Illicit finance quarterly
In this report:
New pathways for illicit finance
Sports betting, prediction markets and the AML gap
Events like the FIFA World Cup create predictable spikes in betting-related payments. Several developments are reshaping the risk landscape for African banks.
OTC crypto brokers
and informal conversion networks
The unregulated layer converting illicit cryptocurrency into fiat, and how African banks are increasingly exposed.
Crypto ATMs as
an emerging risk
Cryptocurrency kiosks in African malls are creating a new cash-to-crypto conversion point ahead of any meaningful regulatory oversight.
Daigou and luxury goods laundering
How informal Chinese networks convert criminal cash into designer items, and the lessons for banks from one of the first related high-profile AML cases.
MARKET TYPOLOGY
The business of cyber scam operations
How scam centres combine online fraud, human trafficking, corruption and money laundering in a single ecosystem, and the transaction indicators that matter most to banks.
SECTION #1
New pathways for illicit finance
Sports betting, prediction markets and the AML gap
Major sporting events like the FIFA World Cup create predictable spikes in betting-related payments. For African banks, the emerging risk is not only traditional sportsbook activity but the growth of prediction markets, stablecoin settlement and crypto-to-fiat conversion points that may sit outside transaction-monitoring typologies. Africa is one of the fastest-growing sports betting markets, and its anti-money laundering (AML) frameworks have struggled to keep pace with the scale and complexity of related payment infrastructures.
For banks processing betting-related payments in African markets, AML exposure is immediate and material. Africa’s sports betting market generated an estimated US$3.08 billion in 2025, with four in 10 Nigerians aged 18 to 40 identifying as regular sports bettors. South Africa alone recorded about US$81 billion in total gambling turnover in the 2024/25 financial year – up 36% from the previous year – with sports betting accounting for three-quarters of that total and online betting driving the bulk of recent growth. Major tournaments drive further surges: ahead of Qatar 2022, Barclays analysts estimated global World Cup wagering at US$35 billion – roughly five times the annual betting handle on the Super Bowl.
Africa is not a single regulatory market. Betting oversight ranges from structured licensing frameworks in South Africa and Kenya to fragmented state and federal enforcement in Nigeria. Across francophone West Africa, the West African Economic and Monetary Union introduced foreign exchange rules in December 2024 that impose strict constraints on crypto-based payment flows, with direct peer-to-peer transfers and cryptocurrency conversions subject to prior authorization requirements. Banks operating across these markets cannot apply a single typology because the exposure profile varies significantly by jurisdiction.
A further complexity is that banks are only one node in the African sports betting payments chain. Across East Africa, mobile money platforms are the dominant rails for betting deposits and withdrawals. In Kenya, M-Pesa is the main payment rail for sports betting deposits and withdrawals – a dynamic Safaricom acknowledged in its 2025 Sustainability Report, disclosing that its upgraded AML systems had detected money laundering through betting platforms and flagged suspicious international money transfers. The AML exposure in sports betting is therefore shared across banks, mobile network operators and fintechs, and compliance gaps in any of these layers create vulnerabilities that affect the entire payment chain.
The core money laundering mechanics are well documented. ACAMS and PwC both identify online gambling as one of the highest-risk sectors for money laundering. Criminal proceeds are placed on a betting platform and winnings are withdrawn as apparently legitimate income. More sophisticated schemes use several accounts to place offsetting bets, converting criminal cash into withdrawable balances while guaranteeing only a small net loss. The cross-border, non-face-to-face and rapid-settlement nature of online gambling makes standard AML controls – designed for slower-moving, identity-verified transactions – structurally less effective. The EU has put the money laundering threat from online gambling in its highest risk category. Against this backdrop, prediction markets introduce a structurally distinct layer of risk for which most AML frameworks have not yet developed specific monitoring guidance or typologies.
Prediction markets: a sharper and less regulated variant
Unlike traditional sportsbooks, prediction markets such as Polymarket and Kalshi operate as exchanges where users trade event contracts – binary bets on real-world outcomes – rather than wagering directly against a bookmaker. Traders take positions against each other, with the platform matching buyers and sellers and settling in cryptocurrency or cash when the event resolves. Funds move globally on blockchain-based financial rails without passing through traditional banking channels until the fiat conversion point.
Polymarket’s global crypto-based exchange operates without universal identity verification requirements. As Columbia University researchers recently noted, the real-world identities of millions of account holders are invisible.
Kalshi, an exchange regulated by the US Commodity Future Trading Commission, applies identity verification requirements, but has expanded to 140 countries, many of which have yet to establish a clear legal treatment for event contracts, leaving uncertainty as to whether they should be regulated as financial instruments or gambling products.
