The Investigative Journal’s weekly digest of international corruption, illicit finance, and accountability developments. All items below are drawn from public records, official announcements, and published investigations; links to primary sources appear throughout. Allegations are noted as such — none of the individuals named below has been convicted unless stated.
This week’s global corruption docket is dominated by a single, sprawling leak: the International Consortium of Investigative Journalists’ “China Capital” project, built on 4.8 million internal records from the world’s largest bank. Around it, the week produced a political earthquake in Kyiv’s prosecution service, a Spanish-led strike on one of the world’s largest underground banking networks, and a pair of U.S. Treasury actions confirming that scam-center finance has become a first-order illicit-finance threat.
1. ‘China Capital’: Leaked ICBC files show a state bank serving oligarchs, autocrats — and Beijing’s agenda
On September 14, ICIJ and media partners in 24 countries published China Capital, an investigation based on 4.8 million records from the Industrial and Commercial Bank of China, the world’s largest bank by assets. According to ICIJ’s summary of the files, ICBC used its London operations as a financing hub for companies linked to sanctioned Russian and Belarusian business owners, autocrats publicly accused of corruption, debt-distressed states, and China’s political establishment — at times breaching the bank’s own sanctions and anti-money laundering policies.
Among the documented findings: ICBC bankers discussed financing Russian mining giant Norilsk Nickel — a company partly owned by four sanctioned, Kremlin-aligned oligarchs — in renminbi to avoid U.S. dollar exposure as Russia’s war in Ukraine raged, according to the ICIJ reporting. The files indicate the bank’s client roster included a bank owned by the daughters of Azerbaijan’s President Ilham Aliyev and Angola’s state oil company during the era when it was controlled by associates of the late ruler José Eduardo dos Santos. In early 2019, days after the U.S. Justice Department indicted Huawei for alleged sanctions violations, ICBC moved $1.3 billion in “emergency cash” out of London for the tech giant — a transfer ICIJ notes was not illegal, but which the records show blindsided the bank’s own financial-crime unit and triggered internal recriminations (details here).
An ICIJ analysis found that since 2014, courts and regulators in eight jurisdictions have imposed adverse rulings and penalties totaling at least $96 million on ICBC and its overseas units. The files also document hardball lending to fragile states — including a $285 million loan to Zambia’s state power utility ZESCO that, records suggest, came with “management fees” and collateral arrangements that deepened the country’s distress as it slid toward sovereign default. Per ICIJ, ICBC did not respond to questions hand-delivered to its London office; a Chinese government spokesperson rejected what it called “false narratives” of “opaque lending,” and Beijing’s embassy in Zambia said Chinese overseas financing “strictly” follows market rules and never “seeks political interests.” The significance is hard to overstate: the files offer the most granular public view to date of how a state-owned megabank can function as an instrument of geopolitics — and they will sharpen questions for Western regulators about ICBC’s correspondent relationships and compliance record.
2. Kyiv shakeup: Ukraine’s prosecutor general is dismissed after anti-corruption raids hit his own office
Ukraine’s National Anti-Corruption Bureau (NABU) and Specialized Anti-Corruption Prosecutor’s Office (SAPO) announced on September 5 that they had uncovered an alleged criminal organization inside the Prosecutor General’s Office that took systematic bribes to shield fraudulent call centers from interference, according to the Kyiv Independent and Ukrainska Pravda. Investigators allege the group, formed in mid-2025, laundered proceeds through real estate, jewelry, and accounts held by associates — more than 20 million hryvnias (about $450,000) in identified purchases, with further assets registered to third parties. A law enforcement source told the Kyiv Independent that detectives detained Serhiy Kropyva, a deputy department head at the Prosecutor General’s Office. Five alleged members have been identified; the case is pending and no one has been convicted.
The fallout reached the top within days. Recordings released by NABU referenced a protector identified as the “boss,” whose patronymic appears to be “Andriiovych” — the patronymic of Prosecutor General Ruslan Kravchenko, though NABU did not directly implicate him and Kravchenko denied any involvement, per Meduza’s account. Kravchenko submitted his resignation on September 7, saying he did not want the office “used as an instrument of political confrontation.” On September 15, Ukraine’s parliament consented to his dismissal by a 317-vote margin and President Volodymyr Zelensky signed the decree, the Kyiv Independent reported.
The episode cuts two ways. It is an uncomfortable demonstration that Ukraine’s scam-center economy — which NABU calls one of the country’s most profitable criminal industries — allegedly reached into the very institution charged with prosecuting it. But it is also evidence that NABU and SAPO, whose independence survived a political challenge in 2025, can force accountability at the highest level of the prosecution service in wartime. For Western partners weighing aid and EU accession benchmarks, both halves of that story matter.
3. Operation DRAKKAR: Spain and Europol dismantle the ‘Dubai Bank’ underground banking network
Europol announced on September 8 that a Spanish-led investigation, Operation DRAKKAR, has resulted in 21 arrests targeting what it described as “some of the world’s biggest underground bankers” — a clandestine money-transfer network known as the “Dubai Bank” that allegedly provided financial infrastructure to major drug-trafficking organizations worldwide (Europol release; see also AML Intelligence). Authorities identified, seized, or froze roughly €20 million in assets — 48 properties worth more than €14 million, vehicles worth €1.6 million, and 121 bank accounts holding €2.3 million. Following a July action day in Spain, international warrants produced arrests in the United Arab Emirates, Egypt, and the Netherlands, including a Europol-designated High Value Target.
