Money laundering is how illicit money, criminal proceeds or sanctions-evading value, is made to look legitimate. This explainer covers the mechanics documented by regulators and courts: the three classic stages, the FATF listing system and what it does to a country’s banking access, and the recurring typologies, shell companies, trade-based laundering, the oil shadow fleet, hawala, underground banking and crypto, with every named case drawn from official records.
What money laundering is: placement, layering, integration
Money laundering is the process of disguising the proceeds of crime so that they appear to come from legitimate sources. Regulators and investigators conventionally break it into three stages. Placement introduces illicit funds into the financial system, for example, depositing cash in amounts small enough to avoid reporting thresholds ("structuring"), running it through cash-intensive businesses, or buying assets. Layering then separates the money from its origin through chains of transactions: transfers among shell-company accounts, cross-border wires, currency exchanges, or conversion into goods, real estate, or crypto assets. Integration returns the value to its owner in apparently lawful form, such as business revenue, loan repayments, or proceeds from selling an asset. In practice the stages overlap, and modern schemes often combine several channels at once. The scale is genuinely unknown, and all headline figures are estimates: the UN Office on Drugs and Crime (UNODC) cites an estimated range of 2–5% of global GDP laundered annually, roughly $800 billion to $2 trillion, and a 2011 UNODC meta-study estimated that about $1.6 trillion, or 2.7% of global GDP, was laundered in 2009. UNODC itself stresses that the clandestine nature of laundering makes precise measurement impossible.
FATF: the blacklist, the greylist, and why they matter for banking access
The Financial Action Task Force (FATF) is the intergovernmental body, created by the G7 in 1989, that sets global anti-money-laundering and counter-terrorist-financing standards (the "40 Recommendations") and grades countries through peer "mutual evaluations." Three times a year it updates two public lists. The blacklist, formally "High-Risk Jurisdictions subject to a Call for Action", currently comprises Iran, North Korea, and Myanmar, unchanged at the June 2026 plenary. For Iran and North Korea, FATF calls on all countries to apply countermeasures; for Myanmar, enhanced due diligence. The greylist, "Jurisdictions under Increased Monitoring", names countries that have committed to fixing identified deficiencies; after the June 2026 plenary added Iraq and Bosnia and Herzegovina and removed Algeria and Namibia, it stood at 22 jurisdictions. The lists have no direct legal force, but banks and regulators worldwide build them into risk models. In practice, blacklisted countries are largely cut off from the formal international banking system, while greylisted countries face costlier compliance checks, slower cross-border payments, and reduced investor confidence. An IMF working paper using machine-learning methods estimated that greylisting is associated with an average decline in capital inflows of 7.6% of GDP, an estimate, though the direction of the effect is widely accepted.
Shell companies and nominee networks
A shell company is a legal entity with no significant operations of its own. Shells have lawful uses, holding assets, structuring investment, but they are also the basic building block of laundering because they let money move under a corporate name that reveals nothing about who controls it. Typical techniques include nominee directors and shareholders who stand in for the true owner, chains of companies spread across multiple secrecy jurisdictions, and layered ownership structures that make the beneficial owner expensive to trace. US enforcement actions involving sanctions evasion routinely feature shells, for example, the Cyprus-registered front company used to buy US microelectronics ultimately destined for Russia in the Petrov case described in the next section. Policy on corporate transparency has shifted. The Corporate Transparency Act of 2021 required most US companies to report their beneficial owners to FinCEN. In March 2025, however, FinCEN issued an interim final rule exempting all US-formed ("domestic") companies, leaving reporting obligations only for foreign companies registered to do business in the United States. The Government Accountability Office has since reported that the expanded exemptions leave gaps in the ownership information available to law enforcement.
Trade-based money laundering and transshipment: dual-use goods to Russia
Trade-based money laundering (TBML) disguises value transfers as ordinary commerce. Core techniques documented by FATF and the Egmont Group include over- and under-invoicing (mispricing goods so extra value moves with the shipment), multiple invoicing for a single shipment, misdescribing goods, and "phantom shipments" that are invoiced but never sent. The same trade infrastructure is used for sanctions evasion. Since Russia's February 2022 invasion of Ukraine, FinCEN and the Commerce Department's Bureau of Industry and Security (BIS) have issued joint alerts describing how restricted "dual-use" goods, semiconductors and other components with military applications, reach Russia through third-party intermediaries and transshipment hubs, with front companies in third countries listed as nominal end users. The alerts identify red flags and high-priority Harmonized System codes for banks to monitor in customer due diligence. Criminal cases document the pattern: in a Southern District of New York prosecution, Arthur Petrov, a Russian-German national extradited from Cyprus, was charged with buying export-controlled US microelectronics through a Cyprus shell company, telling US suppliers the parts were for fire-security systems in third countries, and routing them via Cyprus, Latvia, and Tajikistan to a Russia-based supplier of electronics for Russian weapons manufacturers.
The oil "shadow fleet": ship-to-ship transfers, flag hopping, ghost tankers
The "shadow fleet" (or "dark fleet") refers to tankers, often older ships with opaque ownership, frequently changing flags, and non-Western insurance, used to move sanctioned oil. A 2020 advisory from OFAC, the State Department, and the US Coast Guard documented the standard techniques: disabling or manipulating AIS transponders ("going dark"), ship-to-ship (STS) transfers at sea, often at night, to obscure a cargo's origin, falsified cargo documents, "flag hopping" between registries, and complex ownership and management structures. Iran's tanker network has used STS transfers with non-sanctioned vessels to disguise the Iranian origin of crude; Treasury reports having sanctioned more than 180 vessels for shipping Iranian petroleum since early 2025, largely under Executive Order 13902. For Russia, after the G7/EU price cap on seaborne Russian oil took effect in December 2022, a parallel fleet emerged to carry oil traded outside the cap. On January 10, 2025, OFAC designated 183 vessels in a single action, many identified as shadow-fleet ships flying flags such as Panama, Gabon, and the Cook Islands, alongside oil producers Gazprom Neft and Surgutneftegas, and identified 69 vessels of state shipping company Sovcomflot, itself designated in February 2024, as blocked property.
