Criminals co-mingle illegal and legal proceeds, placing funds generated from environmental crimes into legitimate business accounts. This exposes financial institutions to criminal clients seeking to intermix and hide illicit proceeds. Often, criminals will present illegal earnings as legitimate earnings from a legal business activity they also undertake in tandem, making it harder to identify and differentiate illegitimate funds or activities from legitimate ones.
Proceeds from illegal logging may be disguised as income from legitimate harvesters or timber processors.
Proceeds from illegal wildlife trade can be funnelled through businesses such as exotic pet shops, zoos, or traditional medicine vendors, making it difficult to trace the origin of the funds.
Complex networks of intermediaries, such as nominees or custodians can be exploited to disguise beneficial ownership of a bank account, investment vehicle, or other financial instrument. This strategy is designed to avoid detection and to prevent such accounts from being linked back to criminal activity.
Proceeds of the illegal gold trade may be funnelled through shell companies or trusts that appear to operate legitimate mining services, refinery businesses, or legitimate trade.
Corporate entities with no significant assets or legitimate business operations are used to launder the illicit proceeds of environmental crime, facilitate illicit trade, purchase clandestine assets, or obfuscate the beneficial ownership of financial assets held in their name.ownership of a bank account, investment vehicle, or other financial instrument. This strategy is designed to avoid detection and to prevent such accounts from being linked back to criminal activity.
Import-export businesses are used to justify shipments of trafficked species, or to move funds linked to poaching and trafficking activities across borders without detection.
Criminals can manipulate financial transactions to avoid detection by financial institutions (FIs). This technique is often used to avoid triggering reporting thresholds that FIs must follow, as well as to layer illicit funds and obscure the source of those funds. Creating a high volume of complex transactions can overwhelm monitoring systems and investigators, making it more difficult to spot patterns indicative of money laundering.
A criminal may transfer funds through accounts linked to small-scale mining cooperatives or equipment suppliers before withdrawing the funds in cash.
Bank and wire transfers can disguise the movement of illicit funds, with third-party accounts and masking payments appearing as legitimate transactions for goods or services. These payments are typically crafted to align with the commercial activity of the sector in which the criminal operates – such as agricultural commodities or legally sourced minerals – to reduce suspicion. It is therefore important for FIs to monitor who their clients are transferring money to, to see if funds are going to individuals or entities with higher risk characteristics, such as offshore accounts or newly established companies with no clear legitimate business operation.
Funds may be wired under the pretence of purchasing mining equipment.
Traffickers may route payments through shell import-export companies, claiming the payments are for legitimate animal breeding in fact covering the cost of poaching animals from the wild. Such schemes are often facilitated by falsified CITES permits or invoices, making it harder for financial institutions to distinguish between lawful and unlawful activity.
Systems like Hawala or Fei Chien (飞钱) - are commonly used mechanisms for transferring financial value outside of the formal banking system. While most MVTS businesses serve legitimate purposes, they are also vulnerable to abuse by criminals seeking to launder proceeds from crimes. Because MVTS often operate without formal licensing or recordkeeping, they can enable the movement of large sums of money without leaving a paper trail. MVTS are also commonly used to move money across borders, allowing for individuals to move money abroad without regulatory or FIs oversight. Notably, traditional banking access is limited in remote, under-regulated regions – particularly parts of East and Central Africa – where cash-intensive operations are common. Since MVTS are already widely used for legitimate transactions in these areas, criminal use of these systems may be less likely to trigger immediate detection.
According to FATF, gold illegally mined in the Democratic Republic of Congo is often smuggled into neighbouring countries like Rwanda and Uganda, then exported to refiners in the Middle East or onward to Asia. Payments to smugglers are often made through informal remittance networks once intermediaries have secured the sale, allowing criminals to bypass formal banking channels and obscure the gold’s illicit origin.
Shadow banking entities and activities can include a wide range of FIs and instruments, such as the use of peer-to-peer lending or other fintech platforms, private investment funds, and limited-purpose finance companies that are operating outside the scope of standard banking oversight. These entities may not be subject to the same customer due diligence or reporting requirements as regulated banks, making them attractive for those looking to obscure the origin or destination of criminal proceeds.