Research from Columbia University estimated that wash trading – coordinated volume manipulation using clusters of anonymous accounts – accounted for an average of about 25% of all trading on Polymarket over three years, rising to approximately 60% during periods of peak activity. Sports contracts have become a major driver of recent prediction market volumes, particularly on Kalshi.
Prediction market platforms are expanding rapidly across global markets, in many cases without obtaining local gambling or financial services licences. Publicly available regulatory guidance specifically addressing crypto-based prediction markets remains limited across African jurisdictions. Where these platforms reach African users, whether through active expansion or by being accessible online, settlement flows through stablecoin-to-fiat conversion channels that may fall outside existing betting or virtual asset service provider (VASP) regulation in most African markets.
Where the risk surfaces
Bank exposure in this typology operates at three levels, each of which is an emerging risk scenario rather than an established pattern for most African institutions.
First, banks holding accounts for sports betting platform operators – whether traditional sportsbooks or prediction market platforms – process fiat settlements flowing in and out of these ecosystems. KPMG identifies red flags: unusually large transactions inconsistent with a customer’s profile, frequent deposits followed by immediate withdrawals without gaming activity, many accounts controlled by a single user and inactivity followed by large-value transfers. The high transaction volumes associated with major sporting events create a concentrated window in which these behaviours intensify.
The regulatory focus on betting-related financial flows is already intensifying. In South Africa, the Reserve Bank is reportedly investigating payment processing arrangements involving online betting operator Betway, underlining that supervisory attention is increasingly extending to the broader financial infrastructure that enables wagering activity.
Second, as prediction markets grow and their crypto-to-fiat conversions route through over-the-counter (OTC) brokers and peer-to-peer platforms, the fiat endpoint is frequently a bank account. Banks processing crypto-to-fiat conversions – or holding accounts for entities that do, including crypto exchanges, OTC brokers and VASPs – may be handling the settlement leg of prediction market activity without recognizing it. That conversion point, at which the stablecoin becomes a bank transfer, is where the AML obligation crystallizes and where monitoring frameworks are least calibrated to detect the underlying activity.
Third, and specific to the African context, the mobile money layer creates a parallel exposure channel that banks may not directly see. When betting flows first move through M-Pesa, for instance, the transaction that arrives at the bank has already been processed by a mobile money interface. As Safaricom’s disclosure illustrates, the risk is already active in the mobile money layer. Banks that hold correspondent or settlement accounts for mobile money operators, or that provide banking infrastructure to fintechs active in betting payments, inherit indirect exposure to these flows.
FIFA, ADI Predictstreet and the governance question
In April 2026, FIFA formalized this dynamic by announcing that ADI Predictstreet, a newly launched platform, was its official global prediction markets partner for the World Cup. The deal, worth an estimated US$150 million, placed ADI alongside FIFA’s established global sponsors. FIFA’s statement on the partnership noted that it includes comprehensive integrity oversight with real-time monitoring of suspicious trading activity and structured information sharing between FIFA and ADI.
The structural challenge the partnership creates relates to architecture: ADI Predictstreet operates on blockchain-based financial rails using stablecoin payments – the same infrastructure that regulators in India and Brazil have flagged as raising concerns about circumvention of regulatory frameworks. FIFA’s commercial endorsement is likely to increase awareness of prediction markets among African users and regulators, including in markets where betting activity routes through mobile money channels with limited AML oversight.
South Africa’s Financial Sector Conduct Authority (FSCA) licensing regime for crypto asset service providers and the Financial Intelligence Centre (FIC) Act’s treatment of money services businesses as accountable institutions provide a supervisory framework. But the prediction market platform – operating across borders, on blockchain rails, without a physical presence in any African jurisdiction – sits largely outside that perimeter. As prediction markets expand their reach on the back of FIFA’s commercial endorsement, the gap between the regulatory perimeter and the flow of funds is where the exposure lies for banks that have not yet calibrated their monitoring frameworks to this typology.
OTC crypto brokers and informal conversion networks
Over-the-counter (OTC) cryptocurrency brokers, the intermediaries that convert cryptocurrency into fiat outside regulated exchange environments, have become a critical node in the global illicit finance ecosystem. They operate in the gap between crypto and the formal banking system, absorbing proceeds from organized crime and returning clean fiat through ordinary bank accounts. An INTERPOL–AFRIPOL operation in 2025 confirmed that African banks are increasingly exposed to this infrastructure through customer accounts, VASP relationships and fiat off-ramp flows.
The standard AML framework was built around the cash deposit: the moment criminal proceeds first enter the formal financial system. Cryptocurrency has introduced a less visible second entry point: the crypto-to-fiat conversion. Unregulated OTC brokers perform this function at scale. By the time converted funds reach a bank account, links to the illicit origin have been severed. The receiving account may belong to an apparently legitimate business, an individual with a plausible financial profile, or a front company with no discernible red flags. The challenge for compliance teams is that the transaction, viewed in isolation, looks clean.
