Turning Compliance Theatre into Real Control

Written by Quentin Mugg & Mariola Marzouk

On a Sunday night, a man takes delivery of a sports bag in a restaurant car park east of Paris, and drives off. An hour later he calls his boss abroad. The call runs under a minute. “All good, I’m in Paris, there are 110.” A beat. “80 of it is garbage.” The boss already has a buyer for the cheaper kind, one who took 40 last time; he tells the man to knock 50 off, hold the rest, keep 10 for himself. Then, before hanging up: “the car is in the garage.” The money is safe.

The exchange reveals more than a successful pickup. “Garbage” refers to small-denomination notes, which are bulkier, slower, and more expensive to handle; but the more important point is that the cash has already been priced, segmented, and matched to onward demand. By the time the call is made, the money is no longer being treated as the proceeds of a drug sale waiting to be laundered by the trafficker who generated it. It has become inventory in a secondary market. What matters is how quickly that change occurs. In many large-scale cases, the decisive transfer takes place at the collection, often only hours from the first contact between the drug trafficker and the money broker, and rarely more than a day. Once the cash is handed over, it ceases to be the trafficker’s problem and becomes the broker’s inventory. This article calls that interval the twenty-four-hour window.

The distinction matters because it unsettles one of the most persistent assumptions in anti-money laundering analysis: that drug traffickers typically direct and control the laundering structures that follow their sales. The operational record suggests something else. In many large-scale cases, they do not launder the proceeds themselves. They sell the problem to someone else, and they do so fast.

It is fair to ask whether this picture is simply an artefact of investigative visibility. The objection deserves to be taken seriously, but it does not fit the wider pattern. If large trafficking organisations routinely laundered their own proceeds through trade, one would expect that activity to appear more prominently in the documentary channels that trade generates: invoices, shipments, company accounts, customs records, and banking touchpoints. Yet what repeatedly surfaces in operational material is not the trafficker patiently running his own trade structure, but the brokered settlement layer that buys the cash, prices the risk, and solves the cross-border value problem. The claim here is one of scale, not universality. Smaller proceeds from local offending, or large organization anchored in a territory such as the Italian mafias, can be handled in-house. But at the level addressed in this article, the recurring figure is the intermediary for whom trade becomes a tool for balancing and disguising positions after the trafficker has already been paid out.

Rational Choice

For the trafficker, that choice is rational. European drug markets generate very large volumes of retail cash. Holding that cash creates compounding risk: theft, seizure, robbery, informants, storage problems, and internal leakage. Every additional day of possession is uncompensated exposure. Selling the cash at a discount to a broker who can make equivalent value available elsewhere within a short period is therefore not a failure or a loss of control. It is often the cheapest form of insurance available. The patience required for slower settlement mechanisms, including trade-based ones, belongs not to the trafficker but to the intermediary who has already been paid to assume that risk.

Street cash is therefore transferred at a small discount to brokers whose business is not simply moving money from one place to another. Their business is buying risky cash as inventory, grading it, reallocating it to other demand, and absorbing losses if all or part of it is later lost, stolen, frozen or seized. Those brokers are commonly called hawaladars, though the label varies by region and does not always capture the full range of actors involved. Published case material and operational reporting nevertheless describe the same basic market logic. Brokers buy traffickers’ euro cash in Europe and resell it to people who want precisely what the trafficker no longer wishes to hold: cash in the right place, outside the banking system, undeclared, and immediately usable. The buyer may be a tax fraudster repatriating hidden revenue, an importer evading exchange controls or tariffs, a remittance operator settling obligations, another broker balancing his own books, or one of many other buyers for whom off-system cash has immediate value. The trafficker, meanwhile, is compensated in whatever form he prefers: local currency at origin, credit elsewhere in the network, goods or even, let’s be trendy, crypto.

Cash as Merchandise

That is why the cash is priced like merchandise. In intercepted negotiations, rates are quoted by country and adjusted by variables familiar to any trader: denomination, bulk, route, timing, handling difficulty, and payout form. Small-denomination notes are worth less because they are bulkier, slower, and more expensive to process. It is too often forgotten: a tonne of cocaine produces a tonne of cash. (note : A tonne of cash amounts to roughly €25–55 million, depending on whether it is in €20 or €50 notes, and £22–50 million, depending on whether it is in £20 or £50 notes)

A courier’s travel time adds cost. Cash moved against bank credit costs more than cash moved against cash because the broker must mobilise banking channels, generate supporting cover, and absorb greater detection risk. These are not incidental details. They show that criminal cash is being treated as inventory: bought at a discount, graded for quality, and resold into another market.

Pricing, however, is only part of the explanation. Traffickers hand over the cash because the broker supplies something they cannot easily create for themselves: trusted third-party settlement between parties who cannot rely on law. The same functional architecture appears clearly in migrant smuggling and other illicit markets where payment is held by an intermediary and released only when arrival or delivery is confirmed. This is a form of escrow.

