|
Chinese Money Laundering Networks are a significant and growing threat to U.S. national security and the integrity of the U.S. and global financial system due to their ability to launder vast sums of illicit proceeds and service a wide range of illegal activities.
Between December 2018 and November 2025, FinCEN identified $7.1 billion in suspicious activity reports (SARs) linked to suspected Chinese money laundering organizations (CMLOs).[1] This number highlights the role that CMLOs already play in supporting financial crimes, however the numbers reported through FinCEN are only a very small portion of CMLO activity. Many CMLO activities may not be recognized by financial institutions as being affiliated with these networks and a large and growing portion of their activities occur outside of formal financial system. According to 2025 estimates, Chinese Language Money Laundering Networks process approximately $44 million in cryptocurrency per day.[2]
Chinese Money Laundering Organizations (CMLOs), also referred to as Chinese Money Laundering Networks (CMLNs) are loosely structured financial crime networks with links to China that specialize in laundering illicit proceeds for a wide range of criminal organizations. CMLOs often advertise their services and coordinate deals through Chinese-language postings on Telegram, WhatsApp, and other messaging apps and social media platforms. CMLOs operate through a variety of channels including:
- Formal Financial System
- Chinese Underground Banking Systems
- Trade-based laundering schemes
- Human Mule Networks
- Informal Settlement Systems
- Cryptocurrency Markets
CMLOs are service providers, laundering proceeds for multiple criminal organizations including drug cartels, North Korean Hackers, and groups engaged in financial fraud and scams, and others transnational criminal actors.
 Capital Restrictions Fuel CMLO Growth
China maintains strict capital controls that limit the amount of money individuals can convert to foreign currency and move out of the country. (China’s currency controls include a $50,000 USD annual limit for personal foreign exchange and for moving outside the country.) These restrictions create strong demand inside of China for USD and other foreign currency and a demand to operate outside of the formal financial channels. These characteristics have fueled the rise of alternative value transfer systems.
The Chinese Underground Banking System provides an alternative financial infrastructure to circumvent capital controls and offers currency conversion and informal money transfers. CMLOs use the Chinese Underground Banking System and other mechanisms to move money and provide USD and other foreign currency to Chinese foreign nationals by laundering billions in proceeds from various illicit actors. As an example, CMLOs are known to dispose of the illicit funds by purchasing real estate or college tuition on behalf of Chinese nationals evading restrictions on capital flight.
Because of the strong demand for USD and foreign currency from the Chinese Nationals it serves, CMLOs can reduce overhead costs and provide cheaper rates to criminal enterprises seeking to launder money. These characteristics have fueled the rise of alternative value transfer systems. According to 2025 estimates, over the past five years, CMLOs have expanded to process an estimated 20% of illicit crypto funds.[3] Because of the vast ecosystem that CMLOs now inhabit, in addition to its growth, observers have also noted the increasing professionalization and efficiency of its illicit financial service offerings.
CMLOs operate globally and their methods are broadly similar across regions. Their methods are adapted to local environments, often exploiting regulatory gaps and weak oversight in countries such as Canada, Australia, Europe, Latin America, and Africa. CMLOs maintain a low profile, collaborate with local criminal groups, and avoid violence, making their complex, transnational networks difficult for law enforcement to detect and disrupt.
Composition of CMLOs
CMLOs typically consist of several interconnected components operating across multiple jurisdictions. As is common in the United States, CMLOS may operate as an unregistered money service business. CMLOs also may consist of the following:
- Brokers and coordinators
- Underground banking operators
- Money mule networks
- Trade facilitators and daigou networks
- Crypto brokers and OTC traders
- Cash couriers and logistics facilitators
These actors operate through loosely structured but highly adaptable networks rather than rigid hierarchies.
Guarantee Platforms
Some CMLO operators use guarantee platforms to facilitate trust between criminal clients and laundering brokers. Guarantee platforms may also serve as marketplaces for fraud tools and various contrabands, enabling CMLOs to find clients and for criminal actors to use a one-stop-shop to purchase illicit goods and launder funds. Guarantee Platforms are centralized points that function as reputation and escrow systems within underground markets, serving as an intermediary to ensure payments, deliveries, or services are completed as promised.
