Image source

On October 10, 2024, Toronto-Dominion (TD) Bank agreed to pay approximately US $3.09 billion to U.S. regulators – the single largest penalty ever imposed under the Bank Secrecy Act (BSA). The financial consequences extended beyond the headline figure: compliance overhauls, independent monitors, legal expenses, and operational restrictions materially affected the bank’s U.S. business. Senior executives departed, compensation was reduced, and branch-level employees now face criminal charges.

According to the U.S. Department of Justice, between January 2018 and April 2024, TD’s transaction monitoring program failed to review approximately 92% of its transactions — representing activity collectively valued at more than $18 trillion. Within that same period, three criminal networks with ties to drug trafficking organizations transferred over $670 million in illicit funds through TD accounts.

But the magnitude of the penalty — and its ramifications for TD and the broader banking sector — underscores something more unsettling. If criminal networks were able to move over half a billion dollars through a major financial institution over multiple years – despite the presence of formal monitoring systems – the underlying laundering infrastructure was not opportunistic. It was operationally mature.

While the TD case represents a particularly egregious breach of a major financial institution by bad actors, the vast demand to enter these systems by an expanding global criminal services market makes it a powerful warning of the dangers posed by a lack of action amid a global surge in parallel financial activity.

Investigation and findings

Federal authorities began investigating cartel-linked laundering activity in the New York tri-state area in the early 2020s. In one instance, agents reportedly tailed a box truck transporting bags of bulk cash that were deposited across multiple bank branches, with TD locations featuring prominently. The ringleader of these activities was Da Ying (“David”) Sze, a Chinese-born resident of Queens, New York. According to court filings, Sze’s network laundered approximately $653 million, roughly $470 million of which moved through TD Bank. A subsequent congressional report noted the network moved funds to thousands of individuals and entities across the United States, China, Hong Kong, and other jurisdictions.

The Sze network did not rely on large-scale corruption to operate within TD. According to court documents, the organization provided approximately $57,000 in retail gift cards to multiple bank employees over a three-year period. In exchange for these gift cards, employees repeatedly ignored reporting standards, issuing official bank checks for accounts mostly filled with underreported cash. According to charging documents, one branch employee asked another “how is that not money laundering?” after a customer was permitted to buy more than $1 million in bank checks with cash. “Oh, it 100 percent is,” replied the second employee.

While multiple insiders were charged in connection with related laundering schemes, the only publicly detailed case tied to the Sze network is that of Wilfredo Aquino, an assistant store manager at a Midtown Manhattan TD branch. Aquino accepted more than $11,000 in gift cards between 2019 and 2021. In the context of a mid-level retail banking salary in Manhattan, and given Aquino had processed some 1,680 checks worth over $92 million, the inducements were modest — suggesting that the network’s strategy depended less on dramatic bribery than on sustained, low-friction facilitation at key review points.

At $57,000 in gift cards, total known inducements amounted to roughly 0.01 percent of the funds Sze passed through TD-linked accounts — a negligible input cost for a network operating at industrial scale. The vulnerability was not expensive corruption, but calibrated pressure applied to the right choke points.

While global financial institutions continue to struggle to improve their compliance systems, what is clear is that demand to inject illicit cash into capital markets via legitimate institutions has reached an unprecedented scale and scope.

Da Ying (“David”) Sze depositing bulk cash at a NYC-area TD branch. Image source

Supply and Demand — Laundering as a Service Market

Service-based alternative clearing networks have emerged amid unprecedented capital mobility, digitized payment velocity, and increasing geopolitical fragmentation. Over the past decade, these systems have expanded in ways that bypass and place strain on formal regulatory frameworks. They reflect a convergence of three structural forces: capital flight from high-pressure jurisdictions such as China, the steady supply of bulk cash generated by large transnational criminal enterprises, and the acceleration of cross-border value transfer enabled by fintech and digital assets.

Operationally, these networks integrate bulk cash collection, offshore credit balancing, digital asset conversion, and trade-based value settlement into a continuous clearing cycle. The result is a service-layered market for laundering and liquidity conversion, scaled by the sheer volume of capital seeking movement across jurisdictions. The objective is not merely concealment, but transformation — converting trapped or illicit value into deployable capital within stable financial systems.

Recent enforcement actions and reporting demonstrate the scale and operational capacity of this underground services market. In Southeast Asia, the Huione Chinese language marketplace and corporate networks associated with Prince Group have been identified as providing services used by criminal actors tied to scam compounds and gambling rings. According to Chainalysis, Huione-linked addresses processed more than $70 billion in crypto-denominated transactions between 2021 and 2025. In October 2024, the U.S. Department of Justice announced a civil forfeiture action involving over $15 billion in bitcoin connected to activity tied to Prince Group–associated entities — the largest digital asset seizure in history. In North America, FinCEN reporting has identified Chinese money laundering networks (CMLNs) as key facilitators of bulk cash clearing. Suspicious Activity Reports referencing such networks reflected approximately $312 billion in flagged transactions between 2020 and 2024. The Da Ying Sze network likely represented only one operational node within this broader clearing architecture.

These figures illustrate that the networks in question are not marginal or episodic; they are structured, capitalized, and globally integrated. Their continued operation depends not on remaining entirely outside the formal financial system, but on accessing it selectively at key integration points. This is where regulated financial institutions enter the equation.

Banks as Entry Points for Illicit Capital

Banks sit at the final integration point between parallel financial systems and formal capital markets. At its core, this is a supply-and-demand equilibrium: illicit or trapped capital seeks conversion; regulated capital markets offer absorption capacity and safety; intermediaries profit from the spread. As enforcement actions over the past decade demonstrate, financial institutions exposed to these flows face escalating compliance, reputational, and sanctions-related risks.

Court documents reveal the extent to which TD Bank’s compliance team failed to monitor suspicious transactions and the Department of Justice cited systemic weaknesses in the bank’s AML infrastructure, including gaps in transaction monitoring coverage and risk escalation. But while the TD example may be extreme in scope, the bank is not alone.

Over the past several years, major financial institutions — from HSBC to Danske Bank — have faced significant penalties tied to AML deficiencies valued in the billions of dollars. In less extreme cases – such as Capital One or USAA Federal Savings Bank – penalties have still reached hundreds of millions of dollars. The recurrence of multi-billion-dollar penalties across traditional banks and digital asset platforms underscores a systemic compliance lag rather than isolated institutional failure. Industry analyses and regulatory reports repeatedly warn that compliance systems often lag behind transaction complexity and adversary adaptation. The recurring pattern is not episodic misconduct, but structural misalignment between institutional monitoring models and industrial-scale laundering services.

As banks increasingly integrate digital assets into their payment and settlement systems, risk exposure expands rather than contracts. Beyond retail deposits and digital asset channels, trade finance instruments and correspondent banking relationships provide additional integration pathways between shadow liquidity networks and formal capital markets.

Existing AML evaluation frameworks primarily assess compliance with reporting and supervisory standards; they are less equipped to measure institutional resilience against coordinated, service-based clearing models. As parallel liquidity systems scale, institutions calibrated to detect isolated transactional anomalies — rather than sustained throughput facilitated by dispersed nodes within otherwise profitable client relationships — will remain structurally exposed.

Recalibrating compliance from anomaly detection toward throughput risk management may become one of the banking sector’s defining challenges in the years ahead. National supervisory regimes remain fragmented, while clearing networks operate transnationally, exploiting jurisdictional seams faster than coordination mechanisms can align. In this environment, the question is no longer whether parallel clearing systems can penetrate formal institutions, but whether supervisory models can evolve quickly enough to recognize that they already have.

Conclusion

The TD enforcement action highlights more than episodic compliance breakdown. It reflects the growing sophistication of parallel clearing systems that now function as service-based liquidity providers, capable of sustained access to regulated institutions. These networks do not depend on dramatic corruption, but instead rely on consistent access to friction points — human, procedural, or technological — where transaction flow can continue with minimal interruption.

As illicit and constrained capital continues to seek conversion into stable financial markets, pressure on these integration nodes will increase. Monitoring systems calibrated to detect irregular spikes may struggle to identify persistent throughput dispersed across routine activity. The resulting vulnerability lies less in individual misconduct than in structural misalignment between institutional oversight models and industrial-scale clearing operations. Reorienting supervision toward throughput risk — rather than isolated anomaly detection — may become essential as shadow liquidity systems continue expanding alongside formal capital markets.

Image from a previous police raid on Deutsche Bank that occurred in 2018

On January 28, German police prosecutors raided the Berlin and Frankfurt offices of Deutsche Bank, the largest financial institution in the country. The surprise raid came just one day before the company was set to release its 2025 earnings report, causing share prices to immediately plummet by around 3%. At least 30 plainclothes investigators entered the offices around 10am local time, targeting a “yet unknown” number of employees. According to prosecutors, their investigation surrounds companies suspected of money laundering on behalf of entities tied to sanctioned Russian oligarch, Roman Abramovich.

This raid is illustrative of a much broader trend.

The last few years have delivered a steady slew of headlines about major law enforcement actions against banks suspected of money laundering and falling prey to criminal influence. Last year, the U.S. Treasury made the unprecedented move of sanctioning three Mexican banks as a primary money laundering concerns in connection with opioid trafficking. In 2024, Canada’s TD Bank agreed to pay a record $3 billion in fines in connection with money laundering for the Sinaloa and other Mexican drug cartels; Canada’ FINTRAC imposed nearly $10 million in additional fines against the bank. Crypto exchanges are at the front lines of such punitive measures, with Binance agreeing to pay a $4.3 billion in fines and restitution in a 2023 deal with US regulators enforcement. Last year, FINTRAC imposed a record $177 million in fines against crypto exchange Xeltox in connection with darknet markets, child abuse, fraud, and ransomware.

These are not compliance failures, but failures of perception. Institutions are operating with risk models built for a world in which illicit finance was episodic, traceable, and external to core liquidity systems. That world no longer exists.

While laundering techniques evolve incrementally, detection regimes evolve retroactively. Capital that clears today under acceptable assumptions is increasingly reclassified tomorrow as sanctionable, tainted, or facilitative. Institutions that do not adapt in advance are not merely exposed — they are accumulating latent enforcement risk they cannot unwind. Evidence suggests the consequences are increasingly unaffordable, prompting the need for proactive measures.

Shwe Kokko, Myanmar: built in a civil war and financed through Chinese state investment, the multi-billion-dollar militant-backed city now serves as a notorious hub for cyber scammers.

Parallel financial infrastructures

Massive, parallel liquidity architectures now operate alongside regulated global financial markets. These systems emerged to serve actors excluded from the formal financial system and have proliferated amid rapid fintech innovation, tightening sanctions regimes, and rising geopolitical polarization.

Strict capital controls, combined with sustained political and economic instability, have generated large and unregulated capital outflows from high-stress jurisdictions such as China, Russia, and Iran. These outflows create primary demand for parallel financial infrastructure, supplying the early liquidity needed to establish and scale shell companies, grey-market digital exchanges, trade-based money laundering mechanisms, and over-the-counter (OTC) crypto brokerage networks. Under sanctions pressure, state-linked actors within these jurisdictions also rely on such channels to export goods and procure restricted or dual-use technologies beyond formal oversight.

These parallel architectures are not used exclusively by state-linked elites or individuals engaged in capital flight. Organized criminal groups—including Latin America drug cartels, Chinese-run scam syndicates operating across Southeast Asia and Africa, and European networks such as the ’Ndrangheta—exploit the same ungoverned financial rails to move and launder proceeds.

The systemic risk lies not in any single actor, but in the laundering capacity of these parallel systems themselves. Although designed to operate outside regulatory oversight, these infrastructures ultimately interface with—and depend upon—safe, well-regulated financial markets. Capital originating in capital flight, sanctions evasion, and organized crime frequently converges at the same intermediaries and settlement points before being absorbed into Western asset markets.

For example, Chinese money laundering networks (CMLNs) facilitate the laundering of bulk cash generated by Mexican drug cartels, with funds ultimately settling into U.S. asset portfolios held by wealthy Chinese households seeking capital externalization. Similarly, infrastructure projects financed under the Chinese state-run Belt and Road Initiative have, in certain jurisdictions, contributed to permissive governance environments that organized criminal groups exploit to establish large-scale cyber-scam operations, ultimately moving wealth out of the country and into private hands elsewhere. Once laundered through the region’s vast ecosystem of casino gambling hubs and international shell corporations, these funds may be invested in Western markets like Australia or the United States.

Elsewhere, Iranian regime-linked elites have accumulated extensive international property portfolios in Western countries using shadow financial infrastructure associated with the Islamic Revolutionary Guard Corps and its affiliated networks. In Europe, criminal organizations such as the ’Ndrangheta rely on the same real-estate-based laundering channels in Turkey and offshore banking access points in Cyprus that have long been used by Russian elites to externalize wealth and sustain financial activity under sanctions pressure. Recent evidence also indicates that Russian state-owned factories increasingly supply Italian mafia groups with unmarked weapons via shadow fleet vessels, demonstrating that these informal networks can produce violent consequences.

Across these cases, the common denominator is not coordination between actors, but the repeated reuse of resilient parallel financial infrastructure that channels capital back into regulated Western markets. Funds associated with criminal or terrorist activity are placed through multiple layers—including casinos, online gaming platforms, real estate, and front companies—before being progressively cleaned and integrated. The result is not a segregated illicit economy, but deep structural integration between unaccountable liquidity systems and the global financial core.

Exposure

The three-tiered architecture clarifies the exposure to Western banks and other institutions:

Figure 1 illustrates a three-tier liquidity architecture showing how parallel financial systems interact with regulated Western capital markets.

• Tier 1 captures upstream capital outflows from high-stress jurisdictions shaped by capital controls, sanctions pressure, and regime instability. Driven primarily by elite asset externalization and state-linked value movement, these outflows provide much of the initial liquidity that seeds parallel financial systems due to the volume of demand they represent.

• Tier 2 represents the midstream laundering infrastructure that enables these flows to move and settle outside formal regulatory oversight. This layer includes OTC brokers, trade-based money laundering, shell companies, grey-market digital exchanges, and related facilitators that function as shared financial rails used by state-linked elites, criminal networks, and sanctioned actors alike.

• Tier 3 encompasses downstream threat actors. Including organized crime groups, militant organizations, and terrorist networks. These groups frequently exploit the same infrastructure to move and launder illicit proceeds.

The diagram highlights the bidirectional interaction between tiers, reflecting how upstream capital flight sustains laundering infrastructure while downstream criminal activity reinforces its profitability and resilience.

The right-hand node illustrates the final stage of the cycle: integration into Western capital markets. Despite originating in parallel systems designed to evade oversight, laundered capital ultimately seeks stability and legal protection within regulated financial systems, creating systemic exposure for financial institutions, real estate markets, and investment products.

The core risk lies not in any single actor, but in the durable infrastructure that links capital flight, illicit finance, and regulated markets into a continuous financial circuit. Most importantly, as global sanctions regimes increasingly target state-linked actors at Tier 1 and non-state actors at Tier 3, exposure concentrates in Western capital markets where funds moving through this infrastructure are ultimately integrated.

Global enforcement vigilance

Global regulators and law enforcement agencies are under accelerating pressure to identify, disrupt, and prosecute financial activity linked to illicit finance. This pressure is no longer cyclical or reputational; it is structural and driven by two converging forces.

First, geopolitical escalation and sanctions enforcement

In an increasingly polarized international environment, illicit financial channels used by adversarial states to bypass export controls and procure restricted or dual-use goods are now treated as matters of national security rather than compliance oversight. As sanctions regimes expand in scope and severity, enforcement agencies are increasingly compelled to pursue not only upstream actors but also the financial institutions through which such activity ultimately settles.

Examples include Russia’s sanctioned war economy, Iran’s shadow banking networks, and China’s underground procurement of restricted military and dual-use technologies.

Second, the trans-nationalization of organized crime

Modern criminal networks are increasingly post-sovereign, operating across jurisdictions and establishing parallel financial systems that erode state authority and undermine global governance. These systems are no longer peripheral; they intersect directly with regulated markets.

Examples include militarized Mexican cartels such as Sinaloa and CJNG, as well as large-scale scam-center enclaves in Myanmar and Cambodia.

Across all domains, political tolerance for inaction is collapsing. Regulatory and law enforcement agencies are increasingly expected to demonstrate tangible results, often through high-profile investigations, raids, and retroactive enforcement actions. In the United States, recent sanctions guidance has materially expanded this exposure: the Treasury Department’s Office of Foreign Assets Control now applies a ten-year enforcement lookback, extending liability to conduct that cleared under acceptable assumptions years earlier. Parallel developments are underway in Europe, where the European Union has moved to harmonize criminal penalties for sanctions violations across member states, signaling a broader shift toward more aggressive and coordinated enforcement.

