Sometimes life brings you to a crossroads, as demonstrated to me one morning in Malta by these two cats looking in opposite directions. The picture reminds me of the painting from Goodfellas.

Dear subscribers,

It has been a while since I last posted. Thank you for sticking around. I want to explain why my work has changed, what I’m working toward, and why future research will be behind a paywall.

Why threat finance?

Some of you subscribed for the broader geopolitical and economic analysis I used to publish. My increasing focus on threat finance may seem like a departure. For me, it grew out of a problem I kept encountering: we can identify who moved money and what it financed, yet struggle to explain why the networks behind those transactions keep surviving.

Much of the analysis I read follows particular payments, funding sources or sanctions violations. I wanted to understand the system that makes them possible. What allows a network to replace a frozen account or a sanctioned intermediary and carry on?

I spent a substantial part of my career analysing commodities. In that business, you need to understand what makes a flow possible: who finances it, who arranges the trade, and how policy or events elsewhere affect it. A shipment or a price tells you very little on its own – even less when it comes to predicting outcomes, which is what the clients ultimately demand.

Applying that lens to global grey finance, or “shadow liquidity,” has been alarming and personally transformative. Parallel financial systems already sustain vast criminal economies, armed groups and state-linked intelligence and procurement networks – including those linked to nuclear weapons proliferation. They allow actors to mobilize resources and exercise power beyond the reach of institutions meant to constrain them.

My Parallel Trust framework examines how the relationships holding these systems together form and survive disruption. My complementary Three Tier Framework examines the directionality of these flows, including their source drivers and the intermediaries that make them possible through parallel trust. If the trusted intermediaries and connections remain, closing a financial channel may simply move the activity elsewhere. As these systems expand, they threaten the state’s ability to regulate finance and constrain organized violence. That has consequences for the international order far beyond any individual laundering case.

Where the work has gone

Over roughly the past eighteen months, my research has been cited by:

• The Financial Action Task Force (FATF)

• The U.S. Senate

• The U.S. Congressional Research Service

• The Africa Center for Strategic Studies, a U.S. Department of Defense institution

• The United Nations

• The German Bundestag

• A Coinbase submission to the U.S. Treasury.

My three-part Islamic State finance series received seven citations in FATF’s 2025 comprehensive update on terrorist financing, making me its most-cited individual source.

In April, I presented my Parallel Trust framework to the United Nations Security Council’s Counter-Terrorism Committee Executive Directorate (CTED). I explained how propaganda builds the credibility and trust needed for financial and operational coordination, before a transaction becomes visible.

CTED’s September report cited that briefing and incorporated the framework into its analysis of propaganda as operational infrastructure. It also included five of my articles and the briefing announcement in its counter-terrorist-financing reference database.

I’m proud of that. I wanted this research to be useful, and there is now a record of institutions using it. With any luck, this work and its legacy will outlive me, a man with no children at the dawn of middle age.

What that hasn’t paid for

The income has not followed.

I have continued researching while taking side jobs and pitching commissions, including to institutions already familiar with my work. Some of the most prestigious organizations on earth expect consultations for free. I have travelled around the world twice to attend conferences, with transport and accommodation covered but no payment for my time or contribution.

I cannot keep working that way. Checking evidence, following networks and developing an explanation that holds up to scrutiny take time. A citation does not pay for it, however pleased I am to receive one.

That means changing how I publish. I can no longer afford to develop substantial original work and then compress it into a short article for a few hundred dollars. Subscriptions and properly funded commissions will need to support the research.

What changes here

Future research articles on Between the Lines will be for paid subscribers. Most articles that are currently free will stay free.

I have raised subscription prices to reflect the work involved, while keeping monthly and annual options within reach of individual readers.

There is still a great deal I want to publish. I will be examining the machinery behind shadow liquidity, including the states that deliberately use parallel systems and those that help create them through policy failures or gaps in enforcement.

Readers interested in my broader geopolitical work will find those questions running throughout. Following these systems means examining how states exercise power, how armed groups sustain themselves and how seemingly distant conflicts become financially connected.

For institutional readers

The higher-priced Founding Member tier is intended for institutions. If you are an individual reader, a regular paid subscription gives you access to the research; you do not need to pay the institutional price.

Institutional subscriptions include a 30-minute consultation to discuss the research and its relevance to your work. Commissioned reports, training and ongoing advisory work are separate engagements, with their own scope and fee.

I remain interested in paid institutional partnerships, and several discussions are underway. But Between the Lines also needs to support work I can pursue independently, without waiting for an institution to commission it.

Thank you to everyone who has subscribed, shared an article or brought the research to someone’s attention. I have much more to say, and I want to be able to give it the time it deserves.

Adam

This is an article I recently wrote for the Global Network of Extremism and Technology (GNET). You can find the original link here.

Thank you for taking the time to read this. I am currently working on a larger project, so this will be my final public article until at least August. During this period, Between the Lines will continue to produce original research and can be reached at info@btl-research.com.

By April 2021, Islamic State Mozambique Province (ISMP, also known as al-Shabaab or Ansar al-Sunnah) had reached the zenith of its territorial expanse. Following years of kidnappings, raids, and escalating offensives, the group had seized key towns and transport routes across Mozambique’s Cabo Delgado province. That month, ISMP’s assault on Palma, a town near a US $20 billion international liquefied natural gas operation, forced the project’s suspension and the evacuation of hundreds of personnel.

By July 2021, Mozambique, Rwanda, and other international partners had launched a counterinsurgency campaign that degraded ISMP’s territorial holdings, reducing its fighting capacity by roughly 90 percent. By conventional standards, the campaign achieved important successes, with ISMP losing control over key revenue streams, its ability to amass fighters disrupted, and its territorial footprint pushed back. Moreover, the United States, the European Union and others issued sanctions against the organisation. Additional sanctions targeted core leadership figures, including Tanzanian national Abu Yasir Hasan (aka Sheikh Hasan) and Mozambican national Bonomade Machude Omar (aka Ibn Omar), who was reportedly killed in a 2023 battle with Mozambican forces.

Yet the group did not collapse. Recent reporting suggests that ISMP activity is increasing, with conflict-related deaths in northern Mozambique up 51 percent in 2025. Moreover, a January report by Armed Conflict and Event Location Data (ACLED) notes that ISMP has been expanding its revenue and operating capacity through ransom-taking, mobile-money-enabled payments, mining-site extortion, weapons seizures, and regional facilitation networks. This raises the question: why has ISMP continued to regenerate after years of sustained military and sanctions pressure?

The answer is not simply that these measures failed. The deeper problem is that the applied pressure targeted ISMP’s fighters, territory, and leadership figures, while its regeneration depended on a different capacity: a digital trust network operating across propaganda, finance, and transnational facilitation layers.

The Islamic State’s online ecosystem is therefore not merely a messaging apparatus, but a networked infrastructure functioning as a recognition layer that keeps distributed actors aligned under a shared organisational identity. In this model, propaganda preserves the banner; the banner sustains trust; trust enables distributed financial adaptation; and financial adaptation restores operational capacity. This Insight applies that framework to ISMP as a granular case study, showing how online recognition, trust-node formation, and distributed financial adaptation can help an Islamic State affiliate regenerate after territorial disruption.

From Territorial Disruption to Distributed Resilience

After counterinsurgency pressures began in 2021, ISMP made media production and propaganda validation more central to its operations. Prior to this, ISMP’s coherence was rooted more heavily in territorial control, smuggling corridors, and kinetic activity across Cabo Delgado. Once militarised operations disrupted that spatial substrate, the group increasingly depended on the global Islamic State propaganda ecosystem to preserve visibility, validate attacks, and maintain coherence among dispersed actors operating under the same banner.

This media-based adaptation increased the importance of trust nodes. Although Islamic State-linked media remains present on Facebook, Instagram, TikTok, and X, moderation has pushed much of the mainstream ecosystem toward an outer layer of redirect pathways. In this way, mainstream platforms often serve as a discovery layer, exposing users to fragments of content, supporter accounts, or coded references. The deeper trust architecture forms across less accessible and less moderated channels on platforms such as Telegram, Rocket.Chat, Element, online archival sites, and Google Drive repositories. There, access depends less on discovery than on trusted navigation: users must rely on trusted nodes for access to links, channels, files, accounts, and distribution pathways after takedowns, suspensions, or migration.

The Mozambique case reflects a shift in priority toward this online ecosystem. A 2024 report published by the Hudson Institute found that global Islamic State social media outlets were initially slow to post about events in Mozambique, which the authors suggest indicated “limited communication between fighters on the ground and central coordinators.” By late 2023, however, the authors note that attack attributions from Mozambique were usually published within two days of occurrence, suggesting that ISMP’s connection to the global Islamic State media system had become more functional during the post-intervention period.

Hansen and Bary similarly show the extent to which ISMP became visible inside the global Islamic State propaganda ecosystem after the 2021 intervention. Between May 2022 and May 2023, ISMP received thirty-seven front-page articles in Al-Naba, the Islamic State’s online weekly news publication. Of the 208 Al-Naba articles carrying African themes during this period, roughly 20 percent focused on Mozambique. In March 2024, Caleb Weiss further noted that ISMP led global Islamic State affiliates by total media output by that point in the year. In this way, ISMP became significantly more visible in the online space despite the severe degradation of its local operational capacity.

The results of this online expansion are tangible, with the recruitment of regional and global fighters into ISMP ranks demonstrating the reach of the group’s media footprint. A March 2024 report from the Soufan Center noted that the group had attracted fighters from across much of Africa, including the DRC, Kenya, Rwanda, South Africa, and Tanzania. In May, a French court convicted six men who attempted to travel to Mozambique with the stated intention of joining ISMP, highlighting the group’s global visibility. These recruitment patterns show that ISMP’s trust-based online ecosystem does not merely broadcast narratives, but also makes the group legible to dispersed audiences as a viable destination.

Taken together, these indicators suggest that ISMP’s post-2021 adaptation cannot be understood primarily through military or territorial metrics. As counterinsurgency pressure fragmented the group’s operating environment, propaganda became part of the infrastructure through which ISMP remained recognisable, validated, and operationally coherent. Its media footprint helped build and maintain the trust nodes needed for dispersed actors to continue operating as part of the same Islamic State project.

Figure 1. Issue 365 of al-Naba featured an editorial celebrating the founding, history, and current activities of the ISMP in November, 2022.

Figure 2. An infographic by pro-IS media outlet Halummu from 2022, showing ISMP’s resilience despite counterinsurgency efforts at the time.

Financial and Operational Resilience

ISMP’s post-2021 revenue model is a distributed system of local coercion made resilient by a shared online recognition ecosystem. The group generates value through roadblock extortion, mobile-money payments, mining-site pressure, timber and mineral flows, weapons seizures, cash-out collaborators, and broader facilitation pathways. Local trust, weak identity controls, mobile money, and regional facilitation explain how value moves; the online ecosystem keeps scattered coercive acts, payment chains, resource sales, and operational outputs coherent as Islamic State activity.

Ransom activity illustrates this model. Payments move through mobile-money services such as M-PESA, e-Mola, and mKesh, with victims instructed to transfer funds to accounts controlled by ISMP collaborators in urban areas. Reports indicate that ISMP has targeted buses and commercial vehicles on the N380, where passengers can quickly raise payments through mobile-money accounts, generating ransoms of up to US $600 per passenger. Zitamar News reported that such payments are enabled by weak know-your-customer (KYC) protocols, fake identities, and cash withdrawals without proof of identity. This chain separates the coercive actor, account holder, cash-out collaborator, and ultimate recipient.

Royal United Services Institute (RUSI) fieldwork reinforces the limits of transaction-led analysis. Payments to fighters’ family members were only legible once analysts identified sender-recipient relationships, while mobile-money operators also identified small, precise transfers that appeared to function as covert communications between insurgents. These findings illuminate partial mechanisms—kinship, coded transfers, weak KYC, and cash-out infrastructure—but not how dispersed financial, coercive, and facilitation actors remain part of a coherent insurgency. In a system spanning roadblocks in Cabo Delgado, urban cash-out points, cross-border corridors through Tanzania and South Africa, and recruitment networks reaching as far as Europe, in-person or kinship-based coordination alone cannot explain ISMP’s financial continuity. The online ecosystem is therefore the clearest explanation for how separated actors continue to treat these activities as valid parts of the same Islamic State project.

A 2025 African Security Analysis report, citing Mozambique’s financial intelligence unit, estimated that ISMP moved roughly US $7 million through fragmented deposits, structured withdrawals, and layered banking and mobile-money transfers between 2017 and 2024, involving mobile-money agents, traders, cash withdrawals, public-sector conduits, and cross-border corridors. This scale and diversity make clear that ISMP’s financial system cannot be reduced to kinship transfers or coded mobile-money signals. Those mechanisms help explain how some values and messages move; they do not explain how a geographically dispersed system of coercion, cash-out infrastructure, resource conversion, and regional facilitation remains connected to the Islamic State project under sustained pressure.

The same logic applies to resource extraction and battlefield resourcing. ISMP has increased pressure around artisanal gold and gemstone mining, including forced contributions and demands for access to resources. Authorities estimate the group has generated US $30 million from pilfered ruby sales alone, suggesting that the US $7 million in identified banking and mobile-money flows captures only a conservative slice of a wider value-conversion system. ACLED notes that there is no evidence that ISMP directly controls mining operations, pointing instead to distributed value conversion rather than formal extractive administration. Weapons seizures close the loop: captured materiel reduces procurement needs, while Islamic State media converts battlefield resourcing into proof of capability.

External connectivity is what turns this local adaptation into a wider risk. Islamic State funding to Mozambique has historically flowed through the Somalia-based al-Karrar office, using hawala services, physical cash deliveries from South Africa and Tanzania, and mobile-money transfers to support ISMP’s local operations. This places ISMP’s revenue adaptation inside a regional financial architecture dependent on trusted brokers, couriers, transfer channels, and recognition from the wider movement.

That architecture matters because Cabo Delgado’s gold and gemstone deposits, rare timbers, hydrocarbon investment, and on- and offshore smuggling routes create significant revenue opportunities for a group already expanding through local illicit economies. ACLED notes that ISMP may no longer rely as heavily on external IS support, raising the possibility that it could evolve from a recipient node into a contributor to the global IS project. The shift would invert the conventional affiliate model: ISMP would no longer be understood mainly as a peripheral branch requiring external support, but as a resource-rich node capable of generating value for wider Islamic State networks through al-Karrar-linked or successor facilitation structures.

ISMP’s propaganda ecosystem, therefore, sits upstream of the transaction. It need not carry every payment, signal, or instruction directly; it preserves the recognition layer through which payments, routes, accounts, resource claims, weapons seizures, and coercive actions remain intelligible as Islamic State activity. In this model, propaganda sustains recognition; recognition sustains trust; trust enables distributed finance; and distributed finance restores operational capacity.

Figure 4. ISMP fighters pose with captured weapons, munitions and explosives in July 2022. The image contains the IS media watermark and other elements used to authenticate content within the movement’s online ecosystem at the bottom.

Recommendations

First, authorities should distinguish mapping thresholds from enforcement thresholds. ISMP-related financial infrastructure should not be mapped only after a suspicious transaction, designation, or request for private data. Analysts should begin with open-source and platform-visible indicators: propaganda archives, channel migration, claim timing, route references, broker mentions, donation language, account reuse, and recurring facilitation signals. These indicators may not be actionable on their own, but they can build structured confidence around where trust nodes, payment pathways, and regional facilitation are forming.

