If you would rather listen to an audio summarising this blog and additional detail, you can do so by clicking here.  

​This is a very good money laundering typology for AML training, especially if looking for an international ransomware-as-a-service case involving cryptocurrency, Ireland, the USA and how the High Court of Ireland exercises extradition treaty proceedings. 

Our Peter Oakes is often asked to write more about useful money laundering cases that can be used by MLROs (Money Laundering Reporting Officers) as typologies for AML training.  This typology on Ireland's money laundering website, www.moneylaundering.ie, pulls together:

* ransomware-as-service;
* predicate criminal offence;
* a Ukranian national living in Cork;
* identification of proceeds of crime in bitcoin recorded on the supposedly anonymous promoting blockchain;
* Irish High Court extradition proceedings;
* alleged abuse of human rights; and
* evidence from Google Analytics and Google Drive.

So we am pretty sure it ticks all the "right boxes".

The case when examined from multiple sources (like Money Laundering Ireland has done) provides interesting insights into the Irish extradition regime, identification of supposedly anonymous bitcoin transactions recorded on the blockchain and evidenced obtained from Google Analytics.

Sources:

• The Attorney General v Oleksi Oleksiyovych Lytvynenko [2025] IEHC 100. See https://www.irishlegal.com/articles/high-court-man-committed-to-prison-pending-his-extradition-to-usa-to-stand-trial-for-ransomware-conspiracy-charges / https://www.iisf.ie/Oleksii-Lytvynenko-extradited-conti  /https://ie.vlex.com/vid/the-attorney-general-v-1094149608
• US Case.  https://www.justice.gov/opa/pr/ukrainian-national-pleads-guilty-wire-fraud-conspiracy-connection-conti-ransomware / https://securityaffairs.com/193590/uncategorized/ukrainian-extradited-from-ireland-pleads-guilty-over-role-in-conti-ransomware-scheme.html

STRs Received at FIU Ireland (1995-2024)

1.  Summary

i.  STR Volumes:

1. Reports have grown from 199 in 1995 to peaks of nearly 69,000 in 2023 before dipping to ~61,000 in 2024.
2. Significant growth particularly after 2017, reflecting regulatory expansion, improved monitoring, and new reporting sectors.

ii.  Main Reporting Entities (2024):

1. Banks remain dominant (22,765 STRs).
2. Strong reporting from Credit Unions (3,707), E-Money Institutions (1,954), and Payment Institutions (1,694).
3. Virtual Asset Service Providers (VASPs): massive spike in 2023 (23,843 STRs), dropping sharply to 3,604 in 2024.
4. Other contributors include Gambling Services, High-Value Goods Dealers, Solicitors, and Trust/Company Service Providers.

iii.  STReu (European Union reporting obligation):

1. Rapid rise to 25,209 reports in 2024, mostly from E-Money Institutions (19,929), VASPs (3,299), and Payment Institutions (1,536).
2. Indicates increased regulatory pressure and integration of EU standards.

2.  What’s interesting

i.  VASPs volatility in STR reporting:

1. Explosive growth in 2023, followed by a collapse in 2024, suggests either a regulatory/reporting adjustment, de-risking by firms, or structural market change. This is a key trend for monitoring crypto-related compliance.

ii.  E-Money Institutions as major STR drivers:

1. Both domestic STRs and EU STReu filings show EMIs reporting heavily — highlighting their central role in AML risk, especially in digital payments.

iii.  Persistent dominance of banks but diversification of sources:

1. While banks still contribute the majority of STRs, reporting from sectors like gambling, high-value goods, and trust/company service providers is increasingly material — signalling expanding AML exposure beyond traditional finance.

iv.  International cooperation obligations:

1. The file emphasises FIU Ireland’s role in cross-border intelligence sharing (EU & global). For compliance teams, this underscores the likelihood that STRs involving international activity will quickly escalate into multi-jurisdictional investigations.