Because Western banks and capital markets represent the terminal integration point for most large-scale laundering activity, they are not incidental to this process, structurally exposed to it. Capital that once cleared under acceptable assumptions is increasingly reclassified as sanctionable, tainted, or facilitative. Institutions that treat these dynamics as external threats rather than embedded risks are not merely vulnerable to future scrutiny; they are accumulating enforcement exposure that cannot be unwound once political thresholds are crossed.

Technological advances risk further investigatory disruption

Technological advances in machine learning and artificial intelligence are rapidly expanding investigators’ ability to retroactively identify illicit financial networks after they have already entered Western capital markets. While global organized crime syndicates adopted crypto early to bypass traditional regulatory controls, the underlying structure of blockchain systems — which preserve immutable transaction records on public ledgers — has paradoxically made illicit liquidity more traceable over time. As a result, capital that once appeared safely integrated can later be reconstructed, mapped, and reclassified. Blockchain analytics platforms are already deploying advanced AI-driven pattern detection, and DARPA’s A3ML program aims to make large-scale money laundering economically unviable by disrupting these networks at scale.

At scale, AI adoption favors actors with capital depth, institutional expertise, and the protection of the rule of law. While criminals may experiment with tactical obfuscation, these advantages compound over time in favor of investigators rather than illicit networks. Banks and other financial institutions should therefore assume that today’s undetected exposure may become tomorrow’s enforceable liability, rather than relying on money launderers’ ability to permanently conceal financial activity.

Conclusion

The dynamics described here are not temporary distortions or episodic compliance challenges. They reflect a structural shift in how illicit, gray, and state-linked capital moves, settles, and ultimately integrates into the global financial system. Parallel financial infrastructures have matured into durable liquidity systems that operate continuously alongside regulated markets, not at their margins.

Western banks and asset markets sit downstream of these systems. They are not incidental endpoints but the terminal nodes where capital originating in sanctions evasion, and criminal enterprise ultimately seeks stability, legal protection, and yield. As enforcement priorities expand from reputational misconduct to national security risk, and as sanctions regimes increasingly target both state and non-state actors across this spectrum, exposure concentrates precisely where this capital is absorbed.

Crucially, enforcement is no longer prospective. Detection, attribution, and liability are increasingly retroactive, enabled by improved data integration, cross-border coordination, and advancing analytical technologies. Capital that cleared under acceptable assumptions in the past is now subject to reclassification, scrutiny, and enforcement years later. Once political thresholds are crossed, this exposure cannot be unwound.

Institutions that continue to treat illicit finance as an external threat, rather than an embedded feature of modern liquidity systems, are not merely vulnerable to future action. They are accumulating latent enforcement risk that will surface on timelines and terms they do not control. In this environment, resilience depends less on incremental compliance improvements than on a fundamental reassessment—at the board, supervisory, and enterprise-risk level—of how parallel financial infrastructures intersect with regulated markets and where, within that system, exposure is truly accumulating.

This problem is not cyclical, but structural. Western financial markets sit downstream of parallel liquidity systems that are already embedded. Enforcement is increasingly retroactive, not preventive. Institutions that fail to adapt now are not merely exposed to future scrutiny — they are accumulating liabilities that cannot be unwound once political thresholds are crossed.

Part I:

Part II:

This piece is more technical than much of my prior work. It is intended as a conceptual and analytical framework rather than a narrative essay, and is written for readers interested in understanding the structural mechanics of unregulated capital flows and their downstream security implications.

I am publishing it openly in the belief that clearer analytical tools are necessary if institutions are to anticipate and disrupt emerging threats more effectively. Readers who find this work useful, or who are working on related problems, are welcome to contact me directly at info@btl-research.com.

In work published over the past several months, I have emphasized that unregulated capital flows I term “shadow liquidity” consistently manifest as powerful downstream threats. Whether terrorist groups in Sub-Saharan Africa leveraging illicit networks to smuggle resources and procure weapons, or scam centers and drug cartels exploiting complex liquidity architectures, the global shadow financial ecosystem has become markedly more dangerous.

I developed a three-tier framework to explain how these parallel financial architectures operate and why they generate persistent downstream harm. Tier 2 consists of a vast layer of globally connected financial intermediaries that move value outside formal legal and regulatory oversight. Tier 3 sits downstream of these flows and includes criminal organizations, militant groups, and terrorist networks that exploit Tier 2 infrastructure to finance operations and project predation and violence.

Tier 1 is where the threat ultimately originates. At this level, large pools of wealth—often held by corrupt officials, politically exposed persons, and other elites in tightly controlled capital markets—seek to externalize assets to safer jurisdictions. This demand for offshore mobility creates the economic foundation for Tier 2 networks, which are then leveraged by Tier 3 actors, with or without direct state involvement.

These dynamics likely involve hundreds of billions of dollars annually, much of which fuels instability, entrenches criminal economies, and contributes to the impoverishment and coercion of millions of people worldwide. In recent work for the New Lines Institute, I documented how militarized scam syndicates in Southeast Asia and Latin American drug cartels (Tier 3) tap into Tier 2 infrastructure that moves billions of dollars annually in response to Tier 1 demand originating in the tightly controlled Chinese capital market. My most recent work for Between the Lines shows how Iran leverages a similar three-tiered structure to finance its proxy networks and externalize elite wealth.

Each of these systems is inherently destabilizing, not only for downstream societies targeted by criminal and militant activity, but also for the states at the origin point, where capital flight erodes economic resilience and governance over time. For this reason, understanding the origin of unregulated capital flows at Tier 1 is imperative for global security.

The three-tier framework illustrates how unregulated capital flight and its facilitators at Tier 1 and Tier 2 translate into downstream criminal and militant threats at Tier 3.

Unprecedented Speed

This danger is magnified by the unprecedented speed at which unregulated wealth now moves. Since the collapse of Bretton Woods in the early 1970s, global finance has become increasingly interconnected, with cross-jurisdictional transfers occurring in hours—or seconds—rather than days or weeks. Compliance and enforcement frameworks remain largely reactive, disproportionately focused on individual transactional disruption rather than sustained action against underlying networks, ownership, and control structures. The proliferation of shell corporations and offshore banking has further obscured attribution and accountability, while crypto-based decentralized financial systems introduce parallel liquidity channels that operate largely outside the regulatory assumptions underpinning the modern financial order.

Over the past decade, the consequences of these dynamics have become severe and self-reinforcing. Armed militant groups sustained by global shadow liquidity from resource theft and drug trafficking have destabilized large swaths of the Sahel. Industrial-scale scam operations in Southeast Asia and parts of Africa rely on coerced labor, embedding vulnerable populations in criminal economies that prey disproportionately on the elderly in aging industrial societies. Other multinational laundering networks sustain transnational cartels that distribute lethal products while recycling billions in illicit proceeds.

In both underregulated jurisdictions and advanced economies, the downstream effects are increasingly visible: criminalized local ecosystems, degraded infrastructure, housing market distortion, and the erosion of demographic resilience essential to long-term social stability.

If left unchecked, these illicit flows have the power to destabilize and degrade modern life at a systemic level. For this reason, network-level disruption—not merely transactional interdiction—is imperative.

Toward Networked Disruption

Regulators and enforcement professionals are beginning to grapple with the scope of the challenge. Financial institutions, insurers, manufacturers, and other exposed sectors have devoted increasing resources to understanding global financial risk, giving rise to specialized internal teams and a growing ecosystem of external advisory firms of uneven quality. Enforcement authorities have also come to rely more heavily on the emerging blockchain analytics sector, but often as a partial substitute for deeper structural investigation.

For criminal organizations and malign state actors, blockchain has proven to be a double-edged sword. While it enables near-instantaneous, low-friction value transfer across jurisdictions, the permanent recording of transactions on public ledgers creates cumulative exposure once investigators begin reconstructing networks. Advances in machine learning and artificial intelligence – as I chronicled for an October article at GNET – have further accelerated the ability to cluster, trace, and contextualize these datapoints at scale, offering meaningful advantages over traditional investigative methods.

Regulatory efforts to bring key enablers—such as stablecoins—more fully within existing compliance frameworks are a necessary step forward. But transactional visibility and downstream disruption alone are insufficient. Achieving durable, network-level impact in a way that meaningfully improves global security requires a deeper understanding of how unregulated capital forms, aggregates, and moves at its source—before it is laundered, weaponized, or embedded into resilient criminal and state-aligned illicit infrastructures.

Why Timing Capital Outflows Is Essential

Understanding why timing matters requires close examination of where unregulated capital flows originate. In an increasingly polarized global financial environment, states seeking to operate outside the dollar-denominated system—often due to sanctions or anticipation of future sanctions—have enabled parallel financial architectures to sustain economic activity.

When these systems function as intended, they pull liquidity inward toward core institutions – especially central banks – reinforcing local currencies and supporting essential state functions under stress conditions such as wartime sanctions. As long as confidence holds, capital movement within these systems remains predominantly centripetal, stabilizing rather than eroding the domestic financial base.

But opacity of these parallel systems is both a feature and a fault. Because they are unaccountable by design—even to the states that authorize them—these systems enable insiders to quietly extract and offshore wealth. When confidence begins to fracture, elite incentives shift rapidly. Pressure to externalize capital compounds, transforming inward-facing financial mechanisms into outward-facing extraction channels. At this inflection point, operators increasingly seek offshore liquidity through any available means, including partnerships with transnational criminal networks and, in some cases, the financing of terrorism. When the financing of other states or proxy groups through these opaque networks becomes a state directive, the rate of elite pilfering often accelerates, as illicit capital movement is shielded by national security justifications and subjected to even less internal oversight.

Importantly, Tier 2 capacity is not unlimited. As unregulated capital outflows accelerate, intermediary networks can become congested, creating observable bottlenecks before capital fully disperses downstream. In several recent cases, unusually large pools of digital assets appear to have stalled within intermediary structures rather than being rapidly laundered onward, suggesting constraints in conversion, layering, or off-ramping capacity.

One widely reported example involves Prince Group, which has been linked in open-source reporting to the custody of a multibillion-dollar bitcoin balance. Regardless of ultimate attribution or intent, the scale and persistence of such holdings are difficult to explain by benign delay alone. More plausibly, they reflect saturation at the Tier 2 level—where capital has exited its origin environment but cannot yet be safely or efficiently absorbed into downstream structures.

Such congestion is analytically significant. It indicates that Tier 1 outflows are already stressing intermediary networks, even before full centrifugal dynamics take hold. For analysts and enforcement bodies, these stalled pools may therefore function as early warning indicators of impending cascade behavior rather than isolated anomalies.

This dynamic is already visible across multiple jurisdictions. Unregulated capital outflows from China are enabling multibillion-dollar transnational scam networks, casino-based laundering nodes, and drug trafficking organizations. Opaque outflows from Iran provide direct financial services to proxy groups and, indirectly, to terrorist organizations operating beyond Tehran’s stated strategic interests, including al-Qaeda-aligned actors in Somalia. Russia, meanwhile, relies on opaque financial channels to source physical gold and sanctioned inputs through criminal facilitators and private military companies operating abroad, sustaining its war effort under mounting external pressure.

When systemic trust in these environments deteriorates, capital outflow pressures compound. Iran’s parallel systems have already shifted into a centrifugal phase of capital flight, one likely to generate escalating downstream threats as stress persists. Russia continues to attract liquidity inward, but sustained trade contraction and reserve drawdowns increase the risk of a similar inflection. China, while still appearing stable on paper, has experienced persistent capital leakage for several years—producing some of the most severe downstream criminal and security effects observed to date.

These systems are inherently brittle. The strategic question is not whether they will fracture, but when. Once that threshold is crossed, vast pools of liquidity move rapidly through opaque channels that intersect with criminal and militant actors, producing destabilizing effects that are difficult to reverse. Understanding when these outflows are likely to accelerate—and at what scale—is therefore essential to planning any form of pre-emptive, network-level disruption of illicit liquidity systems.

A simplified diagram of centripetal vs. centrifugal liquidity flows through unregulated Tier 2 channels.

Understanding Capital Logic

In a post–Bretton Woods system, dollar-denominated capital tends to concentrate in jurisdictions that offer:

• Credible protection of property rights through predictable legal and regulatory institutions

• Stable, transparent, and non-punitive tax regimes

• Deep, liquid, and internationally integrated financial systems

• Political and currency stability sufficient to preserve real value

• Credible exit optionality, allowing capital to move without arbitrary restriction or penalty

• Broad-based asset appreciation that rewards passive capital over time

These conditions largely explain why, over the past fifty years, global wealth has been reinvested disproportionately into Western financial markets—particularly the United States, which combines deep capital markets with unmatched legal and currency credibility.

In highly controlled jurisdictions with adversarial or semi-adversarial relationships to Washington—such as China, Russia, and Iran—capital behavior is governed by a different logic. In these systems, jurisdictional prudence becomes a critical X-factor shaping whether capital remains onshore or seeks exit.

In such environments, capital can rationally remain domestic despite restrictive controls if two conditions hold:

• The domestic economy continues to offer returns that exceed the cumulative cost and risk of outward transfer

• Regime behavior remains bounded and predictable, such that capital faces managed exposure rather than sudden or arbitrary appropriation

Where these conditions are met, capital inertia is often the rational outcome—even in jurisdictions that lack many of the features typically associated with capital-attracting environments. But when these conditions go away, typically as a feature of economic downturns borne of deep structural flaws, capital takes flight, even at enormous cost to its owners. However, the adoption of cryptocurrencies, including central bank digital currencies, reduces the cost and increases the speed of capital mobility, reducing the time it takes for downstream threats to manifest.

There is no universal formula for precisely timing or quantifying Tier 1 capital outflows. What is increasingly clear, however, is that the velocity of modern unregulated finance causes downstream threat formation to accelerate rapidly once cascading dynamics are triggered. Conventional country risk frameworks have consistently misread these systems as more stable than they are by ignoring the behavior of elite capital under stress. Effective security intervention therefore depends on identifying and disrupting Tier 1 outflows before they metastasize into downstream criminal and militant activity.

A mathematical simplification

I have formalized this logic into a simple decision rule governing capital outflows from tightly controlled jurisdictions. The formulation builds on John T. Cuddington’s 1986 treatment of capital flight as a portfolio response, updated to reflect the substantially lower costs and reduced barriers to entry created by contemporary Tier 2 facilitators.

In this formulation, Rd denotes the expected return on domestic assets, adjusted for political and regime risk. This adjustment, A, captures the probability and severity of arbitrary state intervention, expropriation, capital freezes, or discretionary enforcement that reduces the effective value of onshore wealth.

Ro denotes the expected return available in offshore jurisdictions, reflecting both asset performance and institutional credibility abroad. The term C represents the cumulative cost of externalization, including capital controls, transaction and intermediary fees, time delays, enforcement exposure, and operational risk associated with moving capital across borders.

Capital remains onshore when the risk-adjusted domestic return (Rd minus A) exceeds the offshore alternative net of externalization costs (Ro minus C). Capital flight becomes the rational outcome once this inequality reverses.

Technologies that reduce transfer friction—most notably cryptocurrencies and related settlement infrastructures—operate by lowering C, thereby compressing the time between deteriorating domestic conditions and large-scale capital outflows and accelerating the emergence of downstream threats.

Bridging the siloes

One of the primary reasons these dynamics continue to be misread is that the systems responsible for monitoring finance, trade, sanctions, and security risk remain analytically siloed. Capital flight is treated as a macroeconomic concern. Trade distortions are assessed separately from illicit finance. Criminal and militant threats are examined downstream, long after the financial conditions that enable them have already taken shape.

This fragmentation obscures the timing problem at the center of modern illicit liquidity. By the time financial and/or political instability registers in conventional economic indicators—or downstream threats become visible to security services—the critical window for upstream intervention has often already closed as Tier 2 intermediaries have scaled. Capital has dispersed. Criminal and militant actors have embedded themselves into resilient networks that are costly and difficult to unwind.

Bridging these siloes is therefore not a matter of institutional reorganization, but of analytical integration. Understanding when and how Tier 1 capital begins to externalize—across financial, trade, and geopolitical domains simultaneously—is essential to disrupting Tier 2 networks before they mature and preventing downstream threats from metastasizing at scale.

Conclusion

Modern illicit liquidity systems move faster than the frameworks built to monitor them. As capital mobility accelerates and parallel financial architectures grow more opaque, downstream threats will continue to emerge faster than reactive enforcement can contain them.

The central challenge is no longer attribution after the fact, but anticipation. Identifying when Tier 1 capital begins to externalize—how quickly it moves, where it encounters friction, and when intermediary capacity begins to saturate—has become the decisive variable in preventing the downstream consolidation of criminal and militant power.

Meeting this challenge requires analytical integration across finance, trade, sanctions, and security domains. Without that integration, institutions will continue to misread stability, intervene too late, and confront threats only after they have embedded themselves into resilient networks.

Primer: How This Piece Got Here

This essay has already lived a small life of its own.

