MONEYVAL ¦ Report on Money Laundering, Terrorist and Proliferation Financing Risks from Conflict Proceeds

Proceeds of conflict – How wars fuel money laundering, terrorist financing and proliferation risks

Conflict zones generate more than humanitarian crises – they create fertile ground for illicit financial flows that sustain violence, enrich corrupt networks, and enable the procurement of weapons and dual‑use technologies. The MONEYVAL December 2025 typologies report on money laundering, terrorist financing and proliferation financing linked to proceeds obtained from conflicts lays out the mechanisms used to extract, conceal and move those proceeds, the emerging global trends, and gaps in national risk frameworks that leave jurisdictions exposed. This article summarises the report’s key messages, illustrates the most consequential typologies, and highlights the practical policy steps needed to limit the financial lifelines of modern conflicts.

Why conflicts become incubators of illicit finance – weakened controls and hybrid threats

Armed conflicts and related hybrid operations (including cyber-attacks, disinformation and economic coercion) weaken state institutions, disrupt regulatory oversight, and damage the capacity of law enforcement. That environment produces predictable conditions for illicit proceeds: institutional capture and grand corruption; theft and re‑registration of public and private assets; new and altered trafficking routes for drugs and arms; exploitation of displaced or vulnerable populations; and large‑scale cyber-enabled fraud and extortion.

The report emphasises that proceeds tied to conflict are not a single typology but a web of interlinked criminal economies. Corruption both drives and is driven by conflict; cybercrime and ransomware become revenue streams; illicit natural‑resource extraction and smuggling produce convertible value; and non‑profit or humanitarian channels can be abused to mask diversion of funds. Virtual assets and opaque corporate structures further enable cross‑border movement and layering, while third‑country intermediaries and shell entities help conceal ultimate ownership and purpose.

Bastian Schwind-Wagner _Follow

"Conflict-driven illicit finance exploits weakened institutions, opaque ownership structures, and new technologies to convert and move proceeds across borders, sustaining violence and undermining regional stability. Effective disruption requires integrating conflict risks into national risk assessments and improving coordination between financial supervisors, law enforcement, and the private sector.

Practical action should focus on strengthening beneficial‑ownership transparency, supervising VASPs, and deploying coordinated sanctions, asset freezes and confiscations where appropriate. Combining financial intelligence with trade, customs and cyber forensics will increase the likelihood of tracing and recovering proceeds that fuel armed conflict."

Typologies and tactics – how proceeds are obtained, laundered and used for TF/PF

MONEYVAL’s analysis identifies recurring methods and actors that characterise conflict‑related illicit finance.

Sanctions circumvention

Actors deliberately structure multi‑jurisdictional trading, transit and payment chains to hide the origin and destination of goods and funds. Offshore entities, trusts and coordinated re‑registration schemes are used to move goods such as oil, microelectronics or luxury vehicles through benign jurisdictions before final shipment or re‑import into sanctioned destinations. These efforts often rely on nominally legitimate corporate fronts, third‑country port transit and friendly local service providers.

Grand corruption and asset theft

Public or quasi‑public assets are appropriated, re‑registered under new legal regimes, placed under “external management”, or sold via nominee companies. Charitable funds and humanitarian channels may be misdirected for propaganda, to reward loyal networks, or to finance armed groups. The report documents large‑scale transfers and reallocation of state resources and significant confiscations and freezes by some jurisdictions in response.

Cybercrime and fraud

Ransomware and extortion operations tied to conflict produce proceeds paid in cryptocurrencies. Fraudulent fundraising, impersonation schemes, fraudulent call‑centre networks and large‑scale scams targeting displaced populations or donors generate funds that are frequently converted via virtual asset service providers (VASPs), peer‑to‑peer exchanges and informal conversion channels.

Financing of mercenaries and PMCs

Payments to private military companies and mercenaries are routed through complex corporate chains, disguised as loans, industrial payments or services. Funding sources include diverted private investments, profits from illicit trades, controlled resource extraction and opaque donations; payments can be made in fiat, cryptocurrencies or in‑kind.

Trade‑ and tax‑based schemes

Trade misinvoicing, fictitious service contracts, misuse of transport/booking platforms, and manipulation of tax structures are used to extract and launder value. These schemes exploit weakened customs and tax administration in conflict settings and benefit from international legal instrument gaps and complex ownership layers.

Illicit markets and human exploitation

Arms trafficking, drug transit corridor shifts and organised human‑trafficking networks produce high‑value proceeds that are integrated into laundering chains. Migrant vulnerabilities are also weaponised – including coercion into military service – generating proceeds and amplifying destabilisation.

