Scroll Top

How to Investigate Money Laundering

Image: Shutterstock

Most of the crim­i­nals I inves­ti­gat­ed over the past two decades could have been some of the world’s best entre­pre­neurs. They had what it takes: resource­ful­ness, cre­ativ­i­ty, fast think­ing, moti­va­tion, the abil­i­ty to net­work and lead, and an obvi­ous if uncan­ny attrac­tion to risk. Many of them could have been on par with the Elon Musks of the legit­i­mate busi­ness world, but they chose crime instead and their skill sets made them into some of the most dan­ger­ous and tox­ic peo­ple on the planet.

They think big and their busi­ness plans are sim­ple: “more vic­tims, more mon­ey.” And their life is made eas­i­er by the fact that most high-lev­el crim­i­nals oper­ate with impuni­ty at a con­ti­nen­tal or even glob­al scale, where they have no nat­ur­al ene­my because law enforce­ment is gen­er­al­ly con­fined by nation­al bor­ders and nation­al interests.

Part One: How It Works

The Financial Blueprints of Crime

Because of the com­pli­ca­tions aris­ing from transna­tion­al crim­i­nal enter­pris­es, the fight against orga­nized crime is most­ly left to jour­nal­ists and activists, who can net­work across bor­ders and work in the pub­lic inter­est. But news orga­ni­za­tions will­ing to take on one of the most pow­er­ful threats on the plan­et are lim­it­ed in num­ber and typ­i­cal­ly under resourced. The good news is inves­tiga­tive reporters have real­ized with the advent of cross-bor­der col­lab­o­ra­tions that crime is, in many respects, a com­mod­i­ty and it fol­lows gen­er­al pat­terns mak­ing it eas­i­er to iden­ti­fy and expose. In short, if a crim­i­nal scheme works in a coun­try or across a region, the same crim­i­nal mod­el will be export­ed else­where in the world. It is the crim­i­nal blue­print and its ele­ments that need to be under­stood to effi­cient­ly fol­low the mon­ey and stop crim­i­nals from doing busi­ness as usual.

We have to under­stand our adver­sary to effi­cient­ly inves­ti­gate and reveal its ille­gal activ­i­ties. So, let’s first go through some of the main instru­ments used by crim­i­nals to steal, hide, and invest their mon­ey. Then, in the sec­ond part, we’ll look at some of the best tools and ideas of our own to inves­ti­gate and expose.

Criminals, both the ones just start­ing out as well as those who are already well estab­lished, have at their dis­pos­al region­al and glob­al infra­struc­ture that is con­tin­u­ous­ly built and main­tained by what we at the Organized Crime and Corruption Reporting Project (OCCRP) call the “crim­i­nal ser­vices indus­try.” This infra­struc­ture entails scores of lawyers, bankers, accoun­tants, com­pa­ny for­ma­tion agents, hack­ers, rep­u­ta­tion man­age­ment com­pa­nies, and many oth­ers who make mon­ey by enabling the crime and by help­ing the crim­i­nals invest their ill-got­ten mon­ey. So, what are the main ele­ments of a crime on the mon­ey side?

Offshore-Type Companies

A lot has been writ­ten about the off­shore finan­cial indus­try and the secre­tive com­pa­nies that allow crim­i­nals to covert­ly steal and move large amounts of mon­ey across juris­dic­tions. Projects such as Offshore Crime, Inc.Panama Papers, and oth­ers brought this illic­it mon­ey-laun­der­ing indus­try into the spot­light, and sub­se­quent large col­lab­o­ra­tions such as OCCRP’s ongo­ing OpenLux project have high­light­ed that many land­locked coun­tries such as Luxembourg pro­vide or pro­vid­ed the same lev­el of secre­cy as the more tra­di­tion­al off­shore loca­tions. Understanding how crim­i­nals struc­ture their busi­ness­es and iden­ti­fy­ing the errors they make or were forced to make is cru­cial when inves­ti­gat­ing high-lev­el orga­nized crime and corruption.