Since July, it circulated through several major legacy outlets. Some passed quickly and professionally; others expressed enthusiasm, requested time-consuming revisions, and ultimately stepped back for reasons that were never fully articulated. The responses varied, but the pattern was clear: uncertainty around unfamiliar frameworks, discomfort with material that sits outside conventional editorial lanes, and a broader hesitancy to publish work that challenges inherited assumptions.

The experience reinforced something that is only now beginning to shift. As recently as this past summer, traditional media still treated illicit liquidity as a peripheral issue. But the field is finally catching up. The traction my newer work has gained—across policy, enforcement, and analytical circles—reflects a broader recognition that liquidity is central terrain, not an auxiliary concern. The industry is evolving, even if the legacy editorial machinery has been slower to recognize the shift.

This piece was written to explain that evolution—how illicit liquidity systems now outlast militaries, sanctions regimes, and enforcement architecture itself—and why understanding this shift is no longer optional. Its publication journey ended up mirroring its own thesis: frameworks built for a previous era often struggle to accommodate the realities of the present one.

Since writing it, I’ve expanded and refined many of the concepts it introduced, but this remains the originating document. I am publishing it here in the form it was meant to take—not diluted, not retrofitted to an older template, and not reshaped to fit the boundaries of legacy formats. If those outlets revisit this space later, they can. My readers don’t need them to recognize the stakes.

Below is the full piece, unchanged except for minor clarity edits—the version that wasn’t designed to make anyone comfortable, but to make the problem clear.

In May 2025, FinCEN designated Huione Group and Huione Pay as a “primary money laundering concern”, citing $4 billion in proceeds tied to scams, human trafficking, and North Korean hackers. Despite global scrutiny, Huione remains operational.

This outcome is a strategic warning.

Huione’s resilience typifies a new global architecture of shadow liquidity that sustains conflict, corruption, and authoritarian influence from Southeast Asia to West Africa and beyond. These networks do not survive because they evade detection but because enforcement strategies continue to treat financial infrastructure as peripheral rather than primary terrain.

While U.S. and allied responses have prioritized weapons transfers, territorial control, and traditional alliance-building, adversaries have quietly focused on what actually sustains power: value mobility. The real vulnerability is our failure to treat financial infrastructure as battlespace—one that sustains adversaries and keeps them resilient against sanctions and other enforcement measures.

If adversaries can move value with speed, deniability, and scale, they do not need air superiority or territorial control. They can fund insurgency, project influence, and exploit crises faster than formal systems can adapt. The longer this architecture remains intact, the greater the threat to global stability.

To remain effective, national security thinking must evolve to treat financial infrastructure as core battlespace. This includes conceptualizing the purpose of tools currently under development, such as DARPA’s Advanced Analysis of Multinational Money Laundering (A3ML) initiative—not merely as forensic engines, but as platforms for pre-emptive disruption of shadow liquidity networks.

Defining the Battlespace

Shadow liquidity is a distinct category of capital movement—decentralized, broker-mediated, and designed for cross-jurisdictional convertibility beyond banking oversight. These networks—operating through over-the-counter (OTC) crypto brokers, stablecoin corridors, hawala-style settlement systems, and gray-market payment platforms like Huione—form a parallel liquidity architecture outside formal regulation. Shadow liquidity spans both licit and illicit nodes; Illicit Liquidity Networks (ILNs) are its subset devoted specifically to illegal flows.

Persistence makes shadow liquidity strategically significant. Traditional threat finance has generally been treated as episodic: discrete flows tied to specific actors, transactions, or events, which can be traced, disrupted, and prosecuted. Shadow liquidity systems, by contrast, behave like infrastructure. They are not pipelines serving a single organization or network but adaptive, self-reinforcing ecosystems that outlast individual actors.

The convergence of these systems with crypto rails has accelerated their reach and resilience. OTC brokers link fiat currencies to dollar-denominated stablecoins, serving not just as technical facilitators, but essential nodes in an informal financial network where trade settlement, investment flows, and other illicit capital flows blend into the same liquidity pools.

Treating shadow liquidity as just another typology of illicit finance misses its structural role: it is not a symptom of criminal activity but an enabler of hybrid state and non‑state operations. Whether used to sustain sanctioned economies, move capital into gray‑zone investment projects, or provide working liquidity to transnational criminal or militant networks, these systems create strategic depth for actors who would otherwise be constrained by formal financial architectures.

Understanding modern threat finance requires a shift from seeing illicit flows as isolated events to mapping the living infrastructure that sustains them. Shadow liquidity is not the side effect of a globalized economy; it is the battlespace in which financial sovereignty, hybrid conflict, and criminal enterprise now converge.

Case study cluster:

The following cases illustrate how shadow liquidity manifests across regions and conflict theaters, showing both its adaptability and its strategic impact. Taken together, these cases illustrate a convergence: shadow liquidity networks evolve into semi-sovereign systems once they achieve scale. Whether scam economies in Southeast Asia, Iran’s proxy liquidity, or Russia’s mercenary finance, the pattern is the same — financial autonomy emerges faster than enforcement adapts. This comparative view highlights why treating flows as isolated typologies misses the structural threat.

Southeast Asia – China’s Shadow Finance Ecosystem

Southeast Asia has become the epicenter of China’s offshore liquidity blowback. What began as state-managed capital outflows—meant to bypass controls and evade sanctions—has evolved into a parasitic financial ecosystem: scam compounds, gray casinos, and informal payment rails now operate beyond Beijing’s reach while draining billions from China’s own economy.

Across Cambodia, Laos, and Myanmar, Huione Pay and networks like it anchor scam hubs tied to Chinese-funded Special Economic Zones (SEZs) and armed actors. This reach extends beyond the region, as evidenced by the Houthis’ use of Huione as a money laundering service, underscoring how Southeast Asia’s shadow finance now fuels conflicts beyond the region. China’s offshore shadow finance systems are no longer just a laundering problem but a crisis of sovereignty. These systems persist not through evasion, but through structural autonomy.

Iran – Liquidity Proxies and Strategic Autonomy

Iran’s proxy liquidity system has become semi-sovereign—sustaining regional influence while eroding domestic control.

Groups like Hezbollah and the Houthis now operate independent financial architectures, built on regional taxation, smuggling, and crypto-mediated commodity sales. Stablecoins and hawala networks stretching from Cambodia to Venezuela allow these proxies to generate and deploy funds without central disbursement—blurring the line between state-backed operations and autonomous liquidity regimes.

Tehran’s leverage is now negotiated, not commanded. Even Iraqi militias once firmly under Iranian Revolutionary Guard Corps (IRGC) influence increasingly pursue self-financing agendas. Meanwhile, the IRGC has offshored vast capital through front companies, creating a shadow reserve system that sustains proxy operations but hollows out Iran’s monetary base.

Phantom gold accounting and offshore accounts conceal a liquidity collapse. The rial’s redenomination—slashing four zeros—signals a potential regime-induced currency failure. Sanctions that target banks or known intermediaries miss the mark; the true threat is not just the actors, but the parallel financial architecture sustaining them.

Russia – Mercenary Liquidity Infrastructure

The resilience of Wagner and its successor, the Africa Corps, reveals how deeply embedded shadow liquidity systems are in Russia’s expeditionary strategy. These networks bypass Moscow’s formal financial system, instead relying on resource smuggling, gold and diamond flows laundered through Dubai, and opaque third-party facilitators. Non-bank intermediaries and commodity traders provide both mobility and deniability, with indications that stablecoin rails bridge African resource wealth to operational accounts abroad.

Russian mercenary operations in Africa reveal how shadow liquidity enables sanctions evasion and strategic divergence. These networks can outgrow state control, making local deals that contradict official policy. The enforcement lesson is structural: targeting individuals fails when the network is modular, adaptive, and partially sovereign. Wagner’s liquidity architecture shows how private and state power converge through shadow finance

Synthesis:

Liquidity systems built for strategic depth have mutated into semi-autonomous infrastructures. Across Southeast Asia’s scam-finance belt, Iran’s proxy networks, and Russia’s mercenary plunder, a common feature emerges—adaptability and persistence. These are not episodic money trails but living financial architectures. Disrupting them requires more than transaction monitoring; it demands ecosystem-level mapping and structural interventions.

Institutional Blind Spots

Despite advances in threat finance, global security systems remain misaligned. The core challenge is conceptual inertia. National security and regulatory frameworks still treat illicit finance as a transactional problem despite shifting circumstances. The greatest threats now move not through isolated bank accounts or criminal actors, but through decentralized liquidity networks—adaptive, hybrid financial ecosystems that function beyond the reach of conventional enforcement.

These networks are not invisible. They are partially observed, persistently flagged, and yet structurally misunderstood. Financial surveillance tracks anomalies inside banks but misses liquidity outside them. What it cannot see, let alone disrupt, is the architecture of liquidity that exists outside its perimeter.

Today’s adversarial liquidity flows increasingly blend stablecoin corridors, over-the-counter (OTC) brokers, shell companies, nested exchanges, and informal value transfer systems like hawala. They straddle legality, often making use of mainstream platforms and payment rails while remaining structurally opaque. These flows do not behave like traditional laundering transactions, but rather like sovereign financial systems in miniature, operating under their own rules and norms. Current tools were built to find bad actors, not to identify financial sovereignty.

This actor-centric paradigm enables profound blind spots. Compliance tools detect transactions but fail to contextualize liquidity patterns across jurisdictions and asset types. As a result, regulators and intelligence agencies see fragments—but no infrastructure. The network remains intact, quietly evolving.

Legal constraints further widen the gap. Jurisdictional silos, lengthy mutual legal assistance treaty (MLAT) procedures, and fragmented beneficial ownership laws delay or block enforcement. Meanwhile, regulatory frameworks remain chronically outdated. Cryptocurrency policy is inconsistent across the U.S., EU, and Asia. Platforms offering liquidity-as-a-service—such as peer-to-peer (P2P) exchanges, stablecoin escrow markets, and anonymous crypto wallets—often fall through the cracks. Many operate in legal gray zones or under regulatory arbitrage, where no single state has oversight, and with little incentive to close the gap.

The result is not a lack of information, but an inability to act on what is already visible. Shadow liquidity does not thrive in darkness. It thrives in disconnection—between agencies, between legal systems, and between the visible and the actionable. This disjointedness is no longer an anomaly. It is the terrain upon which adversarial financial networks are built.

From Designation to Disruption: the Legal Infrastructure for Liquidity Warfare and A3ML

The proposed Anticipatory and Adaptive Anti-Money Laundering (A3ML) framework is designed to identify, designate, and dismantle illicit liquidity systems. Unlike traditional tools focused on compliance and anomalies, A3ML can become an AI-driven infrastructure mapping system. To be effective, it must be trained on deep, pattern-based financial research and empowered by cross-jurisdictional legal reform. Its targeting must focus not only on bad actors, but on the systemic architecture that sustains them.

The American legal architecture built to combat organized crime offers a blueprint for confronting today’s most urgent financial threat: illicit liquidity networks. The Racketeer Influenced and Corrupt Organizations Act (RICO) succeeded not by prosecuting criminals one by one, but by treating entire criminal enterprises as unified entities. It marked a doctrinal shift—from targeting individuals to dismantling infrastructure.

Illicit finance in 2025 demands a similar evolution of thought. What we face today are not merely networks of bad actors but global, adaptive liquidity ecosystems that serve as the financial backbone of transnational crime, proxy warfare, and authoritarian statecraft. These systems are durable, decentralized, and increasingly indistinguishable from legitimate financial activity. We must understand them not as criminal anomalies, but as sovereign financial organisms enabled by adaptive cross-jurisdictional infrastructure.

This is not about policing bad actors. It is about mapping and disabling the systems that allow bad actors to regenerate faster than enforcement can respond.

Civil Asset Forfeiture as Strategic Weapon

Time is the decisive variable in liquidity warfare. Prosecutions remain too slow to neutralize networks moving billions in real time. A3ML must therefore expand the civil asset forfeiture logic pioneered under RICO across global jurisdictions. Unlike criminal cases, civil forfeiture permits freezing assets on a preponderance of the very evidence A3ML is built to track in real time.

Civil forfeiture enables pre-emptive action against identified liquidity networks—especially when paired with new legal definitions that treat financial networks, not just individuals, as targets. This mechanism already exists. What is missing is the conceptual shift that elevates illicit liquidity to the level of strategic infrastructure.

To operate globally, this tool must be accompanied by jurisdictional harmonization. While A3ML does not currently establish mutual recognition protocols, its framework could build on existing international precedents—such as the Strasbourg and Warsaw Conventions—to enable partner states to enforce each other’s forfeiture orders against designated liquidity networks. The goal is speed: convert intelligence into disruption within days, not years.

Jurisdictional Leverage and Legal Hooks

The United States already has the legal foundation to operationalize A3ML. Statutes such as Section 311 of the USA PATRIOT Act and the Bank Secrecy Act provide hooks for systemic disruption, especially when combined with U.S. control over dollar clearing and correspondent banking access. A3ML’s contribution is not legal but conceptual: it unifies these authorities into a framework for targeting liquidity networks rather than isolated actors—and at speeds much faster than human analysis.

Global coordination is not just possible—it is already taking shape. The Financial Action Task Force (FATF), long the international standard-setter for AML/CFT compliance, has begun to acknowledge the complexity of illicit financial infrastructures beyond formal institutions. Initiatives like Operation Grafos—which targeted professional money laundering networks as coherent entities—represent a significant step toward structural thinking. Grafos – highlighted in the FATF’s 2025 report on terrorist finance - showed that the global community is starting to move from transactional enforcement to enterprise-level disruption.

But FATF’s core recommendations still focus primarily on institutional behavior: due diligence, beneficial ownership, and recordkeeping. They stop short of mapping or designating networked liquidity systems, and they lack the enforcement mandates required to neutralize them.

This is where A3ML fits—not as a competitor to established frameworks, but as their architectural complement and enforcer. It provides the conceptual framing and enforcement logic needed to extend current compliance standards into a cross-jurisdictional, structural response to liquidity-based threats. By aggregating and processing data in real time, A3ML can reframe illicit finance not as a series of reporting failures, but as a systematized battlespace—one that demands structural tools to navigate and dismantle. It must be trained on real data and paired with cross-border reform.

Defining the Target: Illicit Liquidity Networks

Illicit Liquidity Networks (ILNs) are the unlawful subset of shadow liquidity—persistent financial structures, whether criminal, corporate, or state-aligned, through which value moves beyond sovereign control. Where shadow liquidity describes the broader architecture, ILNs identify the specifically illicit nodes that A3ML is designed to dismantle.

A3ML could designate ILNs as systemic threats rather than fragmented cases. Phase I would map ILNs through public–private partnerships. Phase II would build on emerging stablecoin oversight to close gray intermediaries. Phase III would disable them through forfeiture, cutoffs, and coordinated sanctions. Implementing these phases would require no new agency, only integration of existing authorities. A3ML is not a silver bullet but a structural correction. Without it, security architecture will remain reactive—outpaced by networks that understand one truth: control liquidity, and you control survival. Operational success will depend on embedding liquidity mapping into existing security frameworks and building analytic partnerships capable of predictive disruption beyond the banking system.

Conclusion – Sovereignty and Strategy in the Age of Hybrid Liquidity

Sovereignty today is no longer defined by borders, flags, or deterrence, but by the ability to control the flow of capital—licit and illicit, digital and analog, state and shadow. In this battlespace, liquidity itself is sovereignty. Without tools to secure the circulatory system of finance, every alliance, sanction, and military asset is vulnerable to erosion by this new paradigm.

Illicit liquidity networks enable proxy wars, hollow out regulatory regimes, and entrench criminal ecosystems that feed on institutional weakness. And they do it faster than conventional enforcement can react. Treating financial architectures as an auxiliary domain of national security is no longer tenable. What A3ML offers is not just a legal instrument—it is a strategic reorientation. One that recognizes that power now flows through networks, not just weapons; through escrow chains and stablecoins, not just supply chains and ships.

If we fail to respond, we invite encroachment—not by military forces, but by liquidity systems we ignored. The choice is clear: keep reacting in fragments, or build the architecture to defeat liquidity insurgency systemically.

No one has ever accused me of being an optimist — especially if they’ve read Between the Lines.

However, today I’m staking out a position of cautious optimism on one of the hardest problems in financial intelligence: getting a handle on illicit crypto flows, especially when it comes to designated terrorist groups.

To be clear: nothing in this field will ever be perfect. Threat finance is adaptive by design. But after tracking this space for years, I’m convinced the scales are tipping in ways that make overwhelming pessimism harder to sustain.

Here’s why.

Data aggregation

Every crypto transaction leaves a digital trace. Even if pseudonymous, it’s still a ledger entry — vastly different from the opaque networks of hawala or bulk cash smuggling.

The successful takedown of illicit Monero transactions by Japanese National Police is proof that anonymity tech can be pierced when regulators and enforcement pair data with persistence. Practitioners in the blockchain analysis space have told me that anonymous tokens are not as anonymous as some would have you believe.