Virtual assets and VASPs

Cryptocurrencies facilitate rapid cross‑border transfers and obfuscation of sources. The report documents VASPs that processed hundreds of millions in crypto associated with sanctioned exchanges, darknet markets and state‑affiliated hacker groups; it also cites regulatory failures and enforcement actions, including large fines against VASPs that continued servicing sanctioned entities.

Systemic features across typologies

Across these methods, common enabling features recur:

• deliberate manipulation of ownership and beneficial‑owner concealment;
• layering via multiple jurisdictions and corporate vehicles;
• conversion into cash or value‑preserving assets (vehicles, vessels, real estate);
• exploitation of weak or compromised supervision; and
• use of both formal financial systems and informal or peer‑to‑peer channels.

Hybrid tactics – mixing cyber, trade, and corruption – make detection and investigation more complex and often require coordinated, transnational responses.

Gaps in national risk assessments and supervision

MONEYVAL’s survey of member jurisdictions (responses from 17 jurisdictions, plus review of additional NRAs) found that many countries do not yet explicitly integrate conflict‑related ML/TF/PF risks into their national risk assessments. Where such risks are acknowledged, they are often described at a high level and lack granular typologies or sectoral indicators. Non‑profit organisations, crowdfunding platforms and VASPs are frequently identified as at‑risk, yet few jurisdictions have completed detailed sectoral reviews. This uneven incorporation of conflict risks undermines targeted supervision and leaves openings for malign actors to exploit jurisdictions perceived as detached from conflict theatres.

Existing mitigation tools and enforcement practice

The international framework offers established mechanisms to respond: UN targeted financial sanctions, EU restrictive measures, FATF standards and cooperation platforms such as the Egmont Group. MONEYVAL jurisdictions have used asset freezes, suspensions, and confiscations – sometimes at very large scales – to disrupt funding channels. The report documents high‑value freezes and seizures, court decisions applying sanctions‑law confiscation, and examples of enforcement against VASPs, trading companies and intermediary service providers. However, implementation remains uneven: decentralised sanctions enforcement, variable criminalisation of sanctions breaches, limited interagency coordination and inconsistent engagement with the private sector reduce overall effectiveness.

What must change – practical policy priorities

MONEYVAL’s findings point to a set of pragmatic priorities for jurisdictions seeking to counter conflict‑related illicit finance:

• Integrate conflict scenarios into NRAs and update sectoral risk indicators, ensuring that VASPs, NPOs, trade, real estate, gambling and trust service providers receive focused attention where risks are identified.
• Strengthen beneficial‑ownership transparency and controls on corporate service providers and trusts to limit the use of nominee structures for sanctions circumvention and asset concealment.
• Enhance regulation, supervision and enforcement of VASPs, coupled with robust outreach to virtual‑asset platforms and crypto custodians to ensure sanctions and AML obligations are applied effectively.
• Build targeted cooperation mechanisms among FIUs, customs, tax authorities, immigration and law enforcement, with dedicated fusion capabilities to combine financial intelligence, trade data and open‑source geospatial or procurement information.
• Expand public‑private partnerships to leverage the private sector’s transaction data and sectoral know‑how, and develop practical typology guides for banks, payment services, VASPs and auditors to detect conflict‑linked red flags.
• Use sanctions proactively with coordinated asset‑freeze and confiscation strategies, while ensuring due process and legal clarity to enable swift asset management and preservation.
• Prioritise cross‑border investigative cooperation and mutual legal assistance channels to tackle transnational corporate chains and trace proceeds routed through third countries.
• Address cyber‑enabled threats by coupling AML/CFT capabilities with cybersecurity incident response, improving forensic cryptocurrency tracing and ensuring law enforcement has the technical tools to follow funds across peer‑to‑peer rails.

Conclusion – conflict finance is a security and financial integrity problem

Proceeds obtained from conflicts are not peripheral criminal revenue streams; they are strategically important resources that enable continued violence, state capture and the spread of destabilising activities. The MONEYVAL typologies report underscores that contemporary conflicts have financial dimensions that reach well beyond theatre boundaries and demand integrated responses that blend AML/CFT practice with geopolitical risk awareness, trade and customs intelligence, cybersecurity, and international sanctions enforcement. Closing the gap between recognition and operationalisation in NRAs, strengthening cross‑sector cooperation, and applying the full toolkit of supervision and law enforcement will be essential to disrupt the financial arteries that maintain conflicts and to protect the global financial system from their corrosive effects.

Dive deeper

• MONEYVAL ¦ MONEYVAL publishes report on money laundering, terrorist and proliferation financing risks from conflict proceeds ¦ Link