC-manufactured weapons and the group’s relationship with PRC criminal syndicates remains unclear. Although villagers in southern Mali have reported that local PRC crime syndicates pay protection money to JNIM, these reports remain unsubstantiated (ECOWAS, November 2023). Such factors call for further investigation.

PRC Defense Contractors Benefit From Worsening Conflict in the Eastern DRC

In the eastern Democratic Republic of Congo (DRC), the March 23 Movement (M23), predominantly composed of Tutsi rebel forces, continues to devastate the region using PRC-manufactured weapons, including an assault on the provincial capital of Goma and the plundering of vast quantities of minerals (United Nations, February 20; Africa Defense Forum, March 5). Photos of seized M23 weapons and equipment released by the Congolese military underscore the PRC origin of these extensive supplies, particularly from Norinco and Xinxing (中国新兴进出口有限责任公司), a firm specializing in military uniforms and tactical gear. In an interview with a local news outlet, Congolese-Belgian defense analyst Jean-Jacques Wondo Omanyundu noted, “the M23 weapons seized by the FARDC [the Congolese military] are almost all Chinese-made” (China Global South Project, July 12, 2022).

A recent UN Security Council report concludes that M23 receives substantial financial and material support from neighboring Rwanda and Uganda, both of which have acquired significant quantities of PRC-manufactured weapons (United Nations; ReliefWeb, June 4). In recent years, Rwanda has made large purchases of artillery systems and other arms produced by Norinco and other firms. A Shanghai-based firm called Deekon Group even uses images of the Rwandan military uniforms it produces for promotional purposes on its website (Deekon Group, October 8). The PRC and Rwanda also maintain close military and defense ties, with Beijing deploying an official defense attaché to Rwanda earlier this year (Embassy of the PRC in Rwanda, February 21). Uganda’s military, meanwhile, has purchased arms from Norinco and another Chinese firm, Poly Technologies (保利科技有限公司; 保利科技), according to a 2021 investigation by a Ugandan journalist (The Independent [Uganda], December 19, 2021). In November last year, Norinco partnered with the Ugandan military to establish a research center focused on unmanned aerial vehicles (UAVs) in the country (MODVA, November 29, 2023). The extensive access of Rwanda and Uganda to PRC-manufactured weapons, along with their support for the M23 movement, highlight the likely source of the rebel group’s large PRC-made arsenal.

To counter the escalating threat from M23, the DRC military has also turned to the PRC defense industry, purchasing its first batch of three CH-4 attack drone systems from China Aerospace and Technology Corporation (CASC; 中国航天) last year (Africa Intelligence, May 22, 2023). Later that year, Norinco became embroiled in controversy in the DRC when its subsidiary, Norin Mining, attempted to acquire cobalt and copper mines outside Lubumbashi, in the Katanga province, south of the M23-led insurgency in North Kivu province. The DRC state-owned mining conglomerate, Gécamines, moved to block the sale, claiming it had not been properly informed of the decision (Africa Confidential, October 11). Although Lubumbashi is approximately 900 miles south of M23-controlled territory in North Kivu, the group conducted extensive attacks in the city during its 2014 offensive (BBC, January 7, 2014).

Corruption at Defense Contractors and the Myanmar Example Raise Further Questions

The PRC’s defense contractors are increasingly flocking to African markets, with the PRC surpassing Russia as the continent’s largest weapons supplier this year (ADF, July 23). Norinco, which manufactures a wide range of weapons from handguns to tanks, has been at the forefront of this expansion, operating offices in over 70 countries. Its latest expansion into Dakar, Senegal, signals growth intentions in the West African market (Norinco, October 8; SCMP, August 21, 2023). According to its website, Norinco controls mining sites across Africa (including gold, cobalt, and palladium mines), is deeply involved in the regional copper trade, and plans further expansion (Norinco, October 8). Although there is insufficient evidence directly linking these companies to the militant groups who are using their weapons, recent developments within the PRC shed more light on these companies’ practices.