The problem right now is that it takes a lot of people to find and process the data needed to track illicit flows and the industry struggles to keep up. That’s where AI comes in — to turn the overwhelming volume of raw data into actionable detection.

AI development

Several blockchain analytics firms are already layering machine learning into their platforms — using AI to catch anomalies humans miss. But they are not the only ones.

The Defense Advanced Research Projects Agency (DARPA) is currently developing a programme called Anticipatory & Adaptive Anti–Money Laundering (A3ML). In a recent podcast, the A3ML project lead commented his team’s goal is to make money laundering “too expensive” by dramatically increasing the effectiveness, speed, and scale of detection using artificial intelligence (AI). Because money laundering is defined by scale, speed, and complexity — exactly the domains where human investigators are outmatched and algorithmic detection excels — AI could be a genuine gamechanger.

DARPA has been quietly promoting A3ML for months, meaning it is well past the idea stage. With leading analytics firms already incorporating AI into their products, the use of AI in this field is no longer hypothetical. Given the rapid speed of advancement in current AI technologies, the efficacy of these products is likely to improve dramatically in the coming months and years.

Regulatory reform

The European Union’s MiCA regime, the U.S. GENIUS Act, and Hong Kong’s stablecoin ordinance all point to a growing global consensus that crypto markets can and must be regulated. The traction my recent articles on unregulated crypto regimes have gained underscores that this isn’t just a policy shift — there’s real appetite across the field to understand and address these risks.

I believe enforcement will continue moving toward a preponderance standard — acting whenever aggregated signals indicate illicit activity is more likely than not, rather than waiting for airtight proof. In practice, that standard favors systems that can aggregate patterns, spot anomalies, and connect disparate signals faster than any manual investigation — exactly the kind of connective tissue that AI-driven systems can surface better than human investigators. Yes, gray jurisdictions will still exist, but in a world where dollar clearing still reigns supreme, the preponderance model will leave them increasingly isolated and deprived for non-compliance.

Terrorist finance: tip of the spear

Terrorist finance is likely to feel the impact of this enforcement shift before other domains. The reason is twofold. First, national security considerations ensure that counter-terrorism receives the highest priority for resources, political will, and legal innovation. Governments simply cannot afford to take a passive stance when designated groups are exploiting new technologies.

Second, counter-terrorism already has over two-decades-worth of laws, regulations, and intelligence cooperation to build upon — from FATF standards and UN Security Council resolutions to domestic tools like the U.S. Patriot Act and equivalent frameworks worldwide. That foundation makes terrorist finance the most immediate proving ground for applying aggregated data and AI-enabled detection under a preponderance standard, before those same methods expand into broader areas of illicit finance.

Conclusion

Progress in this field isn’t measured by perfection — it’s measured by whether the system gets harder for bad actors to exploit. And by every sign — data aggregation, AI adoption, and regulatory convergence — we’re moving in that direction.

Caution is still warranted; threat finance adapts. But the fatalism that says this space is uncontrollable no longer matches reality. There is much work to be done in mapping these systems moving forward, but on this issue at least, I am cautiously optimistic.

Note: This article is in part a preview of a bigger piece I’m currently working out. Also, stay tuned for the long-awaited Part II of my China military series.

Image source

FinCEN’s new advisory on Chinese Money Laundering Networks (CMLNs) underscores a truth often missed in enforcement reporting: these are not isolated laundering schemes but components of a parallel financial architecture, a shadow liquidity system now entrenched across the Americas and around the world.

The advisory contains staggering numbers: over 137,000 suspicious activity reports (SARs), $312 billion in suspicious flows, and the same trade-based, over-the-counter (OTC), and insider-driven mechanisms. The underlying systems that set off these alerts are the connective tissue that allow sanctioned states, cartels, and elites to thrive despite formal financial controls.

FinCEN frames this as “Chinese money laundering.” And when it comes to cartel finance, Chinese enablers are indeed the most visible. Yet they are only part of a parallel financial architecture — a global ecosystem where Chinese actors are central, but not alone. Other state and non-state players drive and exploit these flows as well. Until regulators and analysts treat shadow liquidity as infrastructure, rather than a collection of anomalous SARs, enforcement will remain reactive while the networks evolve faster than the tools meant to stop them.

Subscribe now

Bigger than you think, and more chaotic

These laundering networks are diffuse, but global. They service multi-billion-dollar scam operations in Southeast Asia, terrorist groups like the Houthis, and emerging criminal enclaves in Africa and Latin America. The FinCEN advisory highlights just some of their embeddedness in Western societies, underscoring the scope of this problem.

The sort of networks FinCEN highlights aren’t just laundering for cartels — they’re tapping into a much larger reservoir of Chinese shadow capital. Crypto-enabled, OTC-driven liquidity rails emerged first to move elite wealth offshore, but over the past decade they’ve evolved into a parallel financial architecture. These flows no longer sit neatly under Beijing’s command; they form a sprawling ecosystem of brokers, gray banks, scam centers, and informal clearinghouses that operate beyond the reach of both Western enforcement and the Communist Party itself.

This is what makes the threat so destabilizing: it’s not simply “Chinese laundering,” but a decentralized liquidity system born from state and elite outflows that now finances everything from fentanyl supply chains to dual-use tech procurement. In other words, what started as controlled leakage has become a global shadow infrastructure — chaotic, adaptive, and only partially answerable to any state.

Drug cartels, scammers, and terrorists are just the visible tip of this hidden architecture. They set off SARs and grab headlines, but they are a symptom, not the disease. To understand how we got here, Between the Lines has developed a three-tiered model that tracks the money cascade from its source.

The Three-Tiered Liquidity Approach

Drug cartels, scammers, and terrorists are the visible tip of this hidden architecture. They set off SARs and grab headlines, but they’re only the final chapter in a much longer story. To understand how we got here, Between the Lines has developed a three-tiered model that tracks the money cascade from its source.

• Tier 1: The Seed Money. Vast capital outflows from countries like China, Russia, and Iran fund alternative criminal ecosystems outside global jurisdictions. The true danger of these countries lies not in their strength, but in their weakness — an inability to stem elite graft and offshore leakage that fuels shadow economies worldwide. Although these governments rely on offshored liquidity, they cannot control it once it’s outside the country - leaving them ultimately vulnerable.

• Tier 2: The Enablers. Operating in a legal gray zone, these brokers and businesses aren’t quite illegal enough to shut down without hard evidence. They thrive in lax regulatory environments, running OTC crypto desks, gray exchanges, and shell firms. They provide the escape valves for Tier 1 elites, and the laundering services that Tier 3 bad actors depend on.

• Tier 3: The Headline Grabbers. These are the actors you see in FinCEN advisories and blockchain analytics reports. Southeast Asian scammers, Iranian proxies, Mexican cartels — all exploit this ecosystem. Some build entire operations on Tier 1 outflows; others simply tap it for laundering. They kill, rob, and enslave, but remain only the tip of the iceberg. Authorities shut down one operator, while the deeper pool of shadow liquidity ensures they always resurface somewhere new.

  • Some Tier 3 operators, like Southeast Asian scammers were built directly on Tier 1 capital outflows enabled by Tier 2 operators.

  • Others, like Mexican cartels, came to the game later, accessing Tier 2 channels to legitimize their ill-gotten gains.

  • What they all have in common is that they are the dirtiest players in the game: terrorists, drug traffickers, slavers, and thieves on a massive scale.

Reports highlighting asset seizures are comforting. So are those on the shutdown of gray exchanges like Russia’s Garantex. But in every case, the real operators reconstitute somewhere else with impunity. Until we find a way to go after these cascades systematically, the cycle will continue unabated, threatening global security on practically every level.

Between the Lines’ proprietary Predictive Intelligence Pipeline

What Between the Lines Offers

Before we can disrupt these networks, we need to understand them. Between the Lines exists to map the shadow liquidity systems that underpin global crime, state corruption, and geopolitical instability.

Where others focus on symptoms — the cartels, the scams, the terror groups — we dig into the architecture: the hidden financial scaffolding that sustains them. Our analysis blends geopolitics, macroeconomics, open-source intelligence, and financial investigation with years of institutional memory tracing capital outflows from Beijing, Moscow, and Tehran to scam compounds in Southeast Asia and fentanyl traffickers in Mexico. Beyond mapping the networks, Between the Lines is developing models to anticipate and time these flows with as much precision as possible.

We share the doctrine publicly — models like the three-tiered liquidity approach that explain how capital moves, why enforcement fails, and where interventions could succeed. But we can’t afford to give it all away for free. The real value lies in tailoring this framework to specific risks: a bank’s exposure to shadow liquidity, a government’s vulnerability to illicit flows, or a regulator’s blind spots in enforcement. Those require bespoke reports and private briefings, built to solve problems no generic red flag can.

For policymakers, compliance officers, and investigators, Between the Lines provides more than headlines — it delivers the clarity and strategy needed to actually disrupt these networks. For readers, it offers a rare vantage point on the hidden infrastructure reshaping global security and finance.

Illicit finance is no longer episodic crime. It has matured into shadow liquidity systems: parallel infrastructures where state actors, cartels, mercenary groups, and cybercriminals pool and regenerate capital. These systems – empowered by digital currencies and vast capital outflows – function as underground financial institutions, enabling adversaries to outlast sanctions, rebuild after seizures, and finance operations at scale.

Global institutions still treat illicit finance as a series of anomalies — bad transactions, rogue exchanges, isolated scams. This fragmented view leaves the circulatory system itself untouched. The result: adversaries adapt faster than regulators, and global security erodes while enforcement chases symptoms.

Why It Matters

• National Security: Shadow liquidity sustains proxy wars, sanctions evasion, cyber operations, and militant logistics. It is the bloodstream of hybrid conflict.

• Economic Integrity: These systems siphon billions from households and corporations alike. They play a destabilizing role in across whole regions, as witnessed recently in Southeast Asia.

• Beyond Control: These systems feed off capital outflows (especially from China) but answer to no one — even the countries that spawned them.

• Real World Threats: Iran-backed proxies and Southeast Asian militant groups use these networks. So do multi-billion-dollar global scam operations. The threat is real and it’s already here.

• Strategic Leverage: Whoever maps and disrupts these infrastructures doesn’t just fight crime — they control adversaries’ capacity to project power.

The Gap

• Tools are reactive: Blockchain analytics, anti-money laundering (AML) compliance, and sanctions designations find anomalies but not architectures.

• Regulation is fragmented: National silos and outdated legal frameworks make systemic action impossible.

The BTL Framework

Between the Lines Research has developed a framework to analyze illicit finance as infrastructure rather than incident. Key components:

• Primary Liquidity: Capital outflows — fast, mobile fuel.

• Secondary Liquidity: Informal systems (hawala, OTC desks, trade credit) that enable gray exchange.

• Tertiary Liquidity: Long-term reservoirs (real estate, commodities, criminal operations [ex: scam centers], militant/ terrorist groups) that can be mobilized in crisis.

By tracking conversion between these tiers, we expose the stress points adversaries use to survive and regenerate.

Between the Lines’ proprietary Three-Tiered Framework and Predictive Intelligence Pipeline

Applications

• National Security: Identify and pre-empt liquidity corridors sustaining adversary militaries and proxies.

• Financial Sector: Develop financial intelligence (FININT) products that move beyond anomaly detection into systemic mapping.

• Tech & Cyber: Integrate liquidity mapping with cyber threat intel to close the gap between digital intrusions and financial outcomes.

Case Study: Chinese Capital Outflows and Scam-Backed Militias

The rapid outflow of Chinese capital, driven by elite flight and tightening domestic controls, has created offshore liquidity pools across Southeast Asia. These flows illustrate how shadow liquidity systems evolve from simple capital escape into infrastructures that finance armed groups and destabilize regional economies.

• Capital Outflows (Primary): Wealthy elites and mid-tier operators move funds offshore to evade Beijing’s capital controls. Much of this first moves through cash, stablecoins, and front companies in border economies.

• Infrastructure Formation (Secondary): These outflows feed into OTC desks, casinos, and unregulated payment processors, which become regional hubs for laundering and reinvestment for tertiary actors.

• Tertiary Parasitism and Destabilization: At the highest tier, the threat becomes acute.

  • Scam compounds siphon billions annually through trafficked labor.

  • Armed groups and private militias provide protection for these hubs, turning them into semi-sovereign enclaves in Cambodia and Myanmar.

  • Platforms like Huione facilitate laundering at scale, enabling actors such as the Houthis to exploit the same corridors.

  • The fact that Huione remains active despite sanctions and a nominal shutdown shows that these systems are networked, not episodic — requiring a systemic approach.

This cycle shows how a single driver — Chinese capital flight — cascades into a shadow liquidity architecture that finances militancy, erodes sovereignty, and extracts value from legitimate economies. Episodic enforcement actions like sanctions strike at symptoms in the tertiary tier, but the real threat lies in the multi-tiered networks that remain resilient and regenerative.

What Between the Lines Provides

Between the Lines translates this framework into actionable outputs: tailored briefings, case studies, and strategic advisory designed to help institutions understand and anticipate how shadow liquidity shapes their risk environment. Whether the need is regulatory foresight, adversary mapping, or integration into existing threat intelligence, BTL brings the concepts down to ground level — where they can guide decisions, not just analysis.

PDF Soldiers hunt for IS-S operatives in the Cal Miskaad mountains in January 2025. Image source

On July 25, U.S. Special Operations Forces captured Islamic State–Somalia (IS-S) leader Abdiweli Muhammad Yusuf in a targeted raid near Dhaardaar, Puntland. U.S. Africa Command (AFRICOM) and the Puntland Defense Forces (PDF) describe Yusuf as a senior financial facilitator in IS-S’s regional network—labeled in several outlets as the group’s “finance chief.” He reportedly served as Emir of Maktab al-Karrar (al-Karrar Office), which oversees Islamic State financial operations across eastern and southern Africa.

The operation to capture Yusuf, conducted near Dhaardaar in Puntland, follows a broader uptick in U.S. intelligence-led strikes against jihadist factions in East Africa. Although global security is no doubt improved by Yusuf’s new life in U.S. custody, the networks he oversaw have likely already begun to adapt to his absence. Targeting them will require a similar adaptation in counter threat finance moving forward.

A regional hydra

It’s not that Yusuf was unimportant—I flagged him in an article back in February. But what that piece made clear was this: the system he supposedly presided over is far more resilient than any one individual.

Al-Karrar is the largest fundraising node in IS’s global operation. It manages a sophisticated patchwork of hawaladars (informal money transfer agents), crypto brokers, and administrators spanning much of eastern and southern Africa. Its fundraising includes ransom kidnappings and pig-butchering scams in South Africa. It also maintains close ties to groups like Mozambique’s al-Shabab (not to be confused with the Somali group), which allegedly generates over $20 million annually through illicit timber and resource smuggling.

According to several reports, Al-Karrar is also the main financial backer of Islamic State Khorasan Province (ISKP)—the IS branch behind deadly attacks in Iran and Russia and multiple foiled plots in Europe. Funds appear to move through informal remittance corridors from Somalia to Central Asia, often mediated by crypto brokers and hawala facilitators.

In short, it’s fairly large operation comprised of a broad patchwork of transregional operators.

The architecture that sustains terror

Just like in a major corporation or bank, senior terrorist financial operators—even those at the top—are ultimately replaceable. Finance is a trade: complex, but not rarefied. Puntland may not attract Wall Street-level talent, but it has nonetheless produced a resilient and international cohort of operators skilled in transnational illicit finance.

The architecture that sustains these networks—informal corridors, crypto rails, hawaladars, local extortion, and commodity-based laundering—remains largely intact. These are not fragile hierarchies. They are decentralized ecosystems designed to survive leadership decapitation.

Kinetic operations may produce short-term friction, but they do not dismantle decentralized financial ecosystems. The true point of leverage lies in targeting the liquidity infrastructure itself: the stablecoin brokers, hawala corridors, illicit exchanges, and jurisdictional blind spots that allow terrorist networks to persist, adapt, and regenerate.

The bottom line

Degrading terrorist finance requires more than leadership targeting—it demands structural engagement. That means addressing the financial ecosystems that outlast individuals. From stablecoin rails to commodity laundering and informal remittance routes, these systems must become the focus of counter–threat finance strategy. Tactical successes only translate into durable gains when we challenge the infrastructures that sustain insurgency and transnational violence.

More to come. Stay tuned.

Sovereignty is often depicted as the ability to control territory and govern people. In reality, it is fundamentally the capacity to generate and direct liquidity—to move value, fund loyal networks, and project power across borders. Liquidity is not merely a financial tool; it is the circulatory system of modern power.

Militant groups today function as alternative liquidity states, building informal financial scaffolds that blend local cash taxation, resource extraction, and transnational flows. By leveraging technological advances—such as crypto-enabled remittance networks, digital payment rails, and global e-commerce platforms—these actors have developed a form of sovereignty unparalleled in modern history in terms of flexibility, deniability, and resilience.

