This is an article I recently wrote for the Global Network of Extremism and Technology (GNET). You can find the original link here.

Thank you for taking the time to read this. I am currently working on a larger project, so this will be my final public article until at least August. During this period, Between the Lines will continue to produce original research and can be reached at info@btl-research.com.

By April 2021, Islamic State Mozambique Province (ISMP, also known as al-Shabaab or Ansar al-Sunnah) had reached the zenith of its territorial expanse. Following years of kidnappings, raids, and escalating offensives, the group had seized key towns and transport routes across Mozambique’s Cabo Delgado province. That month, ISMP’s assault on Palma, a town near a US $20 billion international liquefied natural gas operation, forced the project’s suspension and the evacuation of hundreds of personnel.

By July 2021, Mozambique, Rwanda, and other international partners had launched a counterinsurgency campaign that degraded ISMP’s territorial holdings, reducing its fighting capacity by roughly 90 percent. By conventional standards, the campaign achieved important successes, with ISMP losing control over key revenue streams, its ability to amass fighters disrupted, and its territorial footprint pushed back. Moreover, the United States, the European Union and others issued sanctions against the organisation. Additional sanctions targeted core leadership figures, including Tanzanian national Abu Yasir Hasan (aka Sheikh Hasan) and Mozambican national Bonomade Machude Omar (aka Ibn Omar), who was reportedly killed in a 2023 battle with Mozambican forces.

Yet the group did not collapse. Recent reporting suggests that ISMP activity is increasing, with conflict-related deaths in northern Mozambique up 51 percent in 2025. Moreover, a January report by Armed Conflict and Event Location Data (ACLED) notes that ISMP has been expanding its revenue and operating capacity through ransom-taking, mobile-money-enabled payments, mining-site extortion, weapons seizures, and regional facilitation networks. This raises the question: why has ISMP continued to regenerate after years of sustained military and sanctions pressure?

The answer is not simply that these measures failed. The deeper problem is that the applied pressure targeted ISMP’s fighters, territory, and leadership figures, while its regeneration depended on a different capacity: a digital trust network operating across propaganda, finance, and transnational facilitation layers.

The Islamic State’s online ecosystem is therefore not merely a messaging apparatus, but a networked infrastructure functioning as a recognition layer that keeps distributed actors aligned under a shared organisational identity. In this model, propaganda preserves the banner; the banner sustains trust; trust enables distributed financial adaptation; and financial adaptation restores operational capacity. This Insight applies that framework to ISMP as a granular case study, showing how online recognition, trust-node formation, and distributed financial adaptation can help an Islamic State affiliate regenerate after territorial disruption.

From Territorial Disruption to Distributed Resilience

After counterinsurgency pressures began in 2021, ISMP made media production and propaganda validation more central to its operations. Prior to this, ISMP’s coherence was rooted more heavily in territorial control, smuggling corridors, and kinetic activity across Cabo Delgado. Once militarised operations disrupted that spatial substrate, the group increasingly depended on the global Islamic State propaganda ecosystem to preserve visibility, validate attacks, and maintain coherence among dispersed actors operating under the same banner.

This media-based adaptation increased the importance of trust nodes. Although Islamic State-linked media remains present on Facebook, Instagram, TikTok, and X, moderation has pushed much of the mainstream ecosystem toward an outer layer of redirect pathways. In this way, mainstream platforms often serve as a discovery layer, exposing users to fragments of content, supporter accounts, or coded references. The deeper trust architecture forms across less accessible and less moderated channels on platforms such as Telegram, Rocket.Chat, Element, online archival sites, and Google Drive repositories. There, access depends less on discovery than on trusted navigation: users must rely on trusted nodes for access to links, channels, files, accounts, and distribution pathways after takedowns, suspensions, or migration.

The Mozambique case reflects a shift in priority toward this online ecosystem. A 2024 report published by the Hudson Institute found that global Islamic State social media outlets were initially slow to post about events in Mozambique, which the authors suggest indicated “limited communication between fighters on the ground and central coordinators.” By late 2023, however, the authors note that attack attributions from Mozambique were usually published within two days of occurrence, suggesting that ISMP’s connection to the global Islamic State media system had become more functional during the post-intervention period.

Hansen and Bary similarly show the extent to which ISMP became visible inside the global Islamic State propaganda ecosystem after the 2021 intervention. Between May 2022 and May 2023, ISMP received thirty-seven front-page articles in Al-Naba, the Islamic State’s online weekly news publication. Of the 208 Al-Naba articles carrying African themes during this period, roughly 20 percent focused on Mozambique. In March 2024, Caleb Weiss further noted that ISMP led global Islamic State affiliates by total media output by that point in the year. In this way, ISMP became significantly more visible in the online space despite the severe degradation of its local operational capacity.

The results of this online expansion are tangible, with the recruitment of regional and global fighters into ISMP ranks demonstrating the reach of the group’s media footprint. A March 2024 report from the Soufan Center noted that the group had attracted fighters from across much of Africa, including the DRC, Kenya, Rwanda, South Africa, and Tanzania. In May, a French court convicted six men who attempted to travel to Mozambique with the stated intention of joining ISMP, highlighting the group’s global visibility. These recruitment patterns show that ISMP’s trust-based online ecosystem does not merely broadcast narratives, but also makes the group legible to dispersed audiences as a viable destination.

Taken together, these indicators suggest that ISMP’s post-2021 adaptation cannot be understood primarily through military or territorial metrics. As counterinsurgency pressure fragmented the group’s operating environment, propaganda became part of the infrastructure through which ISMP remained recognisable, validated, and operationally coherent. Its media footprint helped build and maintain the trust nodes needed for dispersed actors to continue operating as part of the same Islamic State project.

Figure 1. Issue 365 of al-Naba featured an editorial celebrating the founding, history, and current activities of the ISMP in November, 2022.

Figure 2. An infographic by pro-IS media outlet Halummu from 2022, showing ISMP’s resilience despite counterinsurgency efforts at the time.

Financial and Operational Resilience

ISMP’s post-2021 revenue model is a distributed system of local coercion made resilient by a shared online recognition ecosystem. The group generates value through roadblock extortion, mobile-money payments, mining-site pressure, timber and mineral flows, weapons seizures, cash-out collaborators, and broader facilitation pathways. Local trust, weak identity controls, mobile money, and regional facilitation explain how value moves; the online ecosystem keeps scattered coercive acts, payment chains, resource sales, and operational outputs coherent as Islamic State activity.

Ransom activity illustrates this model. Payments move through mobile-money services such as M-PESA, e-Mola, and mKesh, with victims instructed to transfer funds to accounts controlled by ISMP collaborators in urban areas. Reports indicate that ISMP has targeted buses and commercial vehicles on the N380, where passengers can quickly raise payments through mobile-money accounts, generating ransoms of up to US $600 per passenger. Zitamar News reported that such payments are enabled by weak know-your-customer (KYC) protocols, fake identities, and cash withdrawals without proof of identity. This chain separates the coercive actor, account holder, cash-out collaborator, and ultimate recipient.

Royal United Services Institute (RUSI) fieldwork reinforces the limits of transaction-led analysis. Payments to fighters’ family members were only legible once analysts identified sender-recipient relationships, while mobile-money operators also identified small, precise transfers that appeared to function as covert communications between insurgents. These findings illuminate partial mechanisms—kinship, coded transfers, weak KYC, and cash-out infrastructure—but not how dispersed financial, coercive, and facilitation actors remain part of a coherent insurgency. In a system spanning roadblocks in Cabo Delgado, urban cash-out points, cross-border corridors through Tanzania and South Africa, and recruitment networks reaching as far as Europe, in-person or kinship-based coordination alone cannot explain ISMP’s financial continuity. The online ecosystem is therefore the clearest explanation for how separated actors continue to treat these activities as valid parts of the same Islamic State project.

A 2025 African Security Analysis report, citing Mozambique’s financial intelligence unit, estimated that ISMP moved roughly US $7 million through fragmented deposits, structured withdrawals, and layered banking and mobile-money transfers between 2017 and 2024, involving mobile-money agents, traders, cash withdrawals, public-sector conduits, and cross-border corridors. This scale and diversity make clear that ISMP’s financial system cannot be reduced to kinship transfers or coded mobile-money signals. Those mechanisms help explain how some values and messages move; they do not explain how a geographically dispersed system of coercion, cash-out infrastructure, resource conversion, and regional facilitation remains connected to the Islamic State project under sustained pressure.