​More than €90,000 seized in money laundering investigation [September 14, 2025]

1.  Summary:
i.  Over €90,000 in cash was seized in a money laundering investigation in Ireland, focused on large cash withdrawals from ATMs in Dublin and Cork. The Garda National Economic Crime Bureau (GNECB) led the operation, which followed transactions between 11 August and 9 September 2025.

ii.  The withdrawals used bank cards linked to accounts based in Poland and Norway. During the operation, a vehicle was searched in Lucan, Dublin on 13 September, where a substantial amount of cash and multiple bank cards were recovered. A male in his early-30s was arrested under relevant sections of Irish law.

iii.  Later, a woman in her 30s was also arrested at a Dublin address. Additional searches in Cork recovered more cash, foreign currency, false ID documents, bank cards and mobile phones. Gardaí are cooperating with international law enforcement through Europol in relation to the foreign bank accounts connected to this case. Both suspects remain in custody and the investigation continues.

2.  What’s interesting
i.  Cross-border bank accounts & multi-jurisdictional risk

1. The use of accounts in Poland and Norway to facilitate withdrawals in Ireland shows how transactions can span multiple jurisdictions. Regulatory oversight and mutual cooperation (like via Europol) are crucial.
2. From a compliance view: your AML policies need to account for foreign-linked accounts, which may have different standards or flags.

ii.  Large cash withdrawals from ATMs as a red flag

1. The pattern: significant cash draws from ATMs across different locations. This is a classic cash-based laundering indicator.
2. Suggests that threshold monitoring (for unusual ATM withdrawals) should be tight. Need to consider not just deposits but outflows (withdrawals) and movement of physical cash.

iii.  Use of multiple bank cards and false IDs

1. The use of multiple cards tied to foreign accounts, and the recovery of false identification documents, mobile devices etc. This indicates sophistication in trying to obscure the trail.
2. Compliance officers should ensure that policies around identity verification and suspicious account behaviour are robust; for example, if cards are used in atypical patterns, or many cards are linked to one vehicle/search.

iv.  Timing / detection window

1. The withdrawals took place over a month, from mid-August to early September, before a coordinated operation was executed. That suggests a window where unusual activity might have been visible but not yet acted upon.
2. Important for continuous transaction monitoring systems to pick up series of suspicious activities, not just isolated incidents.

v.  Asset seizure & law enforcement cooperation

1. The seizure of cash, cards, false IDs etc shows the importance of physical searches as well as forensic investigation.
2. Coordination between financial institutions, national enforcement bodies & international bodies (Europol) is key. Compliance officers should ensure their firms cooperate fully, and preserve data/records accordingly.

vi.  Use of false/fraudulent documentation / identity fraud

1. The presence of false IDs indicates an identity fraud element. Compliance teams must ensure that KYC/AML checks include robust identity verification and monitoring for forged or suspicious documents.

vii.  Potential reputational & regulatory risk

1. For banks or payment service providers, being linked (even unknowingly) to accounts engaged in such activity can result in regulatory scrutiny, fines, or reputational damage.
2. Firms should have processes for responding to regulatory enquiries, internal investigations, and for reporting suspicious activity to relevant authorities.

Source: https://www.breakingnews.ie/ireland/more-than-90000-euro-seized-in-money-laundering-investigation-1806873.html

​Student charged with money laundering after agreeing to act as money mule for text scam [September 12, 2025]

Summary:
i.  A 20-year-old student, Darragh Sutcliffe, pleaded guilty to money laundering after agreeing to act as a money mule for a “smishing” (text phishing) scam. He had no prior convictions. At the time of the offence, he was planning to sit accountancy exams.

ii. Between 23-25 May 2023, €16,350 in fraudulently obtained funds from smishing scams were deposited into his account in four separate transactions. €9,350 came from one victim (Cork woman) via an “E-flow text scam” after she responded to a malicious message. Another €2,000 from a Killarney resident.

iii.  Sutcliffe withdrew about €3,500 from ATMs in Lucan before his bank froze his account. After his account was flagged, he went to Gardaí and made a false report to try to distance himself from the transactions. The banks reimbursed the victims, except AIB remained out €3,500 (the ATM withdrawals).

iv.  In court, his solicitor emphasised that he was a typical “non-complicit money mule” — i.e. someone who allows just their account to be used on promise of payments which never materialised.
v.  He’ll repay the stolen funds, was contrite, has family support; sentencing has been adjourned until February. The judge also ordered a €5,000 donation to a cancer charity.

