FinCrime Intelligence Weekly
Hizballah cash couriers, an Ecuador fishing fleet cocaine network, a 92 million dollar Chinese laundering sentence, a UK gambling AML fine, and new ICC and Venezuela sanctions.
Marco’s Take
Marco Beranzoni
This week five stories, different in size and geography, share one quiet feature: every illicit flow moved because it looked like something ordinary. A Hizballah linked cash courier network carried money on commercial flights, the kind you and I board every month. Off Ecuador’s coast, cocaine reached go fast boats through refuelling stops run by registered fishing businesses. In North Carolina, a Chinese money laundering organization used fake driver’s licenses to open shell company bank accounts at major US banks. And QuinnBet, a licensed and regulated gambling operator, missed a customer who staked over 215,000 pounds in a single day because the report reached compliance the following day, not the same one.
The common thread is not sophistication. None of these methods are new. What they share is that the cover was mundane enough to pass a first glance: a passenger, a boat with a fishing licence, a company with a bank account, a customer with a balance. My sharp observation is this: the control that failed each time was the second look, not the first. Verification at onboarding is table stakes. The gap sits in re-checking identity, ownership, and behaviour once the relationship is already running.
The uncomfortable task for this week: pull one dormant shell company or low activity account from your book and ask whether anyone verified the person behind it in the last twelve months, not just at opening.
See you next Monday. Marco
OFAC designates 10 people who smuggled cash on commercial flights between Lebanon, Turkiye, the UAE and Iran to fund Hizballah.
The UK Gambling Commission found QuinnBet let a customer stake £215,000 in a day and accepted deposits with no source of funds check.
Jianfei Lu laundered drug proceeds through shell accounts using fake driver's licenses at major U.S. banks, a federal court in North Carolina ruled.
Treasury designated 15 Ecuador-based targets and 10 vessels for running a cocaine network disguised as legitimate fishing businesses near Manta, tied to Los Choneros, Los Lobos and Mexican cartels.
Treasury added two International Criminal Court officials and a British Virgin Islands company to the sanctions list, with a general license opening a wind-down window.
What changed this week, why it matters, and what to do about it.
| Region | Update | Why it matters | Action |
|---|---|---|---|
| Global | OFAC has taken close to 30 actions against more than 300 individuals and entities under its cartel targeting campaign since the start of 2025, most recently the 20 August 2026 designation of 15 Ecuador based targets and 10 vessels tied to Los Choneros and Los Lobos. | The pace signals sustained pressure on any institution with correspondent or trade exposure to Ecuadorian fishing, shipping, or export sectors. | Screen counterparties in Ecuador's fishing and marine logistics sector against the SDN list, since front businesses in this campaign have repeatedly used ordinary looking fishing registrations. |
| Global | OFAC designated 10 individuals, including Turkish businessman Yunus Alper Yilmaz, for running a cash courier network that moved up to hundreds of millions of dollars for Hizballah on commercial flights between Lebanon, Turkiye, the UAE, and Iran, and re-designated Hizballah itself. | The network relied on exchange houses and front companies as cover, and secondary sanctions risk attaches to any foreign financial institution that knowingly facilitates transactions for the designated persons. | Check correspondent and exchange house relationships touching Turkiye, Lebanon, the UAE, or Iran against the updated SDN list, and review bulk cash courier red flags in your correspondent banking due diligence. |
| UK | The Gambling Commission closed a compliance review of QuinnBet (Gibraltar) Limited covering March 2023 to August 2025, resulting in a 609,104 pound settlement made up of a 193,118 pound disgorgement payment plus investigation costs. | The failures included delayed suspicious activity report submissions and deposits accepted without established source of funds documentation, the same gaps that surface in bank AML reviews. | Test whether your source of funds triggers fire before losses accumulate, not after a periodic report flags them the next day. |
OFAC has taken close to 30 actions against more than 300 individuals and entities under its cartel targeting campaign since the start of 2025, most recently the 20 August 2026 designation of 15 Ecuador based targets and 10 vessels tied to Los Choneros and Los Lobos.
Why it matters:The pace signals sustained pressure on any institution with correspondent or trade exposure to Ecuadorian fishing, shipping, or export sectors.
Action:Screen counterparties in Ecuador's fishing and marine logistics sector against the SDN list, since front businesses in this campaign have repeatedly used ordinary looking fishing registrations.