The same logic applies to resource extraction and battlefield resourcing. ISMP has increased pressure around artisanal gold and gemstone mining, including forced contributions and demands for access to resources. Authorities estimate the group has generated US $30 million from pilfered ruby sales alone, suggesting that the US $7 million in identified banking and mobile-money flows captures only a conservative slice of a wider value-conversion system. ACLED notes that there is no evidence that ISMP directly controls mining operations, pointing instead to distributed value conversion rather than formal extractive administration. Weapons seizures close the loop: captured materiel reduces procurement needs, while Islamic State media converts battlefield resourcing into proof of capability.

External connectivity is what turns this local adaptation into a wider risk. Islamic State funding to Mozambique has historically flowed through the Somalia-based al-Karrar office, using hawala services, physical cash deliveries from South Africa and Tanzania, and mobile-money transfers to support ISMP’s local operations. This places ISMP’s revenue adaptation inside a regional financial architecture dependent on trusted brokers, couriers, transfer channels, and recognition from the wider movement.

That architecture matters because Cabo Delgado’s gold and gemstone deposits, rare timbers, hydrocarbon investment, and on- and offshore smuggling routes create significant revenue opportunities for a group already expanding through local illicit economies. ACLED notes that ISMP may no longer rely as heavily on external IS support, raising the possibility that it could evolve from a recipient node into a contributor to the global IS project. The shift would invert the conventional affiliate model: ISMP would no longer be understood mainly as a peripheral branch requiring external support, but as a resource-rich node capable of generating value for wider Islamic State networks through al-Karrar-linked or successor facilitation structures.

ISMP’s propaganda ecosystem, therefore, sits upstream of the transaction. It need not carry every payment, signal, or instruction directly; it preserves the recognition layer through which payments, routes, accounts, resource claims, weapons seizures, and coercive actions remain intelligible as Islamic State activity. In this model, propaganda sustains recognition; recognition sustains trust; trust enables distributed finance; and distributed finance restores operational capacity.

Figure 4. ISMP fighters pose with captured weapons, munitions and explosives in July 2022. The image contains the IS media watermark and other elements used to authenticate content within the movement’s online ecosystem at the bottom.

Recommendations

First, authorities should distinguish mapping thresholds from enforcement thresholds. ISMP-related financial infrastructure should not be mapped only after a suspicious transaction, designation, or request for private data. Analysts should begin with open-source and platform-visible indicators: propaganda archives, channel migration, claim timing, route references, broker mentions, donation language, account reuse, and recurring facilitation signals. These indicators may not be actionable on their own, but they can build structured confidence around where trust nodes, payment pathways, and regional facilitation are forming.

Second, platforms, FIUs, and counterterrorism analysts should use these open-source indicators to construct AI-assisted trust-node maps before seeking more intrusive data access. FIU outputs – suspicious transaction reports, mobile-money anomalies, structured withdrawals, account churn, coded transfers, and cash-out points – should be compared against observable online behaviour. Where the same corridors, actors, accounts, or facilitation routes recur across both environments, they should be treated as pre-transactional indicators of network resilience rather than coincidental overlap.

Third, this model should operate within existing legal frameworks rather than bypass them. Under rights-based regimes such as GDPR, behavioural risk mapping should be structured around necessity, proportionality, data minimisation, human review, and clear purpose limitation. The point is not to treat behavioural analytics as a shortcut to enforcement, but to use corroborated, lower-intrusion indicators to justify whether further access, lawful sharing, FIU escalation, or network-level disruption is warranted.

Fourth, Mozambique’s mobile-money vulnerabilities should be treated as operational chokepoints. Weak KYC protocols, fake identities, and cash withdrawals without proof of identity allow coercive actors, account holders, and cash-out recipients to remain separated across jurisdictions. Mozambican regulators and relevant regional partners should focus on KYC floor requirements for mobile-money agents in Cabo Delgado and adjacent provinces, reporting thresholds for structured withdrawals, and SADC-region FIU coordination around flows through Tanzania and South Africa.

Finally, authorities should monitor how al-Karrar-linked facilitation adapts after pressure or disruption. When pressure falls on a facilitation node or its operating environment, the network must often reconstitute through new brokers, corridors, account clusters, and authentication channels. Those replacement patterns can reveal more than a single transfer, post, or account. Recurring overlap between online recognition, behavioural signals, cash-out infrastructure, and regional facilitation should therefore be treated as evidence of successor-node formation.

Image source

On October 10, 2024, Toronto-Dominion (TD) Bank agreed to pay approximately US $3.09 billion to U.S. regulators – the single largest penalty ever imposed under the Bank Secrecy Act (BSA). The financial consequences extended beyond the headline figure: compliance overhauls, independent monitors, legal expenses, and operational restrictions materially affected the bank’s U.S. business. Senior executives departed, compensation was reduced, and branch-level employees now face criminal charges.

According to the U.S. Department of Justice, between January 2018 and April 2024, TD’s transaction monitoring program failed to review approximately 92% of its transactions — representing activity collectively valued at more than $18 trillion. Within that same period, three criminal networks with ties to drug trafficking organizations transferred over $670 million in illicit funds through TD accounts.

But the magnitude of the penalty — and its ramifications for TD and the broader banking sector — underscores something more unsettling. If criminal networks were able to move over half a billion dollars through a major financial institution over multiple years – despite the presence of formal monitoring systems – the underlying laundering infrastructure was not opportunistic. It was operationally mature.

While the TD case represents a particularly egregious breach of a major financial institution by bad actors, the vast demand to enter these systems by an expanding global criminal services market makes it a powerful warning of the dangers posed by a lack of action amid a global surge in parallel financial activity.

Investigation and findings

Federal authorities began investigating cartel-linked laundering activity in the New York tri-state area in the early 2020s. In one instance, agents reportedly tailed a box truck transporting bags of bulk cash that were deposited across multiple bank branches, with TD locations featuring prominently. The ringleader of these activities was Da Ying (“David”) Sze, a Chinese-born resident of Queens, New York. According to court filings, Sze’s network laundered approximately $653 million, roughly $470 million of which moved through TD Bank. A subsequent congressional report noted the network moved funds to thousands of individuals and entities across the United States, China, Hong Kong, and other jurisdictions.

Read more

Image from a previous police raid on Deutsche Bank that occurred in 2018

On January 28, German police prosecutors raided the Berlin and Frankfurt offices of Deutsche Bank, the largest financial institution in the country. The surprise raid came just one day before the company was set to release its 2025 earnings report, causing share prices to immediately plummet by around 3%. At least 30 plainclothes investigators entered the offices around 10am local time, targeting a “yet unknown” number of employees. According to prosecutors, their investigation surrounds companies suspected of money laundering on behalf of entities tied to sanctioned Russian oligarch, Roman Abramovich.

This raid is illustrative of a much broader trend.

The last few years have delivered a steady slew of headlines about major law enforcement actions against banks suspected of money laundering and falling prey to criminal influence. Last year, the U.S. Treasury made the unprecedented move of sanctioning three Mexican banks as a primary money laundering concerns in connection with opioid trafficking. In 2024, Canada’s TD Bank agreed to pay a record $3 billion in fines in connection with money laundering for the Sinaloa and other Mexican drug cartels; Canada’ FINTRAC imposed nearly $10 million in additional fines against the bank. Crypto exchanges are at the front lines of such punitive measures, with Binance agreeing to pay a $4.3 billion in fines and restitution in a 2023 deal with US regulators enforcement. Last year, FINTRAC imposed a record $177 million in fines against crypto exchange Xeltox in connection with darknet markets, child abuse, fraud, and ransomware.

These are not compliance failures, but failures of perception. Institutions are operating with risk models built for a world in which illicit finance was episodic, traceable, and external to core liquidity systems. That world no longer exists.

While laundering techniques evolve incrementally, detection regimes evolve retroactively. Capital that clears today under acceptable assumptions is increasingly reclassified tomorrow as sanctionable, tainted, or facilitative. Institutions that do not adapt in advance are not merely exposed — they are accumulating latent enforcement risk they cannot unwind. Evidence suggests the consequences are increasingly unaffordable, prompting the need for proactive measures.

Shwe Kokko, Myanmar: built in a civil war and financed through Chinese state investment, the multi-billion-dollar militant-backed city now serves as a notorious hub for cyber scammers.

Parallel financial infrastructures

Massive, parallel liquidity architectures now operate alongside regulated global financial markets. These systems emerged to serve actors excluded from the formal financial system and have proliferated amid rapid fintech innovation, tightening sanctions regimes, and rising geopolitical polarization.

Read more

Part I:

Part II:

This piece is more technical than much of my prior work. It is intended as a conceptual and analytical framework rather than a narrative essay, and is written for readers interested in understanding the structural mechanics of unregulated capital flows and their downstream security implications.

I am publishing it in the belief that clearer analytical tools are necessary if institutions are to anticipate and disrupt emerging threats more effectively. Readers who find this work useful, or who are working on related problems, are welcome to contact me directly at info@btl-research.com.