Second, platforms, FIUs, and counterterrorism analysts should use these open-source indicators to construct AI-assisted trust-node maps before seeking more intrusive data access. FIU outputs – suspicious transaction reports, mobile-money anomalies, structured withdrawals, account churn, coded transfers, and cash-out points – should be compared against observable online behaviour. Where the same corridors, actors, accounts, or facilitation routes recur across both environments, they should be treated as pre-transactional indicators of network resilience rather than coincidental overlap.

Third, this model should operate within existing legal frameworks rather than bypass them. Under rights-based regimes such as GDPR, behavioural risk mapping should be structured around necessity, proportionality, data minimisation, human review, and clear purpose limitation. The point is not to treat behavioural analytics as a shortcut to enforcement, but to use corroborated, lower-intrusion indicators to justify whether further access, lawful sharing, FIU escalation, or network-level disruption is warranted.

Fourth, Mozambique’s mobile-money vulnerabilities should be treated as operational chokepoints. Weak KYC protocols, fake identities, and cash withdrawals without proof of identity allow coercive actors, account holders, and cash-out recipients to remain separated across jurisdictions. Mozambican regulators and relevant regional partners should focus on KYC floor requirements for mobile-money agents in Cabo Delgado and adjacent provinces, reporting thresholds for structured withdrawals, and SADC-region FIU coordination around flows through Tanzania and South Africa.

Finally, authorities should monitor how al-Karrar-linked facilitation adapts after pressure or disruption. When pressure falls on a facilitation node or its operating environment, the network must often reconstitute through new brokers, corridors, account clusters, and authentication channels. Those replacement patterns can reveal more than a single transfer, post, or account. Recurring overlap between online recognition, behavioural signals, cash-out infrastructure, and regional facilitation should therefore be treated as evidence of successor-node formation.

Press briefing

On April 22, I delivered an Insight Briefing to the United Nations Counter-Terrorism Committee Executive Directorate (CTED) on something I’ve been developing for a while: the idea that propaganda ecosystems don’t just spread ideology, but function as financial infrastructure.

The session was titled Trust Networks and Parallel Financial Systems: How Propaganda Ecosystems Enable Terrorist Financing. The core argument was simple, and largely overlooked.

Terrorist financing begins with trust before a single transaction occurs.

The Missing Layer

Counter-terrorism finance has been built around transactions. Bank transfers. Crypto flows. Suspicious activity reports. Flag the movement, freeze the asset, disrupt the network.

The problem: by the time money moves, networks have already hardened into place.

Extremist propaganda ecosystems operate as trust infrastructure — authentication systems for intermediaries, coordination layers for decentralized finance. They allow geographically and ethnically dispersed actors to validate who receives money, coordinate without direct contact, and maintain financial continuity under sustained pressure.

This is why groups affiliated with the Islamic State and al-Qaeda keep functioning even when their formal financial access is systematically restricted. While transactions get disrupted, the underlying trust that makes them possible does not.

What Happens When You Apply Pressure

Most disruption frameworks assume financial systems behave like centralized structures. They don’t — and the distinction matters.

In a centralized system, authority enforces coordination. Remove a node, the system degrades. That’s the model most enforcement tools are built for.

In a distributed, trust-based system, something different happens. Apply pressure, and the network doesn’t collapse — it fragments, then reorganizes. Trusted intermediaries still exist. Validation pathways remain intact. Coordination resumes without central control.

Financial pressure produces temporary disruption, not systemic collapse. As long as the trust architecture endures, the system regenerates.

That shift — from centralized to distributed — is exactly where current disruption strategies fail.

What the Current Tools Miss

Existing frameworks are built to detect transactions, wallets, and known actors. But these are interchangeable tools. Rather, the system depends on the underlying trust layer — one that is mostly invisible to transaction-based detection models.

Moving upstream changes the picture. Identifying trust nodes. Mapping cross-platform validation patterns. Linking behavioral signals to financial emergence before coordination hardens into infrastructure.

Done correctly, this means surfacing high-risk intermediaries before they receive funds, identifying coordination hubs that never appear in transaction data, and anticipating how networks reconstitute after disruption — rather than rediscovering them afterward.

The Distinction That Determines Outcomes

Most systems are built to follow money. Very few are built to identify the trust systems that determine where that money can move.

That distinction is the difference between tracking activity and disrupting the system that produces it. This is the gap I presented to CTED — and one most current frameworks have yet to close.

Video Recording

Because the session included sensitive propaganda examples, CTED has kept the recording private. To request access, contact info@btl-research.com.

^ Link to original article

This is an article I recently wrote for the Global Network of Extremism and Technology (GNET). You can find the original link here.

Propaganda ecosystems function as parallel trust infrastructures, enabling extremist organisations to coordinate financial activity outside formal financial systems. While extremist propaganda is typically studied as a tool for recruitment or ideological dissemination, these ecosystems also perform a critical financial function as generators of the reputational legitimacy and interpersonal trust necessary for decentralised financial networks to operate.

Over the past decade, violent extremist groups—particularly those affiliated with the Islamic State and al-Qaeda—have leveraged digital propaganda ecosystems to construct increasingly sophisticated parallel financial systems. Through repeated messaging, reputational signalling, and networked communication, these ecosystems enable dispersed actors to authenticate intermediaries, coordinate fundraising, and move resources across geographically fragmented spaces.

This Insight argues that extremist propaganda ecosystems function as trust infrastructures that enable decentralised terrorist financing systems to operate outside formal financial institutions. If propaganda ecosystems generate the trust required for decentralised financial coordination, then disrupting these trust nodes may offer earlier intervention points than traditional transaction-level counter-terrorist financing measures.

The Role of Trust in Institutional and Extremist Financial Systems

Across economic theory, there is broad agreement that financial systems depend on trust. Whereas formal financial systems rely on institutional trust generated by legal frameworks and regulatory institutions that govern banks and financial intermediaries, extremist networks are formally excluded from these channels. This exclusion has forced terrorist groups to build parallel systems that generate trust, enabling the financial coordination required to sustain operations—beginning with propaganda ecosystems.

From a financial perspective, these trust-generating ecosystems enable groups to solicit funds directly while identifying supporters with fundraising potential or financial expertise. At the same time, the rapid expansion of financial technologies—including cryptocurrencies and other fintech tools—has reduced the friction associated with transferring funds across informal networks, allowing extremist actors to mobilise financial resources more rapidly across geographically dispersed stakeholders. Finally, the shared narratives and reputational trust generated within these propaganda ecosystems allow larger organisations to both co-opt local militant groups with independent revenue streams and coordinate financially across otherwise fragmented networks.

To these ends, extremists leverage network-based trust as a substitute for formal institutional trust, enabling financial coordination across informal systems.

Case Studies: Propaganda-Enabled Financial Systems

The following cases illustrate how extremist propaganda ecosystems have contributed to the rise of parallel financial infrastructures used by terrorist groups. While these examples are limited to IS- and AQ-affiliated groups, they are not exhaustive.

Islamic State: Global Financial Facilitation Networks

Although IS affiliates lost the vast majority of their territorial holdings and operational revenue between 2014 and 2019, the broader global organisation has remained resilient in large part due to the continued dissemination of online propaganda. Safe havens such as Afghanistan allowed the organisation’s most active branch—the Islamic State Khorasan Province (ISKP)—to produce and distribute videos, press releases, and its monthly magazine The Voice of Khorasan across platforms including Telegram, Rocket.Chat, Instagram, Facebook, X, and Pinterest.

Beyond ideological messaging, these propaganda ecosystems play a critical role in generating trust across geographically dispersed supporters and operatives. Repeated messaging, shared narratives, and reputational signalling help establish a sense of authenticity and legitimacy within the network. In the absence of formal financial institutions, this reputational infrastructure reduces uncertainty about potential intermediaries and collaborators across geographically vast networks.

With these trust networks in place, the Islamic State organisation has been able to construct sophisticated cross-border financial systems that sustain its global operations. Many of these financial activities were centred in the Cal Miskaad mountain range of Puntland, Somalia, where the group’s al-Karrar office coordinated fundraising and financial transfers across Africa and Asia before a 2025 series of U.S. airstrikes and local military operations disrupted the hub. Arrests of financial operatives in Europe and the United States suggest elements of this architecture were already operating across multiple jurisdictions, suggesting a move toward a more decentralised model of interconnected trust nodes.

Islamic State propaganda ecosystems support these parallel financial systems in three primary ways. The first is direct fundraising, with outlets such as The Voice of Khorasan and individual operatives soliciting donations directly from supporters, often through QR codes linked to cryptocurrency transfers. Because these appeals circulate within trusted propaganda communities, potential donors face fewer informational barriers when deciding whether to contribute. Evidence shows that financial and propaganda roles intertwine: for example, French police arrested a man in November 2025 in relation to financing and disseminating propaganda for the ISKP.

The second function is coordination and network formation. Cryptocurrency transfers and hawala transactions are frequently arranged through encrypted messaging platforms such as WhatsApp by operatives who likely initially connected through propaganda communities on other social media platforms. In this sense, propaganda ecosystems act as authenticators, helping participants identify trusted intermediaries and facilitating financial coordination across dispersed networks.

The third function is integration, with the broader organisation inspiring local jihadist groups with independent revenue streams to join and contribute. Examples include the Islamic State Southeast Asia Province (ISEAP) in the Philippines and Islamic State–Mozambique, both of which operate locally embedded revenue systems while maintaining ties to the broader Islamic State network. In such cases, joining broader financial networks allows these groups to receive funds to expand their attacks or revenue generation, and contribute back to the larger organisation.

Figure 1: Image from the ISKP’s Voice of Khorasan magazine soliciting crypto donations in Monero

Al-Qaeda: Legitimacy, Trust, and Decentralised Finance

Al-Qaeda’s (AQ) global propaganda ecosystem provides the ideological legitimacy and reputational signalling necessary to sustain parallel financial systems across geographically dispersed affiliates. Unlike the Islamic State’s more centralised attempts to coordinate global operations, AQ’s model relies heavily on regional trust nodes that maintain operational autonomy while benefiting from the broader legitimacy of the organisational banner and its propaganda channels. This structure allows locally embedded militant groups to generate revenue independently while remaining integrated into a wider transnational network.

Jama’at Nusrat al-Islam wal-Muslimin (JNIM), an AQ affiliate formed in 2017 through the consolidation of several militant factions operating across the Sahel, illustrates how this model co-opts disparate groups with multiple revenue streams under a parallel financial system. JNIM operates a patchwork of revenue-generating activities tied to illicit timber extraction, artisanal gold smuggling, cattle rustling, taxation of local populations, and narcotics trafficking.

These revenue streams are largely decentralised and embedded in local economies. However, the broader al-Qaeda narrative ecosystem provides legitimacy and cohesion across geographically dispersed factions, allowing multiple militant groups and revenue systems to operate under a shared organisational framework that enables its expansion as a single entity. This combination of propaganda-based legitimacy and locally embedded revenue streams has contributed to JNIM’s rapid expansion across the Sahel.

Open-source evidence demonstrates decentralised revenue generation under a shared JNIM/al-Qaeda framework. Rather than relying on a centralised treasury, these networks operate through a distributed network anchored by the broader al-Qaeda propaganda ecosystem. Through shared narratives, ideological legitimacy, and reputational signalling, this propaganda infrastructure allows geographically dispersed factions to generate and deploy revenue locally while remaining integrated within a wider militant network under the direction of key trust nodes.

JNIM’s decentralised structure resembles the model employed by the Italian ’Ndrangheta criminal network, in which semi-autonomous local groups generate large-scale revenue independently while remaining connected through shared structures rather than centralised financial control – allowing them to largely evade global enforcement for decades. While the scale of JNIM’s finances is far smaller, the comparison highlights how decentralised networks built on trusted intermediaries can sustain resilient financial ecosystems without centralised treasury structures.

A more centralised version of this model can be observed in Somalia through al-Shabaab (AS), which joined AQ in 2012 and generates approximately US $100 million in annual revenue, making it the wealthiest affiliate in the AQ network. AS has developed a structured financial system built around taxation, illicit charcoal trading, diaspora remittances, and intermediaries operating in Gulf financial corridors, East Africa, and Iran.

Despite stronger internal governance than many AQ affiliates, AS’s financial resilience still depends on trust networks reinforced through propaganda and reputational legitimacy. These networks facilitate revenue generation – particularly through diaspora remittances – while evidence also indicates AS reinvests a portion of proceeds into propaganda dissemination. In effect, propaganda functions not only as a communication tool but as a financial infrastructure, sustaining trust, reinforcing legitimacy, and enabling continued resource mobilisation across the broader AQ ecosystem.

Figure 3: AQ-aligned JNIM (red) has expanded rapidly since its 2017 formation, controlling more territory in the Sahel than all other militant groups in the region combined.

The Role of Propaganda-Based Trust in Parallel Financial Systems

Across these cases, propaganda ecosystems function as reputational infrastructures that allow decentralised financial systems to operate beyond formal institutions. While windfall events such as ransom payments or major criminal operations can produce large short-term inflows, these funds likely disperse rapidly due to corruption, competition, and operational fragmentation. By contrast, trust-based financial systems built around propaganda-generated legitimacy rely on repeated small transactions and trusted intermediaries. Although these flows may be lower in individual transaction volume, they often produce greater long-term financial resilience by sustaining continuous revenue streams across distributed networks. In these systems, propaganda does not merely support recruitment or ideological messaging; it also provides the reputational infrastructure that enables financial coordination across decentralised trust nodes.

That these groups’ propaganda frequently emulates the visual and stylistic conventions of mainstream media – videos with news-style watermarks and tickers, press releases, and glossy magazines – is not coincidental. Just as news organisations and commercial brands use such formats to signal legitimacy, extremist organisations deploy them to generate reputational trust among dispersed audiences. These audiences, in turn, form trust nodes that link media channels, influencers, and intermediaries, validating financial flows and enabling coordination across decentralised networks.

Figure 4: Proposed typology breakdown of trust node categories across IS and AQ propaganda ecosystems/financial networks.

Implications for Counter-Terrorist Financing: Targeting Trust Nodes

Current counter-terrorist financing strategies focus primarily on transaction-level disruption, including sanctions, asset freezes, blockchain tracing, and financial surveillance. While these approaches remain essential, they largely target late-stage financial activity after financial coordination has already occurred. The deeper structural vulnerability in many extremist financial systems may lie earlier in the lifecycle of these networks—within the trust relationships that enable decentralised actors to coordinate financial activity across dispersed environments.

Viewed through this lens, propaganda ecosystems function not only as ideological or recruitment platforms but also as trust infrastructures that authenticate intermediaries and enable financial coordination. Within these ecosystems, certain actors, channels, or accounts serve as trust nodes—points within the network that signal legitimacy, validate intermediaries, and facilitate coordination among otherwise disconnected participants. Recent assessments by the Financial Action Task Force (FATF) reinforce this dynamic, noting that groups such as ISKP increasingly embed crowdfunding appeals directly within propaganda ecosystems, including encrypted messaging channels targeting diaspora communities.