2. What’s interesting:

i.  Money mule risk & identification

1. This case illustrates the pattern of how innocent or at-least non-fully aware persons are recruited as money mules: promised a small payment, asked to allow their bank account to be used, but then funds are moved through them.
2. Useful reminder that “non-complicit” classification is possible: people may not know the full scope. That has implications for how to treat suspicious activity, assessing intent, and for reporting obligations.

ii.  “Smishing” / phishing via text + social media (Snapchat in this case)

1. Attack vectors continue to evolve. A compliance program must factor in threats arising from text messages (“E-flow text scam”) and social media solicitations, not just email or more established channels.
2. Awareness programs are essential: many victims are falling for such scams, and many “mules” believe they will be paid or are told they are doing something innocuous.

​
iii.  Bank account usage, transaction monitoring, freezing mechanisms

1. The bank froze the account once suspicious, but a portion had already been withdrawn via ATM. That shows time lag can allow losses.
2. Compliance officers should emphasize timely detection and account freezing protocols, perhaps thresholds or red flags designed to catch multiple deposits from unknown sources in quick succession.

iv.   False reports / attempts to distance oneself

1. After being alerted to suspicious transactions, the accused made a false statement to law enforcement. That underscores potential challenges in investigations, where innocent or semi-innocent parties may try to shift blame or deny involvement.
2. Compliance teams and audit/investigative functions should anticipate this and ensure proper records (bank statements, communications) are preserved.

v.  Financial harm & liability:

1. The banks reimbursed most victims, but one bank incurred loss via ATM withdrawals. That illustrates exposure risk to financial institutions even when victims’ losses are covered; also reputational risk.
2. From a compliance standpoint, institutions need strong policies on reimbursement, reporting to regulators, all tied into AML / fraud prevention frameworks.

vi.  Education & awareness as mitigation

1. The accused plans to speak to local schools about dangers of such scams. The court noted that awareness 2 years ago was lower.
2. Suggests a role for financial institutions, regulators, and compliance functions in public education and outreach to reduce the supply of money mules.

vii.  Sentencing & regulatory implications

1. The punishment isn’t yet final, but there is recognition by the court of mitigating factors (lack of prior conviction, remorse, family support).
2. For compliance programs, knowing how courts treat “non-complicit” mules is important for internal policies (e.g. deciding when to refer for prosecution vs when to consider them victims/responsive parties).

Source: https://www.irishexaminer.com/news/arid-41704397.html

Four charged in connection with international money laundering probe [September 8, 2025]
1.  Summary
i.  Four people in central Dublin have been charged with money laundering involving proceeds of crime, in amounts ranging from around €29,000 upwards.

ii.  The investigation is being carried out by An Garda Síochána’s GNECB (Garda National Economic Crime Bureau) under organised crime legislation.

iii.  The alleged laundering involved use of bank accounts in Poland and Norway; there were large cash withdrawals from ATMs in Dublin and Cork over a period (11 August - 9 September 2025).

iv.  Items seized include cash, bank cards, false identification documents, and mobile phones.

1. What’s interesting

i.  Cross-border aspect & foreign-linked accounts: The use of accounts in Poland and Norway signals risk in international channels. Monitoring & due diligence must consider non-domestic account behavior, especially when funds are being transferred or accessed from multiple jurisdictions.


ii.  ATM cash withdrawal patterns as red flags: Repeated, large withdrawals via ATMs in different locations (Dublin & Cork), often a sign of layering or attempt to extract physical cash; good reminder to ensure outbound cash flow monitoring is strong (not just deposits).


iii.  False identities & multiple devices: Use of false IDs, multiple bank cards, mobile phones suggests efforts to obscure identity, complicate tracing. Reinforces the importance of strong identity verification (KYC), device monitoring if relevant, and forensic recordkeeping.


iv.  Regulatory / legal tools in play: Use of organised crime and criminal justice legislation (Sections under Irish law) shows that law enforcement is using serious legal powers. For compliance programs, this implies that suspicious activity reports (SARs) etc. must be airtight; any lapses could lead to legal/regulatory exposure.

