“A man who can move a tonne of cocaine can move a tonne of dollars.” Opinion of a wiretapped drug trafficker
Written by Quentin Mugg & Dr. Mariola Marzouk
On an intercepted line between Europe and the Gulf, a money broker mentioned in passing that he had gone out to buy a padlock. Three-quarters of a million dollars in banknotes were sleeping in a room, the takings of several collection runs, and the room needed locking. The detail stayed with the investigators because of what it implied. The money was not in transit. It was not being wired, layered or integrated. It was an inventory, counted in “tonnes” on the phone. In the brokers’ slang, one “tonne” meant one million and one “metre” one hundred thousand. The notes were sorted by denomination and stored like any other stock awaiting a buyer.
That room points to a persistent blind spot in anti-money laundering policy. Cash is often treated as a residue of declining retail payments, a legacy instrument gradually displaced by digital finance. Yet in illicit markets cash behaves differently. It functions as working capital: a stock that can be stored, discounted, resold, converted into goods or gold, and settled through brokers without necessarily moving any banknotes. What matters is the off-ledger market that turns cash into a tradable commodity and prices its movement according to risk, route, and demand.
The Banknote Paradox
Across the euro area, the use of cash at the point of sale keeps declining; between 2019 and 2024 its share of in-person transactions fell from 72% to 52% by volume.[1] Yet the value of euro banknotes in circulation has kept growing, to roughly €1.6 trillion.[2] The European Central Bank calls this the paradox of banknotes: people pay with cash less often while holding more of it.[3]
Much of that cash no longer circulates in day-to-day transactions. Instead, it is held as a store of value. Households hold precautionary savings; residents of countries with weak banking systems hold euros as a reserve asset; and criminal economies generate large quantities of physical cash that has to be stored, moved and converted. European drug markets alone produce over €30 billion a year in retail revenue, most of it in small-denomination notes.[4] Fraud, corruption, tax evasion, migrant smuggling and the illicit trades in arms and wildlife add further volumes. The cash share is difficult to be measured reliably, but a substantial part of these proceeds can be assumed to begin in physical form. Before any of it reaches a bank, a trust or a shell company, it poses a physical inventory problem: it must be counted, sorted, transported, protected, and either sold or converted into another store of value.
The Wholesale Market for Cash
The conventional anti-money laundering approach remains fixated on the entry of criminal proceeds into the banking system. Operational reality is often different. Large quantities of criminal cash stay outside formal finance for long periods, traded directly in an informal wholesale market.[13] When collections outrun local demand, pools of cash accumulate, managed by brokers who behave like commodity dealers. They buy these funds at a discount, quoted in points off face value, and warehouse them until a counterparty needs physical cash without a banking trail. Like any trader, they move their prices with the market: when inventory is heavy, buying rates fall; when demand rises, they climb. Much of the pool is resold locally to anyone needing undeclared liquidity, from off-books employers and semi-formal traders to sanctions evaders, tax evaders and importers seeking to circumvent exchange controls. The same notes may change hands several times, generating a commission at every pass.
In this market the trafficker is the broker’s supplier. He sells his cash at a discount and walks away; the margin is taken on the other side, by whoever buys the notes to put them back into use.[5] Bulk cash in one jurisdiction is not worth the same as bulk cash in another. Where it is heavily policed, cash is hard to bank, costly to move and risky to hold; where currency is short or banking access restricted, the same value commands a premium. Brokers profit by arbitraging that gap. On intercepted lines the cost of making value available is quoted to the point, by route and by currency: around 3% to 3.25% into Iraq in one period, 4.5% out of Central Africa, with the West African franc priced against the dollar at a house rate several points off the official one.[5]
Structure and Visibility of the Market
For years this market was inferred from individual seizures. Then, for a few months in 2020 and 2021, investigators were able to observe it directly. The takedowns of the EncroChat and Sky ECC encrypted phone networks put the wholesale cash trade in writing, in the words of the people running it. More than 115 million EncroChat messages and 1.44 billion Sky ECC messages were recovered from operators who had written them believing that no one else would ever read them.[6] What the messages revealed was not a scatter of unconnected launderers but a structured trade. The same brokers served organisations that shared neither language, origin nor form and that were otherwise violently opposed: a Calabrian clan, a Montenegrin gang in a fratricidal war over cocaine, an Australian biker chapter, a Kurdish network pushing heroin into Scandinavia. Their cargoes came in through the same ports, Antwerp and Rotterdam, the same logisticians cleared their containers, and at the end they all handed their money to the same handful of brokers. Investigators came to describe these financiers as a consortium.[7]
Indicative pricing ranges, derived from law enforcement and intelligence reporting on hawala-style value transfer mechanisms, suggest discounts varying between approximately 16% and 5% depending on the location and service, and in some cases lower. These aligned rates may reflect either competitive pricing or tacit coordination; distinguishing between the two depends less on price dispersion than on the underlying structure of interactions, in which the same brokers repeatedly service organisations that compete in other domains, and where transactional communications show little evidence of systematic undercutting.