Organized crime needs to hide behind oth­er iden­ti­ties — prox­ies —so the off­shore com­pa­nies can pro­vide the required secre­cy for their trans­ac­tions. During our inves­tiga­tive work at OCCRP, we’ve iden­ti­fied three main types of prox­ies: unaware, semi-aware, and ful­ly com­plic­it proxies.

Unaware prox­ies are peo­ple whose iden­ti­ties have been stolen (some­times via large-scale infor­ma­tion theft from inter­net ser­vice providers) and who have no idea that their name is being used to form a com­pa­ny or set up a bank account. Semi-aware prox­ies lend their iden­ti­ty doc­u­ments in return for small amounts of mon­ey, but with­out being aware of the true extent of the crim­i­nal­i­ty of the busi­ness­es or trans­ac­tions tied to their name. Complicit prox­ies, as the name implies, are ful­ly cog­nizant of the crim­i­nal schemes that they are abet­ting and get a chunk of the prof­its. Knowing what type of proxy is involved in a crim­i­nal scheme can deter­mine what steps need to be tak­en by the inves­tiga­tive reporter try­ing to expose it.

Image: Jefferson Santos on Unsplash


Despite the recent rise of inno­v­a­tive prod­ucts in the finan­cial sec­tor, such as cryp­tocur­ren­cies, banks remain a crit­i­cal part of the world’s finan­cial sys­tems. They are nat­ur­al tar­gets for orga­nized crime groups, who seek to insert them­selves and take advan­tage of the bank­ing sec­tor in var­i­ous ways. As in the case of prox­ies, some banks are ful­ly com­plic­it, some are unaware, and some seem unpre­pared and per­haps unwill­ing to halt the crim­i­nal funds flow­ing through their accounts.

The bank­ing sys­tem is made of a myr­i­ad of small, medi­um, and large banks and their sub­sidiaries. It is impor­tant to point out that small banks can only join the glob­al finan­cial sys­tem if they open up what are called cor­re­spond­ing bank accounts with larg­er banks, which ensure access to world­wide wire trans­fers. We’ve inves­ti­gat­ed many small and even medi­um-sized banks that were ful­ly or par­tial­ly owned and oper­at­ed by crim­i­nals, but they still relied upon the largest banks in the world to send and receive vast amounts of dirty mon­ey. Smart crim­i­nals real­ized a long time ago that, much like law enforce­ment agen­cies are often tripped up by juris­dic­tion­al con­straints, coop­er­a­tion is also lack­ing between banks and that the finan­cial com­pli­ance sys­tems are geared towards iden­ti­fy­ing indi­vid­ual or small batch­es of sus­pi­cious trans­ac­tions. The FinCENFiles made clear how banks can fail to iden­ti­fy high-vol­ume mon­ey laun­der­ing. Criminals used this to their advan­tage by split­ting large vol­umes of mon­ey between numer­ous banks and bank accounts, so no one bank would have a clear pic­ture of their mas­sive, mon­ey laun­der­ing operations.

Fake Contracts and Invoices

To exe­cute wide­spread mon­ey laun­der­ing schemes, crim­i­nals use forged paper­work, fake con­tracts, and invoic­es that are attached to the bank­ing trans­ac­tion as jus­ti­fi­ca­tion. These fic­ti­tious invoic­es cer­ti­fy on paper that a car­go of, say, per­son­al com­put­ers was sold from off­shore com­pa­ny A to off­shore com­pa­ny B. But, in fact, no real trade has tak­en place, even as the mon­ey trav­els between bank accounts. This illic­it prac­tice is called trade-based mon­ey laun­der­ing and it might account for the biggest chunk of this type of finan­cial crime world­wide. It’s obvi­ous­ly impos­si­ble for a bank­ing com­pli­ance offi­cer to check the con­tents of every ship­ping con­tain­er asso­ci­at­ed with a finan­cial trans­ac­tion — and orga­nized crime counts on that.

In oth­er instances, fake paper­work attached to bank­ing trans­ac­tions cer­ti­fies fic­ti­tious loans and ser­vices with the same results.