The infrastructure of illicit conversion
According to Chainalysis’s 2026 Crypto Crime Report, on-chain money laundering increased from approximately US$10 billion in 2020 to more than US$82 billion in 2025. Chinese-language money laundering networks processed an estimated US$16.1 billion in 2025 – approximately US$44 million a day – across more than 1 800 active wallets. Within this ecosystem, OTC brokers consolidate small deposits of illicit crypto into wholesale amounts suitable for reintroduction into the formal financial system at the integration stage of the laundering cycle.
These networks operate openly. TRM Labs’ 2026 Crypto Crime Report documents how North Korea’s Lazarus Group – responsible for more than US$1.92 billion in cryptocurrency theft in 2025 – increasingly relied on professionalized OTC brokers and underground intermediaries that facilitated off-ramping at scale. These networks provide subcontracted laundering: after the theft operation deposits stolen assets, the OTC broker absorbs them and settles the equivalent in fiat off-chain, distancing the theft from the cash-out point. The same infrastructure is used by drug trafficking networks, scam compound operators and terrorist financiers. The broker’s business model is indifferent to the predicate offence.
Operation Catalyst and the African dimension
Between July and September 2025, INTERPOL and AFRIPOL conducted Operation Catalyst, targeting financial flows linked to terrorism financing, fraud, money laundering and the illicit use of virtual assets across six African countries. The operation resulted in 83 arrests and the identification of approximately US$260 million in illicit fiat and cryptocurrency. Twenty-eight arrests were for financial fraud and money laundering, and 18 were related to the illicit use of virtual assets.
In Kenya, authorities identified a money laundering operation using a registered VASP as a conduit, with links to terrorism financing. In Angola, 25 people were detained in connection with informal value transfer systems, with approximately US$588 000 seized. In Nigeria, a cryptocurrency Ponzi scheme linked to these networks had defrauded investors across 17 countries of more than US$562 million. Binance, Moody’s and Uppsala Security contributed blockchain data and intelligence to the investigation, demonstrating that detecting these flows requires specialist analytical tools and cross-sector data sharing that few financial institutions anywhere have fully operationalized.
The OTC broker ecosystem reaches African banks in three ways. Operators often present as cryptocurrency traders, fintech startups or money services businesses. They hold bank accounts through which converted fiat is distributed – accounts that may show high-volume inbound transfers from crypto platforms followed by rapid distribution to many recipients. African peer-to-peer platforms, the dominant crypto access point in markets with limited regulated exchange infrastructure, function as informal OTC desks in practice, with settlement through mobile money and bank transfers. Sub-Saharan Africa received more than US$205 billion in crypto transactions in the 12 months to June 2025 – a 52% year-on-year increase – with Nigeria ranking among the top countries globally for crypto adoption. Where OTC conversion is the final step in a chain that began offshore, the fiat entering an African bank account is the endpoint of a transaction trail invisible to standard AML controls.
The regulatory gap is structural. South Africa’s FSCA licensing regime for crypto asset service providers (CASPs)[1] creates a formal framework for identifying and supervising these entities, but the informal OTC broker – operating without a fixed address or public-facing platform – frequently falls outside the perimeter of registered CASPs. The gap between what the licensing framework covers and what the OTC ecosystem encompasses is where the highest-risk activity occurs.
Operation Catalyst confirmed what the transaction data already suggested: African financial institutions are embedded in this ecosystem as exit points for proceeds that originated elsewhere. The OTC broker is invisible by design, converting illicit crypto into clean fiat before it reaches a bank account. That invisibility is the risk. Recognizing these flows requires looking beyond the individual transaction to the pattern of accounts, platforms and counterparties around it.
[1] The term VASP is used in international standard-setting frameworks, including those of the Financial Action Task Force. In South Africa, the equivalent domestic regulatory category is CASP, as defined under the FSCA licensing regime. Both terms are used in this article consistently with their respective contexts.
Crypto ATMs: an emerging risk ahead of regulation
Cryptocurrency ATMs allow users to deposit cash and receive digital assets within minutes. In the US, where tens of thousands of machines are installed, they have become the preferred instrument of fraudsters targeting elderly victims, generating US$388 million in losses in 2025, according to the FBI. Enforcement action has revealed fraud rates of up to 95% of total transactions. These machines are appearing in African shopping centres ahead of the regulatory frameworks needed to govern them.
Walk through a shopping centre in Johannesburg or Nairobi and you may notice an unfamiliar machine next to a traditional ATM. These are convertible virtual currency kiosks, and in the US, where the technology is most developed, the pattern of exploitation is already well documented.