Criminals move illicit funds out of a country through a web of layered transactions involving shell companies, intermediaries, or informal financial networks. The money is then reintroduced into the country of origin, typically in the form of foreign direct investment, giving it a veneer of legitimacy. This method can be especially attractive because it can allow criminals to take advantage of tax incentives as well. For example, illicit proceeds could be laundered through offshore accounts and then later used to purchase real estate in the origin country or shares in a legitimate business under the guise of foreign portfolio investment.
Criminals engaging in environmental crimes often seek to convert illicit cash proceeds into high-value, portable assets, such as jewellery, luxury goods, and art. These assets serve multiple purposes: they store value, facilitate cross-border movement, and are often less scrutinised by regulators and FIs, especially in regions with weak oversight. These purchases may take place through layered transactions using front companies or third parties, further obscuring the original source of funds. FIs should remain aware of clients purchasing high-value assets, especially if inconsistent with a customer’s profile, as the purchasing funds could be the proceeds of a crime such as illegal mining or wildlife trafficking.
While still a less commonly used mechanism, cryptocurrencies and other digital currencies are increasingly used by criminals engaging in illegal mining, wildlife trafficking, and other environmental crimes. These currencies appeal to criminals due to their decentralised nature and ability to facilitate fast, cross-border transfers without the same financial oversight as banks. Criminals use various methods to launder assets through crypto, such as using crypto mixers or tumblers (which break large transactions into smaller units and blend them with other users’ funds), chain hopping (where illicit actors rapidly transfer assets across multiple blockchain networks), and peer-to-peer exchanges or unregulated exchanges.
There have been reports of proceeds from illegal mining or natural resources trafficking being converted into crypto using peer-to-peer platforms.
Similarly, individuals may use cryptocurrency to purchase ivory or other illegal wildlife products through online marketplaces or encrypted messaging platforms. The growing shift of the illegal wildlife trade to online channels has made such transactions increasingly common and difficult to detect.
Cash-intensive businesses (e.g. restaurants, construction firms, agricultural suppliers) are often exploited to move and disguise illicit proceeds. These businesses, which typically generate large volumes of physical cash from legitimate activity, can serve as convenient fronts to integrate illegally earned money into the formal financial system.
Multiple cash-intensive businesses may be set up in proximity to at-risk zones, such as areas undergoing rapid deforestation or resource extraction. One common typology involves channelling large cash deposits from a cash-intensive business to beneficiaries operating in regions known for illegal mining or other forms of illegal land conversion. These payments may appear to be legitimate business expenses or supplier payments, but in reality, they are used to fund or launder proceeds from activities such as licensed mining or illegal timber extraction.
In another example, a construction business operating near an illegal gold mining region may export exaggerated cash sales to account for deposits of criminal proceeds, or a transport company could serve as a front to move both physical commodities and funds linked to illegal mining.
Suspicious Account Activity
A single bank account used by multiple businesses
Circular transactions between local bank accounts
Circular transactions between company and shareholder accounts without clear business reason
Rapid movement of funds through multiple accounts, currencies, or institutions
Unusual Payment Methods
Travelers' cheques in precious metals/stones trade
Round-dollar wire transfers (indicating layering)
Vague transfer labels like "consulting fee" unrelated to actual business
Structuring Behaviours
Deposits just below reporting thresholds
Multiple small cash deposits followed by withdrawals
Multiple deposits in various locations when account owner resides elsewhere
From 2010 to 2017, Miami-based NTR Metals laundered over US $3.6 billion in illicit gold proceeds through circular wire transfers and cash structuring involving shell companies. Transactions were often labelled only “gold purchase” just under the US $10,000 reporting threshold, and funds were layered via accounts in Switzerland, Chile and Dubai within hours of placement.
High-Risk Location Patterns
Large cash withdrawals from institutions in remote areas near illegal mining or conservation zones
Significant cash payments from high-risk jurisdictions for illegal mining/wildlife trade
Transfers between free trade zones or countries with weak beneficial ownership transparency
Cross-Border Movements
Deposits from foreign companies followed by immediate transfers to other jurisdictions
Escrow-type transactions with same beneficial owner for cross-border shipments
Multiple MVTS transfers in regions known for environmental crime
In October 2024, Interpol dismantled two criminal networks across Paraguay–Brazil–Argentina. These syndicates logged and trafficked timber using forged permits, and laundered proceeds by cycling them through fake companies in the Tri-Border. They then parked illicit funds in real estate and offshore holdings.