The secret to effi­cient mon­ey laun­der­ing involves offer­ing these four com­po­nents as a full pack­age to crim­i­nal groups and cor­rupt politi­cians. In fact, the crim­i­nal ser­vices indus­try even issues fraud man­u­als — sets of instruc­tions on how to deploy com­pa­nies, bank accounts, prox­ies, and fake invoic­es with­out trig­ger­ing scruti­ny from bank­ing reg­u­la­tors or law enforce­ment. This is an exam­ple of what one of these mon­ey laun­der­ing man­u­als pro­mot­ed by a bank in Latvia and uncov­ered by OCCRP — was advis­ing clients to do:

The deliv­ery con­di­tions spec­i­fied in the con­tract or invoice should be real­is­tic: When you spec­i­fy goods, you have to think how they are going to be ‘shipped’ (weight of the car­go, vol­umes, address of the man­u­fac­tur­ing plant, type of trans­port: road, rail, or ship.) In the case of ‘ship­ping’ of goods with very large vol­ume or size, please spec­i­fy a fac­to­ry close to rail­road or port.”

At OCCRP we call these turnkey mon­ey laun­der­ing sys­tems “laun­dro­mats.” They act like all-pur­pose finan­cial vehi­cles and are typ­i­cal­ly set up by a bank or oth­er finan­cial ser­vices com­pa­ny with the intent of help­ing clients laun­der the pro­ceeds of crime, hide own­er­ship of assets, embez­zle funds from com­pa­nies, evade tax­es and cur­ren­cy restric­tions, or move mon­ey off­shore. OCCRP coined the term in 2014 with its inves­ti­ga­tion “The Russian Laundromat.”

A laun­dro­mat is the finan­cial-world equiv­a­lent of the TOR net­work brows­er, which pro­vides users com­plete anonymi­ty on the inter­net. Laundromats allow peo­ple to split laun­dered mon­ey among dif­fer­ent banks so that, much like with TOR, secre­cy is pre­served because no sin­gle insti­tu­tion has a full pic­ture of what is going on.

Laundromats are made up of com­pa­nies scat­tered across the world that appear inde­pen­dent but are actu­al­ly con­trolled by a sin­gle par­ty — usu­al­ly the bank. The laun­der­ing process begins when a client wires mon­ey to a node in the net­work, often using fake paper­work show­ing a good or ser­vice being bought or sold. From there, the money’s parceled out to the oth­er nodes, accom­pa­nied by more bogus paper­work. Eventually, the mon­ey is sent to an off­shore com­pa­ny or oth­er des­ti­na­tion cho­sen by the client (minus a com­mis­sion for the laundromat’s oper­a­tors). The own­er­ship and ori­gin of the mon­ey is lost in the dizzy­ing num­ber of trans­ac­tions, ren­der­ing it near­ly untrace­able, even by law enforce­ment. (For more on how this works, check out OCCRP’s laun­dro­mat FAQ.)

A clear exam­ple of how laun­dro­mats can evade scruti­ny by some of the largest banks in the world was evi­dent in a leaked, inter­nal Deutsche Bank doc­u­ment, which details the bank’s fail­ure to detect the Russian Laundromat that manip­u­lat­ed its glob­al finan­cial infrastructure.

Internal Deutsche Bank slide, leaked to OCCRP, describ­ing how the bank was an unwit­ting part­ner to a mas­sive Russian mon­ey laun­der­ing scheme. Image: Screenshot

There are many exam­ples of how orga­nized crime manip­u­lates the finan­cial sys­tems of the world. Though the fol­low­ing are three exam­ples from three dif­fer­ent geo­graph­i­cal regions, the pat­tern repeats itself and involves all or a small­er sub­set of the ele­ments of the Russian Laundromat con­spir­a­cy above.