Crypto ATMs allow users to deposit cash and receive cryptocurrency directly into a digital wallet within minutes. Unlike traditional ATMs connected to bank accounts, they connect to the blockchain, making transactions fast, borderless and, once confirmed, irreversible. There is no dispute resolution mechanism, no chargeback right and no fraud recovery pathway. That irreversibility is precisely what makes them attractive to criminals.
The typical fraud follows a documented pattern. A victim receives an unsolicited call from someone posing as a government official, bank fraud investigator or technical support agent. Told their account has been compromised or that they face legal action, they are instructed to withdraw cash and deposit it at a nearby kiosk using a QR code provided by the fraudster. Within minutes, the funds have been converted, transferred to a wallet controlled by the criminal, and routed onwards. A blockchain transaction is final the moment it is confirmed; unlike a wire transfer, it cannot be recalled.
In 2025, the FBI Internet Crime Complaint Center recorded more than 13 400 complaints linked to crypto kiosk fraud, with losses reaching US$388 million – 58% higher than in 2024. Older adults account for most reported losses. The scale of exploitation is reflected in enforcement: in September 2025, the District of Columbia Attorney General sued Athena Bitcoin after finding 93% of deposits at its Washington machines were linked to fraud, with a median victim age of 71 and a median loss of US$8 000.
Regulatory response
In August 2025, the US Treasury Financial Crimes Enforcement Network (FinCEN) issued a formal notice clarifying that crypto ATM operators fall within money services business frameworks under the Bank Secrecy Act. FinCEN reminded financial institutions of their suspicious activity report filing obligations where fraud indicators appear, and confirmed that banks processing transactions for kiosk operators carry direct compliance obligations. State-level responses have accelerated: Indiana enacted a de facto ban on crypto ATM operations in 2026, California and Connecticut imposed daily transaction caps, and Vermont extended a moratorium on new installations.
The regulatory pressure is producing market consequences. In May 2026, Bitcoin Depot, once the largest crypto ATM operator in North America with more than 8 000 kiosks, filed for Chapter 11 bankruptcy, citing unsustainable regulatory and litigation costs. The EU Markets in Crypto-Assets Regulation (MiCA), applicable to CASPs since December 2024, generally brings crypto-asset ATM and kiosk operators within the regulatory framework where they provide regulated crypto-asset services. Operators are therefore subject to authorization, customer due diligence, and AML/counterterrorism financing and transaction-monitoring requirements. Those that fail to obtain the required authorization by the end of applicable transitional periods must cease providing regulated services to EU clients.
Canada has gone furthest at the national level. In its April 2026 spring economic update, the government proposed a ban on crypto ATMs, citing Canadian Anti-Fraud Centre estimates that citizens lost between US$142 million and US$284 million to crypto ATM fraud in 2024. Studies cited in support of the proposal found that between 85% and 98% of crypto ATM transactions are linked to illicit activity. Legislation to implement the ban was pending at the time of writing.
Africa: infrastructure ahead of regulation
In November 2025, shortly after Kenya’s VASPs Act came into force, machines branded ‘Bankless Bitcoin’ appeared in major Nairobi shopping centres directly beside conventional bank ATMs. The machines allowed small-value transactions without know-your-customer (KYC) verification. A joint notice later that month from the Central Bank of Kenya and Capital Markets Authority warned that no VASP had been licensed under the new law, meaning any operator claiming authorization was acting illegally. The infrastructure arrived before the licensing system was ready. Kenya’s experience is a forward indicator for the region: where regulatory frameworks are incomplete, kiosk operators move first and compliance follows under pressure.
In South Africa, CoinFlip – an operator facing enforcement actions from the attorneys general of Iowa and Missouri over allegations that it knowingly facilitated fraud through its kiosks – has deployed machines in major Johannesburg malls, including Bryanston Centre. CoinFlip has contested the Missouri lawsuit as meritless and maintains it has robust consumer safeguards in place.
If operators or users structure repeated cash transactions below South Africa’s R50 000 cash threshold reporting level under the FIC Act, this may create a monitoring and reporting blind spot. Transactions could be processed in a way that limits the data available to the FIC and banks monitoring for suspicious activity. South Africa’s FSCA CASP licensing regime requires crypto ATM operators to register. Enforcement against unlicensed operators has been limited to date, and the CASP framework is still being operationalized.
Three distinct exposures face banks in this space. When a customer withdraws cash to buy cryptocurrency at a kiosk after a scam call, the bank is the last institution with visibility over the funds before they leave the formal financial system. When a bank onboards a crypto ATM operator, it assumes the compliance risk profile of a cash-intensive money services business – an exposure that FinCEN’s August 2025 notice makes explicit and that South Africa’s CASP regime is beginning to formalize. And once fraud proceeds are converted to crypto at a kiosk and eventually reconverted to fiat through peer-to-peer platforms or OTC brokers, African banks are documented destinations for the resulting inbound flows.
