Italian Mafia Crypto Laundering Bust: $76M Hidden Behind a Car Rental
Italian law enforcement has dismantled one of the most elaborate crypto-laundering networks uncovered in Europe this year, seizing assets tied to €68 million (approximately $76 million) and arresting 30 individuals across Italy, Spain, and Switzerland. The operation, conducted jointly by the Guardia di Finanza and prosecutors from Monza Brianza, exposes a playbook that compliance officers, auditors, and CFOs need to understand: layered shell companies, trade-based invoice fraud, and crypto exchanges working together to move organised-crime proceeds across borders at scale.
How the Scheme Was Structured
At its centre sat a Milan-based car-rental company operated by individuals with alleged ties to two of Italy's most powerful criminal organisations, the 'Ndrangheta and the Camorra. The business gave the network a credible commercial identity, a flow of invoiced transactions, and a reason to move money between accounts without immediately triggering suspicion.
The layering mechanism
Investigators describe a four-stage laundering process. First, criminal proceeds from drug trafficking, crypto scams, and tax evasion were pooled into a common fund. Second, a web of shell companies generated approximately €110 million ($123 million) in fictitious invoices for work that was never performed, creating an apparent paper trail of legitimate business activity. Third, those funds were introduced into European bank accounts under the cover of the invoice documentation. Fourth, crypto exchanges were used to convert the funds into digital assets, which were then transferred to wallets controlled by the suspects.
The conversion step is significant from a compliance standpoint. By the time funds reached a crypto exchange, they had already passed through multiple corporate layers and banking relationships, which means the exchange-facing transaction may have appeared relatively clean. This is precisely the layering risk that financial action task force (FATF) typology reports on trade-based money laundering have flagged for years.
Who the network served
The scheme was not exclusively internal to the two mafia organisations. Investigators say it attracted outside clients: crypto scammers, drug traffickers, and tax evaders who paid to have their funds laundered through the infrastructure. That "laundering-as-a-service" model increases the scale and velocity of suspicious flows, and it means any single counterparty relationship in the network could link a financial institution to multiple underlying predicate offences simultaneously.
Profits are also alleged to have been used to support incarcerated mafia members, adding a welfare-financing dimension to the network that prosecutors will likely use to pursue extended enterprise liability claims.
Arrests and Asset Recovery
Among the 30 individuals arrested are two that stand out for the access they held. A driver employed by the Milan magistrates office and a Milan-based lawyer are both named in the operation, illustrating how organised crime embeds itself close to the institutions responsible for prosecution and oversight. Police are pursuing asset seizures totalling €21 million (approximately $23.5 million) across the three countries involved.
Cross-border coordination
The involvement of Spain and Switzerland alongside Italy is a reminder that modern crypto-laundering networks do not respect single-jurisdiction AML frameworks. Each country operates under different reporting thresholds, beneficial ownership disclosure rules, and crypto exchange licensing regimes. Coordinating across those frameworks, even inside the EU where MiCA and the revised Transfer of Funds Regulation now apply, requires significant inter-agency effort. The fact that this operation succeeded is notable; it also signals that the Guardia di Finanza and European partners are building the cross-border intelligence infrastructure to pursue these cases more routinely.
Regulatory and AML Context for EU Firms
This bust lands at a moment when the EU's anti-money laundering architecture is being substantially upgraded. The new AML Authority (AMLA), due to begin supervising high-risk obliged entities directly from 2025 onwards, will have jurisdiction over large crypto-asset service providers (CASPs) operating under MiCA. The Transfer of Funds Regulation, which extended the travel rule to crypto transfers from late 2024, requires CASPs to collect and transmit originator and beneficiary data on every transaction, regardless of amount.
Trade-based money laundering and crypto
The use of fictitious invoices alongside crypto conversion is a textbook trade-based money laundering (TBML) typology, and it creates a specific challenge for CASPs and the banks that serve them. A customer presenting apparently genuine invoice documentation as the source of funds for a crypto purchase passes the most basic KYC check. Detecting the fraud requires either cross-referencing the invoiced entity against corporate registry data, checking whether the contracted work is commercially plausible, or identifying the beneficial ownership chain behind the invoicing company. These are exactly the enhanced due diligence steps that the EU's Sixth Anti-Money Laundering Directive (6AMLD) and FATF Recommendation 22 require for high-risk customers and business relationships.
Lessons for crypto exchanges and virtual asset service providers
The scheme's fourth stage, converting pooled funds through exchanges into wallets, underlines why on-chain analytics cannot be the only line of defence. By the time the funds arrived at an exchange, their criminal origin had been obscured through multiple banking hops. Effective transaction monitoring must therefore look not just at wallet history but at the off-chain documentation supporting the source of funds. Digital asset accounting software that integrates with KYC and transaction monitoring platforms, and that can flag structural patterns like rapid fiat-to-crypto conversion following large invoice settlements, is a practical tool here, though it is only as useful as the compliance policies governing it. Understanding how AI is reshaping crypto AML supervision across VARA, FCA, and HKMA gives compliance teams a sense of where the supervisory bar is moving.