Newly Established Companies
Recently created companies with rapid income accumulation but little visible economic activity
Recently activated dormant companies with income inconsistent with stated activities
Third-party created export companies and bank accounts
Between 2012 and 2017, an Indonesian frozen fish exporter used structured payments, offshore layering, and third-party transfers to conceal illegal pangolin-scale exports to East Asia. The exporter showed revenues of less than US $100,000 in its first year but processed US $90 million within five years. Investigations revealed dozens of intermediary bank accounts in false names that handled 129 transfers to 23 foreign “suppliers” that never appeared in customs records
Sector-Specific Indicators
Frequent payments from mining/logging companies to unrelated beneficiaries
Increased transactions between non-licensed entities and equipment companies
Companies paying employees exclusively in cash/commission creating incentives for illicit activities
Supply Chain Anomalies
Aberrant bank activity in natural resource supply chain companies
Frequent buying/selling of shares in companies holding resource permits
Sudden economic activity increases in rural/isolated zones
Volume and Pattern Alerts
Large cash transfers from gas stations to mining/logging source areas
Unusually high cash turnover or inconsistent flow patterns
High transaction volumes at businesses near at-risk zones
Cash-intensive businesses with rapid income accumulation
Investigators found unauthorised ranchers inside Brazil’s Apyterewa Indigenous Territory moving 12,000 head of cattle through “clean” farms before sale to meat-packers JBS and Frigol, an operation marked by sudden spikes in livestock transfers and falsified transport permits that masked payments to unrelated beneficiary farms. Such “cattle-laundering” is a textbook supply-chain anomaly pointing to third-party risk and rapid, short-lived bursts of economic activity in a remote zone.
Cryptocurrency Indicators
Large/frequent crypto purchases via peer-to-peer platforms
Use of crypto mixers, tumblers, or chain hopping
Unregulated exchange usage
Third-Party and Intermediary Risks
Service intermediaries (accountants, brokers, trust providers) obscuring fund controllers
Payments from unrelated third parties with no apparent business relationship
Repeatedly amended letters of credit without reasonable justification
Timing Indicators
Sudden onset and cessation of payments within a short duration
Brief operational periods for companies registering significant exports
Immediate cash withdrawals following transfers from smelter countries to source countries
Between 2018 and 2022, a South African rhino horn syndicate laundered proceeds from illegal rhino horn sales. Following each poaching run, the syndicate deposited large sums of cash exclusively into local accounts, which were used to purchase properties and vehicles within days, with account activity spiking briefly and then going dormant – indicating brief operational periods and high-volume cash turnover.cattle through “clean” farms before sale to meat-packers JBS and Frigol, an operation marked by sudden spikes in livestock transfers and falsified transport permits that masked payments to unrelated beneficiary farms. Such “cattle-laundering” is a textbook supply-chain anomaly pointing to third-party risk and rapid, short-lived bursts of economic activity in a remote zone.
The Environmental Crimes Financial Toolkit is developed by WWF and Themis, with support from the Climate Solutions Partnership (CSP). The CSP is a philanthropic collaboration between HSBC, WRI and WWF, with a global network of local partners, aiming at scaling up innovative nature-based solutions, and supporting the transition of the energy sector to renewables in Asia, by combining our resources, knowledge, and insight.
Large cash withdrawals from financial institutions operating in remote or rural areas that are near or in areas with higher levels of land conversion (e.g. resource extraction or agricultural production).
Frequent payments from companies in the high-risk land conversion sectors (like timber, extractives or agriculture) to suppliers or beneficiaries unrelated to the legal person’s activity or business.
Circular transactions between local bank accounts.
Deposits or transfers to a trader, dealer, or third party from foreign companies followed by the immediate transfer of similar amounts to another jurisdiction.
Transaction references using timber specimen names or veiled speech.
Transactions which involve the use of repeatedly amended or frequently extended letters of credit without reasonable justification or for reasons like changes of the beneficiary or location of payment.
Multiple deposits occurring in various locations when the account owner resides elsewhere, for example, deposits made in various cities when the account owner resides in a different city.
Transfers from country where the gold smelters are located to source countries for gold, and almost immediate cash withdrawal of majority of the transfer.