Example of a Prolific CMLO Operator
One of the most well-known CMLO guarantee platforms is Xinbi. Xinbi operates primarily in Southeast Asia and is a major hub for illicit financial flows facilitating transactions for "pig butchering" scams, human trafficking, and other illegal activities. While serving Chinese-speaking scammers in Southeast Asia, the platform has historically claimed to be registered as "Xinbi Co. Ltd" in Colorado, USA. In May 2025, US authorities and Telegram banned many Xinbi notes from the telegram platform. Despite such efforts, and since May 2025, Xinbi moved to alternative messaging services and through December 2025 has processed $17.9 billion in transaction volumes, with inflows nearly doubling its inflows since the enforcement action.[4] The resilience of the platform highlights the adaptability of the CMLOs to sustain high volumes of money laundering and the challenges it poses to law enforcement.
 Operational Framework of CMLOs
Layer 1: CMLO Actors – Who runs the System
CMLOs rely on a diverse ecosystem of actors who enable the rapid movement and concealment of illicit funds across borders. This section examines key operational components including pao fen networks - that facilitate high-volume fund transfers and the use of money mules coordinated through “motorcades” to aggregate and rapidly move illicit proceeds while minimizing exposure. This section also explores the targeted recruitment of students to expand and sustain laundering activities. Understanding these roles is critical for identifying the wide range of CMLO participants.
Running Point (Pao Fen) Networks
Pao Fen, roughly translated as “Running Points” (跑分)[5], is an organized laundering system that connects criminals who generate illicit proceeds with intermediaries who control networks of bank and digital payment accounts used to move those funds. Pao Fen Operations leverage purpose-built platforms and encrypted communication channels to coordinate laundering tasks. Participants register on these platforms, receive transaction assignments, and complete fund transfers using dynamic QR codes or third-party payment credentials. The system relies on brokers and recruiters to coordinate transactions and continuously source mule accounts to rapidly transfer and obscure the origin of illicit money across multiple payment channels. Components of the Pao Fen network include:[6]
-
Network organizers oversee participants including the brokers, recruiters, and account holders. For smaller networks, individuals may serve multiple roles.
-
Pao fen brokers serve as a coordinator or intermediary in the operation and connect upstream criminals needing to move funds with downstream infrastructure of mule accounts and payment channels. They manage transaction flows, set the terms or fees for moving money and coordinate accounts used to circulate funds through the network.
-
Recruiters source runner accounts by recruiting placing ads and recruiting individuals through social media platforms, online forms, or using their immediate social networks. They persuade individuals to rent or provide their bank or digital payment accounts and will often operate under the direction of brokers or higher-level coordinators.
-
Runners provide and operate bank or digital payment accounts that can receive, transfer, and withdraw illicit funds as directed by brokers or Pao Fen coordinators.
Money Mules and Motorcades
Motorcades (车队) consist of money mules that collectively work together to achieve complex layering of money laundering. Motorcades function as extensions of pao fen networks, offering sophisticated layering schemes by routing illicit funds through multiple bank accounts in exchange for a cut of the total transferred funds. Crypto researchers describe a phenomenon similar to pao fen but broader in scope in which money mules operate in organized networks - motorcades. Rather than isolated individuals, motorcades are coordinated groups of mule accounts and operators used to layer illicit funds through numerous rapid transfers across bank accounts, digital wallets, and cryptocurrency services. In this framework, motorcades function as laundering service providers within a larger underground money laundering ecosystem that includes brokers, over-the-counter crypto exchanges, and other financial intermediaries. For investigators and financial institutions, these networks often appear as clusters of linked accounts moving funds in synchronized patterns, indicating coordinated laundering activity rather than independent mule behavior. According to researchers, motorcade postings are almost exclusively in Mandarin and often allude to bank accounts and locations in Mainland China, therefore these groups likely serve clientele based in, or having a connection with Mainland China. Advertisements for motorcade services claim to coordinate “fleets” across Africa, emphasizing the global reach of CMLO operations.[7] For additional information on CMLO money mules and the use of counterfeit passports, refer to Cornerstone January 2024 Issue #48.