This liquidity sovereignty enables groups to persist and adapt even after losing territory, charismatic leaders, or formal hierarchies. It is not ideology or battlefield victories alone that sustain them, but their mastery of hidden liquidity architectures — sovereign ecosystems in their own right—that quietly underwrite violence, influence, and long-term survival.

Islamic State networks — Fragmented yet digitally adaptive

The Islamic State’s global branches primarily rely on hyperlocal cash generation — including micro-extortion, petty taxation, and opportunistic resource control — to survive. Yet it is their evolving digital liquidity architecture that sustains them as a transregional threat.

Read more

A makeshift refugee camp in Cambodia’s Oddar Meanchey Province. Image source

Up until only a few months ago, the disputed stretch between Thailand and Cambodia was a quiet landscape of temples visited by people from both sides of the border. In the summer months, this region—known as the Emerald Triangle for its dense forests—can feel like it’s baking in the mid‑40s Celsius, the heat broken only by heavy rains that sometimes clear into spectacular golden sunsets under flamingo pink skies. The ancient sites—and the communities that sustain them—reflect a shared lineage: both peoples trace their roots to the Khmer Empire, once centered near today’s Angkor Wat, until the Sukhothai ancestors of the modern Thai state broke away in the mid‑13th century.

The heart of the border dispute lies in boundaries drawn during the French colonial era, when early 20th‑century treaties fixed a rigid line across what had long been a fluid cultural frontier. The region has since known intense war and instability, albeit previously unrelated to this haphazard border demarcation. From 1967 through 1998, Cambodia endured a brutal civil war that drew in both regional and global powers, leaving its territory among the most heavily land mined on earth. On July 23, one of those remnants maimed five Thai soldiers, prompting shutdowns of both countries’ embassies.

Nevertheless, until only a few weeks ago, the borderlands had settled into a decades-long calm, with people from both sides enjoying picnics at temple sites. According to official reports, Thai soldiers became agitated when Cambodians sang their national anthem at one of these sites, and that’s around when the violence intensified. Nobody seems to have wanted this war, and if you watch accounts like Preston Stewart’s, the Cambodian troops were so unprepared that many are fighting in t‑shirts and flip‑flops.

Recent headlines have been dominated by deadly clashes along the disputed border. Most of those killed have been civilians, with both militaries blaming each other for targeting innocents. Thus far, clashes between Thai and Cambodian troops along the two countries’ disputed border have killed at least 14 people and displaced 120,000 others.

Like most things in Southeast Asia these days, there’s much beneath the headlines. Along this stretch of frontier, Chinese-run scam centers and the illicit capital they generate form part of the conflict’s backdrop—and while it’s too early to call them the driving force, their weight is too significant to ignore.

This piece will unpack that dimension and explain how illicit economies intersect with the border tensions in ways most coverage has missed.

A little context

I knew something was off when Thai authorities suspended the leadership of Prime Minister Paetongtarn Shinawatra, the youngest in the country’s history and only the second woman to hold the post, over a call with former Cambodian Prime Minister Hun Sen. In the leaked conversation, Paetongtarn addressed Hun as “uncle,” offered to “take care of anything you need,” and described Thailand’s top general as “opposing” and out of step with the nation’s interest—remarks that ignited accusations of compromising sovereignty and deference to Cambodian influence. We’ll likely never know the full context of that exchange, but there is much to parse between the lines.

Read more

Introduction — Beyond Asia

Southeast Asia’s scam compounds — fueled with liquidity from Chinese capital flight — have become synonymous with industrial-scale fraud, human trafficking, and gray finance. From the infamous enclaves of Cambodia’s Sihanoukville to the lawless border zones in Myanmar and Laos, these semi-sovereign illicit ecosystems extract a staggering toll, primarily targeting people in mainland China through sophisticated scams and coercive trafficking operations. According to Interpol estimates, they feed into a $3 trillion global underground economy each year.

Although these networks are closely linked to Chinese state-led investment flows, they have rapidly evolved beyond Beijing’s effective control, forcing violent yet largely ineffective cross-border crackdowns. Now, these scam syndicates are turning their attention outward — expanding into Africa, Latin America, and ultimately, Western markets. In doing so, they threaten to become not just a regional crisis but a global liquidity parasite, undermining legitimate economies and corroding financial sovereignty worldwide.

Subscribe now

Why Africa and Latin America?

Africa and Latin America have become increasingly attractive hubs for illicit financial networks and scam operations — and the reasons are both structural and strategic.

First, these regions offer regulatory weakness and pervasive corruption, creating fertile ground for criminal enterprises. Countries such as Nigeria, Ghana, Kenya, and South Africa in Africa, as well as Brazil, Colombia, and Mexico in Latin America, have seen a rapid rise in scam and laundering infrastructure precisely because local enforcement remains fragmented and often politically compromised.

Second, the rise of new digital middle classes in these regions provides a vast pool of fresh, soft targets. As millions of people come online, often without robust digital literacy or strong consumer protections, they become ideal prey for sophisticated social engineering campaigns and financial fraud schemes.

Third, operating from Africa and Latin America provides distance from Asian enforcement pressure. As authorities in China and Southeast Asia crack down on certain scam and laundering networks, criminal actors strategically shift to jurisdictions with weaker oversight and fewer extradition treaties.

Fourth, these regions enjoy proximity to European and North American markets, combined with linguistic and cultural familiarity (English, Spanish, French). This makes it significantly easier to craft scams that resonate with Western emotional and financial vulnerabilities — whether impersonating local authorities, exploiting charitable causes, or manipulating diaspora ties.

Finally, the emergence of advanced AI tools has dramatically lowered the barrier to entry for these networks. AI allows operators in Africa and Latin America to simulate highly convincing Western identities, tailor emotional manipulation at scale, and automate entire scam ecosystems with precision. This convergence of regulatory gaps, technological capacity, and cultural access creates an almost perfect storm for transnational financial exploitation.

The True Objective: Systemic Liquidity Extraction

The ultimate goal of these networks is not simply small-scale fraud or opportunistic scams — it is the deliberate, engineered siphoning of capital out of vulnerable systems on a massive scale. This is what I call systemic liquidity extraction: large, sustained flows designed to hollow out economic and social resilience from within.

Rather than quick-hit financial crimes, these operations weaken social trust in digital systems, creating long-term skepticism toward online platforms, payment rails, and even centralized financial institutions. By undermining user confidence, they create an environment in which alternative (and often illicit) rails can thrive with less scrutiny.

In a landmark case, North Korea’s Lazarus Group, nearly stole $1 billion from the Bangladeshi Central Bank until their transfers were intercepted by authorities in the Philippines. If hackers can nearly execute a financial crime of this scale, the risk to broader systems is enormous.

At a higher level, illicit networks reinforce the architecture of offshore and shadow liquidity sovereignty — allowing bad actors to control, store, and redeploy value outside regulated channels. A clear example is the Huione case, where payment platforms linked to the Chinese language criminal ecosystem (like Huione Pay) have enabled scam and trafficking groups across Southeast Asia to move billions in illicit proceeds while residing in armed and fortified “scam cities”. By operating in weakly regulated environments and offering integrated messaging, payment and layering tools, Huione effectively creates a private, opaque financial system. The network even helped the Iran-backed Houthis move illicit funds. This shadow sovereignty provides strategic flexibility and covert geopolitical leverage, allowing actors to shape markets, destabilize rivals, and shield assets from enforcement or sanctions.

Chinese criminal syndicates, already deeply embedded in Western underground financial and criminal ecosystems, play a central role in this extraction strategy. The most prominent example is their extensive role in laundering money for Mexican drug cartels, but there are many others — including seemingly niche operations like illegal baby eel smuggling on Canada’s East Coast. Over years, these networks have built cross-border laundering structures ranging from casino junkets and underground banks to large-scale e-commerce fraud, giving them direct access to Western liquidity. Their operational maturity allows them to move funds quickly and invisibly into offshore havens, fueling both private enrichment and broader state-aligned objectives. Should these networks become intertwined with expanding global scam operations, their ability to siphon from their host societies would become even greater.

Finally, aging Western societies are particularly susceptible to these scam-driven extraction economies. Older populations often hold disproportionate liquid wealth and are more vulnerable to targeted social engineering, especially as loneliness and digital illiteracy compound emotional susceptibility. As demographic trends continue to skew older across Europe and North America, the scale of potential liquidity siphoning — and corresponding social destabilization — will only grow.

Why Current Responses Fail

Today’s regulatory and enforcement responses are fundamentally reactive, designed to address individual scams or laundered transactions rather than dismantle the systemic financial scaffolding that enables them.

For example, in Australia, banks shut down fewer than 13,000 mule accounts last year despite over 100,000 being exploited. A mule account is a bank account controlled by an intermediary who moves illicit funds on behalf of criminal networks, making it harder for authorities to trace and seize core assets. In another example, in the US, despite losing an estimated $44 billion annually to “pig-butchering” scams, regulators have focused on freezing individual accounts rather than dismantling the networks enabling Chinese syndicates to exploit U.S. bank accounts at scale. Pig butchering is an especially pernicious and increasingly common form of scamming where perpetrators emotionally groom their victims over time, often through romance or investment schemes, before manipulating them into transferring large sums of money into fraudulent platforms controlled by criminal networks.

These examples illustrates a focus on surface-level symptoms rather than dismantling the underlying laundering networks. Instead of treating these networks as strategic threats to economic sovereignty, they are managed as isolated criminal or compliance issues. There is no global framework capable of addressing the structural nature of these transnational scam and laundering hubs. Multilateral efforts target symptoms — not the liquidity networks sustaining them.

According to the Financial Action Task Force’s (FATF) July 2025 report (where I am cited several times), 69% of jurisdictions face major or structural deficiencies in countering terrorist financing — even as vulnerabilities continue to multiply. Similarly, the United Nations Office on Drugs and Crime’s (UNODC) annual report highlights that global responses remain fragmented and reactive, targeting individual cases rather than dismantling cross-border laundering infrastructures.

Finally, weak regulatory regimes have little incentive to change, as these shadow flows often bolster local elites, provide off-books revenue streams, and help maintain fragile patronage systems. In the absence of a fundamental shift in how we perceive this burgeoning parasitic financial ecosystem, many more will inevitably fall prey to it worldwide.

Closing Warning

These scam centers are no longer merely regional nuisances; they are mutating into global economic pathogens. Left unchecked, they will embed themselves as sovereign liquidity parasites, quietly draining our societies from within — hollowing out social trust, weakening regulatory legitimacy, and siphoning capital at scale.

There is still a way to stop them — but it requires a complete shift in how we see them. We must recognize these networks as strategic infrastructure threats, not just criminal annoyances, and move toward dismantling their liquidity architecture as a core element of national and economic security strategy.

Subscribe now

Inner Circle Tier Exclusive:

The Liquidity Kill Switch: Designing the Doctrine to Dismantle Global Fraud Hubs and Terrorist Finance Networks

There is still a way to stop them — but it requires a complete shift in how we see them. We must recognize these networks as strategic infrastructure threats, not just criminal annoyances, and move toward dismantling their liquidity architecture as a core element of national and economic security strategy.

In my upcoming briefing, exclusively for Inner Circle Tier members, I will provide:

• Tools to economically disarm scam centers at scale, cutting off the oxygen that keeps them alive.

• A detailed breakdown of integrated kill switch strategies — spanning financial rails, digital infrastructure, and on-the-ground physical choke points.

• Discover real-world incentive levers to compel host governments to act, even when local elites benefit from scam economies.

• A practical roadmap designed for policymakers, regulators, and private compliance teams looking to move beyond reactive enforcement and toward systemic disruption.

• Built on original, FATF-cited research and hard operational realities — not theoretical white papers.

Many Western Analysts suggest that China’s exported capital remains loyal to Beijing. But the reality is far more interesting — and more dangerous.

The conventional view is deceptively simple:

• Many view China’s offshore liquidity as a giant shadow war chest, a controlled network of sovereign assets deployed at the whim of the Chinese Communist Party (CCP).

• Western policymakers and risk managers build entire frameworks assuming these offshore pools remain tightly harnessed to Beijing’s strategic aims.

• And yes, these pools have indeed been used to discreetly purchase dual-use technology, circumvent export controls, and secure critical commodities beyond the reach of sanctions or trade scrutiny.

But what if that loyalty is an illusion?

What if China’s exported liquidity — ostensibly state-aligned — is actually becoming a self-reinforcing shadow sovereignty, drifting beyond centralized control?

What if it now serves multiple masters: oligarchic families, hybrid criminal networks, local proxies, and opportunistic elites — all willing to pledge partial allegiance to Beijing when convenient, yet equally capable of undermining it when incentives shift?

In this emerging reality, offshore Chinese capital is no longer a single, monolithic weapon of statecraft. It has metastasized into a global gray liquidity architecture — one that blurs the lines between strategic reserves, private vaults, and criminal war chests.

This shift fundamentally rewires the logic of economic influence, risk exposure, and conflict escalation in ways most analysts still refuse to see.

The true nature of liquidity

Liquidity, at its core, means cash or assets easily convertible into cash. But in the 21st century, it is far more than a balance sheet metric — it is the true bloodstream of power. Liquidity buys influence, loyalty, and the capacity to project narratives and ideology. In this way, it is not just a financial tool; it is the lifeblood of sovereignty itself.

A state’s or entity’s ability to deploy liquidity — rapidly and across borders — fundamentally underpins sovereignty today. While armies once defined territorial control, liquidity now defines operational reach, resilience, and influence.

Crucially, those who wield liquidity, especially in environments lacking robust rule of law, tend to prioritize safety and self-preservation over ideology. Capital does not pledge allegiance; it flows toward sanctuary and survival.

Once capital crosses borders and regulatory boundaries, it mutates. It is layered through offshore structures, routed via proxies, embedded in shell networks, and reappears under new ownership masks, often with strong criminal tendencies. This metamorphosis is not a bug — it is a feature of the modern liquidity system, which is technically advanced but increasingly outside the rule of law.

Here is where the concept of post-sovereign liquidity emerges. Post-sovereign liquidity is:

• No longer strictly tied to a single central authority or policy framework.

• Operates as a self-defending organism, protecting itself first — often at the expense of its originating state.

• Creates hybrid power actors: networks that can act as extensions of state power when convenient, but also as independent parasitic or symbiotic systems when strategic incentives shift.

In this new reality, sovereignty itself becomes porous. States may believe they command liquidity, but more often than not, liquidity becomes something well beyond their control. With global payment platforms and crypto currency rails enabling instantaneous global transfers, unregulated liquidity flows have never been easier or more widespread.

Demystifying the Chinese system

I imagine many Western analysts find it comforting to believe that China’s offshore liquidity moves in lockstep with Beijing’s strategic orders — as if all that money acts as one seamless geopolitical weapon. But the truth is far messier, and far more human. It is a reality that the Western mind — so conditioned by rule-of-law frameworks that it cannot imagine a world without them — struggles to fully grasp. Having lived in China for much of my adult life, I carry a kind of muscle memory for systems governed by rule of man rather than rule of law, and thus see things differently.

Inside China, elite interests are deeply fragmented. Party leaders in Beijing strive to keep a tight grip, pushing grand ideological projects and enforcing strict discipline. Yet beneath them, provincial networks focus on their own survival and enrichment, prioritizing regional patronage webs and local power dynamics. Meanwhile, private capital — the tech tycoons, property moguls, and SOE-adjacent billionaires — operates with a different logic altogether, seeking to transform vulnerable domestic wealth into safer, untouchable offshore assets.

George R.R. Martin’s A Song of Ice and Fire series — and the Game of Thrones television adaptation it inspired — offers a powerful lens for understanding these dynamics. Although fictional, the series is rooted in a Western historical period before concepts like a politically independent judiciary and rule of law fully took hold. China’s internal history under the CCP mirrors this kind of ruthless, soul-crushing factionalism and political backstabbing. One of Martin’s most cynical characters, Cersei Lannister, distilled the essence of this worldview when she told her son:

“Everyone who isn’t us is an enemy.”

This simple line captures the raw brutality of contemporary Chinese elite politics. While so much modern analysis mystifies China as an inscrutable civilization beyond Western comprehension, in many ways, it is not so fundamentally different. In the West, corruption cases often end up in court dockets and drawn-out legal battles; in China, competing interests are handled more quietly, swiftly, and brutally.

Capital flight is often the primary byproduct of such heavy-handed approaches — not renewed loyalty, but quiet escape, especially when the economic fundamentals begin to falter. Why capital flight? Because in a system of life-or-death consequences, the safest way to ensure the survival of one’s family — the true core unit of Chinese civilization — is to store assets beyond the reach of one’s enemies.

When legal enforcement is practically non-existent and nobody truly knows who is a friend and who is an enemy, the true nature of exported liquidity is anything but clear cut. When its wielders stand to benefit or face punishment, it can become a powerful tool to advance state interests — avoiding tariffs, securing critical commodities, or acquiring banned military hardware. But when these vast liquidity pools operate beyond the scope of state reward and punishment, they take on a life of their own. In some cases, they directly defy state directives, such as illegally exporting banned rare earth minerals to U.S. markets. At other times, they morph into parasitic criminal ecosystems that feed on human misery in every conceivable way — most visibly in Southeast Asia’s vast archipelago of scam-center cities, all backed by offshored Chinese capital.

