Skip to content

SOC Finance Title.

Most SOC is conducted for financial gain, and the UK remains an attractive location for the laundering of proceeds of crime (both those generated in the UK and overseas). Money laundering enables SOC to benefit from profits and reinvest illicit funds into criminal activity, whilst attempting to avoid law enforcement detection.

The use of technological and professional enablers has remained prominent in the facilitation of SOC finance impacting the UK during 2025.

Many organised crime groups outsource the money laundering aspect of their operating model to dedicated networks that generate profits from providing these services. Reasons for outsourcing money laundering activity include the complexities of the laundering process required, access to enabling services, and organised crime groups spreading the risk of detection by distancing themselves from the illicit funds. 

Methods

Criminals continue to use UK corporate structures in a variety of ways to conduct fraud and illicit finance activity. Legislative changes, in particular Companies House reforms as a result of the Economic Crime and Corporate Transparency Act 2023, aim to reduce the accessibility of some well-established illicit finance methods, which rely on abuse of the UK register of companies. Companies House reforms during 2025 and 2026 include the introduction of mandatory ID verification, authorised corporate service providers, and an increase in filing fees. The full impact of these changes on the illicit finance threat has not yet been assessed.

It is highly likely that action by the UK and other cooperative jurisdictions to disrupt illicit finance and sanctions evasion activity on some crypto exchanges and currencies has led to displacement of this activity to other platforms in Russia or Russia-aligned nations. The UK and United States of America have sanctioned a number of Russia-linked cryptocurrency exchanges including Garantex and Grinex. Tether has also frozen millions of US dollars worth of stablecoin cryptocurrency USDT, held in Garantex-linked cryptocurrency wallets. 

Cryptoassets have maintained their reputation for price volatility, but between March and October 2025 leading cryptocurrencies reported all-time high values, which likely increased public willingness to invest. It is highly likely the public perception of there being profits to be made from investing in cryptocurrency is a key factor driving losses associated with investment fraud. UK Finance data shows that losses during the first half of 2025 increased by 55% to £97.7 million compared to the same period in 2024 (£63.0 million).

The purchasing of UK-based property remains an attractive investment for criminals involved in a wide range of SOC activities partly due to the large amounts of money that can be moved and the stability of property as an asset.

UK property and related services firms have almost certainly acted as professional enablers for individuals designated under UK sanctions (designated persons), thus facilitating sanctions breaches. It is highly likely that designated persons, particularly Russian, have used intricate layers of ownership to distribute their wealth by placing property and related assets under the ownership and control of their family members.57% increase in gold prices between 01 August 2025 and 01 March 2026, reaching peaks of over £4,000 per troy ounce in January 2026 and March 2026

It is highly likely that the significant increase in the price of gold, particularly from August 2025 and continuing into early 2026, has increased the attractiveness of this commodity for a variety of criminal activities impacting the UK, such as money laundering and courier fraud. The UK remains vulnerable to the use of its gold market for illicit purposes for reasons including the significant volume of international trade in precious metals through London, the universal acceptance of gold as a global currency, and the lack of regulation and supervision of the recycled market.

Networks

Chinese-speaking money laundering networks continue to offer a service to UK-based criminals. It is almost certain that Western Balkan organised crime groups use Chinese-speaking money laundering networks, as well as international controller networks, to transfer funds to South America, including to pay for drugs at source. Cash can be collected in the UK and the value paid out in Europe and South America.

Operation DESTABILISE continues to build understanding of Russian-speaking money laundering networks. Russian-speaking money laundering networks service a broad range of clients, creating a mutually beneficial service for transnational organised crime groups involved in a range of predicate crimes, Russian elites, and hostile state-linked entities to bypass the traditional financial sector to move illicit funds and evade sanctions. They broker transactions overseas, instructing coordinators to collect, consolidate, and convert criminal cash into cryptocurrency, facilitated by their access to sanctioned cryptocurrency exchanges and high-impact Russian cybercrime groups. Demand for Russian-speaking money laundering network services has almost certainly been accelerated by the increased use of cryptocurrency in SOC, the war in Ukraine, and subsequent sanctions against Russian entities, creating a market for the obfuscation of Russian-origin funds and their integration into Western financial systems and assets. 

Despite some networks and enablers still using a variety of methods to launder Russian-linked funds, it is likely that sanctions, legislative reforms, and reduced access to investment opportunities and professional enabler services continue to make the UK a challenging environment for Russian elites.

High-impact criminal daigou networks highly likely use corrupt and/or negligent insiders within regulated professional services and high-end retailers. Although daigou activity has previously been characterised as frequently cash-intensive, it is likely that non-cash methods are now more frequently used than cash. These include goods being purchased in-store or online in pounds sterling using payment cards and gift cards (including e-gift cards), as well as using money held in Chinese accounts and accessed by shoppers instore using Chinese-registered mobile phones.

Market Abuse

It is highly likely that the threat to the UK financial system presented by market abuse increased in 2025. Whilst insider trading conducted by organised crime groups has persisted throughout the year, the threat in the form of ‘pump and dump’ trading of company stocks and shares has notably increased. Individuals based outside of the UK operating organised trading groups use social media and articles on bogus financial news websites to spread disinformation, impacting the share price of a chosen product. This activity has a significant negative impact on the integrity of the UK financial market, where confidence and trust in the UK economy is weakened. The threat presented by pump and dump schemes will almost certainly increase in the next year or two due to the increasing use of artificial intelligence.

Throughout 2025, the Financial Conduct Authority observed insider dealing organised crime groups, who are involved in SOC, trading on the UK financial market. Insider dealing organised crime groups have continued to favour the financial products offered by the UK market such as equity spread bets and contracts for difference. This, combined with the leveraged access to world markets, makes the UK a hub for global insider dealing.

Since 2022, the NCA has led Operation DESTABILISE, an investigation targeting Russian-speaking professional money laundering networks impacting on the UK. These networks are responsible for laundering tens of billions of dollars globally to service a variety of SOC groups and upstream threat actors. This activity led to 129 arrests and over £25 million seized in cash and cryptocurrency in the UK (plus additional overseas seizures). 

The operation has exposed the connection between money laundering on UK streets and the Russian state. Individuals associated with the Russian intelligence services attempted to use one UK-linked network to fund individuals including the leader of a Bulgarian network convicted of running a spying operation across Europe for Russia. Another UK-linked network purchased a Kyrgyzstan bank to facilitate sanctions evasion and payments supporting Russian military efforts. 

Graphic showing the uses of Gen AI technologies in CSA offending.