Recruitment
CMLOs have often leveraged Chinese citizens or other individuals with a cultural tie to China, using those ties to support money laundering efforts, such as serving as a recruiter of money mules and other support personnel. As CMLOs have increasingly participated in the laundering of drug cartel proceeds, CMLOs have needed increasing numbers of money mules to launder the proceeds. To meet this demand, CMLOs have targeted students using cultural obligations, debt bondage such as using rigged gambling, and other means. Chinese National Students are frequently recruited for bank account rentals, money mule activity, and buyers and transporters in daigou networks, and other aspects of the CMLO ecosystem. Recruitment often occurs through social media, messaging apps, and community networks. These students may continue to participate in CMLO after graduating, in some cases, not fully understanding the legal implications of their actions.[8]
 Layer 2: Value Transfer Infrastructure - How Value is Transferred
Building on the roles played by key actors within CMLOs, value transfer infrastructure enables the scaling of CMLO activities. This section examples core mechanisms, including the Chinese Underground Banking System, mirror transfers that offset cross-border balances, bulk cash smuggling operations, and the use of informal over-the-counter (OTC) and peer-to-peer settlement channels. Together, these interconnected systems provide CMLOs with flexible, resilient pathways to move and disguise illicit value across jurisdictions.
Chinese Underground Banking System
The Chinese underground banking system serves as the infrastructure that enables CMLOs to launder funds. The Chinese Underground Banking System (CUBS), also colloquially referenced as (飞钱) feiqian or “flying money,” is a network of informal financial intermediaries, often operating outside formal banking regulations, enabling cross border movement of money and can be used for more mundane as well as illicit purposes. CUBS often use "mirror transactions" to move money across borders, often to evade strict Chinese capital controls. For more information on the Chinese Underground Banking System, refer to next month’s Cornerstone Newsletter titled Chinese Underground Banking System.
Mirror Transfers are an informal value transfer system whereby a pair of trades in different jurisdictions offset each other so that money does not need to travel cross-border, thereby evading scrutiny. Trade can include buying securities, engaging in trade-based money laundering, or other actions. CMNLs uniquely benefit from mirror transfers because of the demand for foreign currency by Chinese nationals and the need for criminals to launder funds.
Bulk Cash Smuggling
Many CMLOs include cash-pickup and bulk cash smuggling networks tied to drug trafficking and other illicit activities that generate large volumes of physical cash. CMLOs often pick up hundreds of thousands of dollars from stash houses or intermediaries and transport them in backpacks, boxes, luggage, or vehicles, or other means. Once cash is collected, CMLOs may move the cash across jurisdictions and deliver them to money laundering brokers, underground banking operators, or engage in structuring techniques to deposit cash into a bank.
Informal OTC / Peer-to-Peer Settlement
Transactions through informal OTC (over-the-counter) and peer-to-peer settlement systems happen directly between individuals or through networks of brokers, often using cash, digital wallets, or alternative platforms. CMLOs often use these systems to move large sums internationally, layer transactions to obscure the source of funds, and circumvent capital controls. North Korean state-sponsored hackers have used Chinese OTC crypto brokers to launder stolen cryptocurrency.[9] Informal OTCs may advertise themselves as “white u” or “black u.” [10]
White U channels are viewed as “semi-legitimate” pathways where funds move through trusted peer-to-peer exchanges or business fronts, often appearing legal while still skirting formal bank scrutiny. Despite the White U label, experts have identified several White U services regularly interacting with known money laundering and guarantee platforms highlighting their interconnectedness with illicit money laundering.[11] Conversely, Black U channels are fully underground, handling clearly illicit funds, and advertised as such where the receiving person bears the knowledge they are receiving illicit funds. Black U primarily operates outside of guarantee platforms and sells their cryptocurrency at a discounted rate (sometimes even 10-20% discounted) in exchange for buyers knowingly purchasing illicit funds with criminal provenance.[12]
 Layer 3: Laundering Channels – Where Funds are Disguised
This section explores key methods for laundering funds and obscuring its origin and ownership, including trade-based money laundering (TBML), the use of daigou networks to move value through cross-border consumer goods transactions, casinos as a venue for cash conversion and layering, and digital mixing services that anonymize cryptocurrency flows. Together these channels enable the integration of illicit proceeds into the legitimate economy while complicating detection and attribution.
Trade-Based Money Laundering (TBML)
TBML uses international trade transactions to move illicit value. Many CMLOs engage in TBML given China’s high volume of international trade and the ability to obscure illicit money with legitimate trade funds. TBML companies may rely on falsified invoices such as including over- and under- invoicing or the use of multiple invoices to multiple entities for the same shipment, or the misclassification of goods. Free Trade Zones are especially attractive for trade-based money laundering due to their ability to import, process, and re-export goods with reduced customs oversight, taxes, and reporting requirements.