Recent research also highlights how emerging financial technologies are reshaping the landscape of terrorist financing. Digital assets, encrypted messaging platforms, and decentralised payment rails have created parallel financial infrastructures operating largely outside traditional regulatory oversight. Artificial intelligence tools are increasingly capable of clustering cryptocurrency wallets, identifying laundering typologies, and mapping financial networks that span multiple platforms and jurisdictions. Rather than simply tracing individual transactions, these technologies allow investigators to analyse financial ecosystems as interconnected systems of intermediaries and facilitators.

Amid the emergence of vast illicit financial service ecosystems—as highlighted in a February 2026 FATF report—the longer-term risk may lie in the convergence of decentralised extremist financial networks with these larger criminal service economies, underscoring the need to disrupt the trust infrastructures that sustain them earlier.

When combined with analysis of extremist propaganda ecosystems, AI-enhanced tracing and mapping capabilities may help investigators identify the trust nodes that anchor decentralised financial networks. Wallet addresses, donation links, and financial intermediaries that circulate repeatedly within propaganda communities can serve as indicators of trusted actors within these ecosystems. By linking online behavioural signals with blockchain analytics and financial intelligence, investigators may be able to map the financial networks that emerge from these trust nodes.

This perspective suggests an opportunity for greater collaboration between platforms and national financial intelligence units (FIUs), and financial intelligence tools like blockchain analytics. Social media platforms and messaging services are often the earliest environments where trust nodes emerge, as accounts that repeatedly disseminate propaganda, authenticate intermediaries, or promote fundraising campaigns gain reputational legitimacy within extremist ecosystems. Rather than focusing solely on content removal, platforms could prioritise identifying accounts and channels that function as trust nodes and sharing associated financial indicators—such as wallet addresses, donation links, or payment identifiers—with relevant investigative bodies.

Investigators and researchers may therefore benefit from prioritising several analytical questions:

• Where are the trust nodes within extremist propaganda ecosystems?

• Which actors authenticate financial intermediaries within these networks?

• And how do trusted propaganda channels enable decentralised financial coordination across geographically dispersed actors?

Integrating insights from propaganda analysis, platform data, and financial intelligence may allow investigators to map financial networks emerging from these trust nodes and identify earlier intervention points within decentralised extremist financing systems.

Image source

On October 10, 2024, Toronto-Dominion (TD) Bank agreed to pay approximately US $3.09 billion to U.S. regulators – the single largest penalty ever imposed under the Bank Secrecy Act (BSA). The financial consequences extended beyond the headline figure: compliance overhauls, independent monitors, legal expenses, and operational restrictions materially affected the bank’s U.S. business. Senior executives departed, compensation was reduced, and branch-level employees now face criminal charges.

According to the U.S. Department of Justice, between January 2018 and April 2024, TD’s transaction monitoring program failed to review approximately 92% of its transactions — representing activity collectively valued at more than $18 trillion. Within that same period, three criminal networks with ties to drug trafficking organizations transferred over $670 million in illicit funds through TD accounts.

But the magnitude of the penalty — and its ramifications for TD and the broader banking sector — underscores something more unsettling. If criminal networks were able to move over half a billion dollars through a major financial institution over multiple years – despite the presence of formal monitoring systems – the underlying laundering infrastructure was not opportunistic. It was operationally mature.

While the TD case represents a particularly egregious breach of a major financial institution by bad actors, the vast demand to enter these systems by an expanding global criminal services market makes it a powerful warning of the dangers posed by a lack of action amid a global surge in parallel financial activity.

Investigation and findings

Federal authorities began investigating cartel-linked laundering activity in the New York tri-state area in the early 2020s. In one instance, agents reportedly tailed a box truck transporting bags of bulk cash that were deposited across multiple bank branches, with TD locations featuring prominently. The ringleader of these activities was Da Ying (“David”) Sze, a Chinese-born resident of Queens, New York. According to court filings, Sze’s network laundered approximately $653 million, roughly $470 million of which moved through TD Bank. A subsequent congressional report noted the network moved funds to thousands of individuals and entities across the United States, China, Hong Kong, and other jurisdictions.

Read more

Image from a previous police raid on Deutsche Bank that occurred in 2018

On January 28, German police prosecutors raided the Berlin and Frankfurt offices of Deutsche Bank, the largest financial institution in the country. The surprise raid came just one day before the company was set to release its 2025 earnings report, causing share prices to immediately plummet by around 3%. At least 30 plainclothes investigators entered the offices around 10am local time, targeting a “yet unknown” number of employees. According to prosecutors, their investigation surrounds companies suspected of money laundering on behalf of entities tied to sanctioned Russian oligarch, Roman Abramovich.

This raid is illustrative of a much broader trend.

The last few years have delivered a steady slew of headlines about major law enforcement actions against banks suspected of money laundering and falling prey to criminal influence. Last year, the U.S. Treasury made the unprecedented move of sanctioning three Mexican banks as a primary money laundering concerns in connection with opioid trafficking. In 2024, Canada’s TD Bank agreed to pay a record $3 billion in fines in connection with money laundering for the Sinaloa and other Mexican drug cartels; Canada’ FINTRAC imposed nearly $10 million in additional fines against the bank. Crypto exchanges are at the front lines of such punitive measures, with Binance agreeing to pay a $4.3 billion in fines and restitution in a 2023 deal with US regulators enforcement. Last year, FINTRAC imposed a record $177 million in fines against crypto exchange Xeltox in connection with darknet markets, child abuse, fraud, and ransomware.

These are not compliance failures, but failures of perception. Institutions are operating with risk models built for a world in which illicit finance was episodic, traceable, and external to core liquidity systems. That world no longer exists.

While laundering techniques evolve incrementally, detection regimes evolve retroactively. Capital that clears today under acceptable assumptions is increasingly reclassified tomorrow as sanctionable, tainted, or facilitative. Institutions that do not adapt in advance are not merely exposed — they are accumulating latent enforcement risk they cannot unwind. Evidence suggests the consequences are increasingly unaffordable, prompting the need for proactive measures.

Shwe Kokko, Myanmar: built in a civil war and financed through Chinese state investment, the multi-billion-dollar militant-backed city now serves as a notorious hub for cyber scammers.

Parallel financial infrastructures

Massive, parallel liquidity architectures now operate alongside regulated global financial markets. These systems emerged to serve actors excluded from the formal financial system and have proliferated amid rapid fintech innovation, tightening sanctions regimes, and rising geopolitical polarization.

Read more

Part I:

Part II:

This piece is more technical than much of my prior work. It is intended as a conceptual and analytical framework rather than a narrative essay, and is written for readers interested in understanding the structural mechanics of unregulated capital flows and their downstream security implications.

I am publishing it in the belief that clearer analytical tools are necessary if institutions are to anticipate and disrupt emerging threats more effectively. Readers who find this work useful, or who are working on related problems, are welcome to contact me directly at info@btl-research.com.

In work published over the past several months, I have emphasized that unregulated capital flows I term “shadow liquidity” consistently manifest as powerful downstream threats. Whether terrorist groups in Sub-Saharan Africa leveraging illicit networks to smuggle resources and procure weapons, or scam centers and drug cartels exploiting complex liquidity architectures, the global shadow financial ecosystem has become markedly more dangerous.

I developed a three-tier framework to explain how these parallel financial architectures operate and why they generate persistent downstream harm. Tier 2 consists of a vast layer of globally connected financial intermediaries that move value outside formal legal and regulatory oversight. Tier 3 sits downstream of these flows and includes criminal organizations, militant groups, and terrorist networks that exploit Tier 2 infrastructure to finance operations and project predation and violence.

Tier 1 is where the threat ultimately originates. At this level, large pools of wealth—often held by corrupt officials, politically exposed persons, and other elites in tightly controlled capital markets—seek to externalize assets to safer jurisdictions. This demand for offshore mobility creates the economic foundation for Tier 2 networks, which are then leveraged by Tier 3 actors, with or without direct state involvement.

These dynamics likely involve hundreds of billions of dollars annually, much of which fuels instability, entrenches criminal economies, and contributes to the impoverishment and coercion of millions of people worldwide. In recent work for the New Lines Institute, I documented how militarized scam syndicates in Southeast Asia and Latin American drug cartels (Tier 3) tap into Tier 2 infrastructure that moves billions of dollars annually in response to Tier 1 demand originating in the tightly controlled Chinese capital market. My most recent work for Between the Lines shows how Iran leverages a similar three-tiered structure to finance its proxy networks and externalize elite wealth.

Each of these systems is inherently destabilizing, not only for downstream societies targeted by criminal and militant activity, but also for the states at the origin point, where capital flight erodes economic resilience and governance over time. For this reason, understanding the origin of unregulated capital flows at Tier 1 is imperative for global security.

The three-tier framework illustrates how unregulated capital flight and its facilitators at Tier 1 and Tier 2 translate into downstream criminal and militant threats at Tier 3.

Read more

Protests have erupted across multiple Iranian cities, with demonstrators chanting “death to the dictator.” Such unrest is not new: major waves occurred in 2009, 2017–2018, and 2022–2023. What appears different in the current cycle is its socioeconomic base. Reporting suggests mobilization began in poorer and working-class communities that have historically provided key regime support, before extending into more familiar youth dissident ranks. This pattern points to economic stress as the primary catalyst for the current wave of unrest.

Iran’s economic deterioration has sharpened the underlying drivers of these ongoing protests. Inflation and currency depreciation have eroded purchasing power, while chronic underinvestment has compounded basic-service failures, including acute water stress. With limited fiscal room to stabilize living conditions at scale, the state has increasingly relied on coercive containment—reinforcing incentives for households and elites alike to externalize wealth.

Iran’s accelerating economic crisis is not solely the product of sanctions or mismanagement. It is increasingly driven by capital flight embedded within the same networks initially developed to foster state resilience—networks that now operate beyond effective control. Under pressure, opaque networks built for sanctions resilience and regional power projection now function as conduits for capital flight.

Read more

This article was published in conjunction with the New Lines Institute. You can find the original link here.

Chinese money-laundering networks (CMLNs) have quietly become the financial engine of Latin America’s drug cartels. What once appeared as isolated headlines – Chinese gambling junkets washing millions through U.S. casinos, luxury real-estate loops, suspicious bulk cash deposits at West Coast banks – now forms a single system linking Chinese capital flight to cartel profit cycles.

Regulators continue to grapple with the scale. In late 2024, the U.S. Treasury’s Financial Crimes Enforcement Network (FinCEN) issued a record $3 billion penalty against TD Bank for failures tied to cartel-linked laundering. Less than a year later, in August 2025, FinCEN followed with a national advisory flagging $312 billion in suspected CMLN-related transactions tied to Mexican cartels between 2020 and 2024 – a figure that suggests the headlines are only the surface of a much deeper architecture.

Cartel money laundering through Chinese networks is not an isolated phenomenon. While public attention often centers on downstream effects of cartel operations such as violence and addiction, these impacts are structurally enabled by China’s internal demand to move capital offshore – a demand amplified by digital technologies that now move value faster than any regulatory system can track. The same financial and political dynamics driving Chinese elites to expatriate wealth have also produced the infrastructure powering Southeast Asia’s scam compounds, regional insurgencies, and a shadow digital economy that increasingly behaves like a self-reinforcing network. Taken together, China’s internal financial pressures have produced a shadow liquidity architecture that connects its domestic financial instability to the expansion of criminal and insurgent activity worldwide.

In the Americas, that architecture has taken on a new shape, giving Mexican cartels access to Chinese capital-outflow mechanisms perfectly adapted to their needs. These mechanisms provide criminal groups the means to expand their operations and legitimize illicit gains by tapping into the financial reach of the world’s second-largest economy. From fentanyl precursors and pill presses to consumer goods sold through semilegitimate front companies, China’s industrial machine empowers the criminal-paramilitary networks driving insecurity and mass violence across much of the Americas. Meanwhile, CMLNs legitimize the profits of a multibillion-dollar addiction problem in a way that contributes to inflated prices in an increasingly unaffordable housing market.

The result is a shared financial ecosystem linking capital flight from China to fentanyl profits on either side of the U.S.-Mexican border. It is a convergence that transforms a domestic Chinese financial problem into a global security threat with the potential to upend the traditional power structure behind the North American drug trade, putting globalized CMLNs at its center. Traditional enforcement models were not designed to address this level of complexity, forcing the emergence of a new generation artificial intelligence and machine learning-enabled tools to combat global illicit finance. With criminal actors evolving in parallel, the world is entering a technological contest between shadow capital and the institutions charged with constraining it.

The Liquidity Cascade

CMLNs transform bulk U.S. dollars from narcotics sales into both onshore renminbi purchasing power in China and offshore dollar liquidity for Chinese clients seeking capital flight. Through shadow banking, mirror swaps, crypto-settlement, and cash laundering businesses, these networks have created a financial architecture that allows cartel proceeds to fuse seamlessly into China’s capital-flight mechanisms. What appears from the outside as cartel money laundering is, in reality, the downstream face of a much larger imbalance: the accelerating pressure among Chinese elites to move wealth beyond the reach of domestic controls.

Advances in digital technology underpin this new paradigm: a parallel architecture that operates independently of the SWIFT financial payments system, formal banks, or Western oversight. Mirror transfers (对敲 duìqiāo), over-the-counter cryptocurrency brokers, and gray-market crypto exchangers link Chinese elites, intermediaries, and transnational criminal syndicates into a single global liquidity ecosystem. Cartels have tapped into this infrastructure because it gives them what traditional laundering cannot: frictionless conversion, instant settlement, and access to the world’s largest industrial economy.

Mirror transfers are the primary way Chinese capital outflows are operationalized into cartel laundering infrastructure. The process works thusly:

• Cartels deposit bulk drug cash with Chinese brokers in the Americas, who launder the physical notes locally through cash-intensive businesses such as casinos and massage parlors. These funds pass between shell companies and nominee entities through multiple transactions that obscure their origin.

• U.S.-based brokers then pay Chinese clients in dollars and dollar-denominated assets using laundered funds, thus satisfying their need for offshore funds.

• Simultaneously, China-side brokers settle the other half of the swap by using renminbi pools – paid in by Chinese clients seeking capital flight – to generate export credits or payments for cartel-linked importers in Mexico.

In this arrangement, value moves, but no formal cross-border transfer ever occurs. Because the literature tends to isolate individual pieces, the full architecture is best understood through a three-tiered framework that traces how elite wealth in China becomes operational fuel for fentanyl networks in Mexico and the United States.

Tier 1: Capital Flight Reservoirs in China

The CMLN–cartel relationship begins inside China. For decades, the rise of the world’s largest property bubble created a demand for credit that state-owned banks could not satisfy, fueling the expansion of a vast, unregulated financial sector. At the same time, strict capital controls and political pressure drove elite Chinese households to move money offshore – a dynamic that intensified dramatically after the property bubble’s 2020 deflation. The convergence of these forces produced enormous capital flight pressure, creating vast renminbi pools among China’s underground financiers, waiting to be converted into offshore dollars – a domestic imbalance upon which the entire CMLN system rests.

In this way, Beijing’s failure to regulate its property market not only inflated the bubble but also facilitated the rise of a pervasive parallel financial system.

