FinCrime Intelligence Weekly
OFAC sanctions a 24 billion dollar scam marketplace, Europol dismantles the Dubai Bank network, FinCEN targets Iran aviation front companies, and the UK ranks crypto its third crime priority.
Marco’s Take
Marco Beranzoni
This week’s five stories share something I almost missed on first read: none of them involve someone misusing an ordinary bank account. Every one involves infrastructure built specifically to serve crime.
Xinbi Guarantee, sanctioned by the United States this week, was not a marketplace that criminals happened to find. It was built to service Southeast Asia’s scam economy, with stolen data, fake identity documents, and deepfake tools on offer alongside cash-out services. Spain’s Operation DRAKKAR dismantled a similar build: the “Dubai Bank” network moved drug money across borders through brokers and internal ledgers, not banks. North Korea’s IT worker scheme runs on ordinary freelance platforms and stablecoins as a state-run wage laundering pipeline. Iran’s aviation procurement front companies exist to defeat export controls, nothing else. Even the UK’s National Economic Crime Centre annual report, ranking cryptoassets third among nine economic crime priorities, reads as an admission that crypto has become infrastructure criminals build around, not a channel they stumble into.
The uncomfortable task for this week: pull up your last three typology reviews and check whether you were looking for bad transactions or for the network each transaction sits inside. If it was the former, you are behind where enforcement already is.
See you next Monday.
Marco
OFAC's sanctions freeze $52.8 million in crypto tied to a marketplace that armed Southeast Asia scam syndicates with fake IDs, deepfake tools, and cash out services.
FinCEN's September 8 alert exposes front companies moving US aircraft parts to Iran, alongside new Treasury sanctions on 36 aviation-linked entities.
Europol confirmed on September 8 that Spanish police dismantled the Dubai Bank underground banking network, arresting 21 suspects and identifying EUR 20 million in criminal assets.
The National Economic Crime Centre's 2026 report ranks cryptoassets above criminal cash and money mules, citing innovative laundering tactics.
A DC federal judge ordered forfeiture of a wallet holding $212,700 in stablecoins, part of a Department of Justice case seeking $7.74 million tied to North Korea's overseas IT worker scheme.
What changed this week, why it matters, and what to do about it.
| Region | Update | Why it matters | Action |
|---|---|---|---|
| EU | AMLA (EU Anti-Money Laundering Authority) held two public hearings this week on draft technical standards, one on 9 September on suspicious activity reporting formats and one on 10 September on harmonised money laundering and terrorism financing risk assessments for the non-financial sector. | These standards will set how every EU member state supervisor assesses risk for non-financial businesses and professionals, such as lawyers, accountants, and real estate agents, once adopted. | If your firm sits in the non-financial sector, or advises one, review AMLA's hearing materials now, while the standards are still in draft. |
| US | FinCEN, the US Financial Crimes Enforcement Network, issued Alert FIN-2026-Alert006 on Iran's aviation procurement networks and asked filers to enter the exact key term "FIN-2026-IRANAIR" in the narrative of any related Suspicious Activity Report (SAR). | A missing or mistyped key term means a filing will not be grouped with the rest of the Iran aviation case set, which slows analysis on both sides. | Update your SAR filing templates and frontline guidance now, so staff enter the exact key term on any matching filing. |
| Global | Telegram removed Xinbi Guarantee from its platform on 9 September 2026, the same day the US Treasury designated the marketplace under sanctions administered by the Office of Foreign Assets Control (OFAC). | A platform ban stops new recruitment through that specific channel, but it does not freeze the wallets, vendors, or off platform payment rails the network already built. Exposure does not end when a platform ban happens. It moves. | Do not close monitoring on Xinbi linked wallets and counterparties just because the platform banned the marketplace. Keep screening against the designated entities and wallet addresses named in the OFAC action. |
AMLA (EU Anti-Money Laundering Authority) held two public hearings this week on draft technical standards, one on 9 September on suspicious activity reporting formats and one on 10 September on harmonised money laundering and terrorism financing risk assessments for the non-financial sector.
Why it matters:These standards will set how every EU member state supervisor assesses risk for non-financial businesses and professionals, such as lawyers, accountants, and real estate agents, once adopted.
Action:If your firm sits in the non-financial sector, or advises one, review AMLA's hearing materials now, while the standards are still in draft.