Daigou (代购), which translates to “buying on behalf of,” can be used as a type of trade-based money laundering, whereby individuals will purchase goods abroad (often luxury goods, but can include electronics, infant formula, or other items). These goods will then be shipped to China and sold there. While not inherently illegal, CMLO will often use illicit funds, such as drug proceeds, to purchase these items. CMLOs benefit from daigou because of the price differences between China and abroad, the ability to get around Chinese import taxes, and the demand in China for authentic foreign goods.
Casinos and Online Gaming Platforms
CMLOs use casinos, both physical, and online, along with online gaming platforms to move, disguise, and integrate illicit funds. CMLOs prefer these channels due to high transaction volumes; funds that can be mixed with legitimate gambler funds; cash-heavy environment (of physical casinos); built-in mechanisms for converting between money, chips credits, and cryptocurrency; and possible reduced or lack of reporting requirements.
CMLOs have historically relied upon casinos based in Macau, and hubs based in Cambodia Myanmar, and Laos Golden triangle, as well as Philippine Offshore Gaming Operators (POGOs) to launder money and evade currency controls. More recently, CMLOs have integrated crypto payments to launder proceeds. In addition, third-party payment providers now offer services that include account top-ups using both fiat and crypto, and some processors serviced accounts across multiple gambling sites, allowing for cross-platform movement of funds.
Mixing Services and Swapping-as-a-Service
Mixing services and “swapping as a service” are increasingly used by CMLOs to obscure the origin and movement of illicit funds. These services may be advertised on guarantee platforms and have a regional footing, especially among illicit actors in Southeast Asia, China, and North Korea. In these operations, illicit proceeds are routed through cryptocurrency mixing services, which pool and redistribute coins to sever transactional links and swapping services, which convert one cryptocurrency to another across different chains, complicating traceability. These methods allow actors to bypass Chinese capital controls, move large sums of money offshore, and integrate illicit proceeds in the global financial system. [13]
 Putting it All Together
CMLOs have evolved into a highly adaptive ecosystem that blends traditional and Chinese underground banking with modern digital payment infrastructure. Structural drivers – most notably capital controls in China – continue to fuel demand for mechanisms that move value across borders outside of the formal financial system. Within this environment, laundering services are increasingly specialized and modular. Brokers coordinate capital flows while guarantee platforms provide escrow and reputation systems that facilitate trust between criminal actors. Operational layers include pao fen running-point networks and motorcades (organized clusters of mule accounts). These systems rely heavily on recruitment of transport people who provide bank accounts, identities, logistics, or technical services, enabling funds to move quickly across a wide network of intermediaries.
CMLO draw on a diverse toolkit that blends modern digital finance with long-standing practices associated with the Chinese underground banking system. Methods such as mirror transfers, informal over-the-counter and peer-to-peer settlement, and bulk cash movement reflect traditional underground banking mechanisms designed to bypass formal capital controls, while newer techniques leverage digital assets through conversion between OTCs, mixers, and related crypto-based services. Concurrently, value may be moved or integrated through commercial channels – including trade-based money laundering such as daigou, and casino-linked financial flows. These networks operate less as a single organization but rather several interconnected service markets, combining underground banking infrastructure with digital payment systems and specialized facilitators. Disrupting CNML therefore requires targeting of the broader enabling ecosystem – including brokers, settlement mechanisms, and laundering service providers, rather than select individual transactions or entities.
How HSI Combats CMLOs
In collaboration with its partners in the United States and abroad, HSI special agents develop evidence to identify and advance criminal cases against CMLOs, terrorist networks and facilitators, and other criminal elements that threaten the homeland. HSI works with prosecutors to arrest and indict violators, execute criminal search warrants, seize criminally derived assets, and take other actions with the goal of disrupting and dismantling CMLOs and other TCOs operating throughout the world. These efforts help protect the national security and public safety of the United States.[14]
HSI is actively engaged with the U.S. Department of the Treasury including the Financial Crimes Enforcement Network and the Bank Secrecy Act Advisory Group, and the Department of Justice including their Money Laundering and Asset Recovery Section, to strengthen and enforce regulations and statutes dedicated to anti-money laundering. In addition, HSI participates in several critical intergovernmental agreements and organizations to include the Financial Action Task Force, the Five Eyes Law Enforcement Working Group, and the World Customs Organization. HSI provides anti-money laundering assessments, training, current best practices and lessons learned in the fight against the movement and laundering of illicit proceeds.[15]
|
