Europol has supported law enforcement authorities from six countries in taking down underground bankers who were moving and laundering the proceeds of large-scale drug trafficking and other serious crimes. Building on the findings from two major investigations, Operation GORGON and Operation WHITEWALL, this follow-up operation involved close collaboration between Europol’s experts in serious and organised crime and in financial investigations. It led to the arrest of nine suspects and the seizure of evidence (documents, mobile phones), valuables (gold, luxury goods), EUR 35 000 in cash and EUR 25 million in cryptocurrencies.

Paper trail on euro banknotes

In 2021, cash was seized during a house search in connection with an investigation into cocaine trafficking. Some of the five-euro notes had handwritten inscriptions that provided information on who was coordinating and facilitating the financial aspect of the drug trafficking.

The Spanish Guardia Civil submitted this information to Europol, which cross-checked it against the data gathered in the EncroChat and Sky ECC cases. As a result, the suspect was identified as a coordinator offering underground banking services to a criminal network based in southern Spain, which in turn was under the supervision of a network operating from Dubai. The suspect, a British national, was arrested on 12 September 2022.

Building on this success

The next step in the investigation was to analyse the data in greater depth to identify individuals in contact with the suspect. This effort aimed to map the criminal network and understand the roles of its members. The close collaboration between Europol, the Spanish Guardia Civil and members of the dedicated Operational Taskforce established at Europol facilitated the distribution of numerous intelligence packages. Based on these findings, a Europol-coordinated action day took place on 4 November 2024 in Malaga, Spain, with the participation of Belgian, Bulgarian, Dutch, and United States law enforcement authorities.

‘Offline’ and ‘online’ money flows

Operation WHITEWALL was the first criminal investigation of what was to become a Europol Operational Taskforce focused on underground banking. It aimed to disrupt and dismantle financial networks offering ‘crime as a service’. Predominantly controlled from the United Arab Emirates and operating throughout the EU and beyond, these criminal service providers cater to those who need to conceal the origins of vast amounts of illicit income.

One of the main findings of the investigation was that a member of a criminal network based in Albania, targeted during Operation GORGON, was facilitating the transfer of large sums of money through cryptocurrencies. Used not only by the Albanian criminal underworld, but also by other criminal organisations and high-value targets, this is an innovative approach to money laundering.

Europol as the centre of expertise

The takedown of these sophisticated criminal enterprises relied on Europol’s multi-faceted expertise in the various areas of crime under investigation. Operations GORGON and WHITEWALL highlighted the many facets of organised crime, with underground banking and money laundering not only functioning as financial crimes in their own right but also as services for those involved in drug trafficking, contract killings and weapons trafficking, to name but a few of the crimes in which the networks are involved.

In the course of these long-term investigations, some of which are still ongoing, Europol has disseminated numerous intelligence and analytical reports to the cooperating partners, as well as numerous operational meetings held at the Agency’s headquarters in the Netherlands or in Spain and Albania. During the action days, Europol deployed specialists and analysts to the raids, where they provided expertise in organised crime, financial crime and asset recovery. Cryptocurrency experts and cyber specialists supported the actions on site with mobile offices, as well as from Europol’s headquarters, offering their digital forensic abilities and remote investigative capabilities.

Operation GORGON and Operation WHITEWALL are textbook examples of structured data-driven case building, trust-based international partnerships, and cross-department support provided by Europol. The collaboration with a leading stablecoin issuer and a prominent global cryptocurrency asset provider proved to be instrumental in achieving the operations’ successes. Their seamless integration into the investigation and dedication to halting illegal activities enabled the efficient execution of complex operational measures. This success showcases the power of public-private-partnerships in achieving seizures within the digital asset ecosystem.

Participating countries:

• Albania: Special Prosecution Office for Anti-Corruption and Organised Crime (Struktura e Posaçme Anti-Korrupsion – SPAK), National Bureau of Investigation (Byroja Kombëtare e Hetimit)
• Bulgaria: General Directorate Combating Organized Crime (?????? ???????? „????? ? ?????????????? ???????????“)
• Belgium: Federal Police (Federale Politie)
• Netherlands: FIOD
• Spain: Guardia Civil
• United States: Drug Enforcement Administration