Accounting and Reporting Implications
For accounting firms and auditors
Audit and advisory teams working with clients that operate in cash-intensive or cross-border trade environments, including car rental and vehicle leasing, logistics, or construction, need to treat crypto-linked transactions with heightened scrutiny. The presence of a crypto wallet address in a client's bank statement, combined with a high volume of intercompany invoicing and low demonstrable economic output, should be sufficient to escalate to an enhanced due diligence review and, where appropriate, a suspicious activity report.
From a bookkeeping perspective, the fictitious invoicing leg of this scheme would, if undetected, distort revenue recognition, VAT reclaim positions, and corporate income tax filings across multiple jurisdictions. Auditors relying solely on document verification without substantive testing of the underlying commercial reality face serious professional liability exposure. Robust crypto bookkeeping software that reconciles on-chain movements against invoiced amounts and bank settlements can surface the kind of numerical inconsistencies, such as invoice values that never match actual cash settlements, that human review alone might miss.
For CFOs and treasury functions
CFOs at firms that transact with counterparties in high-risk sectors should treat this case as a prompt to review their own correspondent banking relationships and supplier due diligence processes. If a supplier is settling invoices partly through crypto transfers rather than standard bank payments, that alone is not evidence of wrongdoing, but it should trigger a documented review of the supplier's beneficial ownership and the commercial rationale for the payment method.
Treasury functions that hold or transact in digital assets should also ensure their crypto accounting software produces an auditable ledger that maps each on-chain transaction to a specific business purpose and counterparty. That documentation is likely to be requested by regulators or auditors in the event of a suspicious activity investigation and is increasingly a baseline expectation under MiCA's record-keeping provisions for CASPs.
For context on another front-line AML risk that intersects with crypto, the guidance on Bitcoin ATM scams and what banks must know about on-chain AML risk covers complementary detection approaches.
Broader Enforcement Trend
This Italian operation does not sit in isolation. In the same period, large traditional financial institutions in other jurisdictions have faced significant enforcement actions related to failures in suspicious transaction monitoring, illustrating that AML deficiencies carry material financial and reputational consequences whether the vehicle is crypto or conventional banking. The consistent message from regulators is that the convergence of fiat and crypto flows requires end-to-end monitoring, not siloed oversight of each rail in isolation.
What the FATF typology signals for future cases
FATF's published typologies on virtual assets and TBML predict that criminal networks will continue to use legitimate-looking businesses as layering vehicles precisely because they generate credible documentation. The car-rental model used here mirrors typologies seen in real-estate, luxury goods, and trade finance. Compliance teams should review their sector-specific risk assessments against FATF's most recent virtual assets guidance to ensure they are not treating crypto exposure as an isolated risk separate from their broader commercial relationship risk framework.
Frequently Asked Questions
What is the travel rule and how does it apply here?
The travel rule requires crypto-asset service providers to collect and pass on originator and beneficiary information for every crypto transfer. In this case, had the rule been fully enforced at each exchange used by the network, investigators would have had a cleaner data trail linking wallet addresses to identified individuals much earlier in the process. Under the EU's Transfer of Funds Regulation, CASPs operating in any EU member state are now subject to this requirement for all transfers, not just those above a threshold.
Does MiCA cover this type of laundering activity directly?
MiCA is primarily a market integrity and consumer protection regulation governing the issuance and trading of crypto-assets. It does not replace AML obligations, which sit under the separate EU AML Directive framework. However, MiCA-authorised CASPs are also obliged entities under AML law, so a CASP that facilitated transactions in this network without adequate due diligence would face dual regulatory exposure: a MiCA breach and an AML/CFT violation.
What should an auditor do if they suspect a client's crypto transactions involve fictitious invoicing?
The auditor should escalate internally to the money laundering reporting officer (MLRO) and file a suspicious activity report (SAR) with the relevant financial intelligence unit before taking any further action with the client. In Italy that is the Unità di Informazione Finanziaria (UIF); in most other EU member states an equivalent FIU exists. The auditor must not tip off the client that a report has been made. Engagement should be paused or terminated depending on risk assessment and legal advice.
How should a CASP handle a customer whose source of funds is supported only by commercial invoices?
Invoice documentation alone is not sufficient for enhanced due diligence. The CASP should verify the invoicing entity's registration, check that the described commercial activity is plausible given the entity's size and sector, confirm the beneficial ownership of the invoicing company, and, where possible, cross-reference the invoice values against publicly available financial filings. If those checks cannot be completed satisfactorily, the customer relationship should be declined or exited and a SAR filed if there is reasonable grounds for suspicion.
What seizure tools do Italian authorities use in crypto-related cases?
The Guardia di Finanza has statutory powers to freeze and seize digital assets held in wallets as part of a criminal investigation, including through cooperation with foreign authorities under mutual legal assistance treaties. In cross-border cases involving EU member states, Eurojust and Europol provide coordination support. The €21 million seizure target in this case spans Italy, Spain, and Switzerland, each of which requires separate legal processes, highlighting the importance of the inter-agency coordination that made this operation possible.
Source: Protos