of Serious and Organised Crime
SOC continues to pose a persistent and damaging threat to the UK. Criminal networks have further diversified their activity, expanded their reach, and increased their use of technology to enable offending. These developments have widened the impact of SOC on communities, public services, businesses, and the UK economy.
The NCA leads the national response, working with law enforcement, government, international partners, and the private sector to reduce harm and target those offenders who pose the greatest risk. This response is delivered through the UK’s SOC system, a network of more than 75 organisations across law enforcement, government, the intelligence community, regulatory bodies, local authorities, and international agencies, supported by academic and private sector partners. Together, this system provides the reach, capability, and coordination required to protect the public from serious and organised crime.
In 2025 and into 2026, we continued to prioritise the most serious offenders across child sexual abuse, cybercrime, drug supply, firearms, fraud, illicit finance, and organised immigration crime. Joint operations delivered significant disruptions, removing dangerous individuals from the UK’s communities, protecting vulnerable people, and degrading the capabilities of organised crime groups operating within the UK and overseas.
Technology continues to reshape SOC. Criminal groups are increasingly using online platforms, encrypted communication, and artificial intelligence-enabled tools to identify victims, outsource capability, and scale their activity. The NCA has strengthened its technical and analytical capabilities to identify offenders earlier, exploit digital evidence more effectively, and support policing with specialist expertise. We have expanded partnership working with technology companies to improve safety, reduce illegal content, and increase the UK’s ability to counter online harm.
We have also focused on enhancing the UK’s defences against illicit finance. Criminals are exploiting global financial systems, professional enablers, and specialist money laundering networks to conceal proceeds of crime. The NCA continues to work with domestic and international partners to identify, trace, freeze, and seize criminal assets, and to target those who provide money laundering services to high-harm networks. Implementation of Companies House reforms and increased use of financial disruption tools have strengthened our response.
At the border, the NCA has targeted organised immigration crime groups facilitating dangerous small boat crossings, alongside offenders moving drugs, firearms, and cash into and out of the UK. Our international network continues to work with partners upstream to prevent harmful commodities reaching the UK and to identify emerging trafficking routes.
Our activity also focused on protecting communities from harm caused by drug supply, violence, and exploitation. We continued to support policing to tackle high-harm gangs, safeguard vulnerable children exploited in online environments and criminal networks, and address threats associated with synthetic opioids, ketamine, and other substances.
SOC continues to evolve, driven by technology, global instability, and interconnected criminal markets. The NCA will continue to lead the national effort to identify and assess these changes, coordinate the response across the system, and deliver sustained disruption against those offenders who cause the greatest harm to the UK.
Our Response to the Threat
SOC in Communities
SOC at the Border
Transnational SOC
SOC Online
SOC Finance
Drones | Digital Forensics Links Multiple Prison Flights to a Single Operator
In September 2024, Greater Manchester Police recovered a drone and a package containing drugs and other contraband in woodland near HMP Manchester. Digital examination linked the drone to multiple flights into HMP Feltham, HMP High Down, and HMP Manchester in the preceding months. Further enquiries led to the arrest of Mohammed Sharif (22) at a Birmingham address, where a second drone was seized.
The investigation began with Greater Manchester Police before being passed to the North West Regional Organised Crime Unit for further enquiries and additional charges. Sharif was convicted of possession of cannabis and multiple counts of conveying illicit articles into prisons, and was sentenced on 05 November 2025 to six years’ imprisonment.
This case highlights the growing role of commercially accessible drone technology in enabling prison contraband supply and increasing risk to prison safety and control.
Operation ALLIANCES 2: National Vehicle Crime Week Delivers Mass Disruption
In October 2025, policing partners across England and Wales ran Operation ALLIANCES 2, a Home Office-funded intensification week targeting vehicle crime and associated organised criminality. Activity across 37 forces focused on offenders linked to theft, dismantling networks and ‘chop shops’, reflecting the multi-agency response required where acquisitive crime intersects with wider SOC.