Tier 2 – CMLNs as Liquidity Infrastructure

Tier 2 is where China’s internal capital-flight pressures are transformed into a global facilitation system. CMLNs sit at the operational middle of mirror-transfer swaps, which allow value to move offshore without ever crossing a border. Operating out of hubs such as Los Angeles; Vancouver, British Columbia; and Mexico City, brokers rely on loosely connected networks of cash-intensive front businesses to launder cartel bulk currency and convert it into clean dollars. Their China-side counterparts in Tier 1 settle the mirrored leg of the transfer using renminbi accumulated from elites seeking to offshore wealth, bypassing both China’s formal banking system and SWIFT entirely. Brokers use laundered cash ATM deposits, and increasingly stablecoins and shell company real estate purchases, to make Chinese clients whole in offshore dollars – often with the help of Chinese students enrolled in Western universities working on behalf of family members and associates back home.

For cartels, the same mechanism delivers renminbi-denominated purchasing power inside China. Early iterations relied partly on gray-market daigou arbitrage – purchasing luxury goods in the United States and reselling them inside China through informal retail channels – but this vector has been constrained by slowing demand and Beijing’s crackdowns to protect domestic consumption and control capital flows. Fortuitously for cartels, rising pressure among Chinese elites to move wealth offshore has created large renminbi reservoirs within the underground banking system, more than meeting the China-side obligations of the mirror-transfer process.

By servicing both Tier 1 Chinese clients and Tier 3 cartels, Tier 2 CMLNs collect enormous fees and have become the structural hinge of the entire system – the brokers who connect global criminal economies to the industrial and financial power of China.

Tier 3 – Cartels as End Users

Tier 3 is where cartels receive value from the system, not in renminbi itself but in the purchasing power it represents. By depositing bulk cash with Tier 2 brokers, cartels gain access to renminbi-denominated value inside China’s commercial ecosystem, allowing them to buy the inputs that scale their operations – fentanyl precursors and pill presses to resell in North America for dirty cash and electronics and other goods for clean liquidity. Trade-based money-laundering (TBML) pipelines and front companies provide the commercial cover that turns mirrored value into export credits and legitimate invoices. In effect, CMLNs give cartels a backdoor into China’s industrial economy, enabling them to convert drug proceeds into operational power, hard assets, and legitimacy that would otherwise be inaccessible.

Cartels are not the architects of this system, but they are destructive end users, empowered by a financial architecture built thousands of miles away and far beyond the reach of traditional enforcement.

Upstream Architecture vs. Downstream Effects

The choke point in this system is the CMLN operators at Tier 2 – brokers who convert, settle, and transport value across gray-market channels that long predate cartel involvement. North American banks and payment platforms are not willing participants; they are intrusion targets exploited through shell companies, falsified invoices, identity-laundering tactics, and mule accounts used to obfuscate the origin of illicit funds moving through them. Laundering occurs before funds interact with the formal financial system, which is why Tier 2 remains the operational center of gravity.

This is not the only global threat vector stemming from Chinese capital flight. Although the immediate focus here is the Americas, underground renminbi reservoirs in China anchor an entirely separate but structurally similar ecosystem across Southeast Asia’s scam compounds, gray-market gaming hubs, and illicit digital-finance corridors. There, too, a three-tiered cascade links onshore Chinese RMB pools to offshore facilitators and downstream criminal end users – a parallel architecture that mirrors the CMLN-cartel system. This broader pattern underscores the core point: China’s shadow-finance engine generates global liquidity structures whose downstream expressions differ by region but whose underlying mechanics remain consistent. These dynamics set the conditions for global threats to manifest.

Despite rising public attention on cartel violence and fentanyl overdoses, enforcement agencies and much of the media continue to misdiagnose the architecture behind cartel liquidity. Tier 2 CMLNs are still described as if they were auxiliary cartel partners or offshore laundering boutiques. In reality, they are the globalized expression of China’s internal financial disorder, and the cartels are simply the most dangerous beneficiaries of a system that predates them.

This misdiagnosis has consequences. Policy responses remain locked on downstream symptoms – bulk cash seizures, courier networks, transactions structured to evade reporting thresholds, front companies – while the upstream liquidity cascade stemming from inside China regenerates unabated. Each high-profile enforcement win removes a node, but not the system. The architecture adapts, reroutes, and strengthens, precisely because the underlying demand signal does not come from cartels at all.

Four factors become impossible to ignore:

• Chinese elites are the primary liquidity source, driving the demand for offshore dollars that fuels CMLN operations. Cartel cash is a convenient supply, not the engine of the system.

• Cartel integration is opportunistic, not foundational. Cartels inserted themselves into a pre-existing outflow network designed for capital flight, not criminal finance, because it is more efficient than legacy laundering methods.

• Cartels are downstream clients. CMLN infrastructure does more than launder cartel cash – it supplies the purchasing power that underpins their business model, giving them access to industrial-scale chemical precursors and equipment inside China. With these synthetic drugs now far more profitable than cocaine or cannabis produced in the Americas, this dynamic risks shifting the operational center of gravity toward CMLNs themselves, much as it once shifted from Colombian cartels as exporters to Mexican cartels as global distributors.

• Enforcement wins remain tactically impressive but strategically insufficient. Seizing accounts or shutting down front companies rarely touches the structural incentives that bind Chinese capital flight to cartel proceeds. The architecture is left intact, and the system improves through adaptation.

The strategic blind spot is not a lack of enforcement capacity. It is the persistent belief that cartel laundering is a cartel-led enterprise, when in fact the cartels are downstream actors plugged into an ecosystem shaped by a much larger set of financial pressures. Until policymakers treat CMLNs as part of a global capital-flight infrastructure – not a narco-adjacent novelty – the enduring three-tiered cascade will continue to reproduce itself faster than it can be disrupted.

Strategic Implications

What emerges from this architecture is not a cartel-finance anomaly but another iteration of an emerging global liquidity order. An interconnected and globalized ecosystem of tech-enabled shadow banks, cryptocurrency intermediaries, and laundering networks – operating across mainland China, Hong Kong, and the Americas – now functions as an informal central bank for illicit and gray-market capital. Their balance sheets are vast, opaque, and fed by the constant demand for offshore dollars among wealthy elites under tight capital controls.

China’s domestic weakness is the system’s strength. As long as elite capital-flight pressures persist, CMLNs will remain stable, adaptive, and indispensable. Because renminbi pools inside China feed multiple downstream economies – militant-backed scam compounds in Southeast Asia and militarized drug cartels in the Americas – the threat becomes increasingly globalized.

For Beijing, CMLN mirror transfers represent a deeply problematic, structurally persistent, and critically under examined vector of capital flight. Although renminbi never formally leaves the country, the value of that money exits China through offshore dollar pools controlled by brokers. Exporters are paid in renminbi with no dollars entering the Chinese banking system, depriving the state of foreign-currency inflows and undermining capital-control integrity. The result is a silent erosion of China’s foreign exchange management architecture – a slow hollowing-out effect similar to other forms of elite capital exfiltration, but with even higher opacity and fewer policy levers available for Beijing to control.

For North America, the implications are severe. CMLNs form the financial spine of a system that channels cartel drug proceeds into the offshore renminbi pools used by Chinese elites seeking dollar access. This fusion of cartel cash and capital-flight demand pushes billions of dollars into Western real estate, luxury assets, and private-market vehicles – particularly in Canada and key U.S. cities – at a time of record unaffordability. The same liquidity architecture that fuels fentanyl-linked deaths in the United States and Canada, and enables escalating cartel violence in Mexico, also accelerates opaque trans-Pacific capital inflows that distort markets and weaken financial governance.

For enforcement agencies, the asymmetry is structural. Downstream interventions, no matter how aggressive, cannot meaningfully disrupt a system whose incentives are upstream and whose architecture is distributed. The persistent enforcement gap is not a failure of policing but a failure of framing: the problem is liquidity infrastructure, not individual criminal actors.

Moving Beyond Human Enforcement Capacity

Technology has rewritten the physics of money. What once required suitcases, offshore accounts, and months of coordination can now move through encrypted chats, offshore OTC desks, and digital payment platforms in minutes. Liquidity has slipped out of state control and into networks never meant to wield it, producing a technologically accelerated destabilization that can only be countered with tools operating on the same scale.

Criminal actors grasped this new paradigm before policymakers could react. Bulk cash, once a liability, can now be converted into purchasing power inside China through networks that merge capital flight with cartel liquidity needs. What appears to be a laundering service is, in fact, shared financial infrastructure.

Chinese money-laundering networks sit at the center of that infrastructure. They are not peripheral fixers but the architecture linking China’s internal financial pressures to the expansion of cartel power. They endure because the incentives that produced them remain intact, and because enforcement continues to target the edges rather than the structure itself.

At the structure’s core is liquidity. The ability to move value faster than states can detect has become a force of sovereignty – determining who can project power, absorb shocks, outlast pressure, and operate within the blind spots of the global system. Cartels did not defeat states through ideology or insurgency, but by mastering liquidity, building a financial nervous system more adaptive than the one meant to contain them.

Until CMLNs are recognized not as peripheral laundering boutiques but as the infrastructure of a new liquidity order, the gap between state capacity and illicit capability will only widen. At this point, the limits of human enforcement become unavoidable. Task forces can seize cash, shutter front companies, and arrest intermediaries – but humans can only see snapshots of a system that evolves in real time. A liquidity network built on mirror swaps, diaspora brokers, synthetic trade chains, and offshore renminbi reservoirs cannot be mapped manually. Its architecture is too distributed, too adaptive, too fast.

The shift on the enforcement side has already begun. As recent analysis shows, blockchain-analytics firms and financial-intelligence units are quietly layering machine-learning models into their detection systems – clustering wallets, mapping laundering networks, and identifying anomalies across stablecoin flows, escrow logs, and commercial-invoice patterns. These are prototype architecture-level tools, the first enforcement systems designed not to chase criminals but to map the infrastructure that makes crime possible. The most advanced of these models already operates across jurisdictions and asset classes, revealing relationships that traditional investigative methods could never uncover.

Artificial intelligence is not an adjunct to enforcement; it is the first form of enforcement capable of operating upstream. Only systems that learn as quickly as the networks they track can identify the structure beneath the transactions – the neural architecture of shadow liquidity itself. In a world where liquidity behaves like a distributed neural network, enforcement will require its own neural network in response, guided by humans who can see the system at a structural level.

This is not futurism. It is the logical extension of the world we already inhabit. The liquidity order described above will not be disrupted by more seizures, more arrests, or more border checks. It will only be countered by humans wielding tools capable of recognizing the system for what it is: distributed, multilayered, resilient, and evolving faster than traditional governance can respond.

This is an article I recently wrote for The Diplomat with the help of Brett Erickson - who aided immensely in reaching out to and interviewing the AUSTRAC CEO Brendan Thomas. You can find the original link here.

Australia’s top financial-crime official has sounded the alarm on the worrying transformation of his country’s economy. Behind the rhetoric of fintech innovation lies an expanding shadow liquidity network linking Canberra’s financial sector to the grey market capital circuits of Asia and Latin America – a system now testing the limits of regulatory sovereignty itself.

What began as a permissive environment for digital experimentation has quietly evolved into a regional clearinghouse for unregulated money.

“Digital-currency transactions are major financial-crime risks in Australia,” said Brendan Thomas, chief executive of the Australian Transaction Reports and Analysis Centre (AUSTRAC). “We currently have around 450 digital-currency exchanges and a sector characterized by rapid growth and very poor AML [Anti-Money Laundering] compliance.”

Today, Australia has hundreds of registered digital-currency exchanges and crypto-related operators, many of which, regulators say, are at increasing risk of exploitation for money laundering, scams and fraud, offering the potential for large value flows between criminal syndicates, grey market actors, and legitimate institutions. Stablecoins and over-the-counter (OTC) desks offer frictionless dollar exposure to actors evading capital controls and sanctions, while trade-based laundering networks now tie Sydney and Melbourne directly to illicit and semi-licit actors across Latin America, Hong Kong, and Southeast Asia.

This architecture hides in plain sight. Crypto exchanges double as proxy banks for offshore wealth; illicit proceeds from online fraud and cartel operations mingle with speculative inflows; and regulators struggle to distinguish legitimate liquidity from laundered funds. What appears to be fragmented compliance failure is, in fact, the emergence of a parallel financial infrastructure – one eroding the boundary between licit and illicit capital and exposing Australia to systemic risk on a global scale.

The evidence of that erosion is already visible. The same digital corridors that once promised innovation now facilitate narcotics finance, illicit tobacco syndicates, and Southeast Asian scam networks. In the space of a decade, the promise of frictionless money has matured into something far more consequential: a liquidity system powerful enough to reorder economies, and elusive enough to escape the laws meant to govern it.

Drugs, Cigarettes, and Digital Liquidity

Australia is more flush with illicit substances than ever before. A recent study by the Australian Criminal Intelligence Commission (ACIC) found that Australians consumed over 22 tonnes of methamphetamine, cocaine, and MDMA between August 2023 and August 2024, up 34 percent compared to the previous year’s findings. These drugs had an estimated combined street value of US$7.5 billion – making Australia a high-value market for global drug cartels. Meanwhile, Australia’s record high tobacco excise has created an unprecedented surge in demand for underground alternatives, with industry data finding that illegal tobacco sales account for 64 percent of total consumption and 82 percent of total nicotine use.

Mexico’s Sinaloa and Jalisco New Generation (CJNG) cartels have become central suppliers in this ecosystem, embedding themselves through high-volume methamphetamine and cocaine routes that link Latin American production hubs to Australia’s premium end-market.

“Australians pay quite high prices globally for drugs… there is an increasing cocaine problem, especially in Sydney. This indicates significant supply links with cartels in South America, possibly linked through Asian-based money-laundering organizations,” said Thomas.

Indeed, significant overlap exists between cartel operations and entrenched Chinese and Southeast Asian syndicates that dominate the region’s chemical precursors, laundering networks, and scam-derived liquidity – suggesting that cartel drug profits blend with these systems before being injected into Australia’s capital markets at “clean” investments. AUSTRAC has previously noted how laundered funds often intersect with Australia’s high value property market, contributing to unaffordable prices for citizens across the country.

These growing illicit trades have facilitated the rise of an illegitimate financial ecosystem to service them.

“The narcotics and underground tobacco trades trade are the largest drivers of illicit finance in this country,” said Thomas. He also noted that important role digital currencies play in this financial system. “We have a (digital currency) market that isn’t regulated prudentially and therefore exposed to significant risk,” he added.

Thomas also noted that these illicit trades are not distinct criminal issues, but symptomatic of a maturing underground financial system.

“We believe the illicit tobacco and narcotics markets are controlled by the same entities,” he said.

Recent cases already show how digital currencies underpin the same financial circuits that move narcotics and illicit tobacco profits in Australia. In August 2021, Victoria Police seized AU$8.5 million in cryptocurrency from an online drug syndicate — the largest crypto-asset seizure in Australian history at the time — while AUSTRAC later documented a 2022 conviction in which an offender used cryptocurrency to purchase, import, and resell illicit drugs via dark-web markets.

What emerges is a hybrid criminal order: a system in which Latin American supply chains, Asian liquidity networks, and Australian demand converge into a single adaptive organism that mirrors the complexity of the licit economy while feeding off its infrastructure. Illicit proceeds move through offshore businesses and digital corridors before re-entering legitimate markets as investment capital. These convergent flows inflate asset prices — from property to logistics – and distort trade data once seen as reliable economic indicators.