In work published over the past several months, I have emphasized that unregulated capital flows I term “shadow liquidity” consistently manifest as powerful downstream threats. Whether terrorist groups in Sub-Saharan Africa leveraging illicit networks to smuggle resources and procure weapons, or scam centers and drug cartels exploiting complex liquidity architectures, the global shadow financial ecosystem has become markedly more dangerous.

I developed a three-tier framework to explain how these parallel financial architectures operate and why they generate persistent downstream harm. Tier 2 consists of a vast layer of globally connected financial intermediaries that move value outside formal legal and regulatory oversight. Tier 3 sits downstream of these flows and includes criminal organizations, militant groups, and terrorist networks that exploit Tier 2 infrastructure to finance operations and project predation and violence.

Tier 1 is where the threat ultimately originates. At this level, large pools of wealth—often held by corrupt officials, politically exposed persons, and other elites in tightly controlled capital markets—seek to externalize assets to safer jurisdictions. This demand for offshore mobility creates the economic foundation for Tier 2 networks, which are then leveraged by Tier 3 actors, with or without direct state involvement.

These dynamics likely involve hundreds of billions of dollars annually, much of which fuels instability, entrenches criminal economies, and contributes to the impoverishment and coercion of millions of people worldwide. In recent work for the New Lines Institute, I documented how militarized scam syndicates in Southeast Asia and Latin American drug cartels (Tier 3) tap into Tier 2 infrastructure that moves billions of dollars annually in response to Tier 1 demand originating in the tightly controlled Chinese capital market. My most recent work for Between the Lines shows how Iran leverages a similar three-tiered structure to finance its proxy networks and externalize elite wealth.

Each of these systems is inherently destabilizing, not only for downstream societies targeted by criminal and militant activity, but also for the states at the origin point, where capital flight erodes economic resilience and governance over time. For this reason, understanding the origin of unregulated capital flows at Tier 1 is imperative for global security.

The three-tier framework illustrates how unregulated capital flight and its facilitators at Tier 1 and Tier 2 translate into downstream criminal and militant threats at Tier 3.

Read more

Primer: How This Piece Got Here

This essay has already lived a small life of its own.

Since July, it circulated through several major legacy outlets. Some passed quickly and professionally; others expressed enthusiasm, requested time-consuming revisions, and ultimately stepped back for reasons that were never fully articulated. The responses varied, but the pattern was clear: uncertainty around unfamiliar frameworks, discomfort with material that sits outside conventional editorial lanes, and a broader hesitancy to publish work that challenges inherited assumptions.

The experience reinforced something that is only now beginning to shift. As recently as this past summer, traditional media still treated illicit liquidity as a peripheral issue. But the field is finally catching up. The traction my newer work has gained—across policy, enforcement, and analytical circles—reflects a broader recognition that liquidity is central terrain, not an auxiliary concern. The industry is evolving, even if the legacy editorial machinery has been slower to recognize the shift.

This piece was written to explain that evolution—how illicit liquidity systems now outlast militaries, sanctions regimes, and enforcement architecture itself—and why understanding this shift is no longer optional. Its publication journey ended up mirroring its own thesis: frameworks built for a previous era often struggle to accommodate the realities of the present one.

Since writing it, I’ve expanded and refined many of the concepts it introduced, but this remains the originating document. I am publishing it here in the form it was meant to take—not diluted, not retrofitted to an older template, and not reshaped to fit the boundaries of legacy formats. If those outlets revisit this space later, they can. My readers don’t need them to recognize the stakes.

Below is the full piece, unchanged except for minor clarity edits—the version that wasn’t designed to make anyone comfortable, but to make the problem clear.

Read more

No one has ever accused me of being an optimist — especially if they’ve read Between the Lines.

However, today I’m staking out a position of cautious optimism on one of the hardest problems in financial intelligence: getting a handle on illicit crypto flows, especially when it comes to designated terrorist groups.

To be clear: nothing in this field will ever be perfect. Threat finance is adaptive by design. But after tracking this space for years, I’m convinced the scales are tipping in ways that make overwhelming pessimism harder to sustain.

Here’s why.

Data aggregation

Every crypto transaction leaves a digital trace. Even if pseudonymous, it’s still a ledger entry — vastly different from the opaque networks of hawala or bulk cash smuggling.

The successful takedown of illicit Monero transactions by Japanese National Police is proof that anonymity tech can be pierced when regulators and enforcement pair data with persistence. Practitioners in the blockchain analysis space have told me that anonymous tokens are not as anonymous as some would have you believe.

The problem right now is that it takes a lot of people to find and process the data needed to track illicit flows and the industry struggles to keep up. That’s where AI comes in — to turn the overwhelming volume of raw data into actionable detection.

AI development

Several blockchain analytics firms are already layering machine learning into their platforms — using AI to catch anomalies humans miss. But they are not the only ones.

The Defense Advanced Research Projects Agency (DARPA) is currently developing a programme called Anticipatory & Adaptive Anti–Money Laundering (A3ML). In a recent podcast, the A3ML project lead commented his team’s goal is to make money laundering “too expensive” by dramatically increasing the effectiveness, speed, and scale of detection using artificial intelligence (AI). Because money laundering is defined by scale, speed, and complexity — exactly the domains where human investigators are outmatched and algorithmic detection excels — AI could be a genuine gamechanger.

DARPA has been quietly promoting A3ML for months, meaning it is well past the idea stage. With leading analytics firms already incorporating AI into their products, the use of AI in this field is no longer hypothetical. Given the rapid speed of advancement in current AI technologies, the efficacy of these products is likely to improve dramatically in the coming months and years.

Regulatory reform

The European Union’s MiCA regime, the U.S. GENIUS Act, and Hong Kong’s stablecoin ordinance all point to a growing global consensus that crypto markets can and must be regulated. The traction my recent articles on unregulated crypto regimes have gained underscores that this isn’t just a policy shift — there’s real appetite across the field to understand and address these risks.

I believe enforcement will continue moving toward a preponderance standard — acting whenever aggregated signals indicate illicit activity is more likely than not, rather than waiting for airtight proof. In practice, that standard favors systems that can aggregate patterns, spot anomalies, and connect disparate signals faster than any manual investigation — exactly the kind of connective tissue that AI-driven systems can surface better than human investigators. Yes, gray jurisdictions will still exist, but in a world where dollar clearing still reigns supreme, the preponderance model will leave them increasingly isolated and deprived for non-compliance.

Terrorist finance: tip of the spear

Terrorist finance is likely to feel the impact of this enforcement shift before other domains. The reason is twofold. First, national security considerations ensure that counter-terrorism receives the highest priority for resources, political will, and legal innovation. Governments simply cannot afford to take a passive stance when designated groups are exploiting new technologies.

Second, counter-terrorism already has over two-decades-worth of laws, regulations, and intelligence cooperation to build upon — from FATF standards and UN Security Council resolutions to domestic tools like the U.S. Patriot Act and equivalent frameworks worldwide. That foundation makes terrorist finance the most immediate proving ground for applying aggregated data and AI-enabled detection under a preponderance standard, before those same methods expand into broader areas of illicit finance.

Conclusion

Progress in this field isn’t measured by perfection — it’s measured by whether the system gets harder for bad actors to exploit. And by every sign — data aggregation, AI adoption, and regulatory convergence — we’re moving in that direction.

Caution is still warranted; threat finance adapts. But the fatalism that says this space is uncontrollable no longer matches reality. There is much work to be done in mapping these systems moving forward, but on this issue at least, I am cautiously optimistic.

Note: This article is in part a preview of a bigger piece I’m currently working out. Also, stay tuned for the long-awaited Part II of my China military series.

Image source

FinCEN’s new advisory on Chinese Money Laundering Networks (CMLNs) underscores a truth often missed in enforcement reporting: these are not isolated laundering schemes but components of a parallel financial architecture, a shadow liquidity system now entrenched across the Americas and around the world.

The advisory contains staggering numbers: over 137,000 suspicious activity reports (SARs), $312 billion in suspicious flows, and the same trade-based, over-the-counter (OTC), and insider-driven mechanisms. The underlying systems that set off these alerts are the connective tissue that allow sanctioned states, cartels, and elites to thrive despite formal financial controls.

FinCEN frames this as “Chinese money laundering.” And when it comes to cartel finance, Chinese enablers are indeed the most visible. Yet they are only part of a parallel financial architecture — a global ecosystem where Chinese actors are central, but not alone. Other state and non-state players drive and exploit these flows as well. Until regulators and analysts treat shadow liquidity as infrastructure, rather than a collection of anomalous SARs, enforcement will remain reactive while the networks evolve faster than the tools meant to stop them.