Source: ​www.rte.ie/news/2025/0908/1532433-money-laundering/

Very good AML typology on money mules and goes to show that highly educated people can be sucked-in to money laundering.  I posted about it on Linkedin here and a guest contributor also wrote a detailed piece here.

Noting this person's background of a business degree and work at an airline and tech company, quite possible that a career in financial services may be on the cards. That is certainly not over, but there will be a big hurdle to clear because the fact that no conviction was recorded doesn't mean that the person does not have to disclose it, It will raise concerns about judgement with a potential future regulated financial services provider employer.

➡️ A business graduate who let her “con-artist boyfriend” use her bank account to launder money has been spared a criminal record.
➡️ Chelsea Stelma Cassule (25) had been taken into her then partner’s trust when she gave him access to her account, which was used to transfer the €300 proceeds of a fraud.
➡️ Judge John Hughes struck the case out at Dublin District Court after hearing she had made a €300 charity donation and a probation report put her at a “low risk” of reoffending.
➡️ Cassule, of Brabazon Hall, Cork Street, Dublin 8, had pleaded guilty to money laundering – possession of the proceeds of criminal conduct.
➡️ Cassule had no previous convictions.
➡️ A defence barrister said the third party was Cassule’s boyfriend at the time. He told her he had a job opportunity in Belfast and was going to move there but needed a deposit and asked to use her account.
➡️ She did not know her boyfriend was defrauding anyone but in the cold light of day, she accepted the story was “a little bit fanciful”, the barrister said.
➡️ The accused had a business degree and had worked for an airline and a tech company.
➡️ Judge Hughes said Cassule had been “a victim of this herself” and had not made any financial gain.
Her “con-artist boyfriend” had “taken her into his trust” and her suspicions were lowered, but she “should have known better”, the judge said.
➡️ The accused had an otherwise “unblemished” record.

Source: ​https://www.independent.ie/irish-news/courts/woman-who-let-boyfriend-use-her-account-for-money-laundering-avoids-criminal-record/a1373019726.html

Woman who let boyfriend use her account for money laundering avoids criminal record [September 3, 2025]

1.  Summary:
i.  A business graduate allowed her “con-artist boyfriend” to use her bank account for money laundering.
ii.  She was spared a criminal record in relation to that offence.
iii.  Her defence emphasised that she had been manipulated / misled by her partner, and that her involvement was passive (i.e. letting use of account rather than actively operating the laundering) and that she did not profit.
iv.  The court considered her personal circumstances (e.g. being misled, her lack of awareness of full criminality) when deciding to not impose a criminal record.

2.  What’s interesting:

i.  Non-complicity / Naivety” defence

1. The case shows how someone may be implicated merely by giving account access, even if they believe they are not doing anything wrong. Recognising the difference between recklessness, negligence, and intent is important.

ii.  Risk of insiders or account holders being exploited

1. It underlines the risk that legitimate account holders can be used by others (partners, acquaintances) as intermediaries without fully understanding the scheme. Compliance programmes need to consider not just customers but also relationships and account-sharing risks.

iii.  Court leniency & thresholds for criminal record

1. The fact she avoided a criminal record suggests there are legal / judicial thresholds around culpability, awareness, intention, benefit, etc. For compliance officers, this implies that not all suspicious activity leads automatically to severe legal consequences — the subtleties in how the case is presented matter (e.g. whether account holder understood what was occurring).

iv.  Implications for account monitoring / KYC / due diligence     

1. Even if a person is not willingly laundering, the very use of someone else’s account (especially without strong controls / oversight) is a red flag. Monitoring unusual sources of funds or unexpected account usage remains critical. Also potential institutional liability or reputational risk, even when the account holder claims naivety.

Source: ​https://www.independent.ie/irish-news/courts/woman-who-let-boyfriend-use-her-account-for-money-laundering-avoids-criminal-record/a1373019726.html

Inside an Irish Money Laundering Operation: A Case Study
 
When Gardaí raided a remote farm in County Clare, they didn’t just uncover livestock and machinery—they unearthed a sophisticated money laundering scheme that had quietly converted criminal proceeds into assets that looked, on the surface, perfectly legitimate. This case illustrates a classic Irish money laundering typology, showing how criminals place, layer, and integrate illicit cash within Ireland’s financial and property systems.
 