The Azerbaijani Laundromat and Iran’s Anti-sanc­tion ‘Economic Jihad’

The Azerbaijani Laundromat pri­mar­i­ly allowed the elites in Baku, Azerbaijan, to bribe European politi­cians and to siphon hun­dreds of mil­lions out of the coun­try. But OCCRP dis­cov­ered that this mon­ey laun­der­ing machine was also used by Iran to bypass US and European sanc­tions thanks to the help of an orga­nized crime group led by Reza Zarrab, an Iranian-Turkish crim­i­nal very close to the Turkish President Recep Tayyip Erdogan. The mon­ey laun­der­ing con­duct­ed by Zarrab had all the clas­sic ele­ments enu­mer­at­ed above and turned into a grow­ing geopo­lit­i­cal scan­dal between Turkey, the US, and Iran — and shows how orga­nized crime thrives in times of unrest and can exploit polit­i­cal divisions.

The Troika Laundromat

The Troika Laundromat com­prised a com­plex finan­cial sys­tem that allowed Russian oli­garchs and politi­cians in the high­est ech­e­lons of pow­er to secret­ly invest their ill-got­ten mil­lions, evade tax­es, acquire shares in state-owned com­pa­nies, buy real estate in Russia and abroad, and much more. The Troika Laundromat was designed to hide the peo­ple behind these trans­ac­tions and was dis­cov­ered by OCCRP and its part­ners through care­ful data analy­sis and thor­ough inves­tiga­tive work. The inves­ti­ga­tion involved one of the largest releas­es of bank­ing infor­ma­tion, some 1.3 mil­lion leaked trans­ac­tions from 238,000 com­pa­nies. To see a video explain­er of the scheme, click here.

The Troika Laundromat exposé was born out of data work done on a large set of very dry bank­ing trans­ac­tions. We had to look for pat­terns in order to iden­ti­fy and iso­late trans­ac­tions that stemmed from what we lat­er defined as the Troika Laundromat. We had to look for the errors, the bad links, in order to iden­ti­fy who was the orga­niz­er and who were the users of the sys­tem. Through care­ful data analy­sis, we final­ly found out that the bankers putting this togeth­er made a small, but fatal, mis­take: they con­sis­tent­ly reused just three shell com­pa­nies to make pay­ments to for­ma­tion agents in order to set up dozens of oth­er off­shore com­pa­nies that were them­selves involved in trans­act­ing bil­lions of dol­lars. These pay­ments, which were only in the hun­dreds of dol­lars each, were of course lost in a sea of mil­lions of much larg­er trans­ac­tions, so we had to find them and trace them back to rec­og­nize they were part of a larg­er pat­tern. The whole Troika Laundromat came in focus after iden­ti­fy­ing this com­mon thread.

Riviera Maya Gang

The Riviera Maya Gang (RMG) was a ruth­less and vio­lent cross-bor­der orga­ni­za­tion, and this case offers a clear exam­ple of how orga­nized crime scales up and into dif­fer­ent busi­ness­es. The ban­dits in this case start­ed small in Europe as skim­mers — peo­ple who steal deb­it and cred­it card num­bers by implant­i­ng ille­gal devices or soft­ware into ATMs. Crossing con­ti­nents, they then part­nered up with a Mexican bank and man­aged to install more than 100 ATMs on the Riviera Maya — the tourist area between Cancun and Tulum in south­ern Mexico — gen­er­at­ing more than $200 mil­lion a year in crim­i­nal gains. The RMG used fake doc­u­ments, fake iden­ti­ties, and prox­ies not just to build their busi­ness, but also to offer shel­ter to fugi­tives from jus­tice while using the same infra­struc­ture to smug­gle peo­ple from Mexico into the United States.

Part Two: How to Untangle It—Tips & Tools

As seen in the exam­ples above, orga­nized crime groups can be quite sophis­ti­cat­ed when steal­ing, hid­ing, and invest­ing their mon­ey. But one thing they can­not con­trol is time. And with each pass­ing day, jour­nal­ists, activists, and oth­er inves­ti­ga­tors are gar­ner­ing more transna­tion­al report­ing expe­ri­ence while gov­ern­ments around the world imple­ment more rules about trans­paren­cy, com­pa­ny own­er­ship, and property.