The operation delivered the following outcomes:
- More than 350 arrests (many assessed as linked to SOC)
- More than 400 stolen vehicles recovered (estimated value £3 million)
- More than 1,000 vehicle parts recovered (valued in excess of £13 million)
- More than 20 chop shops closed, including the largest ever identified in the UK
- Seizures included over £150,000 in cash and plant machinery worth more than £800,000
Blank-Firers to Firearms | Conversion Kit Seizure Leads to Eight-Year Sentence
An investigation began after information indicated specialist equipment used to manufacture ammunition had been ordered and delivered to an address in Birmingham. On 28 January 2025, officers arrested Banaras Malang (33) and searched his home address, recovering nine Turkish-manufactured top-venting blank-firers alongside equipment consistent with converting them into live-firing weapons, plus parts and ammunition-making equipment. The orders had been made using the bank card and address of a vulnerable man who Malang had taken advantage of.
Although the weapons were sold as blank-firers, the case proceeded on the basis that the models were readily convertible. Malang was convicted at Birmingham Crown Court and was sentenced on 04 December 2025 to eight years’ imprisonment for possession of those firearms.
This case underlines how enforcement pressure and availability shifts can influence firearms sourcing, and how offenders may exploit vulnerabilities to procure specialist equipment.Shatter Supply Chain Targeted | £120,000 Extractor Kits Seized with Illicit Vapes
On 13 October 2025, officers and partners visited premises suspected of supplying industrial equipment linked to a cannabis shatter laboratory discovered in the north east of England. Working with Trading Standards, teams entered and inspected the premises and seized significant quantities of apparatus, including extractor kits commonly used in shatter production.
The seized equipment was assessed to have been imported from China and to be non-compliant with UK safety standards. Two vans of items were seized, with an estimated £120,000 placed on the sale value of the extractor kits. Officers also seized more than 5,000 illicit vapes stored at the address, valued at around £40,000.
Shatter is a highly concentrated cannabis extract. Illicit drugs laboratories pose an inherent risk to the public, both from exposure to harmful substances, the potential for explosions, and the harm caused to the environment by waste products. In October 2024, an explosion at a house in Newcastle, which led to two deaths, was linked to an explosion of gas canisters used in cannabis extraction.
This case illustrates how domestic drug production can be enabled by specialist equipment and supply chains, increasing safety risks and co-locating wider illicit commodities in community settings.
£42 Million Cocaine Seizure in East Yorkshire
NCA officers disrupted an organised crime group attempting to import 524kg of cocaine (valued at £42 million) using a rigid-hulled inflatable boat. The group, which included Colombian national Didier Tordecilla Reyes, used a boat launched to collect the consignment and land it on a beach in the UK, before transferring multiple bags into a hire van.
Coordinated activity by the NCA, supported by Humberside Police and Border Force, enabled officers to intercept the group, recover the drugs, and evidence Reyes’ role as a facilitator linked to Colombian cartel contacts. Reyes was jailed in September 2025.
English Channel Smuggling Supply Chain Disruption | Boat and Engine Supplier Jailed in Belgium
A joint operation between the NCA and Belgian authorities led to the conviction of Adem Savaş, identified as a key supplier of boats and outboard engines to people smuggling networks operating in the English Channel. Operating under the cover of a legitimate maritime supply business, he sourced engines from China and moved boats and equipment via Turkey, Bulgaria, and Germany before supplying networks in Belgium and France.
Savaş was detained at Schiphol Airport, Netherlands, in November 2024 and extradited to Belgium. In December 2025, he admitted offences relating to people smuggling and membership of an organised crime group and was sentenced to 11 years’ imprisonment and fined €400,000. Three co-defendants received sentences totalling 38 years.
The NCA identified Savaş during its investigation into Hewa Rahimpur, the head of a major Europe-wide smuggling network responsible for moving more than 10,000 migrants in small boat crossings to the UK. The case reinforces the impact of targeting enabling infrastructure (boats, engines, and logistics) internationally to degrade organised immigration crime capability.
Project HIDE | Strengthening the UK’s Capability to Detect Criminal Concealments
In 2025, Project HIDE expanded the UK’s understanding of concealment techniques used by organised crime groups, assessing around 100 new examples and contributing to a national dataset of 874 cases shared across law enforcement. The intelligence enabled the development of specialist training delivered to more than 3,200 officers in the UK and overseas, directly contributing to multiple seizures, arrests, and prosecutions linked to improved detection of hidden illicit goods.