OFAC designated 10 individuals, including Turkish businessman Yunus Alper Yilmaz, for running a cash courier network that moved up to hundreds of millions of dollars for Hizballah on commercial flights between Lebanon, Turkiye, the UAE, and Iran, and re-designated Hizballah itself.
Why it matters:The network relied on exchange houses and front companies as cover, and secondary sanctions risk attaches to any foreign financial institution that knowingly facilitates transactions for the designated persons.
Action:Check correspondent and exchange house relationships touching Turkiye, Lebanon, the UAE, or Iran against the updated SDN list, and review bulk cash courier red flags in your correspondent banking due diligence.
The Gambling Commission closed a compliance review of QuinnBet (Gibraltar) Limited covering March 2023 to August 2025, resulting in a 609,104 pound settlement made up of a 193,118 pound disgorgement payment plus investigation costs.
Why it matters:The failures included delayed suspicious activity report submissions and deposits accepted without established source of funds documentation, the same gaps that surface in bank AML reviews.
Action:Test whether your source of funds triggers fire before losses accumulate, not after a periodic report flags them the next day.
Typology of the week
A CMLO operates as a laundering service for drug trafficking organizations, separate from the traffickers themselves. Couriers collect bulk cash proceeds directly from US based drug traffickers, then deposit that cash, using both real and fake identities, into shell company bank accounts registered by other members of the organization. Senior members within the CMLO procure fake driver's licenses specifically for the couriers to use when making these deposits at major US banks, and coordinate which courier deposits at which branch. The organization can move very large sums quickly this way: one courier alone accounted for more than 20 million dollars in bulk cash pickups and deposits.
Example
This typology is drawn directly from the Jianfei Lu case. Lu, sentenced to 15 years in prison for laundering over 92 million dollars through a CMLO, personally deposited more than 20 million dollars using both his real identity and fake identities into shell company accounts, and separately procured fake driver's licenses that other couriers used to make deposits at major US banks.
Recent actions and the control lessons behind them.
UK Gambling Commission
Control failure:QuinnBet's manual age verification process allowed customers aged 18 to 24 to spend beyond deposit limits, and its harm detection systems missed a customer who placed roughly 4,800 bets in one day and 7,000 the next, plus a separate customer who staked over 215,000 pounds in a single day, none of it escalated the same day.
Lesson:A monitoring system that produces the right report a day late has the same practical effect as no monitoring system at all. Escalation speed is itself a control that needs testing, not just the existence of a report.
US Department of Justice, with the Drug Enforcement Administration and IRS Criminal Investigation
Control failure:Banks accepted cash deposits from couriers presenting fake driver's licenses into shell company accounts, alongside deposits made under couriers' real identities, without the pattern across more than 20 million dollars in deposits triggering a hold.
Lesson:Identity verification that only runs at account opening will not catch a courier depositing under someone else's name months later. Deposit pattern analysis across branches, not just a single teller check, is what closes this gap.
The Jianfei Lu case is a reminder that professional laundering does not need new technology to work, it needs a gap in an old control. Lu procured fake driver's licenses for couriers, who then used them to deposit drug trafficking proceeds into shell company accounts at major US banks, mixed in with deposits made under couriers' real identities. That combination, genuine identities and fake documents moving through the same account, is exactly what a document authentication or liveness check is built to catch, provided it runs on deposit activity tied to a shell company account, not only at account opening. For any institution still treating identity verification as a one time onboarding gate, this case is the argument for extending document and liveness checks to higher risk deposit activity after the account is already open.
Career & Skills Corner
This week's OFAC actions are good practice material. Before reading a law firm alert or a news summary, open the primary document yourself, the Treasury press release and the SDN list entry, and work through it: which executive order applies, which legal basis is cited, which individuals or entities are named, and what property is blocked. The Hizballah courier network designation is a good example, it names ten people and states plainly what each one did, from managing the network to collecting cash from exchange houses to acting purely as a courier. Practising on documents like that builds a skill no summary can hand you: the ability to judge, on your own, whether a designation actually touches your customer base or your correspondent relationships. Do this consistently and you become the person your team asks first, not the person who forwards the alert.
Next week I am watching how the wind down window under General License 12 gets applied to the Venezuela linked Bluwaves Properties designation, and I am tracking whether OFAC holds its pace on cartel related designations, already close to 30 actions against more than 300 individuals and entities since the start of 2025.
Turn this weekly intelligence into a career. Marco’s AML & Financial Crime course takes you from curious to hireable.
AML & Financial Crime course →