The result is a richer, murkier tapestry of competing interests — and one that is, in many ways, even more dangerous than clear-cut geopolitical competition between two adversaries.

Cersei Lannister (left) perhaps carries more historical parallels with women in Chinese history than in the West. I’ve heard her variously compared to the Empress Dowager Cixi (pictured above), Cultural Revolutionary and wife of Mao Zedong, Jiang Qing, and others. Image source

Historic precedent

Fractured elite interests in China are nothing new. We can see echoes throughout its history: the defeated Guomindang’s desperate flight to Taiwan in 1949, carrying state and private treasure by the boatload; or the Ming dynasty’s maritime merchants, who slipped beyond the reach of the imperial court and built independent networks across Southeast Asia.

Having spent much of my life studying Chinese history, I have observed certain patterns. The one that stands out above all: at times of crisis, liquidity always flows away from the core. In pre-modern eras, this meant competing regional strongholds that became warring states as increasingly cash-starved dynasties collapsed. From the Ming dynasty onward, this took the form of wealth quietly stashed abroad — most often in Southeast Asia.

Today, shadow finance serves both as a tool for immediate survival and as a quiet escape hatch. The state, with its vast political and technological reach, plays a powerful role in these overseas archipelagos of escaped sovereignty — perhaps the most powerful — but it is far from the only interest at stake. Many elites, even while professing loyalty to the Party, quietly build offshore structures and hidden reserves: insurance policies for themselves and their families should the system falter or turn on them. Increasingly, these offshore pools morph into parasitic systems the state can neither fully control nor completely disown.

In this way, China’s global liquidity is not a monolith. It is a scattered, self-preserving organism, loyal to no single master, ready to pivot or flee at the first sign of real crisis. What looks from the outside like a unified economic spear is, in fact, a restless swarm of competing interests — each guarding its own future above all else.

Read more

The electoral victory of Canadian Prime Minister Mark Carney, a career central banker, wasn’t just politics — it signals a global pattern: liquidity, not land, increasingly underpins sovereignty. Image source

“Lead us, Big Daddy,” a woman screamed at an event for Canadian Prime Minister and Liberal Party leader Mark Carney in Scarborough, Ontario, this past April.

All cringe aside, the moment marked a clear catalyst in Canadian political life. Just a few months earlier, the upcoming federal election looked like a nightmare for the Liberals: polls showed only 16% of Canadians planned to vote for the party. Carney’s predecessor, Justin Trudeau, had been effectively hounded out of office amid intensifying calls for his resignation, leaving Conservative leader Pierre Poilievre poised to take power.

Then, a parallel chain of events unfolded with stunning speed, galvanizing the Canadian system in a completely different direction. The November election of U.S. President Donald Trump brought new tariffs on Canadian goods and loud calls to make Canada “the 51st state.” The rhetoric infuriated Canadians, with many donning Trump-style hats reading “Canada is not for Sale” and “Canada is Already Great.” By March, Carney — a reserved former central bank chief — won the Liberal Party leadership with nearly 86% of the vote and became Prime Minister. He had never held elected office and became only the fourth Prime Minister in Canadian history to take power without even a seat in the House of Commons.

The April 28 election delivered results no one had predicted just months earlier: Carney’s Liberals handily defeated the opposition and gained seats, ending up just three shy of a majority government.

Carney’s unexpected rise represents more than a resurgence of economic nationalism. It signals a deeper shift in how Canadians imagine sovereignty and resilience in a world increasingly shaped by external shocks underpinned by liquidity systems. Canada, with its highly centralized, transparent, and tightly regulated liquidity architecture, responded to this threat the way it knows best: by electing a technocratic central banker to steer it through crisis. By rehabilitating a party that, after a decade in power, was headed for electoral obscurity, the system made clear what it wanted most — the kind of technocratic leadership that only a regime built on trusted, centralized liquidity could produce.

Liquidity as the new foundation of sovereignty

Sovereignty has long been understood as the power to control territory and enforce borders. Maps and armies were the ultimate symbols of statehood, the concrete markers of a government’s ability to project authority. Yet in an era defined by transnational capital, global supply chains, and instant digital transactions, this territorial framing feels increasingly outdated.

Today, the true backbone of sovereignty is liquidity: a state’s capacity to generate, anchor, and direct flows of value (money, especially digital payments). Control over liquidity determines whether a government can maintain social contracts, fund security apparatuses, and stabilize domestic markets in the face of external shocks.

Here lies the critical schism: states that consolidate liquidity — through centralized, transparent, and trusted systems — can reinforce sovereignty and adapt under pressure. In contrast, states that suffer from liquidity leakage, where capital quietly escapes into offshore havens and private survival networks, find their sovereignty hollowed from within long before any dramatic collapse becomes visible.

Whether through shadow reserves, offshore trusts, or digital asset flight, the silent migration of liquidity reveals where power truly lives — and where it is quietly dying. In this sense, the future of sovereignty will be decided not at the border, but in the bloodstream of value flows.

Under-regulated, opaque systems and sovereign leakage

Sovereignty is not lost all at once; it erodes quietly through small fractures in a state’s liquidity architecture. In under-regulated and opaque systems, value escapes through informal circuits, fueling rival power centers and weakening the state’s core. While these systems may appear centralized on the surface, they often conceal hidden leakage that hollows out actual sovereignty far more effectively than any external invasion.

China — scam centers and gray zone liquidity

China is often viewed as a monolith of centralized control, yet beneath this surface lies a fragmented landscape of gray zone liquidity. While the state nominally controls its financial system through strict capital controls and centralized directives, it simultaneously tolerates and indirectly benefits from peripheral cash ecosystems — especially in Southeast Asia. As we explored in my China Grey Zone series, Beijing enables these liquidity flows as a workaround to external pressure — using them to evade tariffs and sanctions. However, this same strategy seeds fragmentation and empowers peripheral actors, ultimately undermining the very sovereignty it seeks to protect

Scam centers in Myanmar, Cambodia, and Laos serve as offshore liquidity vents, recycling funds through cryptocurrency rails, informal money brokers, and online gambling channels. Chinese actors, including local officials and security services, extract rents and facilitate the expansion of these networks, often under the guise of “development” or “business diplomacy.”

These scam economies and gray financial nodes hollow sovereignty from within. The Chinese state becomes both participant and hostage: benefiting from offshore cash generation while losing consolidated oversight over the system. Beneath the narrative of strong central command lies an archipelago of liquidity escape routes that empower non-state actors, local elites, and transnational crime networks.

Ironically, Beijing has begun pushing to crack down on these scam centers, despite many being indirectly funded or facilitated by state-backed Belt and Road Initiative (BRI) infrastructure and investment projects. This reactive enforcement highlights the internal contradiction: the state depends on gray liquidity flows to sustain influence abroad, yet those same flows undermine its long-term strategic coherence. The result is a sovereignty that appears centralized but is riddled with silent fractures, primed for instability when crisis hits.

Iran — proxies and semi-autonomous liquidity

Iran’s strategy of regional influence hinges on proxy groups like Hezbollah, the Houthis, and various militias in Iraq and Syria. Initially, Tehran’s liquidity flows into these networks served as direct strategic extensions of state policy. However, over time, these proxies have developed semi-autonomous funding channels, creating parallel financial ecosystems that increasingly operate beyond Tehran’s direct control. In this way, proxies funded to advance Iranian security needs could end up undermining its sovereignty.

Hezbollah’s diversified revenue streams — including narcotics, counterfeit goods, and cryptocurrency donations — allow it to make independent strategic decisions, sometimes even contradicting Iranian preferences. The Houthis, meanwhile, have leveraged local commodity taxation, remittance interception, and crypto-enabled remittance corridors to create a self-sustaining war economy. Similarly, Iraqi militias — while historically reliant on Iranian backing — have acted on their own imperatives, launching attacks against U.S. forces even when Tehran has explicitly called for restraint.

These developments mean that Tehran’s once-coherent liquidity projection is now fragmented. Proxy actors can launch attacks based on their independent liquidity systems rather than Iran’s overarching strategic plan. Although Tehran still exerts enormous influence, its control is far from paramount, leading to ceded sovereign control. In trying to externalize sovereignty through proxies, Iran has inadvertently fostered competing centers of power, leaving its regional influence more unstable and less predictable.

Pakistan — ISI’s liquidity and Taliban autonomy

Pakistan’s Inter-Services Intelligence (ISI) has long used liquidity as a tool of strategic depth, funneling cash and resources into Afghan Taliban networks to maintain leverage over Kabul and regional dynamics. However, this liquidity strategy has boomeranged.

The Taliban, once reliant on Pakistani patronage, have built independent cash economies rooted in cross-border taxation, smuggling networks, narcotics trade, and local resource levies. Over time, they have transformed into an alternative liquidity state operating parallel to, and beyond, Pakistani control.

As these autonomous revenue streams grew, Pakistan lost what grip it had over critical border regions, ceding effective sovereignty to a hybrid armed governance structure. This leakage of liquidity from a nominally centralized intelligence service into independent militant coffers has weakened Islamabad’s ability to enforce internal coherence, resulting in a fragmented and fragile sovereignty especially visible in the tribal borderlands.

Technology acceleration

Technology magnifies these dynamics exponentially. Digital payment systems, cryptocurrency rails, and encrypted apps allow liquidity to escape state oversight in real time — especially under conditions of corrupt officials, weak regulatory frameworks, and systemic opacity. Sovereignty is no longer eroded slowly over decades through smuggling and informal markets; it is now undermined at the speed of code, with value moving across borders and into rival hands in seconds rather than years.

The alternative: Canada’s immune response

While many states struggle with fragmented liquidity systems and sovereign leakage, Canada offers a striking systemic contrast. Despite its vast geography and strong provincial identities, Canada’s financial backbone is extraordinarily centralized and coherent. Just six major banks dominate the landscape, operating under tight, transparent regulation overseen by an all-powerful central bank.

This architecture is often misunderstood by outside observers. Commentators like Peter Zeihan, for example, argue that Canada is economically disunified because each province trades more with the U.S. than with other provinces. However, this view misses a deeper structural reality: Canada’s liquidity flows remain centrally anchored and carefully stewarded, allowing it to act as a unified economic organism despite external trade patterns.

When faced with external shocks, such as dramatic tariff increases and talk of trade wars, states with centralized liquidity systems do not turn to military defenses or populist strongmen. Instead, they empower technocratic stewards who can manage financial flows and stabilize internal value networks. Mark Carney’s unexpected rise is the perfect embodiment of this “liquidity immune system” response. The system is not perfect, as Canada has experienced record capital

But the system is not perfect. Canada has seen record capital outflows in recent months—over $84 billion in net securities flight over just four months —highlighting the difference between formal capital flight and that facilitated by shadow liquidity systems. These outflows move under the purview of a strong regulatory regime, flowing through transparent, market-based channels rather than illicit networks siphoning wealth into opaque offshore systems beyond legal reach. This contrast underscores a critical point: while regulated liquidity can be steered even in crisis, shadow liquidity operates on a separate plane—adaptive, opaque, and beyond the grasp of state policy mechanisms.

A former central banker with no electoral background, Carney symbolizes the Canadian instinct to protect sovereignty not through barbed wire or nationalist slogans, but through disciplined monetary governance and systemic financial consolidation. His ascent reflects a collective preference for liquidity resilience over theatrical displays of territorial control — a choice that sets Canada apart in a world where many states increasingly lose coherence under liquidity stress, especially as new technologies accelerate and camouflage capital flight with unprecedented speed.

Not only would the tightly regulated Canadian system not leak liquidity into actors that fundamentally threaten its sovereignty, its system is so consolidated and trusted that when faced with external threats, it reflexively empowers technocratic stewards rather than alternative power centers.

Conclusion: No moral judgment — only structural divergence

What happens when a state can no longer defend its financial bloodstream?

This article is not a moral critique of states that experience liquidity leakage, nor an endorsement of those with highly centralized liquidity systems. Historical and institutional asymmetries shape each country’s financial architecture in ways that cannot be quickly or easily rewritten. Canada, for example, benefits from an industrial and legal foundation that predates those of many developing countries by over a century — a foundation that enables tighter regulatory oversight and more trusted central institutions.

What matters is the structural reality: future sovereign power will be defined by a state’s ability to generate, anchor, and defend its liquidity flows. The decisive contests of the coming decades will not be fought on territorial frontiers alone but within the hidden arteries of capital and value transfer.

In this new era, sovereignty will belong not to states that hold ground, but to those who master the circulatory systems of capital.

Image source

Preface

This article was originally drafted and circulated privately in March 2025. Although it was not published through its initial intended outlet, I share it now to advance public understanding of Al-Shabaab’s evolving financial networks and the broader dynamics of illicit liquidity in conflict economies.

This article draws from my Shadow Liquidity Doctrine, first drafted and circulated privately in early 2025. The doctrine defines shadow liquidity and its operational twin, illicit liquidity, as strategic infrastructures that sustain modern conflict, enable gray zone operations, and maintain covert networks of power. Al-Shabaab’s financial architecture exemplifies this hidden circulatory system: an adaptive flow of capital that transcends borders, sanctions, and formal oversight.

Intro

Somali terror group al-Shabaab remains a persistent global threat despite decades of international efforts to combat its influence. With recent reports indicating the militants have established[1] checkpoints just 15 kilometers from the capital, Mogadishu, the al-Qaeda-aligned group continues to launch a dizzying array of attacks, recently striking the Somali presidential convoy and an international hotel in the capital and launching a bomb attack on a US military base in neighboring Kenya last summer – just to name a few. With the African Union Mission in Somalia (ATMIS) ending its mandate on 31 December 2024 and replaced by a scaled-down African Union Support and Stabilization Mission in Somalia (AUSSOM), many in Somalia and abroad have expressed doubts as to the mission’s future success in combating this growing threat.

Sophisticated financial networks underpin much of al-Shabaab’s regional and global threat. These networks are prime examples of what I define as shadow liquidity — hidden capital flows that function as strategic infrastructure, enabling militant and criminal actors to endure despite military or ideological setbacks.

Al-Shabaab’s sustained influence could have severe geopolitical ramifications, given the group’s sway over piracy outfits on the Indian Ocean and close ties to the Houthis and Iran. Last summer, US reports indicated that the Yemen-based and Iranian-backed Houthis had met with members of al-Shabaab to discuss mutual aid, including Houthi arms transfers and technical expertise in exchange for al-Shabaab’s efforts to ramp up piracy of the Somali coast. If successful, this move could extend the current crisis in the Red Sea by thousands of kilometers and more severely impact global shipping, especially if al-Shabaab and the pirate outfits it supports gain access to sophisticated Iranian drones, missiles, and other weaponry. In addition to these potential global ramifications, al-Shabaab poses a significant threat regionally, having carried out devastating attacks killing thousands in Somalia as well as neighbouring Kenya and Ethiopia. In this way, any future al-Shabaab gains could come at a cost to global security as a whole.

Sophisticated financial networks underpin much of al-Shabaab’s regional and global threat. The organization is by far al-Qaeda’s wealthiest constituent group, generating over $100 million USD in revenue annually, funds essential to its deadly operations at home and abroad. Although growing global scrutiny over the past year has hindered al-Shabaab’s financial operations, the group remains tactically resilient, indicating it has and will likely continue to adapt to its constrained financial circumstances. This insight explores how al-Shabaab raises money locally, has harnessed a sophisticated network of financial facilitators and investments abroad to bring money into Somalia, and how it may adapt following new rounds of sanctions by US authorities.

Local Revenue Generation

Al-Shabaab’s revenue generation starts with its territorial holdings, encompassing much of southern Somalia’s Juba River valley. The Juba valley is Somalia’s primary centre for food production, giving al-Shabaab a considerable advantage over the Mogadishu-based federal government. Somalia produces only 40% of its grain requirement domestically, and with most farmland controlled by al-Shabaab, the federal government relies heavily on imports and aid from the outside world at a time when international container ships face a growing threat of pirate attacks off Somali waters. In a country as famine-prone as Somalia, al-Shabaab holds sway over who eats and who does not, giving it considerable power over the populace. Moreover, by holding these lands, al-Shabab extracts revenue from any and all economic activity that occurs on them through heavy taxes levied on commodity exports.

Illicit charcoal production and sales have been al-Shabaab’s most important revenue stream. According to local reports, the group generates between US $8–18 million in annual revenue from a single roadblock that taxes trucks transporting charcoal in the Badhaade District of the Lower Juba Region. In total, al-Shabaab earns an estimated one-third of all revenue generated by charcoal production in Somalia – some US $38–56 million annually. However, these figures date from 2013, and the group’s revenue may be currently much higher. The largest markets for Somali charcoal include the United Arab Emirates, Kuwait, Egypt, Saudi Arabia, and Lebanon. Shisha smokers especially prize Somali charcoal due to its distinct acacia wood aroma, and Chinese e-commerce giant Alibaba ships the product worldwide on behalf of numerous online sellers.