The case began with 1,835 kilograms of cocaine seized from a vessel off Spain in 2021 — and a further 1,650 kilograms investigators say the network later recovered from the ship after it sank. Following that money trail upward exposed the parallel banking system underneath. The lesson for policymakers is the same one the Financial Action Task Force has been signaling: informal value-transfer systems can move criminal capital across borders in hours, entirely outside the regulated perimeter. FATF’s own workstream on underground banking and hawala-style providers is expected to publish this fall, according to plenary trackers — DRAKKAR is likely to feature as Exhibit A.
4. OFAC designates Xinbi Guarantee network behind cyber-scam finance targeting Americans
On September 9, the U.S. Treasury’s Office of Foreign Assets Control added to the SDN list Xinbi Guarantee — a “guarantee” marketplace operating across Burma, Thailand, and Laos that Treasury says served cyber-scam operations targeting Americans — along with linked technology firms in Cambodia (Anwen Technology) and Singapore (Safew Technology), designating them as transnational criminal organizations. Notably, the designation lists dozens of Tron blockchain addresses tied to the network, giving exchanges and stablecoin issuers a concrete map of wallets to freeze and monitor. OFAC also designated Los Tiguerones, an Ecuador- and Peru-based criminal group, under terrorism authorities in the same action.
The action confirms a pattern: Chinese-language “guarantee” platforms — escrow-style marketplaces where scam syndicates buy laundering services, crypto conversion, and even trafficked labor — have become the connective tissue of Southeast Asia’s fraud economy. Sanctioning the marketplace, rather than individual scam compounds, is an attempt to hit the sector’s payment rails. Whether the network simply rebrands, as records suggest similar platforms have done after past U.S. actions, is a question worth watching.
5. FinCEN: $12.7 billion in suspected scam proceeds moved through the U.S. financial system
Days earlier, on September 3, the Financial Crimes Enforcement Network issued an alert (FIN-2026-Alert005) finding that approximately $12.7 billion in financial activity tied to suspected digital-asset investment scams — the fraud family often called “pig butchering” — flowed through the U.S. financial system between September 2023 and December 2025, according to FinCEN and analyses of the alert. The alert directs financial institutions to detect and report activity connected to overseas scam centers and the laundering of their proceeds.
Read together with the OFAC designations and the Ukrainian call-center case above, the through-line of this week is unmistakable: industrialized fraud has matured into a global illicit-finance category on the scale of narcotics proceeds — one that corrupts state institutions in producer countries and drains victims in consumer countries. Data shows the two ends of that pipeline are now being attacked simultaneously.
6. Australia opens an AML investigation into Western Union
Australia’s financial intelligence agency AUSTRAC has launched an investigation into Western Union Financial Services Australia and its U.S.-based parent over how they manage money laundering and terrorism-financing risks, OCCRP reported on September 1. The probe will examine the company’s AML program, transaction monitoring, and governance — including whether its systems can identify known laundering typologies and suspicious transactions linked to child sexual exploitation and terrorism financing. The investigation follows earlier regulatory engagement and an external audit ordered in 2025; Western Union has said it is committed to addressing the issues the audit raised.
Cash-based cross-border remittance remains one of the most exploited corridors in illicit finance, and AUSTRAC has shown — in past actions against major banks and casinos — that it is willing to litigate to record penalties. A formal probe of one of the world’s largest money-transfer networks will be read carefully by remittance regulators in every market where Western Union operates.
Leads worth pulling: where TIJ digs next
- ICBC’s U.S. exposure. The China Capital files center on London — but which U.S. correspondent relationships touch the flows described, and will American regulators follow up on the compliance failures the records suggest?
- The guarantee-economy shell game. Xinbi’s designation lists specific Tron addresses. Tracing where those balances migrate — and how quickly a successor marketplace absorbs the business — would test whether marketplace sanctions actually bite.
- Scam-center protection rackets beyond Ukraine. The NABU case alleges state protection of fraud infrastructure. Comparable protection dynamics in Southeast Asia’s compound economies deserve the same document-level scrutiny.
- The ‘Dubai Bank’ model and UAE cooperation. Four DRAKKAR arrests occurred in the Emirates — a data point in the larger question of whether the UAE’s post-grey-list enforcement posture is durable.
- African sovereign borrowers in the ICBC files. Partner reporting, including on Ghana’s COCOBOD, points to loan terms and collateral accounts that merit country-by-country reconstruction.
Reporting note: This digest summarizes published investigations and official records linked above. Individuals and entities named in connection with pending cases are presumed innocent unless and until convicted. ICBC did not respond to ICIJ’s requests for comment; former Prosecutor General Kravchenko has denied wrongdoing; Western Union has committed to addressing its auditors’ findings. Corrections and responses: contact the editor.
Featured image: London financial district skyline (public domain, CC0, via Wikimedia Commons).