The US pattern is instructive: infrastructure deployment outpaced regulation, fraud scaled rapidly, and enforcement followed years later after billions had been lost. African markets are at the beginning of that curve, and they are not facing a hypothetical future risk. They are at the early stage of a documented global pattern whose consequences are already measurable elsewhere.
Daigou and luxury goods laundering
Informal purchasing networks operating under the Chinese daigou model, where buyers abroad purchase goods on behalf of customers, are a vehicle for laundering criminal proceeds through high-end retail. A February 2026 enforcement action against Louis Vuitton Netherlands, explicitly linked to daigou activity, illustrates how illicit value moves through legitimate channels. For banks, the exposure sits in merchant accounts, high-value transaction flows and customers whose spending does not reflect their income profiles.
Daigou – ‘buying on behalf of’ in Mandarin – describes an arrangement in which buyers abroad purchase goods for resale to customers in China, where identical items are more expensive due to import duties and brand distribution controls. The practice sits on a spectrum from informal gifting to organized commercial operations. At the criminal extreme, daigou networks convert illicit cash into high-value portable assets – designer handbags, watches and jewellery – which are exported and resold, with the proceeds returning as apparently legitimate commercial income.
The African dimension of this typology is direct. China is Africa’s largest trading partner, with bilateral trade reaching a record US$348 billion in 2025. While commercial networks are overwhelmingly legitimate, they create cross-border purchasing and trading channels that facilitate the operation of informal resale and value-transfer schemes.
South Africa’s luxury goods market is forecast to grow by 15% in 2025, according to Euromonitor International, while Johannesburg’s Sandton City and Cape Town’s V&A Waterfront host boutiques operated by many of the same luxury brands targeted by daigou networks elsewhere, including Louis Vuitton. The combination of established China-linked commercial networks, luxury retail infrastructure and significant cross-border financial flows creates conditions under which similar daigou-linked laundering typologies could emerge across major African commercial centres. The Louis Vuitton Netherlands case illustrates how that exposure can materialize – and what it means for banks holding merchant accounts in these markets.
The Louis Vuitton Netherlands case
On 12 February 2026, Dutch prosecutors issued a €500 000 penalty order against Louis Vuitton’s Netherlands subsidiary for breaching the Prevention of Money Laundering and Terrorist Financing Act, citing failures to identify and report unusual transactions. The case arose from a wider investigation into a convicted underground banker of Greek nationality who had gathered large sums of criminal cash for laundering. Those proceeds were funnelled to a woman in Lelystad who spent more than €2 million on designer handbags at Louis Vuitton outlets across the Netherlands between August 2021 and February 2023, exporting the goods to China for resale.
The scheme’s mechanics illustrate why this typology is difficult to detect. Payments were structured to remain below the €10 000 reporting threshold, the customer used several aliases and email addresses across four locations, and a former sales associate – named as a suspect in continuing criminal proceedings – allegedly provided advance notice of new stock arrivals and warned when monthly cash spending on any account was approaching the level that would trigger a mandatory disclosure. Louis Vuitton failed to verify the customer’s identity or respond to the accumulating pattern of red flags, constituting a breach of the money laundering act.
Until the beginning of 2026, Dutch law required retailers to report cash transactions of €10 000 or more. The suspects structured payments to remain just below this threshold. As of 1 January 2026, the Netherlands has implemented a ban on cash payments of €3 000 or more for professional sellers of goods – a direct regulatory response to cases of this kind, and a signal of the direction of travel for luxury retail compliance globally.
The enforcement action has two implications for banks. First, it establishes that luxury retailers carry AML obligations that prosecutors will enforce criminally. Second, the compliance failure at the retailer creates downstream exposure for banks holding its merchant accounts: transactions that should have been flagged as suspicious were cleared as routine retail income, and the proceeds re-entered the financial system indistinguishable from legitimate sales revenue.
Scale and regulatory context
In August 2025, FinCEN published Advisory FIN-2025-A003 on Chinese money laundering networks, the most comprehensive US regulatory treatment of this typology to date. It identified daigou operations as a laundering mechanism used to convert cartel proceeds into luxury goods for export and resale.
The accompanying financial trend analysis covered 137 153 Bank Secrecy Act filings from 2020 to 2024, representing approximately US$312 billion in suspicious activity linked to these networks. Of this, US$19 billion was associated with unusual credit card activity, a significant proportion of which is assessed to involve daigou-style purchasing chains.
The UK National Crime Agency has documented one network controlling about 600 accounts at a single financial institution. The Institute for Financial Integrity notes that while only US$9.6 million of identified suspicious activity directly references daigou in suspicious activity report filings, the broader category of anomalous credit card activity associated with these networks suggests the true scale is substantially larger.
