Chinese Money Laundering Networks: What Connected Data Shows That Alerts Miss

Introduction

On 13 October 2026, FinCEN assessed a $1.2 billion civil money penalty against Bank of America, N.A. for willful violations of the Bank Secrecy Act between January 2018 and July 2025. According to the consent order, the bank failed to report, or reported late, more than $5 billion in suspicious activity. Roughly $1 billion of that involved national security and priority risks, including indicators of Chinese Money Laundering Networks (CMLNs), fraud and potential trade-based money laundering with a nexus to the southwest border.¹

In March this year, I spoke with the American Bankers Association (ABA) Banking Journal about my years at the DEA following drug money through banks and markets, in Money, Markets, Murder.² That conversation was about the networks behind the money: the brokers, couriers and front accounts that move proceeds for the cartels. This one is about what happens when those networks run through a bank whose monitoring cannot connect them.

The bank had a transaction monitoring program. The order describes how it worked: alerts were scored and grouped customer by customer, money-order and check deposits were not covered, and some alerts could be scored down to zero. Activity that ran across several customers and several payment channels rarely added up to a case.

CMLNs show why this matters. They do not move money in one large transfer. They spread it across cash deposits, money orders, cards and wires, and across accounts that look unrelated. This paper explains how CMLNs operate, which patterns FinCEN described in this case, and how linking data a bank already holds brings those patterns into view. It ends with a 90-minute training I run for bank teams on exactly these networks.

What are CMLNs?

A currency swap between two markets

Chinese Money Laundering Networks (CMLNs) solve two problems at once. Mexican drug cartels hold large amounts of US dollar cash that Mexican rules make hard to deposit at home. Wealthy Chinese citizens want US dollars, but China caps how much foreign currency each citizen can buy, at about $50,000 a year, and bars sending renminbi abroad without approval. CMLNs buy the cartels' dollars and sell them to those Chinese buyers. Treasury counts them among the most significant money laundering threats to the US financial system.³

Figure 1. Who needs what

The Cartel

Holds dollar cash from drug sales in the US. Needs the value in pesos, in Mexico, without smuggling cash across the border.

The CMLN Broker

Collects cash from the cartel's couriers in the US, while its partner in Mexico pays the cartel the same value in pesos. Earns most of its money by selling those dollars to Chinese buyers at a markup, so it can charge the cartel a low fee.

The Chinese Buyer

Wants dollars in the US for property, tuition or savings. Pays in renminbi, inside China, to an account the network controls.

Figure 2. The mirror transaction: three countries, no cross-border transfer

The mirror transaction across the USA, Mexico and China: 1 US dollar cash from the cartel (couriers in the US) to the network operator in the US; 2 pesos minus a fee from the network operator in Mexico to the cartel (Mexican account); 3 renminbi plus a fee from the same buyer (Chinese account) to the network operator in China; 4 dollars: mule deposits, cashier's checks, wires, P2P from the network operator in the US to the buyer (US account); 5 pesos to pay for goods from China from the importer in Mexico; 6 renminbi for goods for the importer to the supplier in China — Figure 2. Orange: the only step a US bank can see; it looks like an ordinary domestic payment. The supplier in China ships goods to the importer in Mexico, so every side of the swap is settled although no money crossed a border. Simplified from FinCEN Advisory FIN-2025-A003, pp. 4–5 and n. 31.

Because the two halves of each swap settle in different countries, no single transaction connects the cartel to the buyer. A US bank sees cash coming in and dollars going out to people and companies that appear unrelated. The pattern only shows when those payments are viewed together.

3 FinCEN Advisory FIN-2025-A003, Use of Chinese Money Laundering Networks by Mexico-Based Transnational Criminal Organizations (28 August 2025), pp. 1–5 and n. 15.

Four tactics and what a bank can see

FinCEN describes the methods CMLNs use to move the cartels' cash into the banking system and on to Chinese buyers. Each comes with red flags a bank can observe in its own data. No single red flag proves anything; FinCEN asks banks to look at the customer's history and at several flags together.⁴

1 Mirror transactions

How it works

Cash received in the US is matched by pesos paid in Mexico and renminbi paid in China (Figure 2). Value moves, money does not cross a border.

What a US bank can see

Large cash deposits, cashier's checks or transfers with no business purpose, followed by cashier's check purchases or transfers to other individuals, often in high-risk jurisdictions.