Subscribe now

Bigger than you think, and more chaotic

These laundering networks are diffuse, but global. They service multi-billion-dollar scam operations in Southeast Asia, terrorist groups like the Houthis, and emerging criminal enclaves in Africa and Latin America. The FinCEN advisory highlights just some of their embeddedness in Western societies, underscoring the scope of this problem.

The sort of networks FinCEN highlights aren’t just laundering for cartels — they’re tapping into a much larger reservoir of Chinese shadow capital. Crypto-enabled, OTC-driven liquidity rails emerged first to move elite wealth offshore, but over the past decade they’ve evolved into a parallel financial architecture. These flows no longer sit neatly under Beijing’s command; they form a sprawling ecosystem of brokers, gray banks, scam centers, and informal clearinghouses that operate beyond the reach of both Western enforcement and the Communist Party itself.

This is what makes the threat so destabilizing: it’s not simply “Chinese laundering,” but a decentralized liquidity system born from state and elite outflows that now finances everything from fentanyl supply chains to dual-use tech procurement. In other words, what started as controlled leakage has become a global shadow infrastructure — chaotic, adaptive, and only partially answerable to any state.

Drug cartels, scammers, and terrorists are just the visible tip of this hidden architecture. They set off SARs and grab headlines, but they are a symptom, not the disease. To understand how we got here, Between the Lines has developed a three-tiered model that tracks the money cascade from its source.

Read more

Illicit finance is no longer episodic crime. It has matured into shadow liquidity systems: parallel infrastructures where state actors, cartels, mercenary groups, and cybercriminals pool and regenerate capital. These systems – empowered by digital currencies and vast capital outflows – function as underground financial institutions, enabling adversaries…

Read more

PDF Soldiers hunt for IS-S operatives in the Cal Miskaad mountains in January 2025. Image source

On July 25, U.S. Special Operations Forces captured Islamic State–Somalia (IS-S) leader Abdiweli Muhammad Yusuf in a targeted raid near Dhaardaar, Puntland. U.S. Africa Command (AFRICOM) and the Puntland Defense Forces (PDF) describe Yusuf as a senior financial facilitator in IS-S’s regional network—labeled in several outlets as the group’s “finance chief.” He reportedly served as Emir of Maktab al-Karrar (al-Karrar Office), which oversees Islamic State financial operations across eastern and southern Africa.

The operation to capture Yusuf, conducted near Dhaardaar in Puntland, follows a broader uptick in U.S. intelligence-led strikes against jihadist factions in East Africa. Although global security is no doubt improved by Yusuf’s new life in U.S. custody, the networks he oversaw have likely already begun to adapt to his absence. Targeting them will require a similar adaptation in counter threat finance moving forward.

A regional hydra

It’s not that Yusuf was unimportant—I flagged him in an article back in February. But what that piece made clear was this: the system he supposedly presided over is far more resilient than any one individual.

Al-Karrar is the largest fundraising node in IS’s global operation. It manages a sophisticated patchwork of hawaladars (informal money transfer agents), crypto brokers, and administrators spanning much of eastern and southern Africa. Its fundraising includes ransom kidnappings and pig-butchering scams in South Africa. It also maintains close ties to groups like Mozambique’s al-Shabab (not to be confused with the Somali group), which allegedly generates over $20 million annually through illicit timber and resource smuggling.

According to several reports, Al-Karrar is also the main financial backer of Islamic State Khorasan Province (ISKP)—the IS branch behind deadly attacks in Iran and Russia and multiple foiled plots in Europe. Funds appear to move through informal remittance corridors from Somalia to Central Asia, often mediated by crypto brokers and hawala facilitators.

In short, it’s fairly large operation comprised of a broad patchwork of transregional operators.

The architecture that sustains terror

Just like in a major corporation or bank, senior terrorist financial operators—even those at the top—are ultimately replaceable. Finance is a trade: complex, but not rarefied. Puntland may not attract Wall Street-level talent, but it has nonetheless produced a resilient and international cohort of operators skilled in transnational illicit finance.

The architecture that sustains these networks—informal corridors, crypto rails, hawaladars, local extortion, and commodity-based laundering—remains largely intact. These are not fragile hierarchies. They are decentralized ecosystems designed to survive leadership decapitation.

Kinetic operations may produce short-term friction, but they do not dismantle decentralized financial ecosystems. The true point of leverage lies in targeting the liquidity infrastructure itself: the stablecoin brokers, hawala corridors, illicit exchanges, and jurisdictional blind spots that allow terrorist networks to persist, adapt, and regenerate.

The bottom line

Degrading terrorist finance requires more than leadership targeting—it demands structural engagement. That means addressing the financial ecosystems that outlast individuals. From stablecoin rails to commodity laundering and informal remittance routes, these systems must become the focus of counter–threat finance strategy. Tactical successes only translate into durable gains when we challenge the infrastructures that sustain insurgency and transnational violence.

More to come. Stay tuned.

Sovereignty is often depicted as the ability to control territory and govern people. In reality, it is fundamentally the capacity to generate and direct liquidity—to move value, fund loyal networks, and project power across borders. Liquidity is not merely a financial tool; it is the circulatory system of modern power.

Militant groups today function as alternative liquidity states, building informal financial scaffolds that blend local cash taxation, resource extraction, and transnational flows. By leveraging technological advances—such as crypto-enabled remittance networks, digital payment rails, and global e-commerce platforms—these actors have developed a form of sovereignty unparalleled in modern history in terms of flexibility, deniability, and resilience.

This liquidity sovereignty enables groups to persist and adapt even after losing territory, charismatic leaders, or formal hierarchies. It is not ideology or battlefield victories alone that sustain them, but their mastery of hidden liquidity architectures — sovereign ecosystems in their own right—that quietly underwrite violence, influence, and long-term survival.

Islamic State networks — Fragmented yet digitally adaptive

The Islamic State’s global branches primarily rely on hyperlocal cash generation — including micro-extortion, petty taxation, and opportunistic resource control — to survive. Yet it is their evolving digital liquidity architecture that sustains them as a transregional threat.

Read more

A makeshift refugee camp in Cambodia’s Oddar Meanchey Province. Image source

Up until only a few months ago, the disputed stretch between Thailand and Cambodia was a quiet landscape of temples visited by people from both sides of the border. In the summer months, this region—known as the Emerald Triangle for its dense forests—can feel like it’s baking in the mid‑40s Celsius, the heat broken only by heavy rains that sometimes clear into spectacular golden sunsets under flamingo pink skies. The ancient sites—and the communities that sustain them—reflect a shared lineage: both peoples trace their roots to the Khmer Empire, once centered near today’s Angkor Wat, until the Sukhothai ancestors of the modern Thai state broke away in the mid‑13th century.

The heart of the border dispute lies in boundaries drawn during the French colonial era, when early 20th‑century treaties fixed a rigid line across what had long been a fluid cultural frontier. The region has since known intense war and instability, albeit previously unrelated to this haphazard border demarcation. From 1967 through 1998, Cambodia endured a brutal civil war that drew in both regional and global powers, leaving its territory among the most heavily land mined on earth. On July 23, one of those remnants maimed five Thai soldiers, prompting shutdowns of both countries’ embassies.

Nevertheless, until only a few weeks ago, the borderlands had settled into a decades-long calm, with people from both sides enjoying picnics at temple sites. According to official reports, Thai soldiers became agitated when Cambodians sang their national anthem at one of these sites, and that’s around when the violence intensified. Nobody seems to have wanted this war, and if you watch accounts like Preston Stewart’s, the Cambodian troops were so unprepared that many are fighting in t‑shirts and flip‑flops.

Recent headlines have been dominated by deadly clashes along the disputed border. Most of those killed have been civilians, with both militaries blaming each other for targeting innocents. Thus far, clashes between Thai and Cambodian troops along the two countries’ disputed border have killed at least 14 people and displaced 120,000 others.

Like most things in Southeast Asia these days, there’s much beneath the headlines. Along this stretch of frontier, Chinese-run scam centers and the illicit capital they generate form part of the conflict’s backdrop—and while it’s too early to call them the driving force, their weight is too significant to ignore.

This piece will unpack that dimension and explain how illicit economies intersect with the border tensions in ways most coverage has missed.

A little context

I knew something was off when Thai authorities suspended the leadership of Prime Minister Paetongtarn Shinawatra, the youngest in the country’s history and only the second woman to hold the post, over a call with former Cambodian Prime Minister Hun Sen. In the leaked conversation, Paetongtarn addressed Hun as “uncle,” offered to “take care of anything you need,” and described Thailand’s top general as “opposing” and out of step with the nation’s interest—remarks that ignited accusations of compromising sovereignty and deference to Cambodian influence. We’ll likely never know the full context of that exchange, but there is much to parse between the lines.