No major public daigou-linked enforcement case has yet been identified in Africa. South Africa’s FIC Act has classified high-value goods dealers as accountable institutions since 19 December 2022, creating explicit AML obligations for luxury retailers. But as the Louis Vuitton case illustrates, legal obligation and effective detection are not the same thing: criminal proceeds passed through customer accounts and into merchant accounts as ordinary commercial transactions, and neither the customer’s spending patterns nor the retailer’s incoming payments were identified as suspicious. This is the gap African banks need to close.
MARKET TYPOLOGY
THE BUSINESS OF CYBER SCAM OPERATIONS
Nearly everybody has a scam story. Over the past decade, scams have spread unchecked worldwide, generating ever-growing amounts of illicit proceeds. Estimates suggest that scams and frauds generated more than US$1 trillion in 2024. Many of them are linked to so-called scam centres: physical locations where criminal networks conduct online crimes at scale.
A global industry, local exposure
While Southeast Asia has long been the operational centre, scam centres can be found globally. INTERPOL confirmed in March 2025 that victims from 66 countries had been trafficked into scam centres, warning that West Africa was emerging as a potential new regional hub. The GI-TOC has also documented China-linked scam centres in South Asia and mapped their presence across more than 30 countries. Research also suggests that scam syndicates with links to China are increasingly turning their attention to Africa. This is not a distant threat.
Cyber scam operations commit ‘compound crimes’: online fraud, trafficking, corruption and money laundering converging in a single ecosystem. These operations are supported by a globalized, professional and multi-layered money laundering system that channels criminal proceeds into legitimate financial and commercial networks. Components of the system can be adjusted depending on the needs of the criminal network, the volume of illicit proceeds, the geography and the type of scam. Crucially, money laundering is available as a service; operators can purchase it from specialist providers, making the threshold for running a large-scale scam operation lower than ever.
The Southeast Asian scam centre model
Four payment categories sustain operations: revenue generation (fraud proceeds), workforce acquisition and control (worker exploitation), operational expenditure and corruption payments. Understanding the transfer types associated with each helps financial institutions identify where they sit in the flow.
Fraud proceeds are the primary source of revenue. Romance scams, investment fraud, impersonation scams, crypto Ponzi schemes and fraudulent gambling sites are the main typologies. Hybrid models are common – victims are groomed over weeks before being directed to a fake investment platform, with workers trained to psychologically profile targets and adapt scripts before the financial ask. Losses per victim vary widely: romance–investment hybrids typically involve higher cumulative transfers, while impersonation scams tend to involve smaller, repeated payments. Victims often make several transfers before the fraud becomes apparent. AI tools such as voice cloning, deepfakes and automated translation are standard operational kit, with industry analyses reporting an exponential surge in deepfake-enabled fraud in early 2024.
Operational requirements are sourced through criminal supply chains on Telegram: fake investment platforms, spoofing tools, customer relationship management systems, SIM boxes (used by scammers to disguise international calls and spam messages as local traffic) and ready-made scam packages. This ‘crime as a service’ model means operators buy infrastructure rather than build it. These Telegram-based guarantee marketplaces – named for the escrow-style payment guarantees they offer – use USDT (Tether) stablecoins on the TRON blockchain for all transactions, allowing peer-to-peer value transfers while bypassing many standard AML checks. The largest such marketplace, launched in 2021, was Huione Guarantee (later renamed Haowang Guarantee), which processed at least US$31 billion in transactions. After a FinCEN special measure in May 2025 severed its access to the US financial system, rival platforms absorbed the criminal user base within weeks.
Worker exploitation is a parallel payment category, particularly relevant to Southeast Asian compound operations. Trafficked workers are controlled through debt bondage, movement restrictions and documented physical coercion. Compounds can resell workers for between US$1 000 and US$15 000 in Cambodia, and up to US$10 000 in Myanmar. The UN Human Rights Office has documented South Africans and Zimbabweans among trafficking survivors. The forced criminality model extends beyond Southeast Asia: a 2024 INTERPOL operation dismantled a scam centre in Namibia where 88 youths were held under coercion. African nationals are also recruited to work in Southeast Asian compounds – a distinct dynamic from the domestic scam centre model, but one that affects the same communities.
Corruption payments run the full supply chain – from border officials to armed groups charging protection fees. The Prince Group case shows how far this can reach: founder Chen Zhi donated US$18 million to the Cambodian government and held a minister-level role while running forced-labour scam compounds for years.