Hawala and informal value transfer
Hawala is an informal value transfer system (IVTS): a customer gives money to a broker (hawaladar) in one country, who instructs a counterpart broker in another country to pay the recipient, with no funds necessarily crossing the border. The brokers settle later through offsetting transfers, trade transactions, or cash. Similar systems operate worldwide under different names, hundi in South Asia, fei ch'ien in China, and the Black Market Peso Exchange in Latin America. A FinCEN report to Congress, required by Section 359 of the USA PATRIOT Act, found that such systems are used mostly for legitimate purposes, especially remittances to countries with limited banking access, but that their reliance on trust and minimal record-keeping also makes them attractive for laundering and terrorist financing. In the United States, hawala operators are "money services businesses": they must register with FinCEN, maintain anti-money-laundering programs, and report suspicious transactions, and operating without registration is a federal crime. FATF standards likewise require countries to register or license money or value transfer services. Enforcement remains difficult because ledgers are informal, settlement can occur through goods rather than money, and much of the activity takes place outside any regulated institution.
Underground banking and Chinese money laundering networks
US authorities have documented the growing role of Chinese money laundering networks (CMLNs), sometimes called Chinese underground banking, as launderers for drug cartels. The mechanism connects two demands: Mexico-based cartels hold bulk US cash they need converted, and Chinese nationals who want to move wealth abroad face China's strict currency controls. In a typical "mirror transaction," a broker buys cartel cash at a discount and sells the dollars in the United States to Chinese buyers, who pay the broker's network in renminbi inside China, no money crosses either border. The cash is then placed through money mules, structured deposits, front businesses, real estate purchases, and trade-based schemes. In Operation Fortune Runner, a federal indictment unsealed in June 2024 charged 24 defendants in Los Angeles with laundering more than $50 million in Sinaloa cartel drug proceeds through a money-transmitting network linked to Chinese underground banking; several fugitives were later arrested in China and Mexico. In August 2025, FinCEN issued advisory FIN-2025-A003 with an accompanying trend analysis: between 2020 and 2024, financial institutions filed 137,153 Bank Secrecy Act reports flagging roughly $312 billion in suspicious transactions potentially tied to CMLNs, a figure that measures reported suspicious activity, not adjudicated laundering.
Crypto: Tornado Cash, Garantex, and documented illicit use
Crypto assets add speed and pseudonymity to the layering stage, and enforcement here is unusually well documented. Tornado Cash, an Ethereum "mixer" that pools deposits to break the on-chain link between sender and recipient, was designated by OFAC in August 2022; Treasury alleged it had processed over $7 billion in virtual currency since 2019, including about $455 million stolen by North Korea's Lazarus Group in the Ronin bridge hack. In November 2024, the Fifth Circuit held that the protocol's immutable smart contracts were not sanctionable "property" under IEEPA, and Treasury delisted Tornado Cash on March 21, 2025. Developer Roman Storm was nonetheless convicted in August 2025 of conspiring to operate an unlicensed money-transmitting business; the jury deadlocked on money-laundering and sanctions-violation counts. Garantex, a Russia-based exchange first sanctioned in April 2022, was the subject of a March 2025 international action: the US Secret Service, with German and Finnish authorities, seized its infrastructure and froze over $26 million, and DOJ indicted two of its operators. Treasury states that Garantex processed more than $100 million in transactions linked to ransomware and other illicit actors since 2019. Its customers then migrated to a successor exchange, Grinex, which OFAC designated in August 2025 along with executives and affiliated companies in Russia and Kyrgyzstan.
The compliance side: KYC/AML obligations, FinCEN advisories, and de-risking
The counter-laundering system rests on obligations placed on financial institutions. Under the Bank Secrecy Act and the USA PATRIOT Act, US institutions must run risk-based anti-money-laundering programs, verify customer identity (know-your-customer and customer identification rules), identify beneficial owners of legal-entity customers, file currency transaction reports for cash movements above $10,000, and file suspicious activity reports (SARs), the raw material behind many of the cases described above. FinCEN steers this reporting through advisories and alerts that describe current typologies, list red flags, and assign SAR "key terms" so analysts can locate related filings; the Russia export-control alerts issued with BIS and the 2025 Chinese money laundering network advisory are examples. The system also has documented costs. "De-risking" occurs when institutions drop entire categories of customers rather than manage their individual risk. Treasury's 2023 De-Risking Strategy, mandated by the Anti-Money Laundering Act of 2020, found that profitability and compliance costs were primary drivers, and identified the most affected groups: money services businesses, nonprofits operating in high-risk jurisdictions, and small foreign banks losing correspondent accounts. The number of correspondent banking relationships has declined for years even as payment volumes grow, a trend Treasury warns can push transactions into less transparent, harder-to-monitor channels.
About this explainer
This explainer is descriptive, not evaluative: it explains how the machinery works, drawing on official and primary sources, every section links to the documents it relies on. Factual claims, list memberships, case figures and legal citations were independently re-checked against those sources before publication. It is part of the Sanctions and Money Laundering Studies program, which also maintains a verified, year-by-year catalog of major sanctions on Russia, China and Iran.