The boundary between organized crime and legitimate enterprise is dissolving. What appears to be foreign investment may conceal criminal liquidity seeking legitimacy – embedding transnational finance and organized crime within the same bloodstream of the Australian economy.

This financial metabolism doesn’t end with narcotics. The same infrastructure now powers the region’s fastest-growing criminal enterprise: Southeast Asian scam centers.

On Australia’s Doorstep: Scam Centers and Massive Capital Outflows

Australia stands at the geographic doorstep of one of the world’s most pressing financial and humanitarian disasters: the vast Southeast Asian scam-industrial complex. As detailed in Rousselle’s recent article for The New Lines Institute, these compounds form part of a broader ecosystem primarily driven by Chinese organized crime – often state-linked – and built on capital outflows from China and neighboring economies. In countries such as Cambodia, Laos, Myanmar, and others, illicit and semi-licit funds are recycled through offshore financial hubs, cryptocurrencies, and digital payment infrastructure.

What began as a fringe phenomenon tied to telecom fraud and online gambling has evolved into a region-wide industry generating tens of billions of dollars annually, intertwined with human trafficking, narcotics proceeds, state-aligned shell corporations, and even armed militants and designated terror groups such as the Houthis.

Australia’s exposure to this ecosystem is twofold: as a lucrative victim market and as a destination for laundered funds. In 2024 alone, Australians reported nearly 495,000 scam incidents and losses exceeding AU$2 billion, according to the Australian National Anti-Scam Centre (NASC). These are not isolated acts of cybercrime but components of a regional financial system that drains consumer capital from high-income economies and reintroduces it into legitimate sectors via offshore layering and crypto-enabled laundering.

“We see crypto used as a source of major narcotic transaction and the source of much scam activity. The scam centers operating in South East Asia are also a major laundering risk for the Australian economy,” Thomas observed.

Australia’s role in this shadow network extends beyond consumer losses. The same digital corridors that move narcotics profits and scam proceeds now intersect with domestic financial infrastructure. As Thomas warned, “These illicit funds are entering the legitimate economy in a number of places and we need coordinated effort to shut that out. We also need coordination to stop the flow of recruitment of people into these centers and block their labor supply – targeting those human trafficking networks would be of great benefit.”

The nexus between financial exploitation and forced labor underscores the human cost of this liquidity system: victims in Australia are connected, through layers of deception and capital transfer, to victims across Southeast Asia whose exploitation sustains the machinery of fraud.

From Cambodia’s scam compounds to Australia’s financial sector, the circuit is closed by liquidity – money stripped of origin, nationality, and moral judgement. What appears as digital crime at the consumer level is, in practice, an extension of the same transnational financial order that Rousselle described: a shadow ecosystem born of unchecked capital outflows, institutional capture, and the global failure to distinguish dirty liquidity from economic vitality.

Coordination, Capacity, and the Enforcement Gap

Australia’s current regulatory architecture was built for an earlier generation of financial crime. The country’s first AML/CTF framework – Tranche 1, enacted under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 and implemented in 2007 – was revolutionary at the time. It brought banks, remitters, casinos, and bullion dealers under AUSTRAC’s supervision, embedding risk-based compliance into the financial sector.

Yet nearly two decades later, that framework has atrophied. Successive governments have failed to deliver the long-promised Tranche 2 reforms that would extend AML/CTF obligations to lawyers, accountants, real-estate agents, and company service providers. These extensions are essential: although digital assets such as cryptocurrencies have been regulated since 2018, the professional intermediaries who help conceal these flows remain largely outside enforcement. Tranche 2 is designed to close that gap, but years of delay have allowed those channels to become the principal on-ramps for illicit digital capital.

The rollout of Tranche 2 — which would bring these professional facilitators under the AML/CTF compliance regime — has been repeatedly delayed amid prolonged consultation and industry resistance, creating structural blind spots that now serve as conduits for illicit liquidity. The result is a bifurcated system: highly regulated financial institutions on one side, and semi-formal professional networks on the other, precisely the spaces through which scam proceeds, narcotics profits, and offshore capital outflows can be re-routed into legitimate assets.

The current regulatory gap will not close until July 2026, when Tranche 2 entities are scheduled to come under full compliance. Until then, most are only beginning to familiarize themselves with their new AML/CTF obligations.

As Thomas noted, “They are understanding the law and their legal obligations but still don’t properly understand money laundering – how people actually do it through law firms and accounting practices in particular.”

AUSTRAC and partner agencies are now preparing extensive case studies to build that operational literacy, but the knowledge gap remains profound.

Australia’s enforcement landscape compounds the challenge. AUSTRAC, Australian Securities and Investment Commission (ASIC), the Australian Federal Police (AFP), and state police each bring essential capabilities to the country’s financial-crime architecture, yet their mandates often intersect across complex and rapidly evolving typologies. Coordination has improved through initiatives such as the Fintel Alliance, but information sharing remains largely case-driven rather than systemic. The protracted rollout of Tranche 2 represents a strategic vulnerability, leaving key professional channels open to exploitation in the meantime.

When the reforms finally take effect in mid-2026, they will bring long-excluded gatekeepers into the AML/CTF regime and expand the country’s capacity to trace illicit flows through professional channels that have so far escaped scrutiny. But timing is everything. Every month of delay allows shadow liquidity to entrench itself further within Australia’s legitimate economy, laundered through legal practices, escrow accounts, property holdings, and offshore intermediaries. The effectiveness of Tranche 2 will depend not only on its legislation, but on whether the institutions charged with enforcing it can move from static compliance to dynamic intelligence, matching the speed and adaptability of the networks they seek to contain.

Conclusion

Blockchain analytics and AI-assisted transaction mapping have stripped away much of the mystery that once surrounded digitized illicit finance. The problem is no longer invisibility but inertia. Regulators and enforcement agencies now possess unprecedented data on cross-border fund movements, stable-coin settlements, and the interlocking wallets and shell entities that sustain shadow liquidity. The question is whether they can move fast enough to act on it.

Other jurisdictions already are. Europe’s MiCA framework, Hong Kong’s virtual-asset licensing regime, and the proposed U.S. GENIUS Act each signal a shift from reactive compliance to proactive financial-infrastructure defense. By contrast, Australia’s reforms remain stalled between consultation papers and industry pushback. Every month of delay leaves the country more deeply embedded in the regional circuits of criminal capital that its own analytics can now trace in real time.

Australia’s challenge is therefore strategic, not technical. The data exist; the patterns are visible. What remains undecided is whether the nation will use its visibility to close the enforcement gap – or continue to serve as the Indo-Pacific’s liquidity sink and laundering hub for offshore criminal finance.

Primer: How This Piece Got Here

This essay has already lived a small life of its own.

Since July, it circulated through several major legacy outlets. Some passed quickly and professionally; others expressed enthusiasm, requested time-consuming revisions, and ultimately stepped back for reasons that were never fully articulated. The responses varied, but the pattern was clear: uncertainty around unfamiliar frameworks, discomfort with material that sits outside conventional editorial lanes, and a broader hesitancy to publish work that challenges inherited assumptions.

The experience reinforced something that is only now beginning to shift. As recently as this past summer, traditional media still treated illicit liquidity as a peripheral issue. But the field is finally catching up. The traction my newer work has gained—across policy, enforcement, and analytical circles—reflects a broader recognition that liquidity is central terrain, not an auxiliary concern. The industry is evolving, even if the legacy editorial machinery has been slower to recognize the shift.

This piece was written to explain that evolution—how illicit liquidity systems now outlast militaries, sanctions regimes, and enforcement architecture itself—and why understanding this shift is no longer optional. Its publication journey ended up mirroring its own thesis: frameworks built for a previous era often struggle to accommodate the realities of the present one.

Since writing it, I’ve expanded and refined many of the concepts it introduced, but this remains the originating document. I am publishing it here in the form it was meant to take—not diluted, not retrofitted to an older template, and not reshaped to fit the boundaries of legacy formats. If those outlets revisit this space later, they can. My readers don’t need them to recognize the stakes.

Below is the full piece, unchanged except for minor clarity edits—the version that wasn’t designed to make anyone comfortable, but to make the problem clear.

Read more

Image source

This is an article I recently published with the Jamestown Foundation China Brief Notes. It comes as a follow up to an article I wrote for China Brief last year, which was cited in a 2025 report by the U.S. Senate Foreign Relations Committee. You can find the link to the latest article here.

Executive Summary:

• Judicial cases in the Democratic Republic of the Congo and in Nigeria confirm that citizens from the People’s Republic of China (PRC) are active in both resource extraction and digital offshore laundering networks, connecting illicit resource economies and stablecoin settlement into value chains that sustain conflict.

• Gold, timber, and crypto flows move through the same corridors that carry PRC-manufactured weapons into embargoed zones. This integration creates a shadow liquidity system in which capital and material reinforce one another, allowing African militant economies to become self-financing and resilient to external pressure.

• Existing regimes treat arms diversion and money laundering as separate issues. They are not. Addressing this challenge requires collapsing the divide between arms embargo enforcement and financial crime intelligence into a single operational continuum.

The circulation of weapons manufactured in the People’s Republic of China (PRC) has become an increasingly visible feature of African conflicts. Earlier research by this author traced how Chinese small arms and light weapons appear in the hands of militant groups across the continent, often in ways that reveal the fragility of existing control mechanisms (China Brief, November 1, 2024; U.S. Senate, July 2025). That research underscored the scale of material leakage from licit trade into irregular markets. Since then, more evidence has come to light to suggest that the story does not end with the physical movement of arms.

Alongside weapons, Chinese illicit finance networks are spreading across Africa’s conflict zones and beyond. These networks have the capacity to enable militant actors to not only acquire weapons but also to sustain self-financing economies of violence and extraction. They tie the diversion of arms to capital flows that are deliberately routed through opaque offshore structures, informal value transfer systems, and state-aligned facilitators.

Illicit finance is not a peripheral concern. It is a structural enabler of militant economies and arms transfers. Understanding the fusion of financial and material supply chains is therefore essential for grasping how African conflicts are evolving, and how external actors shape them.

Chinese Criminals Embedded in Conflict Economies

In January, a court in Bukavu, a war-torn community in the eastern Democratic Republic of the Congo, handed down a rare and decisive judgment against three PRC nationals involved in illicit extractive activity. The defendants were convicted for operating illegal mining concessions and laundering proceeds through both cash and precious metals (South China Morning Post [SCMP], January 15). Authorities seized more than $400,000 in hard currency alongside a quantity of gold bars, establishing a direct evidentiary trail from resource extraction to illicit financial flows (Central News, January 16). Because this conviction was adjudicated in court, it created a judicially verified record of PRC actors engaging in illicit commerce within a conflict zone. The absence of PRC media coverage of this case is telling.

The defendants did not operate in a vacuum. The PRC maintains a visible commercial footprint across eastern Congo’s extractives economy, including Chinese-owned buying houses, traders, and small-scale gold operations in war-torn South Kivu (ECOFIN, December 30, 2024). PRC state media has even warned PRC nationals of the legal and security risks of doing such business in the war-torn region, explicitly mentioning mining activities (Xinhua; Consular Express WeChat Official Account, July 28). Congolese officials and local communities have repeatedly objected to illicit practices attributed to Chinese operators (ACP, November 15; Radio Okapi, August 8).

The Bukavu convictions confirm that Chinese illicit financiers are present inside eastern Congo’s conflict zones. A panel of UN experts reported to the press that minerals extracted from areas in eastern Congo controlled by the Congolese Rwandan-backed rebel paramilitary group M23 are being smuggled through Rwanda and Uganda before entering global markets (AfricaNews, January 10; Al-Jazeera, July 18). At the same time, M23 rebels have been documented with significant stocks of PRC-manufactured weapons and equipment, consistent with supply via their Rwandan and Ugandan backers (China Brief, November 1, 2024). The PRC is the world’s dominant processor of the ore coltan, gold, and other Congolese exports, and both Rwanda and Uganda ship far more of these minerals than they produce (Enact, May 3, 2022; Haitong, April 23, 2023; CASS West Asia and Africa Research Institute, March 2024; AllAfrica, December 18, 2024). Taken together, these facts make PRC end-use not speculative but structurally inevitable: illicit finance on the ground, smuggling through neighbors, and end-user demand in the PRC form a single chain that helps sustain this conflict economy.

These dynamics are not confined to eastern Congo. Across Africa, PRC nationals are embedded in commodity corridors that move value and provide logistics. In 2022, roughly 435 tonnes of gold were smuggled out of Africa, 93 percent of it bound for the United Arab Emirates (UAE), with PRC buyers active at both ends of the chain (SCMP, November 16, 2023; Swissaid, May 30, 2024; Africa Report, October 24, 2024). PRC-linked syndicates also dominate timber and rosewood exports from the Sahel, Central, and East Africa, often sourcing directly from insurgent-affected areas (African Development Bank, 2021). These gold and timber corridors easily provide the financial and logistical backbone for broader illicit trade, establishing flows of capital and transport capacity that could be redirected toward arms procurement or militant financing.

Chinese Criminals Laundering Crypto

In July, a federal court in Lagos, Nigeria ordered the forfeiture of approximately 223,000 Tether ($223,000)—the U.S. dollar-pegged stablecoin—from two PRC nationals convicted of fraud and money laundering (EFCC, July 21). The case was notable not only for the scale of the seizure but also for its judicial confirmation that PRC nationals were operating through crypto networks in Nigeria. It followed an earlier wave of enforcement in December 2024, when Nigeria’s Economic and Financial Crimes Commission (EFCC) carried out mass raids that led to the arrest of 792 suspects. Among those implicated were 148 PRC nationals accused of participating in coordinated crypto fraud and laundering schemes (Toutiao, April 27; African Mirror, December 19, 2024). Together, these cases establish a pattern of sustained involvement by PRC nationals in illicit digital finance across West Africa.

The pattern is clear: PRC illicit finance networks have embedded themselves into West African stablecoin rails. These rails enable frictionless cross-border settlement that can be directed toward extractive rents, arms procurement, or conventional fraud. Stablecoin rails in West Africa now provide the same frictionless settlement capacity increasingly favored by PRC-linked financiers in Southeast Asia (Sina Finance, May 26). In effect, stablecoins have become a structural enabler of transnational illicit finance tied to PRC nationals, providing cross-border transfer capacities beyond the reach of current regulatory controls.

Weapons Trafficking Completes the Supply Chain

In May, Amnesty International verified the presence of PRC-manufactured weapons in both Khartoum and Darfur, despite a standing United Nations arms embargo on Sudan. The investigation traced the weapons’ path through the UAE, confirming that PRC-manufactured weapons had been re-exported into an active conflict zone (Amnesty International, May 8; SCMP, May 9). The UAE—already identified as a primary destination for smuggled African gold and a key entrepôt for trafficked resources such as timber and wildlife—is now linked to weapons leakage into embargoed territories. A 2023 report by the PRC’s Ministry of Commerce (MOFCOM) highlights the country’s central role as a commodity logistics hub, while international investigations document its function as a distribution point for illicit flows ultimately bound for the PRC (The Sentry, February 2021; GITOC, December 2022; MOFCOM, 2023).