Placement: Converting Cash into Tangible Assets
 
The operation began with large volumes of cash generated from drug trafficking and organised crime. Instead of depositing the money directly into banks, where suspicious transaction reports (STRs) might be triggered, the criminals purchased agricultural land, machinery, and livestock. By acquiring a functioning farm, they could explain away large cash movements as agricultural income. This is a common Irish adaptation: cash-rich illicit groups investing in rural property or cash-intensive businesses (such as pubs, car washes, or construction firms) to disguise their income sources.
 
Layering: Complex Transfers and False Trails
 
Once the farm was operational, transactions became deliberately complex. Animals were bought and sold across county lines, often with inflated or understated valuations. Equipment was leased through third parties, and funds were moved across multiple Irish bank accounts in amounts just under the €10,000 reporting threshold. The criminals also relied on “money mules”—individuals, often vulnerable or indebted, who allowed their accounts to be used for funneling funds. This layering process created a tangled financial trail, frustrating investigators trying to trace the money back to its illicit origins.
 
Integration: Dirty Money Becomes ‘Clean’
 
Over time, the scheme succeeded in integrating illicit funds into the mainstream economy. The farm produced legitimate revenue streams: cattle sales, EU agricultural subsidies, and lease agreements. Criminal proceeds were effectively rebranded as farm income. The perpetrators then used these seemingly legitimate profits to invest in vehicles, luxury goods, and even overseas property. By this stage, the money appeared clean—making it extremely difficult to prove its criminal origin without extensive investigation.

This case demonstrates several AML red flags relevant to Ireland:

• Unexplained agricultural or property investments by individuals with no farming or business background.
• Cash-intensive operations inconsistent with the scale of the declared business.
• Structuring deposits (amounts just under the €10k threshold).
• Use of third-party accounts and money mules.
• Rapid turnover of assets (frequent sale and repurchase of livestock or equipment).

The case was eventually cracked by the Garda National Economic Crime Bureau (GNECB), working in partnership with the Criminal Assets Bureau (CAB). Assets—including the farm, machinery, and livestock—were seized under proceeds of crime legislation. Under the Criminal Justice (Money Laundering & Terrorist Financing) Act 2010, amended in line with EU directives, individuals convicted of laundering can face up to 14 years in prison and unlimited fines. In addition, the Central Bank of Ireland can levy significant administrative sanctions against financial institutions that fail to detect and report suspicious activity.

This farm case typifies money laundering typologies in Ireland: criminal cash embedded in rural businesses, layered through complex transactions, and integrated into the economy via legitimate-looking revenue.
For compliance officers, solicitors, accountants, and financial institutions, it serves as a reminder that criminal proceeds don’t always appear as stacks of cash in city banks—they may be hiding in plain sight on a quiet farm road in the Irish countryside.

Source: https://www.irishmirror.ie/news/irish-news/crime/gallery/inside-clare-farm-criminal-assets-35794821

Nail bar worker charged with money laundering after €80k seizure [August 26, 2025]

Summary:
i.  Defendant: Quang Nguyen, 28, of Swords, Dublin; works in a nail bar.

ii.  Seizure: Gardaí recovered about €78,500 and £10,800 at his home.

iii.  Charge: Money laundering under section 7 of the Criminal Justice (Money Laundering and Terrorist Financing) Act 2010 — accused of possessing those amounts as proceeds of crime.

iv.  Explanation given: Nguyen told Gardaí that the euros came from friends to help him open a nail bar in Drogheda; he could not explain the origin of the British currency. The people allegedly supplying the funds have not yet been contacted or verified by Gardaí.

v.  Background & other facts:

1. He has been legally residing in Ireland for about 10 years.
2. He claimed to have been “trafficked” through Russia, Germany, Austria in containers prior to arrival.
3. Bail was set at €21,000 with certain bond conditions.