Read more

Introduction — Beyond Asia

Southeast Asia’s scam compounds — fueled with liquidity from Chinese capital flight — have become synonymous with industrial-scale fraud, human trafficking, and gray finance. From the infamous enclaves of Cambodia’s Sihanoukville to the lawless border zones in Myanmar and Laos, these semi-sovereign illicit ecosystems extract a staggering toll, primarily targeting people in mainland China through sophisticated scams and coercive trafficking operations. According to Interpol estimates, they feed into a $3 trillion global underground economy each year.

Although these networks are closely linked to Chinese state-led investment flows, they have rapidly evolved beyond Beijing’s effective control, forcing violent yet largely ineffective cross-border crackdowns. Now, these scam syndicates are turning their attention outward — expanding into Africa, Latin America, and ultimately, Western markets. In doing so, they threaten to become not just a regional crisis but a global liquidity parasite, undermining legitimate economies and corroding financial sovereignty worldwide.

Subscribe now

Why Africa and Latin America?

Africa and Latin America have become increasingly attractive hubs for illicit financial networks and scam operations — and the reasons are both structural and strategic.

First, these regions offer regulatory weakness and pervasive corruption, creating fertile ground for criminal enterprises. Countries such as Nigeria, Ghana, Kenya, and South Africa in Africa, as well as Brazil, Colombia, and Mexico in Latin America, have seen a rapid rise in scam and laundering infrastructure precisely because local enforcement remains fragmented and often politically compromised.

Second, the rise of new digital middle classes in these regions provides a vast pool of fresh, soft targets. As millions of people come online, often without robust digital literacy or strong consumer protections, they become ideal prey for sophisticated social engineering campaigns and financial fraud schemes.

Third, operating from Africa and Latin America provides distance from Asian enforcement pressure. As authorities in China and Southeast Asia crack down on certain scam and laundering networks, criminal actors strategically shift to jurisdictions with weaker oversight and fewer extradition treaties.

Fourth, these regions enjoy proximity to European and North American markets, combined with linguistic and cultural familiarity (English, Spanish, French). This makes it significantly easier to craft scams that resonate with Western emotional and financial vulnerabilities — whether impersonating local authorities, exploiting charitable causes, or manipulating diaspora ties.

Finally, the emergence of advanced AI tools has dramatically lowered the barrier to entry for these networks. AI allows operators in Africa and Latin America to simulate highly convincing Western identities, tailor emotional manipulation at scale, and automate entire scam ecosystems with precision. This convergence of regulatory gaps, technological capacity, and cultural access creates an almost perfect storm for transnational financial exploitation.

The True Objective: Systemic Liquidity Extraction

The ultimate goal of these networks is not simply small-scale fraud or opportunistic scams — it is the deliberate, engineered siphoning of capital out of vulnerable systems on a massive scale. This is what I call systemic liquidity extraction: large, sustained flows designed to hollow out economic and social resilience from within.

Rather than quick-hit financial crimes, these operations weaken social trust in digital systems, creating long-term skepticism toward online platforms, payment rails, and even centralized financial institutions. By undermining user confidence, they create an environment in which alternative (and often illicit) rails can thrive with less scrutiny.

In a landmark case, North Korea’s Lazarus Group, nearly stole $1 billion from the Bangladeshi Central Bank until their transfers were intercepted by authorities in the Philippines. If hackers can nearly execute a financial crime of this scale, the risk to broader systems is enormous.

At a higher level, illicit networks reinforce the architecture of offshore and shadow liquidity sovereignty — allowing bad actors to control, store, and redeploy value outside regulated channels. A clear example is the Huione case, where payment platforms linked to the Chinese language criminal ecosystem (like Huione Pay) have enabled scam and trafficking groups across Southeast Asia to move billions in illicit proceeds while residing in armed and fortified “scam cities”. By operating in weakly regulated environments and offering integrated messaging, payment and layering tools, Huione effectively creates a private, opaque financial system. The network even helped the Iran-backed Houthis move illicit funds. This shadow sovereignty provides strategic flexibility and covert geopolitical leverage, allowing actors to shape markets, destabilize rivals, and shield assets from enforcement or sanctions.

Chinese criminal syndicates, already deeply embedded in Western underground financial and criminal ecosystems, play a central role in this extraction strategy. The most prominent example is their extensive role in laundering money for Mexican drug cartels, but there are many others — including seemingly niche operations like illegal baby eel smuggling on Canada’s East Coast. Over years, these networks have built cross-border laundering structures ranging from casino junkets and underground banks to large-scale e-commerce fraud, giving them direct access to Western liquidity. Their operational maturity allows them to move funds quickly and invisibly into offshore havens, fueling both private enrichment and broader state-aligned objectives. Should these networks become intertwined with expanding global scam operations, their ability to siphon from their host societies would become even greater.

Finally, aging Western societies are particularly susceptible to these scam-driven extraction economies. Older populations often hold disproportionate liquid wealth and are more vulnerable to targeted social engineering, especially as loneliness and digital illiteracy compound emotional susceptibility. As demographic trends continue to skew older across Europe and North America, the scale of potential liquidity siphoning — and corresponding social destabilization — will only grow.

Why Current Responses Fail

Today’s regulatory and enforcement responses are fundamentally reactive, designed to address individual scams or laundered transactions rather than dismantle the systemic financial scaffolding that enables them.

For example, in Australia, banks shut down fewer than 13,000 mule accounts last year despite over 100,000 being exploited. A mule account is a bank account controlled by an intermediary who moves illicit funds on behalf of criminal networks, making it harder for authorities to trace and seize core assets. In another example, in the US, despite losing an estimated $44 billion annually to “pig-butchering” scams, regulators have focused on freezing individual accounts rather than dismantling the networks enabling Chinese syndicates to exploit U.S. bank accounts at scale. Pig butchering is an especially pernicious and increasingly common form of scamming where perpetrators emotionally groom their victims over time, often through romance or investment schemes, before manipulating them into transferring large sums of money into fraudulent platforms controlled by criminal networks.

These examples illustrates a focus on surface-level symptoms rather than dismantling the underlying laundering networks. Instead of treating these networks as strategic threats to economic sovereignty, they are managed as isolated criminal or compliance issues. There is no global framework capable of addressing the structural nature of these transnational scam and laundering hubs. Multilateral efforts target symptoms — not the liquidity networks sustaining them.

According to the Financial Action Task Force’s (FATF) July 2025 report (where I am cited several times), 69% of jurisdictions face major or structural deficiencies in countering terrorist financing — even as vulnerabilities continue to multiply. Similarly, the United Nations Office on Drugs and Crime’s (UNODC) annual report highlights that global responses remain fragmented and reactive, targeting individual cases rather than dismantling cross-border laundering infrastructures.

Finally, weak regulatory regimes have little incentive to change, as these shadow flows often bolster local elites, provide off-books revenue streams, and help maintain fragile patronage systems. In the absence of a fundamental shift in how we perceive this burgeoning parasitic financial ecosystem, many more will inevitably fall prey to it worldwide.

Closing Warning

These scam centers are no longer merely regional nuisances; they are mutating into global economic pathogens. Left unchecked, they will embed themselves as sovereign liquidity parasites, quietly draining our societies from within — hollowing out social trust, weakening regulatory legitimacy, and siphoning capital at scale.

There is still a way to stop them — but it requires a complete shift in how we see them. We must recognize these networks as strategic infrastructure threats, not just criminal annoyances, and move toward dismantling their liquidity architecture as a core element of national and economic security strategy.

Subscribe now

Inner Circle Tier Exclusive:

The Liquidity Kill Switch: Designing the Doctrine to Dismantle Global Fraud Hubs and Terrorist Finance Networks

There is still a way to stop them — but it requires a complete shift in how we see them. We must recognize these networks as strategic infrastructure threats, not just criminal annoyances, and move toward dismantling their liquidity architecture as a core element of national and economic security strategy.

In my upcoming briefing, exclusively for Inner Circle Tier members, I will provide:

• Tools to economically disarm scam centers at scale, cutting off the oxygen that keeps them alive.

• A detailed breakdown of integrated kill switch strategies — spanning financial rails, digital infrastructure, and on-the-ground physical choke points.

• Discover real-world incentive levers to compel host governments to act, even when local elites benefit from scam economies.

• A practical roadmap designed for policymakers, regulators, and private compliance teams looking to move beyond reactive enforcement and toward systemic disruption.

• Built on original, FATF-cited research and hard operational realities — not theoretical white papers.

Many Western Analysts suggest that China’s exported capital remains loyal to Beijing. But the reality is far more interesting — and more dangerous.

The conventional view is deceptively simple:

• Many view China’s offshore liquidity as a giant shadow war chest, a controlled network of sovereign assets deployed at the whim of the Chinese Communist Party (CCP).