It is worth separating two services the broker provides, because they are often run from the same shop and easily confused.  In the first, he takes a single client’s cash and undertakes to make equivalent value available elsewhere. In the second, he stands between two counterparties. The broker holds value between parties separated by distance and mutual distrust, and releases it when agreed proof appears. It is this second function, not the first, that is properly described as escrow.  In that sense, the broker is not merely a transporter of value. He is a seller of conditional payment, enforceable trust, discretion, speed, and conversion.

Seen in this light, the broker’s indifference to the client’s underlying business is not a defect in the service but one of its core attractions. What the broker sells is not loyalty to a specific criminal enterprise. He sells settlement. In one intercepted explanation to a prospective client, the offer was simple: funds could be handed over in one country and made available in another, in either currency, with exchange handled in-house for commission. Nothing in that description requires intimate knowledge of the client’s upstream activity. The broker’s value lies in his ability to receive, hold, net, and release funds on his word and balance sheet.

Detection Challenges

Two consequences follow. First, seizure statistics are often attributed to the wrong party. Once the trafficker has handed over the cash and received value in return, the loss from any later interception usually falls on the broker who purchased the consignment, not on the trafficking organisation that generated it. The broker absorbs the hit as a cost of doing business, spreads it across future pricing, and avoids reporting it in ways that would destroy his reputation for delivery. In partnering networks the hit is mutualised further still, spread across the broker’s wider flow and absorbed collectively rather than landing on any single consignment. Either way, the seizure risk belongs to the layer that bought the cash, not to the offence that produced it.

Second, the moment of real vulnerability for the proceeds of the predicate offence is the transfer itself. Before the handover, the cash belongs to the trafficking organisation. After it, liability has shifted, ownership has too, as the repayment is almost instantaneous and the cash has become part of a brokered financial inventory. The interval can be extraordinarily brief, sometimes little more than the time needed to verify the courier, authenticate a token or serial-number reference, and pass a bag across a car park. Before verification, the problem is criminal logistics. After verification, it is already financial exchange.

This also explains a paradox that has frustrated financial investigators for decades. “Follow the money” often leads away from the predicate offender and towards a different actor: the broker, or the wider settlement network into which the cash has already been absorbed. After the handover, the trail may still be warm, but it leads to a different owner. By then, the predicate offender may already have been compensated through a separate channel, often by netting against obligations that never required the physical cash to cross a border at all. The injunction to follow the money made sense when criminal proceeds remained with the offender long enough to be traceable as his asset. In the corridors that matter here, they often do not.

Trade Belongs to the Intermediary

Once the handover is complete, the relevant question is no longer how the trafficker launders his proceeds. It is how the broker settles the position he has just purchased. This is the point at which trade enters the picture. Hawaladars and other money brokers use trade, among other mechanisms, to move value, recycle inventory, and settle balances between themselves. The trafficker has already solved his immediate problem by converting risky local cash into safer value elsewhere. The broker is the one left holding inventory that must be redeployed, documented, balanced, or transformed into a more durable form.

The interception of encrypted communications systems such as EncroChat and Sky ECC gave investigators a rare, large-scale view of organised crime communicating in real time. What emerged from that material was not simply a picture of traffickers discussing drugs and then separately laundering proceeds. A striking proportion of the communications concerned money, rates, collection, delivery, settlement, and onward coordination. Operational reporting also indicates that the organisation of drug imports  is often heavily structured by money brokers themselves, who recruit traffickers into arrangements that serve broader financial and logistical purposes. This reverses the familiar laundering narrative. The broker is not merely a downstream cleaner of dirty money after the crime. He is often present at the point of organisation, helping structure the logistical and financial architecture from the outset.

The contradiction between the “indifferent broker” and the broker actively involved in the trafficking schemes is only apparent, and it dissolves once the broker’s ecosystem is understood. It’s a tiered market. At the top sits the controller who takes the large laundering contracts directly from the criminal organisation, and who may help structure the importation from the outset: he is the single point of contact, the figure the client knows by name. But he does not personally collect and settle every euro. He breaks the contract into portions and sells them down to regional brokers, who resell smaller tranches to local operators, each tier holding its own roster of buyers waiting for cash in a particular city. It is those lower-tier buyers who are indifferent. Payment runs back up the chain almost instantly, because each level funds its purchase from the one beneath it: the regional broker pays the controller with money already committed by the local broker below him, and so on down to the end buyers who wants the notes. This is how value from one crime, such as tax fraud, can end up settling the cash position created by another, even across different jurisdictions.

The top tier knows the client and the business; the lower tiers do not need to, and that is precisely what makes the service generic and scalable. A second- or third-tier broker buys a block of cash and a delivery obligation. His indifference is not ignorance, since he knows perfectly well the cash is criminal, but professional incuriosity about which crime, because the upstream offence is someone else’s contract. What appears as an omniscient organiser in one case file and an incurious cash dealer in another is the same network seen from two heights.