Increase in transactions between entities or individuals not registered in mining/logging sector (i.e., non-license-holding) and equipment leasing companies and equipment sales companies.
Recently created companies that register gold exports for significant amounts and noticeably brief period of operations.
Frequent buying and selling of shares in companies holding agricultural, mining or logging permits, especially transactions involving shareholders in third party jurisdictions.
Client is a recently activated dormant company which undertakes resource extraction with income inconsistent with the activity being undertaken, where the primary customer or beneficiary is a related corporate entity.
Transactions between accounts of different companies that are affiliated with the same customer, particularly to or from free trade zones or countries with less beneficial ownership transparency.
A single bank account being used by multiple businesses.
Unusual forms of payment for a specific trade/sector, e.g. use of travellers’ cheques in the trade of precious metals or stones.
The use of services intermediaries such as accountants and brokers or trust or company service providers that help to obscure the identity of persons controlling funds.
Structuring of deposits just below suspicious transaction reporting thresholds.
Transactions which involve the use of repeatedly amended or frequently extended letters of credit without reasonable justification or for reasons like changes of the beneficiary or location of payment.
Checking accounts receiving cash deposits in amounts under $1,000 as frequently as several times per month. These deposits may be followed by ATM withdrawals in foreign countries. This method, sometimes referred to as micro-structuring, is used by ‘smurfs’ to deposit cash which may then be used to purchase goods.
Frequent payments from companies in the logging or mining sectors to individuals or beneficiaries unrelated to the legal person’s activity or business.
Large volume and value of cash transfers from cash-intensive businesses (such as petrol or gas stations) to beneficiaries in areas known as a source of mining and logging and land clearing.
Aberrations/anomalous bank activity (i.e. sudden, or unexplained changes to cash flows) or corporate revenues of company operating in natural resource supply chains (e.g. timber processing, harvesting).
Sudden and unexplained increases in economic activity (formal and informal) in rural or isolated zones, particularly in source countries for illegal logging and mining.
Rapid fund movements such as multiple cash deposits and round amounts, internal transfers followed by multiple cash withdrawals, or multiple cash deposits into account followed by multiple cash withdrawals.
Significant cash payments into accounts linked to individuals from high-risk land conversion jurisdictions.
Escrow-type transactions from/to accounts and companies with the same beneficial owner for cross border shipments.
Illogical or anomalous loans between trading and import/export companies in high-risk zones, especially in source and transit countries for land conversion.
Use of third parties to create export companies and bank accounts, such as ATM cards registered under third parties.
Transactions which involve receipt of cash (or other payments like wire transfers, checks, bank drafts or postal money orders) from unrelated third-party entities or an intermediary (either an individual or an entity) apparently unrelated to the seller or purchaser of goods. This may be done to obscure the true origin of the funds (e.g. wires where no apparent business relationship appears to exist between the originator and the beneficiary).
Newly established gold (or other minerals) buying companies with rapid accumulation of large amounts of income (cash and bank accounts) showing little real economic activity at their facilities.
High value, volume or frequency of transactions involving banks, money service businesses and remitters (including mobile payment processors and/or electronic money), or unusually high volume of business turnover in cash transactions at businesses providing consumer goods and services in proximity to at-risk zones.
Companies such as refineries or timber processing facilities that pay their employees exclusively in cash and/or on a commission basis, creating the potential of a direct incentive for investment into illicit activities.
High-risk geographic origins
Shipments or transactions from high-risk source countries or regions, as detailed below.
Involvement of locations identified as key transit hubs or destination countries for the products of environmental crime.
Transactions from countries with low penalties for environmental crimes.
Conflict and instability
Shipments from countries experiencing current conflict and rich in natural resources (e.g. minerals, timber).
Transactions from natural resource-rich countries with high drug cartel presence.
Activity from regions where crackdowns on drug crimes may have incentivised diversification into natural commodities.
Governance and security indicators
Involvement of politically exposed persons (PEPs) from higher-risk countries and regions.
Use of intermediaries or shell companies registered in offshore or higher-risk jurisdictions.
Shipments from natural resource-rich countries where local crime rates around forest-dense regions or protected areas have increased.
Money laundering risk
Commodities transported to or from jurisdictions designated high-risk for money laundering (e.g., FATF Black List or Grey List countries).