Both al-Shabaab and the Somali Federal Government generate significant revenue from illicit charcoal exports, with government-imposed roadblocks in the capital also collecting taxes on cargo trucks coming from al-Shabaab-controlled territories. For this reason, controlling exports from within the country is practically impossible. According to a 2018 report, al-Shabaab works closely with Iran to facilitate charcoal exports, shipping goods under false country of origin certificates from Comoros, Côte D’Ivoire, and Ghana to ports in Iran, wherein local agents package and resell the product under a ‘Product of Iran’ label. These factors obfuscate the true origin of much of the charcoal on the global market. Reports also indicate that al-Qaeda, al-Shabaab’s parent organization, bases much of its operations in Iran with the central organization’s de-facto chief, Sayf al-‘Adl, reportedly living openly in Tehran. In this way, al-Qaeda Central may facilitate and benefit from illicit Somali exports to Iranian shores.

Other means by which al-Shabaab generates revenue locally include trans-Saharan human and narcotics trafficking, as well as kidnapping foreign nationals for ransom, important sources of foreign currency that it uses to purchase weapons and other goods. Reports indicate that al-Shabaab purchases much of its supplies from coastal pirate rings, requiring cash to do so. Estimates of the group’s total fighting force vary between 5,000–14,000: feeding, clothing, and arming these individuals and paying them enough to support their families requires a steady flow of cash in one of the world’s poorest countries, meaning al-Shabaab must take an active role in Somali export markets and invest globally to generate stable sources of hard currency.

International Financial Networks and Adapting to New Constraints

The United States Treasury Office of Foreign Asset Control (OFAC) and other entities heavily sanction al-Shabaab, limiting its access to the global financial system; given al-Shabaab’s reliance on commodity exports and Somalia’s limited cash economy, the group has had to work with external financiers to bring cash onto Somali shores. According to OFAC, the Dubai-based Haleel Holdings LLC and Qemat al Najah General Trading have been the primary facilitators of al-Shabaab’s global financial operations. The former operates branches in several countries to export Somali goods, transfer money, and make investments on al-Shabaab’s behalf. However, with OFAC slapping these firms with new sanctions last May, al-Shabaab now faces significant challenges in receiving funds from abroad. This development will likely cause the group to adapt.

Haleel Holdings operates a vast network of regional offices in the UAE, Cyprus, Kenya, Uganda, and Somalia. Prior to its 2024 OFAC designation, the company had avoided restrictions for many years despite significant international pressure and scrutiny. For example, in 2019, Ugandan courts cleared the firm’s local foreign exchange and commodities trading division, Haleel Commodities, of charges associated with financing terrorism despite considerable pressure from US authorities and the Ugandan Financial Intelligence Agency (FIA).

According to reports, Haleel’s financial nexus served as interlocutors between al-Shabaab and local businesses in Somalia – likely helping these businesses export commodities such as charcoal and apportioning some of the revenue to al-Shabaab as a form of taxation. Using al-Shabaab funds, Haleel oversaw foreign revenue-generating investments, such as the Kenya-based Crown Bus transport company, which the US also claims helped facilitate al-Shabaab’s logistical operations. Last year’s OFAC sanctions on al-Shabaab facilitators targeted 15 other companies linked to the terrorist group, investments likely facilitated by Haleel. The company likely funneled some of the profits back to al-Shabaab’s Somali operations via hawala. These informal financial networks covertly transfer as much as $300 billion USD worldwide annually. Haleel also provided other services to al-Shabaab, including weapons procurement and recruitment.

By designating Haleel and other companies related to facilitating al-Shabaab financial activities, US authorities have effectively blocked these companies’ access to global fund transfers and asset holdings while adding increased scrutiny by local authorities. Although these facilitators may turn to informal means, such as hawala networks, to transfer funds back to al-Shabaab, they will likely face considerable challenges moving forward, given their inability to access legitimate funding sources. While this is a positive development for countering al-Shabaab’s growing influence, the group’s considerable resources in Somalia and longstanding ingenuity will likely result in its financial adaptation moving forward. For this reason, global law enforcement agencies and tech companies should monitor the situation closely.

Under current levels of scrutiny from Washington, al-Shabaab’s financial path forward will not be an easy one. However, the group has likely already adapted to some degree. In the past, al-Shabaab generated money through fraudulent charitable donations set up across the vast global Somali diaspora community, including from within the United States, receiving funds from witting and unwitting donors. The fundraisers, often women, sent remittances to Somalia broken into small amounts to avoid suspicion. In 2011, an American jury found two female US citizens of Somali origin from Rochester, Minnesota, guilty of providing material support to al-Shabaab. In 2017, a Virginia court successfully prosecuted a similar case involving two Somali-American women linked to al-Shabaab fundraising. In both cases, the women formed part of a global fundraising network, including operatives in Somalia, Kenya, Egypt, the Netherlands, Sweden, the United Kingdom, and Canada. These women and others provided financial support to al-Shabaab at the time through traditional cash remittance companies. With today’s mobile remittance providers more widespread and sophisticated cryptocurrencies also more readily available, al-Shabaab could attempt to solicit donations from global donors in larger amounts now that US authorities have placed the group’s primary financial facilitators under heavy restrictions.

Al-Shabaab could also solicit donations via digital currencies, especially those with enhanced privacy protections such as Monero. The group could also leverage al-Qaeda’s vast global propaganda apparatus, which operates extensively in places where local regimes likely provide haven for its activities, such as Afghanistan, Iran, and Yemen. Al-Qaeda’s chief global rival, the Islamic State, has pioneered this fundraising model, and, given its success, al-Qaeda affiliates like al-Shabaab could adapt it for their own purposes moving forward. Moreover, given the high levels of scrutiny on al-Shabaab financiers who transfer cash and make investments via traditional means, digital currency transfers to new external financial facilitators are likely, given the significant revenue al-Shabaab generates from commodity exports. Finally, al-Shabaab will likely increasingly turn to criminal activity to finance its operations, including kidnapping for ransom, as well as human and narcotics trafficking, to finance its operations. The group kidnapped five Kenyan officials from the Kenya-Somalia border order region of Mandera County in February, and such incidents could become increasingly commonplace.

Recommendations

Al-Shabaab will likely take a multifaceted approach to its increasingly constrained financial circumstances. Ensuring this terror group, one of the world’s four deadliest, remains restricted from accessing global funds will require technology companies to remain vigilant and closely collaborate with law enforcement agencies. Companies can also explore long-term and short-term measures to combat financial operations by al-Shabaab and other groups.

In the short term, global remittance providers and digital currency exchanges should closely monitor suspicious transactions, especially in East Africa. These organizations should also work to compile comprehensive, human-curated datasets containing suspicious transactions that may be shared with law enforcement when required. The Financial Action Task Force (FATF) has released a comprehensive guide to countering terrorist crowdfunding campaigns, noting these groups’ propensity for using cryptocurrencies with enhanced privacy features such as Tether and Monero. Last year, the Japanese National Police Agency’s Special Cyber Investigations Division arrested an individual suspected of conducting money laundering activities using Monero. Although the agency has not commented on their exact methods, they did indicate that they used the suspect’s records from communication apps, credit card transactions, and suspected Monero transactions. This landmark case may prove an invaluable blueprint for global law enforcement agencies and technology companies to compile as much data on suspicious transactions as possible to share with these potential investigations.

In the long term, service providers such as e-commerce platforms and blockchain companies should explore ways to improve the verification of supply chains associated with goods used to finance terrorism, such as charcoal. Current estimates place the value of the global charcoal market at just over $8 billion USD, making Somalia’s illicit and environmentally unsustainable exports a small fraction of this total, and thus difficult to track internationally. Given al-Shabaab and its partners’ talent for obfuscating the true origin of their goods, cutting off funding to this deadly terror group demands a more technical approach. Blockchain verification systems could be an important step in the right direction as they offer a tamper-proof, efficient, and transparent means to verify the legitimacy of exports and imports at each journey step.

For example, a legal and compliant Indonesia-based charcoal supplier would upload a public, secure stamp verifying the legal shipment of goods from their facility to the nearby port of Tanjung Parek in Surabaya. Agents at both this port and its destination port in Jeddah, Saudi Arabia, would also upload their own secure stamps, as would the buyer upon delivery, with each individual contributing to a record of the product’s legal supply chain in the form of a publicly accessible digital ledger. Any individual or group seeking to commit fraud by selling illegally sourced goods through legitimate channels would do so publicly and transparently, greatly heightening their personal risk for doing so. In this way, e-commerce retailers and their compliance teams could rest assured of the near-zero risk that the goods sold on their platforms finance terrorist groups like al-Shabaab. By investing in such products, companies may also come ahead of future compliance requirements regarding counter-terrorist financing related to goods sold on their platforms.

Finally, hawala systems present the single largest frontier in counter-terrorist financing. Countering terrorist activity through these networks requires financial institutions and transfer apps to keep close tabs on suspicious activity that may be timed with illicit hawala transfers, as many hawaladar (hawala transfer agents) use legitimate means to settle their accounts. In the longer term, offering low-cost and accessible solutions to the world’s vast unbanked population of some 1.4 billion people is the best way to add transparency and accountability to this vast, unregulated, informal global remittance system. Many companies and governments across Africa have invested in such products, and global technology companies should consider further investing in new ways to enhance access for the globally unbanked. With hawala currently accounting for as much as $300 billion in transfers annually, there is a clear profit incentive to offering more accessible and lower-cost options than this vulnerable population can access through their local hawaladar. By limiting the flow of legitimate money through Hawala networks, providing services to the global unbanked population ultimately limits the cover provided to bad actors such as criminals and terrorist groups, who also use Hawala to finance their activities.

Conclusion

Al-Shabaab’s survival depends not only on ideology and violence, but on its ability to maintain and adapt its shadow liquidity networks. For a deeper exploration of these hidden financial infrastructures and their strategic implications globally, see my Shadow Liquidity Doctrine.

Between the Lines Research – Strategic Note, July 2025

Personal Note

This work is the product of years spent tracing the financial systems that sustain both state and non-state actors. It is not a polemic, but a strategic framework designed to support policymakers, practitioners, and financial system stakeholders. The goal is to illuminate how liquidity flows — especially those operating beyond formal oversight — shape modern conflict, resilience, and global risk.

Introduction: Why Liquidity Matters

Geopolitical and security analyses often focus on ideology, battlefield tactics, or formal alliances. But beneath these surface-level factors lies a deeper infrastructure: shadow liquidity — the unregulated or hybridized capital flows that underwrite the operational capacity of both governments and armed non-state actors.

Understanding this hidden architecture is critical to designing effective counter-threat finance (CFT) and anti-money laundering (AML) strategies. It also reframes sovereignty not just as legal authority, but as the capacity to generate, direct, and protect liquidity.

Defining the Concept: What Is Shadow Liquidity?

Shadow liquidity refers to the movement of value through informal, opaque, or hybrid channels outside regulatory visibility. This includes:

• Non-transparent conduits (e.g., hawala systems, OTC brokers, dual-use trade logistics)

• Privacy-enhancing crypto rails and decentralized exchanges

• Illicit resource-to-cash pipelines (e.g., gold, timber, synthetic drugs)

• Informal remittance streams embedded in conflict economies

These flows are often structured to resist attribution, formal tracing, or enforcement — making them highly adaptive and strategically valuable.

Liquidity as Strategic Capacity

Liquidity is not merely a financial concern; it is a source of power. It enables:

• Insurgents and hybrid actors to survive loss of territory or leadership

• Sanctioned states to sustain procurement, proxy support, and domestic control

• Transnational networks to expand influence without conventional military tools

In fragile, sanctioned, or contested environments, control over liquidity is what allows actors to endure. It is a form of sovereignty unto itself.

Historical Context: Sovereignty and Value Control

Across history, power and legitimacy have followed control over capital:

• The American Founders’ revolutionary authority was underwritten not only by ideology, but by their personal assets, shipping networks, and trans-Atlantic credit lines.

• Imperial collapses — from the Western Roman Empire to late Ming and Qing China — were preceded by liquidity fragmentation long before formal dissolution.

Modern threat actors replicate these patterns: embedding in high-value ecosystems, exploiting loopholes in digital finance, and building sovereign-like liquidity systems that bypass formal governance.

Policy Relevance: Why Institutions Should Care

This framework has direct implications for financial security, compliance, and multilateral coordination:

• FIUs and CFT teams must look beyond direct actors to the liquidity infrastructures that enable threat persistence.

• Sanctions architects must trace how shadow liquidity routes evolve around enforcement barriers.

• Multilateral bodies may benefit from integrating this lens into typology-building and technical assistance.

• Technology platforms and financial firms play a frontline role in identifying and disrupting emergent liquidity corridors.

Who This Serves

This framework is intended for:

• Financial intelligence units and national risk teams

• Investigative and judicial bodies working on threat finance

• Regulatory technology and compliance firms

• Multilateral analysts engaging fragile or high-risk jurisdictions

Accessing the Full Framework

This note introduces the “Liquidity as Sovereignty” doctrine and outlines the Shadow Liquidity Framework, developed by Between the Lines Research (BTL). The complete version — including case studies (ISKP, Hezbollah, Houthis, JNIM), typology matrices, and operational indicators — is available upon request.

For secure access, institutional briefings, or research collaboration:

info@btl-research.com

Stay ahead

Subscribe or join my Inner Circle for updates, exclusive analyses, and private briefings on shadow liquidity, threat finance, and global strategic risk.

Subscribe now

Share and cite

You are welcome to share or cite this summary with attribution. For full doctrine use or excerpts, please request permission.

-Adam Rousselle, Founder and Chief Analyst, Between the Lines Research

All frameworks and original conceptual language herein are protected as intellectual property under applicable law. Any unauthorized use without attribution is expressly prohibited

The headlines called it retaliation. Some analysts labeled it symbolic. But as we explored on Friday, Iran’s massive missile and drone barrage wasn’t about face-saving—it was a live demonstration of capability. A stress test. A rehearsal.

But there’s a second battlefield brewing—quieter, more resilient, and arguably more enduring—unfolding in parallel to the visible barrage. One that most coverage ignores.

Beneath the missiles lies a deeper infrastructure: a financial ecosystem engineered to survive sanctions, bypass traditional systems, and fuel conflict beyond the reach of the global financial system. Crypto wallets, OTC brokers, and informal financial nodes—stretching from Qom to Caracas, from Sana’a to Hong Kong— make up a vast and largely invisible financial infrastructure powering Iran’s asymmetric war machine. This is asymmetric finance.

What began as a workaround to Western sanctions has now hardened into a core pillar of Iran’s regional strategy. In the hours and days after the attack, crypto markets reacted—not in ways that definitively point to illicit proxy activity – but interestingly nonetheless. Bitcoin and other major tokens dipped, reflecting broader geopolitical uncertainty and a flight from risk. In the days to come, we are likely to see reports from leading blockchain analytics firms on illicit flows associated with Iran and its proxies. These networks have long relied on informal financial rails, including stablecoin brokers and weak-KYC exchanges, to quietly route funds through jurisdictions like Lebanon, the Gulf, Venezuela, and Southeast Asia. The extent to which this system will be mobilized remains unknown—but past escalations suggest these financial rails become activated in parallel with military operations.

To understand this conflict today, and where it’s going tomorrow, we must look not just at what exploded—but what moved, where, and how much. The story isn’t just about rockets, drones, and ballistics. It’s about rails—financial rails—that enable the machine behind them.

Iran has built a system designed for asymmetric conflict across multiple domains. The military strikes dominate headlines, but they’re only part of the picture. Behind them is a parallel system designed to quietly sustain escalation—a financial infrastructure built to move money, fund proxies, and resist sanctions without triggering collapse.

Why This Matters to Threat Finance

Every war casts a financial shadow. Behind every drone strike is a supply chain. Behind every military advance, a funding channel. And in Iran’s case, those channels are increasingly built on a patchwork of informal networks: hawala dealers, OTC crypto brokers, and stablecoin rails straddling two hemispheres.

These systems—designed to evade formal banking channels and U.S. sanctions—don’t just enable the fight. They shape it. Iran’s ability to project power without triggering catastrophic retaliation depends in part on its ability to quietly move funds, mask logistics, and keep its proxies liquid. As Western scrutiny tightens on traditional sanctions-evasion tools, crypto has increasingly filled the gap. Tether (USDT), in particular, has become a favored instrument for laundering value between jurisdictions, with minimal friction and high anonymity.

The same digital rails that move funds for everyday transactions are now the arteries of asymmetric warfare, sustaining networks that would otherwise go dry under traditional scrutiny. For threat finance, this means the front line has shifted: identifying wallet activity, tracing OTC intermediaries, and mapping stablecoin liquidity are no longer technical exercises—they are essential to preempting escalation, disrupting proxy logistics, and safeguarding the integrity of the global financial system.