• Western policymakers and risk managers build entire frameworks assuming these offshore pools remain tightly harnessed to Beijing’s strategic aims.

• And yes, these pools have indeed been used to discreetly purchase dual-use technology, circumvent export controls, and secure critical commodities beyond the reach of sanctions or trade scrutiny.

But what if that loyalty is an illusion?

What if China’s exported liquidity — ostensibly state-aligned — is actually becoming a self-reinforcing shadow sovereignty, drifting beyond centralized control?

What if it now serves multiple masters: oligarchic families, hybrid criminal networks, local proxies, and opportunistic elites — all willing to pledge partial allegiance to Beijing when convenient, yet equally capable of undermining it when incentives shift?

In this emerging reality, offshore Chinese capital is no longer a single, monolithic weapon of statecraft. It has metastasized into a global gray liquidity architecture — one that blurs the lines between strategic reserves, private vaults, and criminal war chests.

This shift fundamentally rewires the logic of economic influence, risk exposure, and conflict escalation in ways most analysts still refuse to see.

The true nature of liquidity

Liquidity, at its core, means cash or assets easily convertible into cash. But in the 21st century, it is far more than a balance sheet metric — it is the true bloodstream of power. Liquidity buys influence, loyalty, and the capacity to project narratives and ideology. In this way, it is not just a financial tool; it is the lifeblood of sovereignty itself.

A state’s or entity’s ability to deploy liquidity — rapidly and across borders — fundamentally underpins sovereignty today. While armies once defined territorial control, liquidity now defines operational reach, resilience, and influence.

Crucially, those who wield liquidity, especially in environments lacking robust rule of law, tend to prioritize safety and self-preservation over ideology. Capital does not pledge allegiance; it flows toward sanctuary and survival.

Once capital crosses borders and regulatory boundaries, it mutates. It is layered through offshore structures, routed via proxies, embedded in shell networks, and reappears under new ownership masks, often with strong criminal tendencies. This metamorphosis is not a bug — it is a feature of the modern liquidity system, which is technically advanced but increasingly outside the rule of law.

Here is where the concept of post-sovereign liquidity emerges. Post-sovereign liquidity is:

• No longer strictly tied to a single central authority or policy framework.

• Operates as a self-defending organism, protecting itself first — often at the expense of its originating state.

• Creates hybrid power actors: networks that can act as extensions of state power when convenient, but also as independent parasitic or symbiotic systems when strategic incentives shift.

In this new reality, sovereignty itself becomes porous. States may believe they command liquidity, but more often than not, liquidity becomes something well beyond their control. With global payment platforms and crypto currency rails enabling instantaneous global transfers, unregulated liquidity flows have never been easier or more widespread.

Demystifying the Chinese system

I imagine many Western analysts find it comforting to believe that China’s offshore liquidity moves in lockstep with Beijing’s strategic orders — as if all that money acts as one seamless geopolitical weapon. But the truth is far messier, and far more human. It is a reality that the Western mind — so conditioned by rule-of-law frameworks that it cannot imagine a world without them — struggles to fully grasp. Having lived in China for much of my adult life, I carry a kind of muscle memory for systems governed by rule of man rather than rule of law, and thus see things differently.

Inside China, elite interests are deeply fragmented. Party leaders in Beijing strive to keep a tight grip, pushing grand ideological projects and enforcing strict discipline. Yet beneath them, provincial networks focus on their own survival and enrichment, prioritizing regional patronage webs and local power dynamics. Meanwhile, private capital — the tech tycoons, property moguls, and SOE-adjacent billionaires — operates with a different logic altogether, seeking to transform vulnerable domestic wealth into safer, untouchable offshore assets.

George R.R. Martin’s A Song of Ice and Fire series — and the Game of Thrones television adaptation it inspired — offers a powerful lens for understanding these dynamics. Although fictional, the series is rooted in a Western historical period before concepts like a politically independent judiciary and rule of law fully took hold. China’s internal history under the CCP mirrors this kind of ruthless, soul-crushing factionalism and political backstabbing. One of Martin’s most cynical characters, Cersei Lannister, distilled the essence of this worldview when she told her son:

“Everyone who isn’t us is an enemy.”

This simple line captures the raw brutality of contemporary Chinese elite politics. While so much modern analysis mystifies China as an inscrutable civilization beyond Western comprehension, in many ways, it is not so fundamentally different. In the West, corruption cases often end up in court dockets and drawn-out legal battles; in China, competing interests are handled more quietly, swiftly, and brutally.

Capital flight is often the primary byproduct of such heavy-handed approaches — not renewed loyalty, but quiet escape, especially when the economic fundamentals begin to falter. Why capital flight? Because in a system of life-or-death consequences, the safest way to ensure the survival of one’s family — the true core unit of Chinese civilization — is to store assets beyond the reach of one’s enemies.

When legal enforcement is practically non-existent and nobody truly knows who is a friend and who is an enemy, the true nature of exported liquidity is anything but clear cut. When its wielders stand to benefit or face punishment, it can become a powerful tool to advance state interests — avoiding tariffs, securing critical commodities, or acquiring banned military hardware. But when these vast liquidity pools operate beyond the scope of state reward and punishment, they take on a life of their own. In some cases, they directly defy state directives, such as illegally exporting banned rare earth minerals to U.S. markets. At other times, they morph into parasitic criminal ecosystems that feed on human misery in every conceivable way — most visibly in Southeast Asia’s vast archipelago of scam-center cities, all backed by offshored Chinese capital.

The result is a richer, murkier tapestry of competing interests — and one that is, in many ways, even more dangerous than clear-cut geopolitical competition between two adversaries.

Cersei Lannister (left) perhaps carries more historical parallels with women in Chinese history than in the West. I’ve heard her variously compared to the Empress Dowager Cixi (pictured above), Cultural Revolutionary and wife of Mao Zedong, Jiang Qing, and others. Image source

Historic precedent

Fractured elite interests in China are nothing new. We can see echoes throughout its history: the defeated Guomindang’s desperate flight to Taiwan in 1949, carrying state and private treasure by the boatload; or the Ming dynasty’s maritime merchants, who slipped beyond the reach of the imperial court and built independent networks across Southeast Asia.

Having spent much of my life studying Chinese history, I have observed certain patterns. The one that stands out above all: at times of crisis, liquidity always flows away from the core. In pre-modern eras, this meant competing regional strongholds that became warring states as increasingly cash-starved dynasties collapsed. From the Ming dynasty onward, this took the form of wealth quietly stashed abroad — most often in Southeast Asia.

Today, shadow finance serves both as a tool for immediate survival and as a quiet escape hatch. The state, with its vast political and technological reach, plays a powerful role in these overseas archipelagos of escaped sovereignty — perhaps the most powerful — but it is far from the only interest at stake. Many elites, even while professing loyalty to the Party, quietly build offshore structures and hidden reserves: insurance policies for themselves and their families should the system falter or turn on them. Increasingly, these offshore pools morph into parasitic systems the state can neither fully control nor completely disown.

In this way, China’s global liquidity is not a monolith. It is a scattered, self-preserving organism, loyal to no single master, ready to pivot or flee at the first sign of real crisis. What looks from the outside like a unified economic spear is, in fact, a restless swarm of competing interests — each guarding its own future above all else.

Read more

The electoral victory of Canadian Prime Minister Mark Carney, a career central banker, wasn’t just politics — it signals a global pattern: liquidity, not land, increasingly underpins sovereignty. Image source

“Lead us, Big Daddy,” a woman screamed at an event for Canadian Prime Minister and Liberal Party leader Mark Carney in Scarborough, Ontario, this past April.

All cringe aside, the moment marked a clear catalyst in Canadian political life. Just a few months earlier, the upcoming federal election looked like a nightmare for the Liberals: polls showed only 16% of Canadians planned to vote for the party. Carney’s predecessor, Justin Trudeau, had been effectively hounded out of office amid intensifying calls for his resignation, leaving Conservative leader Pierre Poilievre poised to take power.

Then, a parallel chain of events unfolded with stunning speed, galvanizing the Canadian system in a completely different direction. The November election of U.S. President Donald Trump brought new tariffs on Canadian goods and loud calls to make Canada “the 51st state.” The rhetoric infuriated Canadians, with many donning Trump-style hats reading “Canada is not for Sale” and “Canada is Already Great.” By March, Carney — a reserved former central bank chief — won the Liberal Party leadership with nearly 86% of the vote and became Prime Minister. He had never held elected office and became only the fourth Prime Minister in Canadian history to take power without even a seat in the House of Commons.

The April 28 election delivered results no one had predicted just months earlier: Carney’s Liberals handily defeated the opposition and gained seats, ending up just three shy of a majority government.