Banking and Court Records

Access to bank records is the Holy Grail when inves­ti­gat­ing orga­nized crime financ­ing, but bank­ing records are dif­fi­cult to obtain because they are con­fi­den­tial, pri­vate doc­u­ments. Reporters can’t always count on leaks and whistle­blow­ers inside of banks and finan­cial reg­u­la­tors to hand over records. But there is anoth­er way to get bank­ing records. These types of doc­u­ments are often attached to crim­i­nal court cas­es against orga­nized crime or even to com­mer­cial, civ­il lit­i­ga­tion. It all depends on the juris­dic­tion, and the US is a pro­lif­ic source for glob­al bank­ing records that become pub­lic on the Public Access to Court Electronic Records (PACER) service.

For exam­ple, OCCRP obtained hun­dreds of thou­sands of bank­ing records by check­ing PACER and fil­ing free­dom of infor­ma­tion requests with US courts after that coun­try opened a legal case against the Azerbaijani Laundromat king­pin, Reza Zarrab. Previously, we obtained sim­i­lar records from courts in oth­er parts of the world. These bank­ing records are often sub­poe­naed in bulk by law enforce­ment agen­cies and are a boon for inves­tiga­tive reporters who can get hold of them.

Leaked sus­pi­cious activ­i­ty reports (SAR) from finan­cial insti­tu­tions, like those obtained in the FinCENFiles inves­ti­ga­tion, can also offer a glimpse into the world of bank­ing secre­cy. Leaks will only grow in qual­i­ty and quan­ti­ty, and if used in con­junc­tion with court records, they can be extreme­ly valu­able to inves­tiga­tive reporters and the pub­lic they serve.

Court records and espe­cial­ly com­mer­cial lit­i­ga­tion between two crim­i­nal par­ties are also very use­ful to inves­ti­ga­tors as crim­i­nals get to laun­der their dirty clothes in pub­lic, as are divorce cases.

Property Records

Criminals like to own things and while the lux­u­ry car, watch, or oth­er bling‑y items are a must for many, the ill-got­ten gains gen­er­at­ed by orga­nized crime often end up invest­ed in real estates, like lux­u­ry man­sions, or vast agri­cul­tur­al and for­est lands. Investigative reporters should increase their focus on prop­er­ty records to untan­gle the invest­ments and the scale of mon­ey laun­der­ing on the side of orga­nized crime. In most coun­tries, prop­er­ty doc­u­ments are pub­lic records and will show the cur­rent own­er, pre­vi­ous own­ers, as well as some finan­cial details like the pur­chase price and taxes.

Company Records

National and inter­na­tion­al reg­istries of com­pa­nies can pro­vide infor­ma­tion not only about share­hold­ers and board mem­bers, but in many cas­es also con­tain a company’s finan­cial data. On rare occa­sions, these records also reveal bank­ing trans­ac­tions, prop­er­ty records, and even gran­u­lar infor­ma­tion or ben­e­fi­cial own­er­ship infor­ma­tion about off­shore-type com­pa­nies that might be share­hold­ers. Quite often we get infor­ma­tion about a ben­e­fi­cial own­er through reg­istries of com­pa­nies or prop­er­ty in places where these com­pa­nies invest their illic­it funds. Also, keep in mind that not all infor­ma­tion is dig­i­tized and indexed in data­bas­es, so a trip or a phone call to the reg­istry might give you access to a lot more data than what is avail­able online.

An impor­tant stage in expos­ing high-lev­el mon­ey laun­der­ing is expos­ing the ben­e­fi­cial own­er­ship of banks. Treat banks like any com­mer­cial com­pa­ny and try to find out who owns them. This is espe­cial­ly impor­tant in the case of new­ly formed, small- and medi­um-sized banks.