Project HIDE’s data has also been used to identify operational barriers, including the previous inability to seize vehicles containing empty concealments. Evidence presented by the project supported a major legislative change in the Border Security, Asylum and Immigration Act 2025, which now criminalises concealments in vehicles, vessels, and aircraft.
The project continues to track emerging concealment trends. In 2025, two heavy goods vehicles were intercepted at the UK border with fuel tank concealments containing significant quantities of cocaine, indicating the resurgence of a historic smuggling technique.
EncroChat Firearms Brokerage | International Coordination Dismantles Cross-Border Supply
An NCA investigation disrupted a high-harm firearms supply network run by an offender using the EncroChat handle ‘Aceprospect’, who advertised a catalogue of automatic and semi-automatic weapons to UK organised crime groups. Working from abroad, he marketed weapons including AK-47s, Skorpion, and Uzi machine guns, pistols, and ammunition, arranging for firearms to be smuggled into the UK and transferred via a Warrington-based associate.
NCA officers deployed with the Spanish National Police to arrest him in Malaga, leading to extradition. In 2025, the offenders admitted firearms offences and a conspiracy to inflict grievous bodily harm after plotting an acid attack, receiving custodial sentences of 26 years 8 months, and 11 years 4 months respectively. This investigation shows how secure communications and cross-border logistics enable firearms brokerage at scale, and why international cooperation is central to disruption.
Livestreaming Child Sexual Abuse | UK Offender Jailed for Commissioning Overseas Abuse
An NCA investigation found that Patrick Howlett (58), from Kent, sent almost £56,000 to known child-abuse facilitators in the Philippines to commission livestreamed child sexual abuse over several years. Intelligence showed he maintained regular contact with a woman who abused her own children at his direction, producing and sending him images and videos in exchange for payment. Investigators recovered 14,311 illegal images, including more than 5,000 created specifically for him; the offending spanned from 2003 until his arrest in 2021.
Working with law enforcement partners in the Philippines, the NCA identified 19 child victims who were safeguarded. Howlett pleaded guilty in January 2025 and was sentenced on 18 July 2025 at Canterbury Crown Court to 26 years’ imprisonment.
This case illustrates the transnational nature of online-enabled child sexual abuse, where communications and payments allow offenders to generate direct harm remotely while increasing safeguarding demands.International Collaboration to Disrupt Organised Fraud
In 2025 and 2026, activity to disrupt organised fraud demonstrated the value of cross-border intelligence sharing and operational coordination.
In July 2025, the India Central Bureau of Investigation raided a fraudulent call centre in Uttar Pradesh, resulting in multiple arrests. This followed collaboration and intelligence sharing between the Central Bureau of Investigation, the NCA, the United States of America's Federal Bureau of Investigation, and Microsoft to identify the organised crime group, build a case, and target the complex IT infrastructure used by the criminals. Over 100 UK victims had been contacted, with total losses over £390,000.
In January 2026, the NCA supported the Nigerian Police Force to take down a fraud centre. Using intelligence from Meta, an address was identified and raided within days, resulting in several arrests. Police enquiries found the centre was conducting a range of operations including investment fraud, romance fraud, and financially motivated sexual extortion targeting the UK and United States of America.
Wider, multi-country disruption activity was also delivered through Operation SERENGETI 2.0, a UK-supported, Interpol-coordinated operation. This resulted in the arrest of over 1,200 criminals across Africa, targeting nearly 88,000 victims and the recovery of $97.4 million. Investigators from the UK and 18 African countries worked together to tackle high-harm, high-impact crimes including investment fraud, business email compromise, and ransomware. Private sector partners strengthened the operation by providing intelligence, guidance, and training to help investigators act on intelligence and effectively identify offenders.Telegram Com Forum Disrupted Following NCA Investigation into Large-Scale Online Coercion
Offenders exploit encrypted and anonymised platforms to mobilise Com networks that crowdsource coercion, blackmail, and distribution of abuse at scale. In one NCA case, Bradley Talbot (29), from Portsmouth, acted as a moderator within one such group of around 6,000 members on Telegram that targeted children, made demands for indecent images, and weaponised threats of exposure to force further compliance. The investigation identified more than 100 child victims, with at least a quarter believed to be UK-based.
Talbot pleaded guilty on 29 April 2025 to offences including participating in the criminal activities of an organised crime group, arranging or facilitating the sexual exploitation of a child under 13, and distributing an indecent image. He was sentenced to seven years and six months’ imprisonment and received a lifetime Sexual Harm Prevention Order.