Extractive commodities and arms flows are not separate streams but parts of a single transnational infrastructural system. Gold and timber exports provide the financial base, often routed through opaque networks tied to PRC buyers. Stablecoin rails in West Africa supply frictionless cross-border digital settlement, as increasingly favored by PRC-linked illicit financiers in Southeast Asia (Sina Finance, May 26). The re-export of weapons through commodity hubs completes the circuit, bringing material support back into conflict zones. The convergence is the critical risk: financial, logistical, and military flows run along the same corridors, reinforcing each other and expanding the resilience of militant economies.

This configuration functions as a shadow liquidity system. Value extracted from African resources is continuously re-expressed as kinetic capability, ensuring that liquidity itself becomes a weaponized asset class. Each transaction in this system, whether a gold shipment, stablecoin transfer, or weapons re-export, amplifies the others, producing a feedback loop that stabilizes illicit power structures where governance fails.

Conclusion

The evidence now available establishes that the illicit involvement of PRC nationals in African conflict economies is neither incidental nor peripheral. Judicial convictions in Bukavu and Lagos confirm the presence of criminal actors from the PRC engaged in both extractive laundering and stablecoin-based fraud, while reporting from Sudan illustrates how weapons manufactured in the PRC reappear in embargoed theaters.

These cases reveal a common pattern. Illicit finance and logistics linked to PRC nationals run through the same corridors that sustain militant supply chains. Gold, timber, digital assets, and arms move along overlapping routes, creating a resilient system in which capital and material flows reinforce one another.

Recognizing this convergence is essential. The challenge is not simply weapons leakage or financial opacity in isolation but the way disparate supply chains combine to strengthen insurgent and criminal economies. PRC end-user demand and facilitation give the system scale and durability, tying local extraction and digital laundering directly to global markets. Addressing this challenge requires collapsing the divide between arms embargo enforcement and financial crime intelligence; and treating both as elements of one integrated system.

This is an article I recently wrote for the Global Network of Extremism and Technology (GNET). You can find the original link here.

Terrorist groups are increasingly using digital assets to move money outside traditional financial oversight. These same channels – blockchain networks, stablecoins, and encrypted apps – now underpin a wider illicit economy that spans cybercrime, sanctions evasion, and elite capital movement. Together, they form a shadow financial infrastructure that operates at a scale and velocity traditional enforcement cannot match.

As regulators struggle to keep pace, artificial intelligence (AI) is emerging as a force multiplier. From clustering wallets and detecting laundering networks to automating early detection, AI is transforming how investigators detect, map, and disrupt illicit flows. Yet technology alone cannot solve the problem. Effective countermeasures require human analysis and strategic framing – linking the rise of digital liquidity systems to the broader financial ecosystems that sustain both criminal and terrorist actors. This Insight will explore emerging regulatory and technological trends aimed at closing the global enforcement gap – showing how AI-enabled enforcement, systemic liquidity mapping, and multi-domain synthesis can shift counter-terrorist financing from reactive disruption toward proactive resilience.

Figure 1: The three-tiered liquidity framework.

Understanding the Problem: A Three-Tiered Approach

The challenge today is not simply that terrorists seek money beyond regulatory and enforcement oversight, but that the methods they use to mobilise funds converge with a broader set of illicit and semi-licit flows. The rise of blockchain and digital currency ecosystems has provided bad actors with faster, cheaper, and less traceable means of moving value globally. These value transfer mechanisms, combined with encrypted messaging apps, offer the ability to move vast sums outside the global banking system, thus representing a structural alternative to it.

Terrorists are not alone. A much larger global criminal ecosystem – spanning cyber fraud, state-linked sanctions evasion, and elite capital flight – exploits the same digital corridors. On 14 October, U.S. authorities seized over $14 billion USD worth of Bitcoin tied to Cambodia-based and Hong Kong-registered Prince Group, which provided laundering services to Southeast Asia’s vast cybercrime industrial complex. It was the largest Bitcoin seizure in history, underscoring the scope of these illicit systems. These systems represent a financial substrate where actors with varied goals and ideological motives can rely on the same facilitators, which become more pervasive with each transaction.

The three-tiered liquidity framework explains this new paradigm. At the top, Tier 1 captures elite flows – shadow banks, high-net-worth individuals, and state-adjacent funds that seed the system – generally manifesting as capital outflows, although at times taking the form of strategic inflows in specific contexts. Tier 2 is the facilitation layer, comprising over-the-counter (OTC) brokers, underregulated exchanges, and laundering platforms that have grown from Tier 1 flows. These entities now rent their services to anyone with the means to access them. Tier 3 is where threats surface, as extremists and criminal groups exploit the same intermediaries to move money through unregulated corridors. By mapping this cascade, we see how funds that leave states at the top can ultimately end up financing terrorism and criminality at the bottom – with Tier 2 serving as the connective tissue with none of the accountability of regulated financial systems.

Tier 2 intermediaries take many forms, but Huione Guarantee in Cambodia, Garantex in Russia/Dubai, and Iran’s Derakhshan/ Alivand shadow banking network all show how digital asset facilitators operate at the intersection of offshore capital and terrorist finance. Huione’s illicit marketplace evolved into a laundering channel for ethnic Chinese criminal networks across Southeast Asia, with clear evidence of participation by Hong Kong facilitators – strongly suggesting its use by Chinese elites to evade domestic capital controls. U.S. authorities also flagged Huione for laundering $39 million USD tied to the Houthis, a clear example of terrorist financial usage. Evidence also suggests that Myanmar-based militant groups have accessed Huione and comparable networks, further illustrating how such financial ecosystems enable militant and terrorist funding structures.

Meanwhile, U.S. and European regulators sanctioned the Moscow-based crypto exchange Garantex for enabling Russian sanctions evasion and elite capital flows, as well as for processing transactions linked to Palestinian Islamic Jihad. Further analysis has also revealed that funds from Garantex flowed into wallets controlled by the Islamic State Khorasan Province (ISKP). Finally, in Iran, the Derakhshan/ Alivand shadow banking network operated as a crypto-enabled extension of the regime’s sanctions evasion architecture, moving billions through front companies and exchange houses. U.S. Treasury designations also show the network provided financial services to Hezbollah funding corridors, again demonstrating a clear cascade between Tier 1, 2, and 3 flows.

While the three-tiered framework currently captures only some terrorist organisations, groups such as those associated with the Islamic State and al-Qaeda also rely on intermediaries to move and launder funds on the blockchain. As these networks become more digitally sophisticated and financially liquid through their exploitation of high-value trades – including commodities such as gold and timber as well as narcotics trafficking – it is likely that they too will engage Tier 2 facilitators, further expanding their global financial reach and resilience.

Disrupting only the Tier 3 terrorist groups is insufficient, as these actors are symptomatic of broader systems. The real leverage lies in targeting the Tier 2 facilitators who profit from servicing everyone – oligarchs, sanctioned states, and militant/ terrorist groups alike. A strategy of networked disruption must therefore neutralise the brokers, platforms, and exchanges that systematically connect these flows. By constraining Tier 2, regulators and investigators can structurally disrupt the cascade before funds reach Tier 3, cutting off not just individual plots, but the infrastructure that makes global illicit liquidity possible. Although this challenge remains enormous in scope, new regulatory and technology-based solutions have begun to tip the scales in favour of global enforcement.

Regulatory Reforms and AI Advances

Emerging regulatory frameworks are bringing digital assets under formal oversight. In the U.S., the GENIUS Act would pull the issuers of and intermediaries behind stablecoins – the current lifeblood of large-scale illicit financial flows – into the existing anti-money laundering and combating the financing of terrorism (AML/CFT) system. In the European Union, the Markets in Crypto-Assets regulation (MiCA) sets harmonised standards for licensing and disclosure across the bloc. Financial hubs such as Hong Kong and Singapore, as well as Southeast Asian jurisdictions such as the Philippines, are also moving to regulate exchanges, OTC brokers, and other intermediaries. Together, these measures mark a decisive shift: digital assets are no longer a lawless frontier, with governments actively working to close the gaps that criminals, sanctioned states, and violent extremists exploit.

However, tens of billions of dollars move each year through the informal systems described above, and human analysts alone cannot keep pace with flows of this magnitude and velocity. Without advanced tools and coordinated enforcement, new regulatory frameworks risk becoming outmanoeuvred by the actors they seek to constrain. Recent AI advances increasingly address this enforcement gap – not by replacing human analysis, but by amplifying it through pattern recognition at scale. Leading blockchain analytics firms have already begun layering AI into their products in ways that concretely boost detection, attribution, and investigation speed.

Blockchain analytics platforms currently use machine learning to cluster addresses that belong to the same actor, trace funds that are deliberately split and rerouted to hide their origin, and flag unusual transaction patterns that suggest illicit flows. Some systems go further, automating the first level of triage, presenting investigators with likely leads rather than raw data. Others use advanced models to sift through vast webs of wallet interactions and highlight networks that resemble known money-laundering structures. While private analytics firms rarely disclose which AI modules are employed in specific investigations, recent rollouts of AI-enabled triage, clustering, and typology-detection tools suggest that such technologies are increasingly embedded in live enforcement workflows.

The effect on investigations is simple: machines take on the role of scanning and sorting, allowing human investigators to focus on context, judgment, and strategy. The combination makes it increasingly possible to confront illicit flows at volumes that have long exceeded the limits of manual enforcement. But the technology is still developing, coverage remains uneven, and determined actors continue to find ways to exploit the gaps. What AI offers today is not a finished solution, but an evolving opportunity to narrow the enforcement gap at the scale currently required.

Advances in AI disruption do not end with the private sector. The U.S. Military’s Defense Advanced Research Projects Agency (DARPA) has been developing a new programme called Anticipatory and Adaptive Anti-Money Laundering (A3ML). According to DARPA, the programme seeks to transform anti-money laundering from “manual, reactive, and expensive analytic practices” into a system that can proactively identify illicit financial activity by analysing transaction data at machine speed. The initiative aims to build adaptive models capable of detecting complex laundering behaviours and evolving with new threat patterns across global financial networks. In a recent interview, A3ML programme manager David Dewhurst claimed the goal of the project is to “raise the cost of money laundering so high that it becomes unsustainable.”

If realised, A3ML would represent a significant step toward closing the enforcement gap that today’s regulators and investigators struggle to manage in the realm of terrorist and illicit finance. Given DARPA’s 60-year track record of pioneering AI technology, as well as the core technologies behind the Internet itself, the fact that the agency is promoting A3ML publicly signals its potential as an emerging game-changer in countering terrorist finance and illicit liquidity networks as a whole.

Recommendations: Building Human–Machine Fusion Across the Enforcement Chain

Artificial intelligence will not replace human financial investigators; it will demand a new generation of them. As enforcement agencies integrate AI tools into financial investigations, the limiting factor will not be processing power but strategic judgment – the ability to interpret machine-generated signals in context. AI excels at pattern recognition, but it cannot discern intent, geopolitical linkage, or systemic consequence. These require human synthesis based on deep contextual understanding.

Three priorities follow from this reality:

1. Invest in human-machine fusion: Regulators, tech firms, and research institutions should prioritise training analysts who can interpret algorithmic outputs, question model assumptions, and integrate AI findings into broader geopolitical and financial-systems analysis.

2. Expand interdisciplinary research: The convergence of digital assets, sanctions evasion, and terrorist finance demands a research agenda that unites data science, economics, finance, criminology, strategic studies, and more. Understanding illicit liquidity networks at scale requires systems-level mapping and cross-domain synthesis, not siloed expertise.

3. Institutionalise feedback loops: AI detection models improve only when informed by real investigative experience and extensive research. Private firms and research institutions should create channels for case-based learning and publication, ensuring that enforcement outcomes continuously refine analytical models.

Additional priorities for technology platforms to consider:

4. Integrate financial signal detection into trust and safety operations: Social media, messaging, and other platforms are uniquely positioned to identify the early stages of extremist financing. Embedding financial intelligence cues such as patterns of wallet sharing, donation link reuse, or coordinated in-app transfers into existing moderation systems would enable early intervention without compromising privacy.

5. Create secure interoperability between financial and content-moderation ecosystems: Platforms can pilot controlled data-exchange frameworks that allow vetted enforcement partners and blockchain analytics firms to cross-reference on-chain data with online behavioural indicators. This would help surface the connective tissue between propaganda distribution, recruitment, and funding pipelines that rely on digital payment rails.

6. Promote collaboration on typology discovery: Major platforms can co-fund shared typology libraries that describe emerging laundering and fundraising behaviours across digital ecosystems. Building upon the precedent set by GIFCT’s hash-sharing database and other collaborative frameworks, as well as existing typology reporting by FATF and the Egmont Group, a complementary repository for financial signals could integrate structured input from public and private stakeholders, including blockchain analytics firms at the forefront of these trends. This would create a unified typology framework – linking regulatory, platform, and investigative perspectives – and provide a common analytical language for identifying new threats while ensuring that emerging AI models across companies learn from consistent signal categories.

AI is reshaping financial intelligence, but its success will depend on the people who wield it – analysts capable of seeing the system, not just individual outcomes. For the technology companies that host, route, and monetise digital interactions, this means examining how digital economies can be co-opted by illicit liquidity systems and disrupting them when possible. The next frontier in counter-terrorist finance will belong to those who can bridge the gap between computation and comprehension – between safeguarding platforms and preserving the integrity of the digital economy.

No one has ever accused me of being an optimist — especially if they’ve read Between the Lines.

However, today I’m staking out a position of cautious optimism on one of the hardest problems in financial intelligence: getting a handle on illicit crypto flows, especially when it comes to designated terrorist groups.

To be clear: nothing in this field will ever be perfect. Threat finance is adaptive by design. But after tracking this space for years, I’m convinced the scales are tipping in ways that make overwhelming pessimism harder to sustain.

Here’s why.

Data aggregation

Every crypto transaction leaves a digital trace. Even if pseudonymous, it’s still a ledger entry — vastly different from the opaque networks of hawala or bulk cash smuggling.

The successful takedown of illicit Monero transactions by Japanese National Police is proof that anonymity tech can be pierced when regulators and enforcement pair data with persistence. Practitioners in the blockchain analysis space have told me that anonymous tokens are not as anonymous as some would have you believe.

The problem right now is that it takes a lot of people to find and process the data needed to track illicit flows and the industry struggles to keep up. That’s where AI comes in — to turn the overwhelming volume of raw data into actionable detection.

AI development

Several blockchain analytics firms are already layering machine learning into their platforms — using AI to catch anomalies humans miss. But they are not the only ones.

The Defense Advanced Research Projects Agency (DARPA) is currently developing a programme called Anticipatory & Adaptive Anti–Money Laundering (A3ML). In a recent podcast, the A3ML project lead commented his team’s goal is to make money laundering “too expensive” by dramatically increasing the effectiveness, speed, and scale of detection using artificial intelligence (AI). Because money laundering is defined by scale, speed, and complexity — exactly the domains where human investigators are outmatched and algorithmic detection excels — AI could be a genuine gamechanger.

DARPA has been quietly promoting A3ML for months, meaning it is well past the idea stage. With leading analytics firms already incorporating AI into their products, the use of AI in this field is no longer hypothetical. Given the rapid speed of advancement in current AI technologies, the efficacy of these products is likely to improve dramatically in the coming months and years.