Import-Export Databases

Frequently, we use data­bas­es such as ImportGenius or Panjiva to track down import-export oper­a­tions. These are expen­sive data­bas­es — down­load­ing one year of a company’s US import data from ImportGenius costs $199 — but they can be help­ful to iden­ti­fy trade-based mon­ey laun­der­ing and the com­pa­nies involved with it. We have used these data­bas­es to con­firm if com­pa­nies involved with the laun­dro­mats were also involved in oth­er pho­ny com­mer­cial oper­a­tions. Of note: In many coun­tries, the annu­al import-export trans­ac­tions are avail­able via nation­al free­dom-of-infor­ma­tion laws, while the United Nations Comtrade site offers use­ful glob­al trade data where import-export pat­terns can be identified.


At OCCRP, we built a glob­al archive of research mate­r­i­al for inves­tiga­tive report­ing called Aleph. Here, we index infor­ma­tion on com­pa­nies, prop­er­ty, bank accounts, court cas­es, leaks, and many oth­er enti­ties. But the index­ing is just the begin­ning, as Aleph allows jour­nal­ists to make sense of data and to iden­ti­fy the crim­i­nal pat­terns that are crit­i­cal for start­ing a mean­ing­ful inves­ti­ga­tion in the pub­lic inter­est. Journalists can also keep per­son-of-inter­est watch­lists inside Aleph and our sys­tem will con­tin­u­ous­ly match the names in the lists against the oth­er data con­tained with­in the sys­tem. This auto­mates our work­flow and helps ignite fresh and use­ful inves­tiga­tive reporting.

The OCCRP has devel­oped Aleph, a use­ful resource that allows inves­tiga­tive jour­nal­ists to search for pub­lic records and leaks. Image: Screenshot

What Does the Future Hold?

For the past few decades, transna­tion­al orga­nized crime was many steps ahead of law enforce­ment, inves­tiga­tive reporters, and activists. Things start­ed to change slow­ly with jour­nal­ists join­ing forces across bor­ders, but crim­i­nals still enjoy an advan­tage thanks to the huge resources at their dis­pos­al and because they are ear­ly adopters of new tech­nol­o­gy that allows them to stay one step ahead of law enforcement.

One group often over­looked are so called crim­i­nal angel investors, peo­ple who finance oth­er crim­i­nals because the return on invest­ment is great and crime brings more oppor­tu­ni­ty to peo­ple used to this lifestyle. Investigative reporters need to bet­ter under­stand the finan­cial ecosys­tem built around crime, where the crim­i­nal ser­vices indus­try thrives and devel­ops new mon­ey laun­der­ing and covert invest­ment techniques.

To keep up with orga­nized crime’s evolv­ing tech­niques, inves­tiga­tive jour­nal­ism orga­ni­za­tions should invest time and mon­ey under­stand­ing cryp­tocur­ren­cies, blockchain, non-fun­gi­ble tokens (NFTs) and any oth­er new tools of the trade crim­i­nals have adopt­ed for their busi­ness models.

Follow the mon­ey” will soon become “fol­low the code” (as in an algo­rithm), but in the end, it all takes a phys­i­cal form in the shape of prop­er­ty and the vis­i­ble lifestyle that crime brings with it.

Paul Radu is co-founder and chief of inno­va­tion at OCCRP. He found­ed the orga­ni­za­tion in 2007 with Drew Sullivan. He leads OCCRP’s major inves­tiga­tive projects, scopes region­al expan­sion, and devel­ops new strate­gies and tech­nol­o­gy to expose orga­nized crime and cor­rup­tion across borders.

Editor’s Note: For the next sev­er­al months, GIJN is run­ning a series drawn from our forth­com­ing Reporter’s Guide to Investigating Organized Crime, which will debut in full in November at the Global Investigative Journalism Conference. This sec­tion, which focus­es on mon­ey laun­der­ing, was writ­ten by Paul Radu, co-founder of the Organized Crime and Corruption Reporting Project. For those inter­est­ed in more tips and tools on cov­er­ing mon­ey laun­der­ing, check out GIJN’s two-part “Investigating Company Finances” webi­nar, host­ed by Finance Uncovered’s Nick Mathiason.

Original source of article :‑re­porters-guide-how-to-inves­ti­gate-orga­nized-crimes-finances