2 Money mules, including students

How it works

Recruits deposit cartel cash into accounts they are told to open, or into accounts held by Chinese nationals and businesses in the US who bought the dollars. Many declare themselves students, retirees or housewives. Some are given counterfeit Chinese passports.

What a US bank can see

A "student" or low-income customer who deposits cash regularly or receives wires labeled "tuition" or "living expenses" well above declared income, then sends wires or P2P transfers to unrelated people. Cash split across several branches. A passport and visa with the same photo despite different issue dates.

3 Trade-based laundering and daigou

How it works

Recruits and "daigou" buyers (people who shop on behalf of clients in China) buy electronics and luxury goods with cartel cash, P2P funds, or credit cards that the network or a complicit business later pays off. The goods are resold or exported to Mexico, China, Hong Kong or the UAE.

What a US bank can see

A customer who receives P2P or wire transfers from unknown people and uses them for a large credit card payment. A business that pays off credit cards belonging to several unrelated individuals. Heavy card spending on electronics. A business that exports goods but never buys inventory.

4 Real estate

How it works

Mules or shell companies buy property with laundered money, as an investment for the network or for a wealthy client in China.

What a US bank can see

A customer with unexplained wealth who wires money for a property purchase or buys cashier's checks payable to a real estate company. An escrow company receiving funds from an unrelated foreign shell company.

How the network knows who to settle

Operators in three countries must know which cash matches which payout. Criminal cases describe a "serial-number verification system": courier and cartel confirm each handover with a photo of a banknote's serial number.⁵ That token never reaches a bank. What does reach the bank are identifiers shared by many customers, such as the same ID cited in wires from different senders.

An additional signal: digital footprint

Login, device and session data are not part of FinCEN's red flags, but they can expose the mule accounts behind tactics 2 and 3: "student" accounts opened or operated from the same device or the same phone number show up as one group.

4 FinCEN Advisory FIN-2025-A003, pp. 5–10, red flags 1–18.

5 DOJ, Eastern District of Virginia, indictment of R. Zhen and H. Wu (press release, 22 May 2026).

What FinCEN now expects

Four control gaps in the consent order

Beyond the penalty, FinCEN's order explains in detail why the bank's monitoring missed this activity. Most of the gaps it describes could exist at any bank that analyzes one customer and one product at a time.⁶

$1.2BFinCEN penalty; $750M OCC payment credited

$5B+suspicious activity missed or reported late

~$1Btied to priority risks, including CMLNs

1 in 3+investigations started by outside requests, not alerts

One customer at a time

The monitoring system scored each alert and grouped alerts by customer. A case opened only when a customer's group reached 20 points within 13 months; older alerts stopped counting. Activity spread across several customers never added up in one place.

Money-order and check deposits outside monitoring

The bank's model covered only certain purchases of money orders and checks; their deposits were not monitored at all. The system also could not tell a money order from a check. Quarterly reviews of high-risk customers left these deposits out too, although two auto auction platforms deposited tens of billions of dollars in such instruments between 2020 and 2025.

Exception lists switched alerts off

To cut false alarms, the bank kept exception lists built "ad hoc", for example of customers exempt from large cash reporting. Their alerts, including alerts for splitting cash deposits into smaller amounts, scored 0 points and never moved the customer toward the 20-point threshold. One auction platform had more than 20 such alert groups; only three became cases. When the rules were removed in December 2023, about 150,000 active alert groups had been affected.

Linking data left unused

Buyer IDs written into wire instructions and onto money orders tied payments from different channels to the same vehicle buyers. FinCEN used them to connect the activity. Most of the bank's own reports on these customers did not cover the money-order deposits or the buyers behind them.

6 FinCEN Consent Order No. 2026-03, In the Matter of Bank of America, N.A. (13 October 2026), §§II.D.1, II.D.1.d–e, II.D.3, II.F.2.

Three patterns regulators expect banks to catch

FinCEN grouped the missed reporting into categories. Three of them describe patterns any bank can test for in its own data.⁷

CMLN indicators

Hundreds of millions

What happened

A group of customers presenting themselves as logistics or electronics businesses. FinCEN found the following signals together in the same customers.

Signals in the bank's data

Back-to-back credit card purchases at major retailers and shipping companies. Regular, large ACH and bill-pay payments from the customer's account to credit cards issued by other banks, including cards in the names of unrelated individuals. Large wires to China described only as "for goods". Repeated transfers to counterparties with no web presence, operating from residential addresses.