Regulatory reform

The European Union’s MiCA regime, the U.S. GENIUS Act, and Hong Kong’s stablecoin ordinance all point to a growing global consensus that crypto markets can and must be regulated. The traction my recent articles on unregulated crypto regimes have gained underscores that this isn’t just a policy shift — there’s real appetite across the field to understand and address these risks.

I believe enforcement will continue moving toward a preponderance standard — acting whenever aggregated signals indicate illicit activity is more likely than not, rather than waiting for airtight proof. In practice, that standard favors systems that can aggregate patterns, spot anomalies, and connect disparate signals faster than any manual investigation — exactly the kind of connective tissue that AI-driven systems can surface better than human investigators. Yes, gray jurisdictions will still exist, but in a world where dollar clearing still reigns supreme, the preponderance model will leave them increasingly isolated and deprived for non-compliance.

Terrorist finance: tip of the spear

Terrorist finance is likely to feel the impact of this enforcement shift before other domains. The reason is twofold. First, national security considerations ensure that counter-terrorism receives the highest priority for resources, political will, and legal innovation. Governments simply cannot afford to take a passive stance when designated groups are exploiting new technologies.

Second, counter-terrorism already has over two-decades-worth of laws, regulations, and intelligence cooperation to build upon — from FATF standards and UN Security Council resolutions to domestic tools like the U.S. Patriot Act and equivalent frameworks worldwide. That foundation makes terrorist finance the most immediate proving ground for applying aggregated data and AI-enabled detection under a preponderance standard, before those same methods expand into broader areas of illicit finance.

Conclusion

Progress in this field isn’t measured by perfection — it’s measured by whether the system gets harder for bad actors to exploit. And by every sign — data aggregation, AI adoption, and regulatory convergence — we’re moving in that direction.

Caution is still warranted; threat finance adapts. But the fatalism that says this space is uncontrollable no longer matches reality. There is much work to be done in mapping these systems moving forward, but on this issue at least, I am cautiously optimistic.

Note: This article is in part a preview of a bigger piece I’m currently working out. Also, stay tuned for the long-awaited Part II of my China military series.

Author’s Note: This article was originally written for the New Lines Institute (link).

The analysis was cited by Coinbase in an October 2025 Request for Comment submitted to the U.S. Treasury Department (link).

A soldier stands guard as workers cover their faces while authorities raid the offices of Central One, an alleged scam hub masquerading as a call center company, on Oct. 31, 2024, in Bagac, Philippines. (Photo by Ezra Acayan/Getty Images)

The explosive rise of Southeast Asia-based scam networks targeting victims globally is no accident; it is the byproduct of China’s vast offshore shadow liquidity systems. Scammers from the region have increasingly targeted victims in the United States, who lost at least $5 billion to such scams in 2024 alone. Scam hubs, some of which comprise entire cities built using offshored Chinese wealth, threaten stability across Asia by draining middle-class savings into a self-perpetuating parasitic ecosystem. These criminal enterprises are now actively expanding their operations in Africa and Latin America, positioning themselves closer to Western societies where aging populations are especially vulnerable to sophisticated cybercrimes. These systems also threaten regional stability, with recent military clashes between Thailand and Cambodia underpinned by rising scam activity and capital flows to the Cambodian side of their disputed border.

Over the past decade, China built a secret offshore capital reservoir to shield itself from an increasingly hostile outside world. That reservoir, combined with massive capital outflows, has spawned a vast criminal ecosystem that threatens social and economic interests the world over. Moreover, the networks constituting this ecosystem now serve their own ends, not merely those of Beijing. In the absence of safeguards, this pooled liquidity has fueled criminality that now threatens China despite Beijing’s ongoing efforts to reassert control over it. This offshored criminal ecosystem demonstrates a fundamental truth by its very existence: liquidity systems, once externalized beyond state oversight, become self-reinforcing, corrosive infrastructures.

In Southeast Asia, sprawling scam hubs now siphon an estimated tens of billions of dollars or more annually, turning a defensive buffer into a parasitic financial ecosystem threatening regional and global stability. This criminal ecosystem exposes a significant contradiction at the heart of China’s model: a regime built on centralized control increasingly entangled with systems it can neither regulate nor contain. These networks – once designed to strengthen China’s financial sovereignty – now threaten it, eroding domestic stability and undermining the very narrative of control the ruling Communist Party depends on to maintain legitimacy.

What Is Shadow Liquidity?

Shadow liquidity is a mobile layer of capital that exists outside standard regulatory frameworks. Unlike traditional illicit finance, which is explicitly criminal, it occupies a gray zone – part statecraft tool, part private escape valve, part opportunistic exploitation. Its core function is not to hide individual transactions but to maintain a resilient flow of value that can shift jurisdictions, instruments, or ownership structures as conditions demand.

China’s offshore liquidity systems emerged as a response to external pressures, including tariffs and sanctions. Initially structured as discreet channels to support trade and investment, these reserves evolved into conduits for elite capital flight and informal influence operations. A clear example is the $900 billion in offshore foreign currency assets held by China’s state commercial banks, funded by deposits made by state-owned enterprises and outside the official People’s Bank of China (PBoC) balance sheet. Designed as a buffer against external shocks, these pools of liquidity coincide with the rise of informal networks beyond Beijing’s direct control.

DeepSeek, an artificial intelligence product developed in close proximity to China’s state-owned military and defense sector, provided a striking example of how offshore liquidity pools serve Chinese state interests. In June 2025, U.S. officials accused DeepSeek’s parent company of using shell corporations in Southeast Asia to acquire banned Nvidia H100 chips – critical for training advanced AI models – thereby bypassing sanctions aimed at curbing Beijing’s military AI ambitions. Recent cases also show that Chinese firms leverage offshore entities to evade recently escalated U.S. tariffs. In this way, these networks created a parallel reservoir of liquidity designed to move outside Beijing’s formal financial architecture while remaining at least partly aligned with state objectives.

However, by unleashing vast sums of liquidity into loosely regulated financial systems, Beijing seeded a landscape where state-linked capital, private wealth, and criminal enterprise converge. According to a July 2025 report from the U.S.–China Economic and Security Review Commission (USCC), Chinese criminal networks in Southeast Asia “have built ties – some overt, some deniable – to the Chinese government by embracing patriotic rhetoric and supporting China’s Belt and Road Initiative (BRI).” The report further notes that “Chinese crime syndicates have expanded across the region with, at a minimum, implicit financial and political backing from elements of the Chinese government.” Murky state-linked investments in now-notorious scam hubs like the Golden Triangle Special Economic Zone (SEZ) in Laos and Myanmar’s Shwe Kokko SEZ are just some examples. What was meant to be a controlled instrument of resilience has instead become a porous, adaptive ecosystem – one increasingly beyond Beijing’s ability to discipline without destabilizing the very flows it relies on.

In China’s case, offshored “shadow reserves” have become a critical funding source for BRI projects, with state commercial banks channeling offshore foreign currency assets – often absent from official PBoC reporting – into overseas infrastructure. BRI has become the most visible expression of how shadow liquidity can be weaponized as both an economic and geopolitical instrument.

Because liquidity is inherently dynamic, these networks behave less like pipelines and more like living infrastructure. They adapt under enforcement pressure, migrate during crises, and often move faster than formal financial reforms can catch them. For China, this networked capital is both a pillar of external influence and a source of internal fragility: a system built to shield the state from outside constraint that has instead created an informal architecture of power – one Beijing now depends on but cannot fully control. Simultaneously, this informal architecture has proved resilient against Chinese and other global crackdowns, likely at least in part due to its entrenchment in Chinese elite power structures.

The Southeast Asia Inflection Point

In Southeast Asia, China’s shadow liquidity strategy has mutated into something far more volatile. Scam compounds in Cambodia, Laos, and Myanmar, sprawling online gambling hubs in the Philippines, and a dense web of informal crypto-asset brokers now act as powerful magnets for Chinese capital outflows. Funds slip past Beijing’s formal controls through domestic underground banking networks, gray-market over-the-counter (OTC) brokers based in Hong Kong, and payment platforms such as Huione and other similar underground systems. These actors often facilitate capital flight disguised as trade settlement or investment outflows, converging powerfully with state-led outflows.

Investigations have tracked billions of dollars flowing through OTC desks in Bangkok and Ho Chi Minh City into scam operations and laundering networks. What began as pass-throughs for capital flight is now self-reinforcing. Reports indicate that Chinese middle-class investors have lost tens of billions of dollars to newer forms of crypto fraud – particularly pig-butchering scams – often facilitated by border OTC networks in Southeast Asia. According to Wired, global losses due to scam operations exceeded $75 billion in 2023, with China-origin capital feeding scam compounds and high-risk gambling zones in Cambodia, Laos, Myanmar, and beyond. These systems no longer route funds back into China; they feed their own expansion, siphoning ever-larger volumes of Chinese wealth to sustain illicit economies.

This dynamic has created a parasitic financial architecture. Chinese liquidity designed to circumvent external constraints is now trapped in feedback loops, comingling with and empowering nonstate actors and criminal organizations. For example, the Yemen-based al-Houthi rebel group has used Huione to transfer $39 million in illicit proceeds. Militant groups in Myanmar have been linked to similar funding schemes. These networks have proven resilient in the face of global pressure, such as recent revelations that Huione remains operational despite its formal shutdown in the wake of U.S. sanctions.

Scam centers now threaten regional stability in Southeast Asia, draining middle-class savings while embedding themselves into the broader gray-zone economy. For example, ethnic Chinese-run scam centers in Cambodia routinely target middle-class victims in neighboring Thailand. Thai authorities report that since 2022, these operations have defrauded domestic investors of roughly 80 billion baht (about $2.5 billion), while regional estimates variably suggest the industry now generates nearly tens of billions of dollars annually. These scam centers became an important point of tension between Thailand and Cambodia in the months leading up to the July border clashes between the two countries that killed at least 35 people and displaced more than 260,000.

The result of China’s shadow liquidity outflows is a network that serves state, private, and criminal interests simultaneously – but answers fully to none. In this Southeast Asian crucible, China’s shadow liquidity has crossed an inflection point: from strategic tool to autonomous ecosystem, eroding the very stability it was meant to secure.

How It Backfires on China

The explosion of scam-driven liquidity drains in Southeast Asia produces visible social and economic consequences inside China. Hundreds of thousands – possibly millions – of Chinese citizens have lost savings to cross-border fraud schemes linked to scam compounds and gray-market payment platforms. While reliable data on those losses is scarce, early documented cases point to hundreds of millions of dollars stolen through pigbutchering scams – long con frauds where perpetrators groom victims online before convincing them to hand over large sums of money. Today, estimates claim scam compounds generate tens of billions of dollars annually, most extracted from Chinese households – an ongoing bleed of domestic savings that represents a vastly underestimated long-term erosion of national capital.

This state-facilitated ecosystem has bred distrust within China’s middle class – the demographic Beijing relies on most for social stability. Recent unemployment and failed investments have fueled unrest and rising violence – potential harbingers of things to come as scam losses mount. The scale of loss from cross-border scams is not merely individual but systemic. As illicit networks siphon billions annually, they erode China’s internal capital coherence – the ability of the state to direct domestic savings into strategic investment. Instead of reinforcing national resilience, these shadow channels are diverting household wealth into offshore criminal ecosystems that recycle capital outside Beijing’s control.

Although Chinese authorities have made efforts at cross-border crackdowns, Southeast Asia’s scam economy continues to flourish. It is likely that Beijing cannot fully disavow these operations due to how embedded they have become within elite circles. For example, organized crime figures such as the 14K Triad’s Wan Kuok Koi (aka “Broken Tooth”) reportedly hold close political ties to the Chinese Communist Party (CCP), with Wan allegedly stating that although he used to fight for the cartels, he now fights for the CCP. In 2018, Wan launched the World Hongmen History and Cultural Association, an entity U.S. authorities sanctioned two years later for its alleged criminal activity, including close ties to Southeast Asian scam operations. Washington also claims that Wan is a senior member of the Chinese government, holding a position on the Chinese People’s Political Consultative Conference – an assertion Beijing denies.

Another Chinese gangster, Zhao Wei, has benefited from extensive BRI investment in his Laos-based Golden Triangle SEZ, where he owns and operates the infamous Kings Romans Casino, which allegedly maintains extensive ties to scam operations in the SEZ. Such cases indicate that the Chinese regime maintains deep ties to the very scam operations that consistently undermine its public image despite attempts to rein them in. As ensuring capital outflows likely plays a key role in maintaining loyalty within the CCP’s opaque patronage networks, these scam operations may benefit from protection by the very officials meant to regulate them.

This dynamic sharply inverts the original aim of China’s offshore liquidity systems. What began as an effort to secure financial sovereignty and shield the economy from external shocks has instead produced an internal liquidity leak. It undermines the narrative of centralized control – the cornerstone of party legitimacy – as the population sees their own savings flow into unregulated, foreign-run criminal networks backed by state-led investments. In this way, the social cost of shadow liquidity is not just economic dislocation but also the corrosion of the trust Beijing needs to sustain its model of governance.

Policy and Security Implications

Current anti-money laundering and counter-terrorist financing frameworks focus on shadow liquidity as a criminal threat on a case-by-case basis rather than a systemic one. Compliance systems emphasize wallet-level monitoring and red-flag thresholds, but as the Financial Action Task Force (FATF) warns, the decentralization of financial operations “may further complicate efforts to disrupt larger financial networks.”

There is a clear imperative for disrupting and dismantling these shadow liquidity systems. The human cost is already visible – from human trafficking rings sustaining scam operations to the growing number of victims in the United States and globally whose wealth is funneled into opaque offshore corridors. With Western populations aging, Chinese illicit financial infrastructure already embedded within Western societies, and scam centers expanding into geographically, linguistically, and culturally proximate regions such as Africa and Latin America, the risk of a structurally entrenched global scam economy is rising. Evidence that these same corridors are exploited by terrorist and militant groups such as the Houthis to launder and transfer funds beyond the reach of traditional enforcement only underscores the urgency for decisive action.

At the state level, China’s BRI has become a dual-use platform – advancing Beijing’s geopolitical objectives while quietly facilitating elite capital flight and enabling shadow liquidity systems under the cover of infrastructure investment. In this way, BRI simultaneously spreads and undermines Beijing’s influence globally but doubly harms U.S. and other global interests by simultaneously furthering Chinese military expansionism while enabling parasitic organized criminal infrastructure. Until Beijing demonstrates a genuine commitment to dismantling these offshore shadow liquidity networks, global regulators and enforcement agencies should treat its financial initiatives with maximum caution.

Scam compounds, OTC desks, and gray-market payment networks are no longer discrete criminal enterprises; they are embedded in shadow capital infrastructure originally tied to Chinese state objectives. Treating them as isolated criminal enterprises misses their role as autonomous reservoirs of capital capable of sustaining proxy influence and destabilizing economies.

Addressing this requires ecosystem-level targeting. FATF’s 2025 report highlight “Operation Grafos,” where real-time intelligence sharing, blockchain analysis, and cross-jurisdictional coordination was employed to disrupt a virtual asset-based terrorism finance network. Those methods must become standard practice, not isolated cases.