A recovered message from a counterpart operating between West Africa and Lebanon illustrates the same logic from another angle. In a single line, he asked whether cash could be collected in Milan, Paris, and Brussels so that operations could begin immediately. The exchange did not read like post hoc laundering by traffickers trying to clean up after themselves. It read like logistics between financial intermediaries who needed liquidity in specific places and on specific terms. The trafficker is not visible because, at that stage, he no longer needs to be.

The broker is the only actor in this structure with a sustained need to move value across borders and convert it into durable, defensible form. The trafficker’s requirement is the opposite: immediate liquidity and rapid dissociation from cash. That divergence explains the appearance of goods in laundering schemes: cars, textiles, construction equipment, watches, and other forms of tradable inventory. They are not selected because they have anything to do with narcotics as such. They are selected because they help a broker who already owns the cash convert it into goods, move value across jurisdictions, manage documentation, and recover value over a slower time horizon. The broker can wait for a container to clear or an invoice to be processed. His client usually cannot.

Trade Documentation Purpose

The record is also clear about who this documentation serves. In one undercover recording from a European investigation, a broker explained his commercial cover without prompting. He said he operated a car business and a charcoal import business because he did not want anyone “turning up one day and asking how he made his money.” That statement is revealing. The invoices and trade structures in such cases are not only devices for deceiving banks or customs authorities. They are also long-term protective architecture for the broker himself, built in advance for the moment scrutiny arrives. Trade documentation is not merely a laundering instrument. It is reputational armour for the intermediary who has made a business out of buying and settling risky cash.

This is why it is misleading to imagine Trade-Based Money Laundering (TBML) primarily as something traffickers do through trade. Large trade-based schemes often belong to the professional financial service layer rather than to the predicate offender. Recent analytical work has begun to reflect that distinction by separating criminal groups that generate proceeds from professional money launderers who exploit trade supply chains, front companies, and settlement networks to move value. That distinction should not be treated as a technical refinement. It goes to the heart of who is actually operating the trade structure. If professional launderers organise the trade, then detection strategies built around traffickers risk targeting a participant who may not even be present in the relevant scheme.

Put differently, if brokers are the market-makers in this system, then the analytical focus has to move with them. The more revealing questions are not simply which invoices look false or which shipments appear mispriced. The more revealing questions are where cash pools accumulate, how inter-broker balances are netted across jurisdictions, what cash pricing reveals about enforcement pressure, which corridors command a premium, and what happens to rates and settlement routes when a major broker is removed. Those are questions about a criminal financial service layer. Some resist measurement, and none will be answered by transaction monitoring alone; but they are the right questions to instrument, through intercept analysis, cash-pricing, and the disruption that follows the removal of a major broker, and they sit far closer to the real centre of gravity than the familiar image of the trafficker.

What Follows

None of this diminishes the seriousness of what brokers do, nor does it place traffickers beyond reach. Two operational logics follow, and the discipline is to run both deliberately without mistaking one for the other.

The first is point-in-time: the twenty-four-hour window marks the moment the predicate offender is most exposed, while the cash and its owner are still together, and it argues for concentrating effort on the collection itself rather than on the trade chain weeks later.

The second is longitudinal. Following a broker over time, across meetings, travel, trade activity, and peripheral banking relationships, can reveal a financial architecture that transaction monitoring alone is unlikely to reconstruct. These are not competing strategies, but two ends of the same thread. A handover-focused investigation may lead from the predicate offender to the broker who bought his cash and to the layer above him; a broker-focused investigation, pursued patiently, may lead upward to the traffickers and counterparties who rely on his services. The mistake is not to choose one or the other, but to treat either as a substitute for both. Reaching the offender is a fast and perishable opportunity; mapping the service layer is a slow and cumulative one. A serious strategy requires both, and must know at each stage which one it is pursuing. That also helps explain why some of the more meaningful enforcement outcomes have involved criminal financial service providers in the dock, rather than only the trafficking groups that generated the cash in the first place.

The larger implication is institutional. Customs analytics designed around trafficker-led misinvoicing, bank monitoring tuned to predicate-offence typologies, and prosecutions that frame the launderer as merely accessory all risk assigning the scheme to the wrong principal. The trade flows are real, and so is the laundering, but the organising intelligence behind many of these structures belongs to a financial specialist who bought the cash, priced the risk, and then redesigned the settlement route around whatever controls stood in front of him.

The trafficker, meanwhile, may have been paid before any container was booked, any invoice raised, or any shipment inspected. That does not make Trade-Based Money Laundering irrelevant. It makes timing central. A policy that claims to deprive criminals of their proceeds should therefore be judged not by whether it can reconstruct a trade chain months later, but by whether it can intervene before the proceeds have been sold, netted, and transformed into someone else’s inventory.