Operational forms
The core financial infrastructure – mule accounts, cryptocurrency conversion, motorcade layering (the use of coordinated networks of money mules, or ‘motorcades’, to disguise and obscure the origins of illicit digital funds) – runs through all models. The patterns shown in the table reflect what is most distinctive to each form; indicators will frequently overlap.
|
OPERATIONAL FORM |
PHYSICAL FOOTPRINT |
ASSOCIATED FINANCIAL PATTERNS |
|
Prison-based units |
Cells within correctional facilities; 1–10 operators; collusion between inmates and officials. |
Mule accounts opened by outside associates; rapid-transit digital wallet flows (funds cleared within minutes); card-not-present fraud proceeds; low per-transaction amounts by design. |
|
Apartment and small-office nodes |
Rented residential or small commercial premises; 5–40 operators; relocate frequently. |
Many accounts at one address; high-volume inflows from dispersed senders consolidated into outbound transfers; workers paid through prepaid cards or digital wallets. |
|
Networked cell model |
Decentralized house-based or apartment cells linked through a senior organizer. |
Clusters of mule accounts registered by local associates; short-cycle phone registration on banking apps; fragmented inflows forwarded offshore within minutes; local passport holders used as nominees. |
|
Legitimate business fronts |
Registered call centres, offshore gaming operators, business process outsourcing firms or technology companies. |
Invoiced IT, consulting or support services with no verifiable activity; revenues inconsistent with premises and staffing; payments layered through several entities; operators may hold financial services licences. |
|
Hotel and casino operations |
Hotels converted to host illegal online businesses; casino properties; gambling platforms used for operations and laundering. |
Casino deposits and withdrawals as integration layer; crypto conversions with no documented source of funds; workforce recruited through false job ads and housed on premises. |
|
Walled compound operations |
Purpose-built fortified complexes; can host up to tens of thousands of trafficked workers; self-contained with management, finance and security departments. |
High-volume proceeds requiring professional laundering infrastructure; layering through cryptocurrency, real estate, luxury goods and gambling across jurisdictions; citizenship-by-investment passports used to access international banking. |
The laundering cycle
Laundering for scam operations is a professional marketplace. In Southeast Asia, so-called gateway companies – specialist intermediaries, some of which hold financial service licences – broker between scam operators and laundering networks. Their licensed status gives them access to correspondent banking, corporate accounts and trade payment channels, making them difficult to distinguish from legitimate financial intermediaries. Bank accounts, cryptocurrency, fintech platforms, credit cards and cash all run simultaneously, making transactions appear routine at every layer.
Every scam flow starts with a victim-initiated transfer in which funds are sent voluntarily to what appears to be a legitimate investment, person or authority. There is no single routing: funds may go directly to a mule account or victims may be coached to buy cryptocurrency on a legitimate exchange and connect to a fraudulent platform with a smart contract that automatically drains the wallet.
Funds then enter a motorcade that defeats pattern-based monitoring by fragmenting and reconsolidating value across platforms and jurisdictions within minutes. A typical sequence converts victim funds to USDT, moves them across TRON blockchain wallets, then through decentralized finance tools to obscure the trail; 45% of all illicit crypto transactions in 2023 ran on TRON. Huione Pay, the payments arm of Huione Group, processed at least US$103 billion in USDT, illustrating the industrial scale at which these systems operate. For banks, exposure happens at several points: the initial victim transfer, the fiat-to-crypto conversion, the OTC dealer or exchange account where proceeds re-enter the formal system, and the formal accounts used to stash integrated proceeds after laundering.
Cash-out runs through OTC cryptocurrency dealers, casino platforms or centralized exchanges. Integration uses nominee real estate, luxury goods, and false trade invoices. Gambling is a prominent mechanism: deposits are wagered and the resulting winnings are withdrawn.
Two cases show the scale. In 2023 in Singapore, US$2.2 billion linked to online gambling and transnational organized crime was distributed across at least 16 financial institutions, nine of which – including Credit Suisse, UOB, UBS and Citibank – were subsequently fined US$21.5 million by the Monetary Authority of Singapore for AML failures. Each transaction had appeared legitimate in isolation. In the Prince Group case in 2025, the US Department of Justice seized US$15 billion in bitcoin, the largest forfeiture in history. Chen Zhi’s assets – property, yachts, a Picasso – were held through shell companies in more than 30 countries, with 17 Singaporean and 17 Hong Kong companies among the 146 sanctioned laundering conduits.
Africa’s scam centre landscape
Africa has a long history of online fraud. West Africa once led the field with advance-fee scams (so-called ‘419’ fraud) and confidence schemes that preceded and, in many ways, anticipated the industrialized scam-centre model. What is new is the emergence of compound-style networks that combine fraud, human trafficking and organized criminal control at scale.
In West Africa, ‘hustle kingdoms’ – house-based operations run on a profit-sharing model – have proliferated since 2020, some coordinated with actors from China, Indonesia and the Philippines. In South Africa, Nigerian confraternities run a decentralized variant: small cells operating from residential properties with high-security infrastructure that provides operational cover. Local associates open bank accounts and hand their phones to the syndicate for use as mule nodes. Some operatives acquire South African passports specifically to access banking channels that attract less scrutiny. The UN Office on Drugs and Crime has documented Asian-led scam operations in Nigeria, Zambia and Angola.