Carney’s unexpected rise represents more than a resurgence of economic nationalism. It signals a deeper shift in how Canadians imagine sovereignty and resilience in a world increasingly shaped by external shocks underpinned by liquidity systems. Canada, with its highly centralized, transparent, and tightly regulated liquidity architecture, responded to this threat the way it knows best: by electing a technocratic central banker to steer it through crisis. By rehabilitating a party that, after a decade in power, was headed for electoral obscurity, the system made clear what it wanted most — the kind of technocratic leadership that only a regime built on trusted, centralized liquidity could produce.

Read more

Image source

Preface

This article was originally drafted and circulated privately in March 2025. Although it was not published through its initial intended outlet, I share it now to advance public understanding of Al-Shabaab’s evolving financial networks and the broader dynamics of illicit liquidity in conflict economies.

This article draws from my Shadow Liquidity Doctrine, first drafted and circulated privately in early 2025. The doctrine defines shadow liquidity and its operational twin, illicit liquidity, as strategic infrastructures that sustain modern conflict, enable gray zone operations, and maintain covert networks of power. Al-Shabaab’s financial architecture exemplifies this hidden circulatory system: an adaptive flow of capital that transcends borders, sanctions, and formal oversight.

Intro

Somali terror group al-Shabaab remains a persistent global threat despite decades of international efforts to combat its influence. With recent reports indicating the militants have established[1] checkpoints just 15 kilometers from the capital, Mogadishu, the al-Qaeda-aligned group continues to launch a dizzying array of attacks, recently striking the Somali presidential convoy and an international hotel in the capital and launching a bomb attack on a US military base in neighboring Kenya last summer – just to name a few. With the African Union Mission in Somalia (ATMIS) ending its mandate on 31 December 2024 and replaced by a scaled-down African Union Support and Stabilization Mission in Somalia (AUSSOM), many in Somalia and abroad have expressed doubts as to the mission’s future success in combating this growing threat.

Sophisticated financial networks underpin much of al-Shabaab’s regional and global threat. These networks are prime examples of what I define as shadow liquidity — hidden capital flows that function as strategic infrastructure, enabling militant and criminal actors to endure despite military or ideological setbacks.

Al-Shabaab’s sustained influence could have severe geopolitical ramifications, given the group’s sway over piracy outfits on the Indian Ocean and close ties to the Houthis and Iran. Last summer, US reports indicated that the Yemen-based and Iranian-backed Houthis had met with members of al-Shabaab to discuss mutual aid, including Houthi arms transfers and technical expertise in exchange for al-Shabaab’s efforts to ramp up piracy of the Somali coast. If successful, this move could extend the current crisis in the Red Sea by thousands of kilometers and more severely impact global shipping, especially if al-Shabaab and the pirate outfits it supports gain access to sophisticated Iranian drones, missiles, and other weaponry. In addition to these potential global ramifications, al-Shabaab poses a significant threat regionally, having carried out devastating attacks killing thousands in Somalia as well as neighbouring Kenya and Ethiopia. In this way, any future al-Shabaab gains could come at a cost to global security as a whole.

Sophisticated financial networks underpin much of al-Shabaab’s regional and global threat. The organization is by far al-Qaeda’s wealthiest constituent group, generating over $100 million USD in revenue annually, funds essential to its deadly operations at home and abroad. Although growing global scrutiny over the past year has hindered al-Shabaab’s financial operations, the group remains tactically resilient, indicating it has and will likely continue to adapt to its constrained financial circumstances. This insight explores how al-Shabaab raises money locally, has harnessed a sophisticated network of financial facilitators and investments abroad to bring money into Somalia, and how it may adapt following new rounds of sanctions by US authorities.

Read more

Between the Lines Research – Strategic Note, July 2025

Personal Note

This work is the product of years spent tracing the financial systems that sustain both state and non-state actors. It is not a polemic, but a strategic framework designed to support policymakers, practitioners, and financial system stakeholders. The goal is to illuminate how liquidity flows — especially those operating beyond formal oversight — shape modern conflict, resilience, and global risk.

Introduction: Why Liquidity Matters

Geopolitical and security analyses often focus on ideology, battlefield tactics, or formal alliances. But beneath these surface-level factors lies a deeper infrastructure: shadow liquidity — the unregulated or hybridized capital flows that underwrite the operational capacity of both governments and armed non-state actors.

Understanding this hidden architecture is critical to designing effective counter-threat finance (CFT) and anti-money laundering (AML) strategies. It also reframes sovereignty not just as legal authority, but as the capacity to generate, direct, and protect liquidity.

Defining the Concept: What Is Shadow Liquidity?

Shadow liquidity refers to the movement of value through informal, opaque, or hybrid channels outside regulatory visibility. This includes:

• Non-transparent conduits (e.g., hawala systems, OTC brokers, dual-use trade logistics)

• Privacy-enhancing crypto rails and decentralized exchanges

• Illicit resource-to-cash pipelines (e.g., gold, timber, synthetic drugs)

• Informal remittance streams embedded in conflict economies

These flows are often structured to resist attribution, formal tracing, or enforcement — making them highly adaptive and strategically valuable.

Liquidity as Strategic Capacity

Liquidity is not merely a financial concern; it is a source of power. It enables:

• Insurgents and hybrid actors to survive loss of territory or leadership

• Sanctioned states to sustain procurement, proxy support, and domestic control

• Transnational networks to expand influence without conventional military tools

In fragile, sanctioned, or contested environments, control over liquidity is what allows actors to endure. It is a form of sovereignty unto itself.

Historical Context: Sovereignty and Value Control

Across history, power and legitimacy have followed control over capital:

• The American Founders’ revolutionary authority was underwritten not only by ideology, but by their personal assets, shipping networks, and trans-Atlantic credit lines.

• Imperial collapses — from the Western Roman Empire to late Ming and Qing China — were preceded by liquidity fragmentation long before formal dissolution.

Modern threat actors replicate these patterns: embedding in high-value ecosystems, exploiting loopholes in digital finance, and building sovereign-like liquidity systems that bypass formal governance.

Policy Relevance: Why Institutions Should Care

This framework has direct implications for financial security, compliance, and multilateral coordination:

• FIUs and CFT teams must look beyond direct actors to the liquidity infrastructures that enable threat persistence.

• Sanctions architects must trace how shadow liquidity routes evolve around enforcement barriers.

• Multilateral bodies may benefit from integrating this lens into typology-building and technical assistance.

• Technology platforms and financial firms play a frontline role in identifying and disrupting emergent liquidity corridors.

Who This Serves

This framework is intended for:

• Financial intelligence units and national risk teams

• Investigative and judicial bodies working on threat finance

• Regulatory technology and compliance firms

• Multilateral analysts engaging fragile or high-risk jurisdictions

Accessing the Full Framework

This note introduces the “Liquidity as Sovereignty” doctrine and outlines the Shadow Liquidity Framework, developed by Between the Lines Research (BTL). The complete version — including case studies (ISKP, Hezbollah, Houthis, JNIM), typology matrices, and operational indicators — is available upon request.

For secure access, institutional briefings, or research collaboration:

info@btl-research.com

Stay ahead

Subscribe or join my Inner Circle for updates, exclusive analyses, and private briefings on shadow liquidity, threat finance, and global strategic risk.

Subscribe now

Share and cite

You are welcome to share or cite this summary with attribution. For full doctrine use or excerpts, please request permission.

-Adam Rousselle, Founder and Chief Analyst, Between the Lines Research

All frameworks and original conceptual language herein are protected as intellectual property under applicable law. Any unauthorized use without attribution is expressly prohibited

The headlines called it retaliation. Some analysts labeled it symbolic. But as we explored on Friday, Iran’s massive missile and drone barrage wasn’t about face-saving—it was a live demonstration of capability. A stress test. A rehearsal.

But there’s a second battlefield brewing—quieter, more resilient, and arguably more enduring—unfolding in parallel to the visible barrage. One that most coverage ignores.

Beneath the missiles lies a deeper infrastructure: a financial ecosystem engineered to survive sanctions, bypass traditional systems, and fuel conflict beyond the reach of the global financial system. Crypto wallets, OTC brokers, and informal financial nodes—stretching from Qom to Caracas, from Sana’a to Hong Kong— make up a vast and largely invisible financial infrastructure powering Iran’s asymmetric war machine. This is asymmetric finance.

What began as a workaround to Western sanctions has now hardened into a core pillar of Iran’s regional strategy. In the hours and days after the attack, crypto markets reacted—not in ways that definitively point to illicit proxy activity – but interestingly nonetheless. Bitcoin and other major tokens dipped, reflecting broader geopolitical uncertainty and a flight from risk. In the days to come, we are likely to see reports from leading blockchain analytics firms on illicit flows associated with Iran and its proxies. These networks have long relied on informal financial rails, including stablecoin brokers and weak-KYC exchanges, to quietly route funds through jurisdictions like Lebanon, the Gulf, Venezuela, and Southeast Asia. The extent to which this system will be mobilized remains unknown—but past escalations suggest these financial rails become activated in parallel with military operations.