Beijing has taken punitive actions against at least two senior Norinco executives since 2021 in response to corruption charges. In October 2021, PRC authorities charged former Norinco Chairman Yin Jiaxu (尹家绪) with bribery and seeking illegal profits for relatives and friends (People’s Daily, October 25, 2021). According to an official readout, Yin received “huge sums” of money and gifts, and held top positions at the company from 2002 until his 2018 retirement (Global Times, April 4, 2021; CCDI, September 30, 2021). Last December, authorities removed then-Norinco Chairman Liu Shiquan (刘石泉) from the 14th National Committee of the Chinese People’s Political Consultative Conference amid an anti-corruption investigation into the defense and aerospace sector (China Brief, February 2; Global Times, March 3). Liu had previously held senior roles at the state-owned China Aerospace Science and Industry Corporation (CASIC; 中国航天科工).

These high-level disciplinary actions highlight the prominence of corruption within some of the PRC’s top defense contracting firms. Given the distance between operations in African countries and oversight by Beijing authorities, corrupt backchannels may be funneling the transfer of PRC-manufactured weapons to African militant groups for personal gain. Coupled with the involvement of Chinese criminal elements in Africa and the potential for internal corruption within the militaries of affected nations, this situation merits further investigation as a possible source of these weapons (OCCRP, May 25, 2022; Africa Report, August 12; May 14).

The PRC’s experience in Myanmar may offer insights into this involvement in internal African conflicts, such as those in Mali and the DRC. For decades, Beijing has supported Myanmar’s ruling government while simultaneously providing material and financial backing to various armed resistance groups (China Brief, March 17, 2023; MLM, July 31; South China Morning Post, August 25). Both JNIM in Mali and M23 in the DRC hold significant value for the PRC due to their access to rare and high-value resources. It is plausible that Beijing may unofficially support one or both groups to secure its continued resource access. However, if such claims are substantiated, they could damage the PRC’s reputation in Africa. Moreover, as seen in Myanmar, further conflict escalation could endanger Chinese investments and those of other nations. Moreover, JNIM’s prolonged conflict with Wagner mercenaries fighting for the Malian junta—coupled with the group’s use of PRC-manufactured weaponry—may strain the PRC’s “no limits” partnership with Moscow, particularly regarding African matters (Xinhua, January 2, 2021).

Conclusion

The expanding presence of PRC defense contractors in Africa and the increasing use of PRC-manufactured weapons by militant groups warrant deeper investigation. However, such inquiries will likely prove challenging due to the frequently opaque nature of business dealings in these regions. What remains clear is that the growing prevalence of PRC-manufactured weapons among powerful militant groups in Africa has considerable implications as Beijing moves to dominate the African arms market. These implications include regional security, as non-state actors gain further access to advanced PRC weaponry and equipment, and geo-strategic concerns, as resource-based conflicts can potentially disrupt global supply chains. Given current trends, these threats will likely intensify as PRC defense contractors seek greater access to the continent’s arms markets.

Illicit finance is no longer episodic crime. It has matured into shadow liquidity systems: parallel infrastructures where state actors, cartels, mercenary groups, and cybercriminals pool and regenerate capital. These systems – empowered by digital currencies and vast capital outflows – function as underground financial institutions, enabling adversaries to outlast sanctions, rebuild after seizures, and finance operations at scale.

Global institutions still treat illicit finance as a series of anomalies — bad transactions, rogue exchanges, isolated scams. This fragmented view leaves the circulatory system itself untouched. The result: adversaries adapt faster than regulators, and global security erodes while enforcement chases symptoms.

Why It Matters

• National Security: Shadow liquidity sustains proxy wars, sanctions evasion, cyber operations, and militant logistics. It is the bloodstream of hybrid conflict.

• Economic Integrity: These systems siphon billions from households and corporations alike. They play a destabilizing role in across whole regions, as witnessed recently in Southeast Asia.

• Beyond Control: These systems feed off capital outflows (especially from China) but answer to no one — even the countries that spawned them.

• Real World Threats: Iran-backed proxies and Southeast Asian militant groups use these networks. So do multi-billion-dollar global scam operations. The threat is real and it’s already here.

• Strategic Leverage: Whoever maps and disrupts these infrastructures doesn’t just fight crime — they control adversaries’ capacity to project power.

The Gap

• Tools are reactive: Blockchain analytics, anti-money laundering (AML) compliance, and sanctions designations find anomalies but not architectures.

• Regulation is fragmented: National silos and outdated legal frameworks make systemic action impossible.