Money orders at auto auctions

$660M+

What happened

Buyers on two online auto auction platforms bought money orders at money services businesses and paid for vehicles with them. The platforms deposited the money orders at the bank.

Signals in the bank's data

About 220,000 sets of three money orders: sequential serial numbers, round amounts, each set totalling $2,900–$3,000. That is just under $3,000, the level at which the seller must record the buyer's identity for a cash purchase. About one set in three was bought near the southwest border.

High-risk wires

Nearly $1B

What happened

Wires to auto-related customers, mainly from Georgia, Belarus and other former Soviet states, most of them after February 2022.

Signals in the bank's data

Many unrelated senders paid for vehicles citing the same buyer ID issued by one auction platform. Some wires asked for the money to be "stored". An exporter expected to sell $1–4 million a year received over $700 million.

FinCEN links CMLN indicators to the card and wire activity of the first group. It describes the money orders as potential trade-based laundering and fraud with a southwest border nexus.

Questions for your team

Do money-order and check deposits feed your monitoring?
Can you list identifiers, such as buyer IDs, shared across different customers?
When you exit a customer, do you review the customers connected to it?
Can you test a scenario on all customers, not only those already alerted?
Do you use digital footprints (devices, phone numbers, IP addresses) to link customers?

7 FinCEN Consent Order No. 2026-03, §§II.F.1–3 and n. 47, 49.

Connect the pieces and the network appears

The auction platform gave each registered vehicle buyer an ID number. FinCEN found the same buyer IDs in wire instructions and on money orders deposited by the platforms. Dozens of unrelated senders cited one buyer ID. An exporter that did business with both platforms received far more than its profile allowed. Every one of these records was already in the bank's data.⁸

Figure 4. From connected data to testing hypotheses

1 Connect the data: Wires, money orders, checks, cards, KYC, SAR history and digital footprints go into one knowledge graph. Every record keeps its source. 2 Resolve identities and entities: Different records of the same person, company, phone or buyer ID merge into one entity. Only then can you see who is really behind the payments. 3 Check the whole population: Take the pattern from page 6 (many unrelated senders, one ID, one customer) and test it on every customer at once, not only those already alerted. 4 Change conditions, test hypotheses: Change the amount threshold or time window, or add an attribute, and run the analysis again on the full data without rebuilding the model. — Figure 4. Four steps of population analysis. Names, parameters and number of groups are illustrative.

Why few banks can run this today

FinCEN's analysis worked across the whole population: it grouped more than 680,000 money orders into about 220,000 sets and matched buyer IDs across wires and deposits. Law enforcement told the bank that extensive data analysis had revealed repeated purchases by certain buyers and connections among purchasers. The bank, by contrast, planned an analysis of all its auto auction customers in 2022 and did not carry it out for two years. Its case notes record that one customer's activity was so large the investigative system could not download the transactions.

This is not unusual. One bank we spoke with told us that preparing a single population-level scenario of this kind can take more than two months: data must be extracted and joined, and new relationships built. When one parameter changes, much of the work has to be recalculated or started again. Tracing paths through transactions on the full volume is often impossible with existing technology, or too slow and costly to repeat.

8 FinCEN Consent Order No. 2026-03, §§II.D.3.b, II.F.1–2 and n. 53.

How DataWalk helps Population analysis on connected data

DataWalk is a graph-AI investigation platform used by banks and government agencies to fight fraud and financial crime. It connects siloed data into one knowledge graph, so investigators and AI agents can find hidden relationships, speed up investigations and prove every answer.

Connect every channel. Money orders, checks, wires, cards, ACH, KYC and SAR history in one knowledge graph, including products your alerts do not cover. Digital footprints, such as devices, phone numbers and logins, can be added as another layer.
Link shared identifiers. Buyer IDs, senders, card holders, addresses, phone numbers and devices become entities that join customers, with the evidence for every link kept.
Run scenarios on the whole population. Test a typology across every customer at once, not one alert at a time. Change a parameter and run it again on the full data, without rebuilding the data model.
Follow the network. When you exit a customer, review everyone connected to it. AI agents work on the same graph, with an audit trail of each step.

A typical scenario project today	With DataWalk
Data extracted and joined again for each new question	Data connected once, in one knowledge graph
Relationships rebuilt for every scenario	Relationships reused across scenarios
A changed parameter means recalculating or starting over	Change the parameter and run again
Path analysis on the full volume too slow or too costly	15-hop trace across 200 billion transactions in 5.34 seconds. In one client case, 28 transfer steps traced and €5 million blocked.

Introduction