Within such networks, where counterparties are often familiar and have limited incentive to compete aggressively on price, observed rates tend to remain relatively stable over time. At the upper end of the structure, one broker associated with a cluster of major importers is assessed to have facilitated cash movements on a scale of hundreds of millions annually through Dubai. This estimate is reconstructed from transactional messages by aggregating recorded collections across time, location, and amount, and extrapolating annual volume from observed activity. Seizure data does not materially alter this interpretation, as it captures only a limited and non-random subset of underlying flows.
Value Displacement and Conversion
Moving value across borders rarely means moving the cash itself. The messages set out a standard method in which value travels while the banknotes remain in place. In one recurring scheme, euros collected from the drug trade in France are handed to Chinese textile wholesalers operating there, and the cash never leaves the country. Chinese suppliers then ship goods to Moroccan importers, invoicing them at a fraction of their true value and thereby embedding the excess value in the shipment. In Morocco, the importers settle the traffickers’ broker in local currency. The accounts are balanced internally, and the drug money reappears in Rabat without a wire transfer or a physical movement of cash across borders. [14]
That same principle of displacement extends to cases where value is deliberately given physical form. When cash is converted rather than routed, gold is the preferred medium: compact, widely saleable, difficult to trace once melted, and relatively stable in value. In one European investigation, collected cash was exchanged for gold bullion, close to two hundred kilograms over the life of the scheme, and moved through Antwerp on to Dubai and South Asia. [15] A bar can be transported, melted down and resold without retaining an identifiable transaction history. American and European authorities describe the same structure on other routes, including networks of Chinese cash brokers in Milan, Prato and Rome who service the European illicit cash market.[8]
AML Problem of Surface Visibility
Where the cash economy does touch the banking system, AML doctrine has often misread the contact point, treating cash-intensive businesses as laundering engines: restaurants, kebab shops, tanning and nail salons, barbers, convenience stores. Such businesses can absorb some criminal proceeds, but their capacity is structurally limited. Turnover, staffing, supplier relationships, margins and operating costs all constrain how much illicit cash can be introduced without attracting attention. Experienced offenders therefore deposit only what is needed to sustain the visible operation of the business—wages, rent and vehicle costs.[9] The bulk tends to remain outside the accounts, financing trade, consumption and reserves through channels that never appear in formal banking data.
In many cases, the business exists primarily as a defensible explanation for excess cash. A suspect found with €100,000 that cannot be reconciled with declared turnover may not claim innocence; instead, he may attribute it to undeclared restaurant takings, concede a tax offence, and thereby deflect a more serious laundering allegation, particularly where no predicate offence can be established. In such cases, incomplete or fragmented accounts can shift the case toward tax evasion rather than money laundering, with reassessments and penalties absorbed as a cost of doing business. The key question is therefore not the sectoral label but the internal coherence of the business: turnover, staffing, margins, logistics, counterparties and overall economic logic must align. The same logic operates at higher levels of criminal infrastructure. When Spanish police arrested a suspected money launderer linked to the Kinahan group in 2022, his cover involved a vodka brand distributed through Costa del Sol clubs and a garage with concealed cash compartments; Europol alleged that he laundered around €200 million through hawala in just over a year.[10] At every tier, the shopfront supplies a narrative for the cash, not a route for it.