The BTL Framework

Between the Lines Research has developed a framework to analyze illicit finance as infrastructure rather than incident. Key components:

• Primary Liquidity: Capital outflows — fast, mobile fuel.

• Secondary Liquidity: Informal systems (hawala, OTC desks, trade credit) that enable gray exchange.

• Tertiary Liquidity: Long-term reservoirs (real estate, commodities, criminal operations [ex: scam centers], militant/ terrorist groups) that can be mobilized in crisis.

By tracking conversion between these tiers, we expose the stress points adversaries use to survive and regenerate.

Between the Lines’ proprietary Three-Tiered Framework and Predictive Intelligence Pipeline

Applications

• National Security: Identify and pre-empt liquidity corridors sustaining adversary militaries and proxies.

• Financial Sector: Develop financial intelligence (FININT) products that move beyond anomaly detection into systemic mapping.

• Tech & Cyber: Integrate liquidity mapping with cyber threat intel to close the gap between digital intrusions and financial outcomes.

Case Study: Chinese Capital Outflows and Scam-Backed Militias

The rapid outflow of Chinese capital, driven by elite flight and tightening domestic controls, has created offshore liquidity pools across Southeast Asia. These flows illustrate how shadow liquidity systems evolve from simple capital escape into infrastructures that finance armed groups and destabilize regional economies.

• Capital Outflows (Primary): Wealthy elites and mid-tier operators move funds offshore to evade Beijing’s capital controls. Much of this first moves through cash, stablecoins, and front companies in border economies.

• Infrastructure Formation (Secondary): These outflows feed into OTC desks, casinos, and unregulated payment processors, which become regional hubs for laundering and reinvestment for tertiary actors.

• Tertiary Parasitism and Destabilization: At the highest tier, the threat becomes acute.

  • Scam compounds siphon billions annually through trafficked labor.

  • Armed groups and private militias provide protection for these hubs, turning them into semi-sovereign enclaves in Cambodia and Myanmar.

  • Platforms like Huione facilitate laundering at scale, enabling actors such as the Houthis to exploit the same corridors.

  • The fact that Huione remains active despite sanctions and a nominal shutdown shows that these systems are networked, not episodic — requiring a systemic approach.

This cycle shows how a single driver — Chinese capital flight — cascades into a shadow liquidity architecture that finances militancy, erodes sovereignty, and extracts value from legitimate economies. Episodic enforcement actions like sanctions strike at symptoms in the tertiary tier, but the real threat lies in the multi-tiered networks that remain resilient and regenerative.

What Between the Lines Provides

Between the Lines translates this framework into actionable outputs: tailored briefings, case studies, and strategic advisory designed to help institutions understand and anticipate how shadow liquidity shapes their risk environment. Whether the need is regulatory foresight, adversary mapping, or integration into existing threat intelligence, BTL brings the concepts down to ground level — where they can guide decisions, not just analysis.

Last week, a China Coast Guard cutter collided with a People’s Liberation Army Navy (PLAN) vessel during a confrontation off the Philippine coast. It wasn’t an accident of navigation but the result of aggressive, unprofessional maneuvering — the kind of chest-thumping that Beijing now deploys as routine statecraft in disputed territories. Reports show the vessel sustained serious damage and it remains unclear whether any China coast guard personnel were killed or injured in the collision. Reports indicate that the PLAN vessel continued in its pursuit of the Philippine vessel after the collision rather than aid in the rescue of its Coast Guard counterpart.

The incident captured something important: the gap between image and reality in China’s military posture. On paper, the PLA looks formidable, with the world’s largest navy in terms of vessel count and personnel, fields of J-20 stealth fighters, and hypersonic missiles on parade. The numbers impress and intimidate. The technical threat is real: Chinese hypersonic missiles can strike U.S. military installations as far off as Guam. Moreover, as we explored in a recent series, Chinese integrated air systems can outperform more technically advanced but less integrated counterparts.

But military power does not rest on platforms alone. It depends on people — their training, discipline, and ability to fight together under stress. By those metrics, the PLA likely falls short in myriad ways. It’s time to reassess China’s military capabilities not by just in terms of hardware, but by what would happen under real-world conditions. That is where strength is measured — and where China’s weakness is most exposed.

Read more