What’s interesting:

i.  Large cash holdings + unexplained source(s):
The combination of a high cash amount and inability to clearly verify or document the origin of funds (especially from “friends”) is a classic red flag. Being able to trace and validate origins of large cash deposits is critical for AML compliance.

ii.  Cross-currency risk / multiple currencies:
The presence of both euros and British pounds, with only partial justification for one, adds complexity. Monitoring for unexplained foreign currency inflows is important, especially in jurisdictions close to or dealing with different currencies.

iii.  Use of funds for business investment claims vs. money laundering allegations:
Claiming the money was intended for investment (e.g. starting a nail bar) is a common defense. Compliance must ensure that business investment claims are backed by legitimate documentation (invoices, contracts, etc.) and corroborated sources, not just anecdotal “friend-gave-me-money.”

iv. Presumption of innocence but burden of proof on source verification:
The case highlights that while legal process presumes innocence, from an institutional/compliance standpoint you must act on strong indicators. Documenting KYC, performing enhanced due diligence where needed, and maintaining records so you can support or contest claims about fund origin are vital.

​Source: https://www.waterford-news.ie/nail-bar-worker-charged-with-money-laundering-after-80k-seizure_arid-68834.html

The saga of Thierry Fialek‑Birles—known in some circles as “Terry Birles,” the self‑styled Irish aristocrat—reveals the elaborate mechanics by which confidence fraud and money laundering intertwine, particularly in cross‑border contexts. His multi‑million‑euro scheme, which ensnared celebrated French comedian and filmmaker Dany Boon, was woven with layers of deception that offer vivid insight into typologies of transnational financial crime.

Claiming decency, heritage, and legal expertise, Fialek‑Birles convinced Boon he descended from an ancient Irish aristocratic family and was an Oxford‑educated maritime lawyer. Boon was drawn in by references to glitzy affiliations, including the Royal Cork Yacht Club, and grand plans involving yacht restorations and tax‑free investments with the (fake) Irish Central Bank

These personal details were the foundation of trust—crafted authenticity intended to mask the reality of fraud and exploitation.

Over several months, Boon transferred approximately €2.2 million for maintenance of his yacht and a further €4.5 million into a supposedly tax‑free investment scheme. Of course, that scheme was entirely fictitious.
​
What emerges is a clear typology: criminals often deploy a mirage of legitimacy—be it elite education, exotic family history, or exclusive clubs—to lower suspicion and facilitate large financial transfers.

Once the money was in, Fialek‑Birles dissolved the façade, vanishing from view. Subsequent investigations revealed he had exploited a network of shell companies across jurisdictions—Irish‑registered entities including South Seas Merchants Mariners Ltd Partnership (SSMM), as well as entities in Samoa, the British Virgin Islands, Antigua and Barbuda, and beyond.

This corporate scaffolding served two purposes: obscuring the true ownership of funds and imprinting complexity into the trail—hallmarks of layering in money laundering typologies.

Irish courts responded with stringent measures, including freezing orders (Mareva injunctions) that restrained assets—including yachts in Cork, property in Youghal, and offshore accounts—totalling upwards of €4.87 million in damages awarded to Boon by a High Court judgment.

This demonstrates the integration of civil and criminal strategies to protect victims and recover assets.
 
What does this typology teach us? First, exploitation of social engineering and reputation—as in claims of aristocracy or legal expertise—remains a potent tool in money laundering and fraud. Second, the use of front-companies and offshore jurisdictions is a recurring tactic to launder proceeds and obscure paper trails. Third, effective cross-border cooperation—from Interpol notices to freezing orders—is crucial for disruption.

In essence, the fake aristocrat case underscores the risks when legitimacy becomes a façade. Criminals exploit cultural or institutional trust; legitimate structures—like courts and law enforcement—must respond with equal dexterity. Vigilance toward seemingly charismatic figures, investment opportunities, or inherited privilege remains a critical defense in the typology of transnational fraud and money laundering.
 
Source: https://www.theguardian.com/world/2025/aug/26/dany-boon-french-film-star-the-fake-irish-aristocrat-thierry-fialek-birles-and-the-missing-euros