This distinction matters because closing the shopfront removes a visible fiction without affecting the underlying cash pool or the networks that generate it. AML systems are built around regulated touchpoints. Banks monitor accounts, transactions, thresholds and anomalies, but they only observe the moments when illicit value intersects with formal finance. They do not see the collectors, brokers, warehouses, trade relationships or local resale networks that sustain the cash economy. The encrypted networks exposed that market in fuller form; the compliance system sees only the narrow points where it brushes the regulated surface.
The Market Price of Enforcement
Asset-recovery figures show the consequence. Europol estimated in 2016 that between 2010 and 2014, 2.2% of criminal proceeds were provisionally seized or frozen and only 1.1% ultimately confiscated. Its 2025 threat assessment now places confiscation at around 2% of illicit proceeds.[11] This is often read as weak enforcement. But part of the explanation lies in timing and in the division of labour along the chain. By the time cash is seized—from a courier, vehicle, warehouse or stash—the organisation that generated it has often already sold it onward to a broker. The loss therefore falls on intermediaries or holding points rather than originators, who price that exposure like any other operating cost.
Within that system, risk is continuously priced. Cash from heavily policed jurisdictions trades at deeper discounts because it is harder to use and costlier to hold. Settlement into high-risk or low-liquidity corridors commands higher premiums to cover enforcement exposure and operational friction. Cash-to-cash exchange is therefore cheaper than cash-to-bank, since entry into the regulated sector adds cost and visibility. Broker rates move with jurisdiction, route, denomination and perceived risk, and when a major operator is removed, spreads typically rise before competitors absorb the demand. Pricing thus becomes a form of intelligence: sustained increases may indicate real pressure on infrastructure, while stable spreads suggest capacity remains intact despite seizure figures. The withdrawal of the €500 note illustrates the limits of denomination-based enforcement: it increased storage and transport costs and disrupted some bulk-cash logistics, but it did not close the market, because what is being traded is not paper but convertibility into usable value.
What cash ultimately becomes is more visible than how it moves. The same investigations that reconstructed the market also catalogued its end points: property, vehicles, gold and the companies used to hold them feature prominently, while cryptocurrency appears only marginally in the asset profile. A single 2025 operation seized over €300 million in assets, including 681 properties and 127 vehicles; the EncroChat material alone recorded 271 properties and 971 vehicles.[12] A flat purchased in cash and rented out converts banknotes into declared income, but it also anchors value in registries, titles and tax systems. The cash economy is largely invisible in motion; its converted assets are more visible, and that is where financial investigation partially recaptures it.
The Key to the Padlock
The persistence of cash challenges the assumption that digitisation will steadily widen the view into illicit finance. Criminal economies follow a different logic. Their participants seek reliability, discretion and control over value, not transparency. Cash still provides all three: it is anonymous at rest, widely accepted, flexible and trusted across borders. More importantly, it is embedded in a wholesale market that sits largely outside the reach of bank monitoring.
Nor would abolishing cash resolve the underlying problem; it would displace it. Value does not need to be paid where it is generated. A transaction initiated in one country can be settled elsewhere—through cash balances or equivalent value transfers in hubs such as Dubai, Istanbul or Caracas—without any physical movement across the original border. Removing cash from one jurisdiction would therefore shift settlement geography and increase reliance on substitutes such as cryptoassets at the lower end of the market.
The central problem, then, is the market that gives cash its liquidity and exchange value, not the cash itself: the brokers who intermediate it, the demand that sustains it, and the settlement mechanisms that allow value to circulate without moving banknotes. The padlocked room will be emptied in time, its stock sold, converted or settled, and most of that activity will leave no meaningful trace in the account data, reports or transaction signals on which anti-money laundering systems depend. As long as criminal working capital circulates through these off-ledger markets, systems built around regulated touchpoints will continue to capture only fragments of the structure they are meant to observe.