Strategic Continuity Through Financial Asymmetry

A remarkable aspect of this escalation apart isn’t just what Iran launched—but how it manages to stay funded while doing it. Beneath the drones and ballistic headlines is a quieter story: Iran’s financial system has adapted to conflict. Not by bracing for impact—but by flowing around it.

Over the past year—and particularly since early 2024—Tehran has actively deepened its already robust resilience against sanctions. These efforts include signing a bilateral monetary contract with Russia to enable rial–ruble trade and linking their payment systems, pushing forward BRICS-wide local-currency trade initiatives, and building SWIFT-alternative transfer systems through regional platforms like the Asian Clearing Union. Commodity sales, particularly oil, help fuel this cashflow and proxies like the Houthis play a central role in the shadow fleets and laundering logistics that make it all possible.

Simultaneously, Iran has steadily expanded its domestic crypto infrastructure—not just as a pressure valve for ordinary citizens, but as a strategic workaround of sanctions. Nobitex, the country’s largest exchange, continues to facilitate significant volumes of crypto-to-rial conversions, often routed through high-risk wallets or offshore OTC channels. In parallel, Iranian authorities have pursued a central bank digital currency (CBDC) pilot program, signaling their interest in developing state-aligned digital payment systems outside U.S.-controlled rails.

Iranian proxy networks—including the Houthis and Hezbollah—have also increasingly relied on stablecoins such as Tether (USDT) and relatively anonymous over-the-counter (OTC) brokers to move funds discreetly, circumvent compliance barriers, and sustain operational liquidity. The effect is not macroeconomic stabilization but the creation of flexible, deniable financial corridors that extend Tehran’s reach in conflict zones while insulating its core institutions from direct exposure.

In short: airstrike exchanges are one front. Money movements are another.

The New Architecture of Modern Conflict

Iran’s shadow financial infrastructure is not a temporary workaround. It is part of the broader emergence of global shadow financial architecture—created by states currently or increasingly outside the established international order such as Iran, but also Russia, China, and North Korea. It is a constellation of tolerated proxies and cutouts. Some analysts refer to these countries as forming a so-called ‘axis of authoritarianism’ – but when it comes to threat finance, that framing misses the point. These financial ties are not based on mutual ideology, but method. They form a shared playbook of sanctions resistance, obfuscation, and liquidity in a growing global gray space.

Iran isn’t improvising. Nor is Russia, with its ruble-backed crypto experiments and stablecoin laundering through the UAE and elsewhere. Nor is China, which shelters capital in offshore shadows while tolerating OTC networks that quietly enable adversaries. North Korea with its navy-based narcotics rings and criminal hacker groups like the Lazarus Group were early adopters of this game.

Each escalation—military or political—is now mirrored by a quieter campaign: proxy wallets, OTC brokers, and stablecoins routed through permissive zones. Financial adaptation has become a core function of conflict, not an afterthought.

The systems meant to detect and disrupt these shadow networks—compliance regimes, sanctions enforcement, blockchain forensics—are still fighting to keep up. New designations from the U.S. Treasury’s Office of Foreign Assets Control (OFAC) arrive with growing regularity, but often only after the fact. One distinct advantage in this new terrain is transparency by design: every cryptocurrency transaction exists on a ledger. But visibility alone isn’t enough. Without the right tools—and without timely coordination—these records remain inert, meaningful only in hindsight.

Tracking and mapping these systems requires multidisciplinary expertise—not just blockchain analytics, but a deep understanding of the actors behind the flows and the geopolitical currents that guide them. As the conflict in the Middle East intensifies, and as state and proxy actors grow more fluent in exploiting financial gray zones, the cost of analytical blind spots will rise—not just on the battlefield, but across global markets. The battlefield is expanding—and so are the rails that sustain it. Research like this doesn’t just explain the fire—it might be the thing that removes the oxygen before it spreads.

For custom briefings on the financial networks behind today’s conflicts, get in touch today: info@btl-research.com

In the first two parts of this series, we examined how Beijing has strategically blurred the lines between crime, finance, and statecraft.

• Part I explored how transnational criminal networks—scam syndicates, money laundering fronts, and trafficking hubs—offered China a deniable infrastructure for advancing influence across Southeast Asia and beyond.

• Part II explored how informal financial channels—ranging from offshore dollar reserves and state-tied shell companies to elite capital flight—became embedded in China’s strategy for resilience, evasion, and quiet geopolitical reach.

But the system has started to turn on its architects.

What began as a tool of resilience has become a vector of global risk. China’s shadow reserves, gray banking operations, and offshore laundering proxies—once seen as clever circumventions of Western sanctions—are now leaking influence, bleeding capital, and empowering actors Beijing can’t fully control. In some cases, these networks pose greater strategic and reputational threats than the constraints they were built to avoid.

Think the Chernobyl disaster—but global. A radioactive core leaking financial and geopolitical fallout across everything it touches, until someone builds a concrete dome over the whole thing. That dome may be coming—but the damage is already done, and the fallout will linger for years.

This third and final installment unpacks how the very mechanisms China built to escape constraint may now be generating volatility, corruption, and strategic backlash at a scale even Beijing can’t contain.

The Internal Fracture: Power Diffusion at Home

When Beijing implemented the Three Red Lines policy in 2020 to curb reckless real estate borrowing, it triggered a cascade far beyond the housing sector. As liquidity dried up, elite families and state-linked firms sought refuge—not in domestic reforms, but in the exit ramps of offshore finance. A surge of capital flight followed, channeled through underground banks, crypto rails, and shell networks tied to party patrons abroad.

But this wasn’t a system constructed from scratch—it was already primed for abuse.

For years, state-owned banks had been quietly stockpiling offshore dollar reserves, tucked away in opaque accounts and affiliated investment vehicles. These reserves, originally meant as a financial shock absorber against Western pressure, became a deep pool of shadow liquidity—ready to be tapped, siphoned, or strategically rerouted with minimal oversight.

What began as a strategy for resilience—steering capital into the shadows to protect it from volatility—has become a mechanism for fragmentation.

Read more

In the 2010s, China began quietly shifting hundreds of billions of dollars in U.S. reserves into hidden accounts controlled by state banks, offshore entities, and opaque investment arms. At the same time, elite capital flight surged, triggered by political crackdowns and economic uncertainty. Also during this time, we’ve seen the rise of a murky offshore empire of Chinese money now deeply embedded in illicit markets, scam zones, crypto laundromats, and corrupt logistics hubs across Southeast Asia and beyond. Coincidence? Probably not. What began as a strategy to evade sanctions and project financial resilience has instead helped fuel one of the largest gray financial ecosystems in modern history—blurring the line between statecraft, corruption, and organized crime.

This piece unpacks how it happened, why it matters, and what it means for the future of global power.

Read more

Yes, I asked ChatGPT to make me a GTA-themed cover image.

When most people think of China’s role in the global economy, they picture vast container ships, massive port infrastructure, and sprawling industrial zones. That’s accurate—but it’s not the whole story. Beneath the surface of legal trade flows exists a shadow economy: sprawling, loosely regulated, and increasingly strategic.

This is the realm of China’s gray zone strategy—the space between peace and conflict, legality and criminality. In this domain, Chinese transnational crime networks and illicit financial systems quietly advance Beijing’s geopolitical interests. These operations—ranging from online gambling syndicates to crypto laundering rings—often operate independently. Yet they frequently intersect with state-linked business interests or serve strategic ends, especially in Southeast Asia, Africa, and parts of the West.

This convergence of organized crime, illicit finance, and covert influence is no accident. It forms a plausibly deniable architecture of power—a parallel system that moves weapons, people, and digital assets while supporting China’s strategic ambitions and shielding it from direct accountability. Understanding this shadow infrastructure is essential to grasping the future of global competition and statecraft in an era defined by blurred lines and contested rules. Although other countries have credible accusations of ties to criminal rings operating outside their borders, China’s are distinct in scale and integration with state interests, such as the Belt and Road Initiative (BRI).

Most of Chinese criminal syndicates operate independently. But when the moment is right, the Chinese state can and does lean on them—subtly or forcefully—to advance its goals without attribution, and often without consequence. To be clear: most of these actors are not agents directly working on behalf of Beijing (although some allegedly are), but that the system in which they operate creates space for strategic alignment and informal state benefit—a hallmark of gray zone dynamics.

What results is a decentralized, plausibly deniable financial architecture that enables Beijing’s global ambitions—not by command, but through complex relationships involving a mix of financial incentives and coercion.

Subscribe now

Dual-Use Dynamics – Crime as Opportunity

All Chinese-linked criminal networks operating globally exist for one primary reason: profit. From online gambling rings in Southeast Asia to smuggling routes in Africa and cartel money laundering in the Americas, these groups are driven by self-interest and economic opportunity. But their operations increasingly generate strategic spillover for Beijing.

These ecosystems corrode institutions, overwhelm enforcement capacity, and destabilize fragile states. In Cambodia and Laos, Chinese-run casino compounds and scam centers have fueled trafficking, corruption, and political capture—often embedded in Belt and Road-aligned infrastructure projects. In some cases, these ventures are associated with state-linked businessmen, raising questions about their role as informal instruments of Chinese influence. Although other countries like Russia leverage their overseas crime syndicates to help meet state goals, China’s unique blend of gray finance, state-aligned enterprise, diplomatic cover, and the scale of its investment stands out.

The digital dimension is just as consequential. These criminal networks rely heavily on over-the-counter (OTC) crypto brokers, stablecoins like Tether, and platforms like Huione to move billions outside the reach of global regulators. These tools enable real-time capital mobility, payment anonymity, and sanction-resistant value transfer. Crypto is not just a laundering mechanism—it’s a core pillar of a parallel financial infrastructure that serves both illicit actors and, at times, broader Chinese interests.

In parallel, these same networks extend China’s informal reach into diaspora communities. In Canada, Australia, and the U.S., loosely affiliated actors have engaged in surveillance, harassment, and coercion of dissidents, often in tandem with Chinese consular or United Front-linked operations. These networks also help generate untaxed capital, entrench Chinese business interests, and build parallel financial infrastructures that operate well outside the purview of global regulators.

This is not a top-down operation. It’s a decentralized ecosystem—where illicit actors, shadow financiers, and state-linked intermediaries often find alignment. What emerges is a deniable architecture of power and profit—adaptable, resilient, and increasingly strategic.

US law enforcement recently sanctioned Cambodia-based Huione Pay in connection with terrorist financing and money laundering. The company’s primary focus was its regional Chinese criminal clientele. Image source

Selective Enforcement – Rule of Law as a Dial, Not a Switch

China’s approach to transnational crime is not uniformly applied—it’s strategic. Domestically, Beijing aggressively prosecutes crimes like online gambling, crypto fraud, and large-scale scamming, particularly when they risk domestic unrest or reputational fallout. Abroad, however, enforcement becomes far more selective. Crimes committed by Chinese nationals in foreign jurisdictions—especially in Southeast Asia—often draw inconsistent responses depending on the political and strategic context.

Cambodia offers a clear case in point. Chinese-run gambling and scam operations have flourished in cities like Sihanoukville, despite Beijing’s sweeping 2020 domestic ban on online gambling. While China has extradited hundreds of suspects from Cambodia—including a 2024 operation that saw over 680 nationals repatriated for fraud and illegal gambling—it has shown remarkable tolerance for larger, well-connected networks. Notably, She Zhijiang, a Chinese-born tycoon who built a regional gambling empire, operated for years despite being wanted by Chinese authorities since 2014. A self-professed Chinese spy, his eventual arrest in Thailand came only after allegations that he had defied Chinese intelligence demands—suggesting political selectivity in enforcement.

This pattern reflects a deeper logic: crackdowns at home protect social stability, while tolerance abroad enables capital outflows, influence-building, and deniable engagement in unstable environments. Sometimes mass arrests are politically expedient, especially when the criminals target victims in Mainland China of create diplomatic fallout abroad1. By regularly seeking extraditions of known criminals and prosecuting them, the Chinese state state takes a very public stance against overseas crime. However, it apparently tolerates some individuals more than others—a strategic gray zone posture, not explicit policy. In this way, Chinese law enforcement functions less like a binary switch and more like a dial—tightened or relaxed depending on what serves China’s national interest.

Having lived in China for a significant portion of my adult life, I can say the dial metaphor applies just as well to the domestic context. Laws are not fixed boundaries; they are instruments, applied flexibly to manage dissent, control capital, and preserve state authority. Internationally, this same model has been quietly exported—not as a formal doctrine, but as a political habit. What emerges is a form of rule by man, not rule by law—adapted to local environments, but unmistakably recognizable to anyone who has seen how the system works at home.

Personal Note: After disembarking a flight from Sihanoukville, Cambodia to Xiamen, China, I witnessed dozens of my fellow passengers arrested in front of live news cameras at customs. Present were around a dozen uniformed officers—alongside one plainclothes agent wearing khakis, a golf shirt, windbreaker, sunglasses, and a badge hanging from his neck – think Horatio Caine from CSI Miami.

I didn’t stick around long, but I caught enough to recognize what was happening. As he cuffed a middle-aged man in a Gucci tracksuit dripping with heavy jewelry, the plainclothes officer mentioned “illegal gambling operations.” It was fast, public, and clearly orchestrated for the cameras. My friend and I were the only foreigners there – we exited quickly and tried to avoid rousing suspicions.

A ChatGPT rendering the scene at Xiamen Gaoqi International as I remember it.

Chinese casinos like this one are a common sight in Sihanoukville, Cambodia these days. An idyllic beach resort once visited by Jackie Kennedy and other global jetsetters, the town has since descended into a gritty playground for China’s criminal underworld. Image source

The Gray Zone Advantage – Influence Without Ownership

In this context, the “gray zone” refers to the space between peace and open conflict—where states pursue strategic objectives through unofficial, unattributable, or legally ambiguous means. China has proven adept at operating in this space in a number of ways, most prominently through its maritime militias – an unofficial naval force disguised as fishing vessels increasingly used to press China’s territorial claims in the South China Sea. China’s indirect engagement with transnational criminal networks is another form of gray zone tactic as these actors offer Beijing a toolkit for reshaping environments abroad —without the political costs of formal intervention. However, as we will see in the coming parts of this series, these tactics do not always work out in China’s best interest.

Criminal syndicates aligned with Chinese interests can quietly destabilize adversaries, erode governance, and undermine legal norms. Through illicit logistics routes, offshore gambling hubs, and informal banking networks, they create parallel corridors of capital and influence that operate beyond the reach of traditional regulatory regimes. These networks have become deeply embedded in weak and fragile states—from Cambodia to Mali—where enforcement is limited, corruption is entrenched, and the allure of Chinese money often overrides accountability. The result isn’t just corruption—it’s a quiet erosion of sovereignty in regions where enforcement is weak, capital flows are opaque, and China’s informal proxies move faster than state regulators can track.

But the reach of these ecosystems doesn’t stop there. In Western societies, these criminal groups intersect with real estate markets, underground financial systems, and diaspora-linked political influence efforts. From Vancouver’s “snow washing” phenomenon to United Front-linked surveillance in Sydney and Toronto, Chinese-aligned networks have quietly moved billions and shaped elite ecosystems—often under the radar of traditional law enforcement.

Across all settings, the strategic advantage is the same: plausible deniability. China benefits from the reach and flexibility of these actors—reaping access, leverage, and insulation—without incurring the costs of formal involvement. When scrutiny intensifies, officials can disavow any connection. But by then, the strategic value has often already been extracted: institutions have been strained, norms undermined, and influence embedded. The disorder serves a purpose—and attribution remains elusive by design.

Looking Ahead – Setting the Stage for Parts II & III

This first part provided an overview on how China quietly benefits from transnational criminal ecosystems—not by directly commanding them, but by tolerating and, at times, subtly enabling them. These networks blur the boundaries between profit and policy, crime and strategy. But the story doesn’t end with deniable influence.

Part II will examine how financial nodes like crypto brokers, shadow banking systems, and offshore economic enclaves have become vital components of China’s informal resilience architecture. In a future defined by economic decoupling and great-power conflict, these mechanisms may serve as critical lifelines—moving money, skirting enforcement, and keeping strategic initiatives afloat.

Part III will explore how these same networks entrench China’s presence across Southeast Asia and the broader Global South, empowering its geopolitical reach through informal supply chains, regulatory arbitrage, and captured digital infrastructure in preparation for an uncertain future.

To understand tomorrow’s strategic competition, we need to understand the infrastructure no one officially owns—but that many quietly rely on.

Enjoying this deep dive?

Part I of China’s Gray Zone Syndicates is free to read — but Parts II and III will be available exclusively to paid subscribers.

If you value original, high-impact research on illicit finance, geopolitics, war, energy, and more, consider supporting this work by becoming a founding or paid subscriber.

🔒 Unlock the full series — and future investigations — by subscribing now.

Subscribe now