FinCEN, the US Financial Crimes Enforcement Network, issued Alert FIN-2026-Alert006 on Iran's aviation procurement networks and asked filers to enter the exact key term "FIN-2026-IRANAIR" in the narrative of any related Suspicious Activity Report (SAR).
Why it matters:A missing or mistyped key term means a filing will not be grouped with the rest of the Iran aviation case set, which slows analysis on both sides.
Action:Update your SAR filing templates and frontline guidance now, so staff enter the exact key term on any matching filing.
Telegram removed Xinbi Guarantee from its platform on 9 September 2026, the same day the US Treasury designated the marketplace under sanctions administered by the Office of Foreign Assets Control (OFAC).
Why it matters:A platform ban stops new recruitment through that specific channel, but it does not freeze the wallets, vendors, or off platform payment rails the network already built. Exposure does not end when a platform ban happens. It moves.
Action:Do not close monitoring on Xinbi linked wallets and counterparties just because the platform banned the marketplace. Keep screening against the designated entities and wallet addresses named in the OFAC action.
Typology of the week
Underground banking networks like this one move value without ever moving money across a border. A person who owes funds in one country pays a local broker in cash or crypto. The network's broker in the destination country pays out an equivalent amount to the intended recipient, minus a commission. No wire ever crosses the border. The network settles its internal balances later, often through trade invoices, property purchases, or cash pooling, and keeps its own private ledger of who owes whom. Clients never see a bank statement because there is no bank. The service is available to any client willing to pay the commission, drug trafficking organisations included.
Example
Operation DRAKKAR, led by Spain's National Police, arrested 21 suspects on 22 July 2026 tied to a network known as Dubai Bank, which offered commission based, off book value transfer to drug trafficking organisations worldwide. Investigators seized EUR 20 million in assets, including 48 properties, vehicles, and 121 bank accounts. The case began from a 2021 cocaine seizure investigation and led to international arrest warrants executed in the United Arab Emirates, Egypt, and the Netherlands.
Recent actions and the control lessons behind them.
US Department of Justice, District of Puerto Rico
Control failure:An internal employee, not an external fraudster, was able to eliminate tax bills owed by individuals and businesses in exchange for bribes, repeatedly, over time. Alexander Ortiz-Robles is the third Hacienda employee to plead guilty to a bribery or fraud scheme within three months, which points to a gap in how tax adjustments get approved and reviewed, not an isolated case.
Lesson:A single conviction can look like an isolated case. Three convictions from the same agency within three months, with total losses exceeding $14 million, is a pattern. When internal fraud recurs inside one unit, look at the approval workflow itself, not just the individual.
Vendors on the sanctioned Xinbi Guarantee marketplace sold stolen data, fake identity documents, and deepfake tools alongside cash out services, according to the US Treasury's designation. If your onboarding relies on a selfie match against a submitted identity document, treat that combination as a single control, not two independent ones. Test it against the kind of synthetic document and video a marketplace like this is built to supply, not just a stock demo deepfake.
A US court ordered forfeiture of a crypto wallet holding $212,700 in stablecoins traced to wages earned by at least 14 North Korean IT workers, part of a broader $7.74 million Department of Justice forfeiture action. If your platform pays remote developers or freelancers in stablecoins, screen for the pattern behind this case: one identity behind multiple freelance profiles, wages routed to a small number of wallets, and payout timing that does not match your normal freelancer base.
Career & Skills Corner
Every story in this issue involves an enforcement team that mapped a network, whether brokers, front companies, wallet clusters, or freelance profiles, before making an arrest or freezing an asset. That is not how most compliance analysts are trained. Most of us learn to review one transaction, one alert, one account at a time. Link analysis and network mapping are different skills: reading a graph of accounts and counterparties, spotting the same phone number or address behind different names, and asking who benefits when several accounts move together rather than what one account did on one day. If your current role is mostly single alert review, ask your manager for exposure to whatever link analysis or case management tool your team already owns. Even a spreadsheet with a pivot table counts as a start. The practitioners moving into senior investigation and typology roles are the ones who can already read a network, not just clear a queue.
Next week I am watching whether the court grants DOJ's request to restrain the other 47 wallets tied to Xinbi Guarantee, and whether the network resurfaces under a new name now that Telegram has banned it. I will also be reading AMLA's follow up once the two draft technical standards move toward a final version.
Turn this weekly intelligence into a career. Marco’s AML & Financial Crime course takes you from curious to hireable.
AML & Financial Crime course →