To understand this conflict today, and where it’s going tomorrow, we must look not just at what exploded—but what moved, where, and how much. The story isn’t just about rockets, drones, and ballistics. It’s about rails—financial rails—that enable the machine behind them.

Iran has built a system designed for asymmetric conflict across multiple domains. The military strikes dominate headlines, but they’re only part of the picture. Behind them is a parallel system designed to quietly sustain escalation—a financial infrastructure built to move money, fund proxies, and resist sanctions without triggering collapse.

Why This Matters to Threat Finance

Every war casts a financial shadow. Behind every drone strike is a supply chain. Behind every military advance, a funding channel. And in Iran’s case, those channels are increasingly built on a patchwork of informal networks: hawala dealers, OTC crypto brokers, and stablecoin rails straddling two hemispheres.

These systems—designed to evade formal banking channels and U.S. sanctions—don’t just enable the fight. They shape it. Iran’s ability to project power without triggering catastrophic retaliation depends in part on its ability to quietly move funds, mask logistics, and keep its proxies liquid. As Western scrutiny tightens on traditional sanctions-evasion tools, crypto has increasingly filled the gap. Tether (USDT), in particular, has become a favored instrument for laundering value between jurisdictions, with minimal friction and high anonymity.

The same digital rails that move funds for everyday transactions are now the arteries of asymmetric warfare, sustaining networks that would otherwise go dry under traditional scrutiny. For threat finance, this means the front line has shifted: identifying wallet activity, tracing OTC intermediaries, and mapping stablecoin liquidity are no longer technical exercises—they are essential to preempting escalation, disrupting proxy logistics, and safeguarding the integrity of the global financial system.

Strategic Continuity Through Financial Asymmetry

A remarkable aspect of this escalation apart isn’t just what Iran launched—but how it manages to stay funded while doing it. Beneath the drones and ballistic headlines is a quieter story: Iran’s financial system has adapted to conflict. Not by bracing for impact—but by flowing around it.

Over the past year—and particularly since early 2024—Tehran has actively deepened its already robust resilience against sanctions. These efforts include signing a bilateral monetary contract with Russia to enable rial–ruble trade and linking their payment systems, pushing forward BRICS-wide local-currency trade initiatives, and building SWIFT-alternative transfer systems through regional platforms like the Asian Clearing Union. Commodity sales, particularly oil, help fuel this cashflow and proxies like the Houthis play a central role in the shadow fleets and laundering logistics that make it all possible.

Simultaneously, Iran has steadily expanded its domestic crypto infrastructure—not just as a pressure valve for ordinary citizens, but as a strategic workaround of sanctions. Nobitex, the country’s largest exchange, continues to facilitate significant volumes of crypto-to-rial conversions, often routed through high-risk wallets or offshore OTC channels. In parallel, Iranian authorities have pursued a central bank digital currency (CBDC) pilot program, signaling their interest in developing state-aligned digital payment systems outside U.S.-controlled rails.

Iranian proxy networks—including the Houthis and Hezbollah—have also increasingly relied on stablecoins such as Tether (USDT) and relatively anonymous over-the-counter (OTC) brokers to move funds discreetly, circumvent compliance barriers, and sustain operational liquidity. The effect is not macroeconomic stabilization but the creation of flexible, deniable financial corridors that extend Tehran’s reach in conflict zones while insulating its core institutions from direct exposure.

In short: airstrike exchanges are one front. Money movements are another.

The New Architecture of Modern Conflict

Iran’s shadow financial infrastructure is not a temporary workaround. It is part of the broader emergence of global shadow financial architecture—created by states currently or increasingly outside the established international order such as Iran, but also Russia, China, and North Korea. It is a constellation of tolerated proxies and cutouts. Some analysts refer to these countries as forming a so-called ‘axis of authoritarianism’ – but when it comes to threat finance, that framing misses the point. These financial ties are not based on mutual ideology, but method. They form a shared playbook of sanctions resistance, obfuscation, and liquidity in a growing global gray space.

Iran isn’t improvising. Nor is Russia, with its ruble-backed crypto experiments and stablecoin laundering through the UAE and elsewhere. Nor is China, which shelters capital in offshore shadows while tolerating OTC networks that quietly enable adversaries. North Korea with its navy-based narcotics rings and criminal hacker groups like the Lazarus Group were early adopters of this game.

Each escalation—military or political—is now mirrored by a quieter campaign: proxy wallets, OTC brokers, and stablecoins routed through permissive zones. Financial adaptation has become a core function of conflict, not an afterthought.

The systems meant to detect and disrupt these shadow networks—compliance regimes, sanctions enforcement, blockchain forensics—are still fighting to keep up. New designations from the U.S. Treasury’s Office of Foreign Assets Control (OFAC) arrive with growing regularity, but often only after the fact. One distinct advantage in this new terrain is transparency by design: every cryptocurrency transaction exists on a ledger. But visibility alone isn’t enough. Without the right tools—and without timely coordination—these records remain inert, meaningful only in hindsight.

Tracking and mapping these systems requires multidisciplinary expertise—not just blockchain analytics, but a deep understanding of the actors behind the flows and the geopolitical currents that guide them. As the conflict in the Middle East intensifies, and as state and proxy actors grow more fluent in exploiting financial gray zones, the cost of analytical blind spots will rise—not just on the battlefield, but across global markets. The battlefield is expanding—and so are the rails that sustain it. Research like this doesn’t just explain the fire—it might be the thing that removes the oxygen before it spreads.

For custom briefings on the financial networks behind today’s conflicts, get in touch today: info@btl-research.com

In the first two parts of this series, we examined how Beijing has strategically blurred the lines between crime, finance, and statecraft.

• Part I explored how transnational criminal networks—scam syndicates, money laundering fronts, and trafficking hubs—offered China a deniable infrastructure for advancing influence across Southeast Asia and beyond.

• Part II explored how informal financial channels—ranging from offshore dollar reserves and state-tied shell companies to elite capital flight—became embedded in China’s strategy for resilience, evasion, and quiet geopolitical reach.

But the system has started to turn on its architects.

What began as a tool of resilience has become a vector of global risk. China’s shadow reserves, gray banking operations, and offshore laundering proxies—once seen as clever circumventions of Western sanctions—are now leaking influence, bleeding capital, and empowering actors Beijing can’t fully control. In some cases, these networks pose greater strategic and reputational threats than the constraints they were built to avoid.

Think the Chernobyl disaster—but global. A radioactive core leaking financial and geopolitical fallout across everything it touches, until someone builds a concrete dome over the whole thing. That dome may be coming—but the damage is already done, and the fallout will linger for years.

This third and final installment unpacks how the very mechanisms China built to escape constraint may now be generating volatility, corruption, and strategic backlash at a scale even Beijing can’t contain.

The Internal Fracture: Power Diffusion at Home

When Beijing implemented the Three Red Lines policy in 2020 to curb reckless real estate borrowing, it triggered a cascade far beyond the housing sector. As liquidity dried up, elite families and state-linked firms sought refuge—not in domestic reforms, but in the exit ramps of offshore finance. A surge of capital flight followed, channeled through underground banks, crypto rails, and shell networks tied to party patrons abroad.

But this wasn’t a system constructed from scratch—it was already primed for abuse.

For years, state-owned banks had been quietly stockpiling offshore dollar reserves, tucked away in opaque accounts and affiliated investment vehicles. These reserves, originally meant as a financial shock absorber against Western pressure, became a deep pool of shadow liquidity—ready to be tapped, siphoned, or strategically rerouted with minimal oversight.

What began as a strategy for resilience—steering capital into the shadows to protect it from volatility—has become a mechanism for fragmentation.

Read more

In the 2010s, China began quietly shifting hundreds of billions of dollars in U.S. reserves into hidden accounts controlled by state banks, offshore entities, and opaque investment arms. At the same time, elite capital flight surged, triggered by political crackdowns and economic uncertainty. Also during this time, we’ve seen the rise of a murky offshore empire of Chinese money now deeply embedded in illicit markets, scam zones, crypto laundromats, and corrupt logistics hubs across Southeast Asia and beyond. Coincidence? Probably not. What began as a strategy to evade sanctions and project financial resilience has instead helped fuel one of the largest gray financial ecosystems in modern history—blurring the line between statecraft, corruption, and organized crime.

This piece unpacks how it happened, why it matters, and what it means for the future of global power.

Read more