What to watch for in
the South African context
Transaction patterns
Rapid-transit flows
Funds received and forwarded within minutes across linked accounts to cryptocurrency exchanges or international wires. Speed, not amount, is the primary signal. South African accounts are documented as collection points for the proceeds of Nigerian confraternity fraud before funds move offshore.
Victim-side transfers
A customer with no prior cryptocurrency experience makes repeated, increasing purchases. A customer who has not previously made international transfers begins doing so repeatedly, with increasing amounts – often at unusual hours. Retail banks are usually the last point of intervention before funds are lost.
Structuring
Repeated transfers just below local reporting thresholds from accounts with no commercial purpose, to the same or related offshore beneficiaries. The confraternity cell model operates at transaction sizes that typically fall below domestic reporting thresholds.
Gambling-linked integration
Round-number deposits to online gambling accounts, including locally licensed platforms, followed by irregular withdrawals as winnings.
Intangible service invoices
IT, software or consulting invoices from Southeast Asian or West African counterparties with no verifiable underlying relationship or delivery. Apparent regulatory legitimacy is a feature of these entities, not a clearing factor.
Distress-pattern transfers
Outbound payments to cryptocurrency wallets or informal channels by customers showing distress indicators – potentially ransom payments by families of trafficked relatives.
Customer-level patterns
Account clusters at one address
Many accounts registered to a single residential or business address – particularly security estates or high-end apartment complexes – each receiving payments from different senders and forwarding to a common offshore destination. This is the signature of the confraternity cell model in Johannesburg and Cape Town.
Short-cycle phone registration
Accounts where the linked mobile phone registers and deregisters from the banking app in short cycles, indicating that the registered account holder has handed the device – and effective control of the account – to a third party.
Local passport nominees
South African nationals with no apparent business activity receiving many inbound transfers and consolidating outflows offshore. Some operatives acquire South African passports to reduce banking scrutiny.
Nominee property structures
Property acquired by individuals with no verifiable income, where beneficial ownership traces to foreign nationals or offshore entities. This is a documented integration mechanism, including in the Singapore and Prince Group cases.
Citizenship-by-investment passports
Second passports from Cambodia, Saint Kitts and Nevis, Dominica or Vanuatu presented alongside South African accounts with high cross-border activity and gambling-linked transactions – a pattern from the Singapore and Prince Group cases.
Priorities
These priorities map directly to the operational models above – in particular, the networked cell and residential confraternity models, compound-based operations, and the professional money laundering service infrastructure that underpins them all.
Develop scam-centre typologies at sector level. Rather than investigating individual scam types, focus on the scam centre model to understand how criminal networks launder, layer and integrate proceeds. Cross-institution pattern sharing – clusters of mule accounts, common beneficiary destinations – requires visibility that no single bank can achieve alone. The FIC compliance guidance – in particular its obligations on suspicious transaction reporting, customer due diligence and the crypto asset travel rule – provides the relevant regulatory framework.
Engage the Hawks on the residential cell model. The role of private security estates as operational cover warrants greater law enforcement attention. Anonymized typology intelligence shared through public–private channels can accelerate disruption.
Apply risk-based enhanced due diligence to unusual first-time international transfers to high-risk jurisdictions linked to scam centres, including Cambodia, Myanmar, Laos, the Philippines and the United Arab Emirates, and to crypto exchange platforms where the customer profile does not support the volume. Review correspondent relationships in West African jurisdictions where scam operations have been documented against current sanctions lists and Financial Action Task Force (FATF) grey list status.
Invest in frontline victim identification. Staff who can recognize and sensitively engage customers making repeated, increasing transfers at unusual hours provide a control that technology alone cannot replicate for social-engineering fraud.
Build financial literacy into account onboarding and digital banking channels. Many mule account holders were recruited through credible-looking social media job offers and do not know they are facilitating fraud. Awareness at account opening and on banking apps can help reduce recruitment success rates and build customer resilience.
Review exposure to gateway companies. Enhanced due diligence on fintech partners, payment processors and correspondent relationships should specifically assess whether counterparties are providing gateway company-style services, regardless of their regulatory status in their home jurisdiction.
Share typologies with the FIC and with financial intelligence unit counterparts in key financial centres – including Nigeria, Kenya, Tanzania, Singapore and Hong Kong – through which illicit proceeds in the region are routed. The FATF information-sharing framework provides the mechanism; the gap lies in operational implementation.
Explore past issues:
About the Global Initiative GI-TOC
The Global Initiative Against Transnational Organized Crime is a global network with over 700 Network Experts around the world. The Global Initiative provides a platform to promote greater debate and innovative approaches as the building blocks to an inclusive global strategy against organized crime. www.globalinitiative.net
Built with Shorthand