Hybrid threat frameworks must integrate liquidity analysis alongside kinetic and cyber domains. The Basel Framework’s network-based supervision and the Organization for Economic Cooperation and Development’s beneficial ownership models offer practical templates for this. Pressure on Southeast Asian jurisdictions hosting scam enclaves must also escalate. Cambodia, Laos, Myanmar, and the Philippines are now structural nodes; carrot-and-stick approaches could force structural change.

Stablecoin and OTC-specific controls are essential. Hong Kong’s virtual asset service provider OTC regime and International Monetary Fund guidance on stablecoin flows provide blueprints for containing these pipelines. The recent announcement that stablecoin issuer Tether will fully comply with Washington’s Guiding and Establishing National Innovation for U.S. Stablecoins (GENIUS) Act over a period of 36 months is a positive step in this direction. Without systemic measures to regulate and contain these flows, shadow liquidity will continue to metastasize beyond state control, embedding itself as a structural layer of global capital flows. Given the primacy of U.S. regulatory and enforcement bodies in the global financial system, Washington will have to anchor any serious effort to contain these high-risk and unregulated flows.

By mapping these flows as an ecosystem rather than isolated incidents, enforcement bodies can identify structural chokepoints where targeted interventions may have disproportionate disruptive impact.

Conclusion

Shadow liquidity is more than a byproduct of illicit finance; it is a strategic architecture. China’s experience shows how systems built to project resilience can evolve into autonomous networks draining wealth and feeding actors beyond state control.

This is the central warning: once liquidity is externalized into unregulated systems, it no longer necessarily serves the state or actor that created it. Financial sovereignty is not just reserves; it depends on controlling the conduits of trust – the pathways through which value moves. Without discipline over these flows, even the most carefully engineered financial architecture can become a vector of decay, eroding the very stability it was built to secure. The real question is whether these systems can be contained in time – before they permanently erode the foundations of the global financial order.

Image source

FinCEN’s new advisory on Chinese Money Laundering Networks (CMLNs) underscores a truth often missed in enforcement reporting: these are not isolated laundering schemes but components of a parallel financial architecture, a shadow liquidity system now entrenched across the Americas and around the world.

The advisory contains staggering numbers: over 137,000 suspicious activity reports (SARs), $312 billion in suspicious flows, and the same trade-based, over-the-counter (OTC), and insider-driven mechanisms. The underlying systems that set off these alerts are the connective tissue that allow sanctioned states, cartels, and elites to thrive despite formal financial controls.

FinCEN frames this as “Chinese money laundering.” And when it comes to cartel finance, Chinese enablers are indeed the most visible. Yet they are only part of a parallel financial architecture — a global ecosystem where Chinese actors are central, but not alone. Other state and non-state players drive and exploit these flows as well. Until regulators and analysts treat shadow liquidity as infrastructure, rather than a collection of anomalous SARs, enforcement will remain reactive while the networks evolve faster than the tools meant to stop them.

Subscribe now

Bigger than you think, and more chaotic

These laundering networks are diffuse, but global. They service multi-billion-dollar scam operations in Southeast Asia, terrorist groups like the Houthis, and emerging criminal enclaves in Africa and Latin America. The FinCEN advisory highlights just some of their embeddedness in Western societies, underscoring the scope of this problem.

The sort of networks FinCEN highlights aren’t just laundering for cartels — they’re tapping into a much larger reservoir of Chinese shadow capital. Crypto-enabled, OTC-driven liquidity rails emerged first to move elite wealth offshore, but over the past decade they’ve evolved into a parallel financial architecture. These flows no longer sit neatly under Beijing’s command; they form a sprawling ecosystem of brokers, gray banks, scam centers, and informal clearinghouses that operate beyond the reach of both Western enforcement and the Communist Party itself.

This is what makes the threat so destabilizing: it’s not simply “Chinese laundering,” but a decentralized liquidity system born from state and elite outflows that now finances everything from fentanyl supply chains to dual-use tech procurement. In other words, what started as controlled leakage has become a global shadow infrastructure — chaotic, adaptive, and only partially answerable to any state.

Drug cartels, scammers, and terrorists are just the visible tip of this hidden architecture. They set off SARs and grab headlines, but they are a symptom, not the disease. To understand how we got here, Between the Lines has developed a three-tiered model that tracks the money cascade from its source.

Read more

A screenshot from the movie Hotel Rwanda, in which a Hutu warlord shows off his PRC-made machete. (Source: Douban)

This article was published on November 1, 2024 in the Jamestown Foundation China Brief. It has since been cited in a July 2025 report by the U.S. Senate Committee on Foreign Relations. You can find the original article here.

Executive Summary:

• Weapons manufactured in the People’s Republic of China (PRC) are increasingly falling into the hands of militant groups across Africa, with key contributors being state-owned defense contractors like Norinco. However, it is unclear how the weapons reach these groups.

• Militant groups such as Mali-based JNIM and the Democratic Republic of Congo’s M23 are employing PRC-manufactured arms in their operations, with evidence suggesting the potential involvement of Chinese criminal syndicates and corruption within PRC defense firms and African militaries.

• Extensive access to PRC-manufactured weapons by countries like Rwanda and Uganda, both of which support rebel groups, underscores the growing influence of PRC defense contractors in Africa, potentially contributing to regional conflicts.

• Beijing’s experience in Myanmar, where it supports both the government and rebel groups, may offer insights into its role in African conflicts, raising concerns about how escalating conflicts could strain Beijing’s partnerships and jeopardize its regional investments.

Weapons manufactured in the People’s Republic of China (PRC) are increasingly falling into the hands of militant groups across Africa as PRC defense contractors expand their influence in the region. Many African governments have signed arms deals with Beijing, with the PRC becoming the continent’s leading supplier of weapons this year. It is unclear how weapons are falling into the hands of militants, though corruption is likely playing a part in the influx of PRC-manufactured arms on the continent. Corruption has been rampant in recent years within the PRC’s military-industrial complex, reaching right to the top of the system. At the same time, the likelihood of corrupt activities by PRC arms companies in Africa—that operate far from regulatory oversight by Beijing—is high, as is the involvement of Chinese criminal groups that are also active in the region.

In late September, the Mali-based, al-Qaeda-affiliated Jama’at Nasr al-Islam wal Muslimin (JNIM) continued to escalate its presence in Africa’s Sahel region, executing attacks that claimed over 70 lives in Bamako (Xinhua, September 18; September 20). JNIM has access to large numbers of PRC-manufactured weapons. This is one of several instances of non-state actors having access to substantial quantities of PRC military equipment—Myanmar constitutes another prominent case.

Mali-based Terrorist Group Maintains Extensive Arsenal of PRC Weapons

Propaganda videos and footage released by the Malian military reveal substantial stockpiles of weapons produced by PRC state-owned defense contractor Norinco (中国兵器工业集团; 北方工业), including a Type 80 machine gun, a Type 81-1 assault rifle, and at least two Type 69 rocket-propelled grenade (RPG) launchers equipped with high-explosive anti-tank projectiles (Militant Wire, September 22). While the images also display weapons from other countries such as Russia, Romania, and older Soviet Union models, most of the arms pictured are of PRC origin.

Norinco has increasingly expanded its role in supplying militaries throughout the Sahel, particularly in Mali. A video released last summer shows Malian special forces outfitted with a broad array of PRC-manufactured weapons and equipment, including Norinco-produced CS/VP11 Lynx all-terrain vehicles equipped with W85 anti-aircraft machine guns, as well as JS 9mm submachine guns produced by Jianshe Industries (云南建设工业集团) (BiliBili, August 27, 2023). Last month, during the Forum on China–Africa Cooperation (FOCAC) in Beijing, Mali secured another contract with Norinco to provide additional weapons to its military (Embassy of the PRC in India, September 2; Military Africa, September 3).

In recent years, JNIM has funded much of its expansion by running a protection racket associated with the illicit harvesting and trade of southern Malian rosewood, a highly valued tropical hardwood prized for its distinctive color and durability (ISS Africa, June 19). In 2018, Malian whistleblower Amadou Traoré exposed the extensive deforestation and criminal activities tied to Mali’s rosewood trade, prompting several international investigations (Corruption Anonymous, September 13, 2023). Reports suggest that most of Mali’s exported rosewood ends up in the PRC, with PRC criminal syndicates operating in Mali and Senegal playing essential roles in the trade (South China Morning Post, May 22, 2022; PPLAAF, September 11, 2023). In the PRC, the trade of illegally exported Malian wood is so widespread that several online retailers sell it on Aicaigu (爱采购), a business-to-business platform operated by PRC tech giant Baidu (Aicaigou, October 10). However, the origin of JNIM’s vast cache of PRC-manufactured weapons and the group’s relationship with PRC criminal syndicates remains unclear. Although villagers in southern Mali have reported that local PRC crime syndicates pay protection money to JNIM, these reports remain unsubstantiated (ECOWAS, November 2023). Such factors call for further investigation.

PRC Defense Contractors Benefit From Worsening Conflict in the Eastern DRC

In the eastern Democratic Republic of Congo (DRC), the March 23 Movement (M23), predominantly composed of Tutsi rebel forces, continues to devastate the region using PRC-manufactured weapons, including an assault on the provincial capital of Goma and the plundering of vast quantities of minerals (United Nations, February 20; Africa Defense Forum, March 5). Photos of seized M23 weapons and equipment released by the Congolese military underscore the PRC origin of these extensive supplies, particularly from Norinco and Xinxing (中国新兴进出口有限责任公司), a firm specializing in military uniforms and tactical gear. In an interview with a local news outlet, Congolese-Belgian defense analyst Jean-Jacques Wondo Omanyundu noted, “the M23 weapons seized by the FARDC [the Congolese military] are almost all Chinese-made” (China Global South Project, July 12, 2022).

A recent UN Security Council report concludes that M23 receives substantial financial and material support from neighboring Rwanda and Uganda, both of which have acquired significant quantities of PRC-manufactured weapons (United Nations; ReliefWeb, June 4). In recent years, Rwanda has made large purchases of artillery systems and other arms produced by Norinco and other firms. A Shanghai-based firm called Deekon Group even uses images of the Rwandan military uniforms it produces for promotional purposes on its website (Deekon Group, October 8). The PRC and Rwanda also maintain close military and defense ties, with Beijing deploying an official defense attaché to Rwanda earlier this year (Embassy of the PRC in Rwanda, February 21). Uganda’s military, meanwhile, has purchased arms from Norinco and another Chinese firm, Poly Technologies (保利科技有限公司; 保利科技), according to a 2021 investigation by a Ugandan journalist (The Independent [Uganda], December 19, 2021). In November last year, Norinco partnered with the Ugandan military to establish a research center focused on unmanned aerial vehicles (UAVs) in the country (MODVA, November 29, 2023). The extensive access of Rwanda and Uganda to PRC-manufactured weapons, along with their support for the M23 movement, highlight the likely source of the rebel group’s large PRC-made arsenal.

To counter the escalating threat from M23, the DRC military has also turned to the PRC defense industry, purchasing its first batch of three CH-4 attack drone systems from China Aerospace and Technology Corporation (CASC; 中国航天) last year (Africa Intelligence, May 22, 2023). Later that year, Norinco became embroiled in controversy in the DRC when its subsidiary, Norin Mining, attempted to acquire cobalt and copper mines outside Lubumbashi, in the Katanga province, south of the M23-led insurgency in North Kivu province. The DRC state-owned mining conglomerate, Gécamines, moved to block the sale, claiming it had not been properly informed of the decision (Africa Confidential, October 11). Although Lubumbashi is approximately 900 miles south of M23-controlled territory in North Kivu, the group conducted extensive attacks in the city during its 2014 offensive (BBC, January 7, 2014).

Corruption at Defense Contractors and the Myanmar Example Raise Further Questions

The PRC’s defense contractors are increasingly flocking to African markets, with the PRC surpassing Russia as the continent’s largest weapons supplier this year (ADF, July 23). Norinco, which manufactures a wide range of weapons from handguns to tanks, has been at the forefront of this expansion, operating offices in over 70 countries. Its latest expansion into Dakar, Senegal, signals growth intentions in the West African market (Norinco, October 8; SCMP, August 21, 2023). According to its website, Norinco controls mining sites across Africa (including gold, cobalt, and palladium mines), is deeply involved in the regional copper trade, and plans further expansion (Norinco, October 8). Although there is insufficient evidence directly linking these companies to the militant groups who are using their weapons, recent developments within the PRC shed more light on these companies’ practices.

Beijing has taken punitive actions against at least two senior Norinco executives since 2021 in response to corruption charges. In October 2021, PRC authorities charged former Norinco Chairman Yin Jiaxu (尹家绪) with bribery and seeking illegal profits for relatives and friends (People’s Daily, October 25, 2021). According to an official readout, Yin received “huge sums” of money and gifts, and held top positions at the company from 2002 until his 2018 retirement (Global Times, April 4, 2021; CCDI, September 30, 2021). Last December, authorities removed then-Norinco Chairman Liu Shiquan (刘石泉) from the 14th National Committee of the Chinese People’s Political Consultative Conference amid an anti-corruption investigation into the defense and aerospace sector (China Brief, February 2; Global Times, March 3). Liu had previously held senior roles at the state-owned China Aerospace Science and Industry Corporation (CASIC; 中国航天科工).

These high-level disciplinary actions highlight the prominence of corruption within some of the PRC’s top defense contracting firms. Given the distance between operations in African countries and oversight by Beijing authorities, corrupt backchannels may be funneling the transfer of PRC-manufactured weapons to African militant groups for personal gain. Coupled with the involvement of Chinese criminal elements in Africa and the potential for internal corruption within the militaries of affected nations, this situation merits further investigation as a possible source of these weapons (OCCRP, May 25, 2022; Africa Report, August 12; May 14).

The PRC’s experience in Myanmar may offer insights into this involvement in internal African conflicts, such as those in Mali and the DRC. For decades, Beijing has supported Myanmar’s ruling government while simultaneously providing material and financial backing to various armed resistance groups (China Brief, March 17, 2023; MLM, July 31; South China Morning Post, August 25). Both JNIM in Mali and M23 in the DRC hold significant value for the PRC due to their access to rare and high-value resources. It is plausible that Beijing may unofficially support one or both groups to secure its continued resource access. However, if such claims are substantiated, they could damage the PRC’s reputation in Africa. Moreover, as seen in Myanmar, further conflict escalation could endanger Chinese investments and those of other nations. Moreover, JNIM’s prolonged conflict with Wagner mercenaries fighting for the Malian junta—coupled with the group’s use of PRC-manufactured weaponry—may strain the PRC’s “no limits” partnership with Moscow, particularly regarding African matters (Xinhua, January 2, 2021).

Conclusion

The expanding presence of PRC defense contractors in Africa and the increasing use of PRC-manufactured weapons by militant groups warrant deeper investigation. However, such inquiries will likely prove challenging due to the frequently opaque nature of business dealings in these regions. What remains clear is that the growing prevalence of PRC-manufactured weapons among powerful militant groups in Africa has considerable implications as Beijing moves to dominate the African arms market. These implications include regional security, as non-state actors gain further access to advanced PRC weaponry and equipment, and geo-strategic concerns, as resource-based conflicts can potentially disrupt global supply chains. Given current trends, these threats will likely intensify as PRC defense contractors seek greater access to the continent’s arms markets.