References
[1] ECB, Study on the Payment Attitudes of Consumers in the Euro Area (SPACE) 2024; ECB, “Keep calm and carry cash,” Economic Bulletin 6/2025 (cash share of point-of-sale transactions 72% to 52% by volume, 2019-2024), www.ecb.europa.eu.
[2] ECB, banknotes and coins circulation statistics (total value of euro banknotes in circulation approx. €1.6 trillion); ECB blog, “Making euro cash fit for the future,” 4 August 2025, www.ecb.europa.eu.
[3] Ibid. (the “paradox of banknotes”: store-of-value holdings are dominant despite declining transactional use).
[4] EMCDDA and Europol, EU Drug Markets Analysis 2024 (EU retail drug market estimated at approximately €31 billion per year), www.emcdda.europa.eu.
[5] Mugg, Q. and H. Constanty (2021), Argent sale : La traque, Fayard (the broker buys traffickers’ cash and resells it at an advantageous rate; commissions of 3% to 15% by service rendered; the collection of street cash as the most vulnerable link).
[6] Europol and Eurojust, “Dismantling encrypted criminal EncroChat communications leads to over 6 500 arrests and close to EUR 900 million seized,” 27 June 2023
[7] On brokers serving multiple, rival organised-crime groups, Europol public reporting on professional money-laundering and underground-banking networks. On the Dubai apex, Europol, Operation Desert Light, 28 November 2022 (dismantling of the “super-cartel”; Dubai described as the network’s financial command centre), corroborated by ICIJ reporting on UAE and BVI shell companies, August 2024, www.europol.europa.eu. The authors’ analysis of the intercepted records estimates the wholesale business at between EUR 1.5 billion and EUR 2 billion a year.
[8] FinCEN (U.S. Treasury), advisory on Chinese money-laundering networks (mirror transfers, trade-based laundering), 2025; Europol reporting on Chinese cash-exchange networks in Milan, Prato and the Esquilino district of Rome supplying the European illicit cash market, www.fincen.gov; Authors’ analysis of the judicial case file in Operation Virus, led by Quentin Mugg as the investigating officer at the French Central Office for the Fight against Serious Financial Crime; the case was subsequently tried. Relevant judicial and investigative materials are on file with the authors.
[9] Marzouk, M. and B. Hock (2026), Trade-Based Money Laundering Compliance and the Law (the gap between documentary compliance and the structures through which value actually moves).
[10] Europol, “One of Europe’s biggest money launderers arrested in Spain,” 15 September 2022 (John Francis Morrissey, linked to the Kinahan group; c. €200 million recycled via hawala in little over a year; covers including a vodka brand and a garage with concealed cash compartments; OFAC designation, April 2022), www.europol.europa.eu.
[11] Europol, The Changing DNA of Serious and Organised Crime: European Union Serious and Organised Crime Threat Assessment 2025, The Hague, 18 March 2025, p. 14.
[12] Europol, Operation Bulut, 15 April 2025 (over €300 million in assets seized, including 681 properties and 127 vehicles; intelligence from Sky ECC and ANOM); Europol/Eurojust, EncroChat consolidated results, 27 June 2023 (271 properties and 971 vehicles among assets seized or frozen), www.europol.europa.eu.
[13] Frontline. (n.d.). Black market peso exchange. PBS. https://www.pbs.org/wgbh/pages/frontline/shows/drugs/special/blackpeso.html
[14] French Senate. (2024). Report no. 757 (2023–2024), Volume I: Commission of inquiry into drug trafficking. Sénat de la République française. https://www.senat.fr/rap/r24-757-1/r24-757-16.html
[15] Cash-to-gold laundering routed via Antwerp to Dubai and South Asia, with hawala settlement: FATF, Risks and Vulnerabilities Associated with Gold (2015); for a recent prosecution, Eurojust French–Italian gold-bars case (2025). https://www.fatf-gafi.org/content/dam/fatf-gafi/reports/ML-TF-risks-vulnerabilities-associated-with-gold.pdf https://www.eurojust.europa.eu/news/criminal-networks-dismantled-drug-trafficking-and-money-laundering-trade-gold-bars
MEVA 
Leave a comment