This case demonstrates how networked online ecosystems can scale harm rapidly, requiring fused intelligence and safeguarding responses across jurisdictions.Joint Intelligence Cell Tackles Harms Associated with Online Forums Through Early Intervention and Safeguarding
In 2025, the NCA and partners created a joint intelligence cell to counter the global threat posed by individuals using online forums to share extreme material designed to cause harm and distress to young female victims. These forums are used to coerce victims into serious abuse, self-harm, and other harmful acts, including, in some cases, taking their own lives. Often adolescent boys, this subculture also engages in cybercrime and the sharing of extreme terrorist, racist, and nihilistic ideologies, often with a fascination with violence.
The cell has brought together the NCA, police, and Counter Terrorism Policing in the UK, alongside international partners amongst the Five Eyes community and Europol to deliver a worldwide coherent law enforcement response. Between establishment in October 2025 and March 2026, the cell received 540 referrals from industry, and international and domestic policing partners. To date, 14 arrests have resulted in the UK, 21 vulnerable individuals have been safeguarded, and 337 investigations have been instigated both in the UK and overseas supported by the cell.
In many cases, parents were unaware of the harmful online activity affecting their children at home, and some children indicated an intention to continue offending or to continue participating in coerced harms despite interventions, reinforcing the need for a broader public health approach to the threat.Cyber Prevent | Early Support Linked to Lower Reoffending
The National Cyber Prevent Referral Mechanism provides a UK-wide process to assess and manage people at risk of engaging in cybercrime offending.
An evaluation of 1,041 referrals, made between December 2017 and April 2025, found that, although some people did go on to reoffend, reoffending rates (for cyber offences and for all crime) were around half those seen in comparable groups who did not go through the programme. Wider research suggests youth diversion schemes typically deliver more modest reductions in reoffending, making these findings comparatively strong. The results support the NCA’s wider prevention offer, including Cyber Choices, which helps young people understand the law and use their digital skills safely, reducing the future supply of cyber offenders alongside operational disruption.
The UK’s cybercrime threat landscape continues to evolve, requiring a coordinated system response that not only disrupts offenders but also prevents individuals from entering or escalating within cyber-dependent criminality. Cyber Prevent plays a central role in this preventative effort, aiming to intervene early and divert individuals away from a cybercriminal pathway through targeted, risk-based engagement.
‘Logged Out’ | Record Takedowns of Organised Immigration Crime-Linked Social Media Accounts in 2025
During 2025, the NCA led a record year of takedowns of social media accounts linked to people smuggling, with 10,700 accounts closed. Since late 2021, more than 27,000 accounts have been taken down; over 2024 and 2025 more than 90% of accounts referred by the NCA were removed by platforms.
The activity included proactive scanning and referral of potentially criminal content, while also generating crucial investigative leads. In one case, a man was detained by NCA investigators on suspicion of offering crossings from Libya to Italy on Facebook, and three individuals were arrested for offering fraudulent visas and illegal entry into the UK in posts on TikTok.
This activity demonstrates the scale at which online platforms can be used to market organised immigration crime services and how account disruption can be paired with intelligence development to support investigations.
Prince Group Sanctions: Coordinated Designations and Asset Freezes Target Overseas-Linked Harm
In October 2025, the UK announced designations under the Global Human Rights Regulations against the Prince Group founder and network, after government research triggered by media allegations linking them to fraud compounds, trafficking, fraud, and money laundering.
The Prince Group is one of Cambodia’s largest conglomerates, running a multi-billion pound business across real estate, construction, banking, and retail. Media reporting has alleged criminal involvement by the Prince Group and its founder, Chen Zhi, in scam compounds, including human trafficking, fraud, money laundering, and human rights abuses.
The UK designations were announced in October 2025, alongside similar sanctions by the United States of America, with parallel action being taken by UK and United States law enforcement on the same day. The NCA and Isle of Man Constabulary froze £100 million in assets and executed search warrants at UK and Isle of Man properties, including a 70-room mansion in Regent’s Park, London. The United States Department of Justice also unsealed an indictment against Chen Zhi, in which prosecutors seized $15 billion in Bitcoin.
This activity highlights how illicit finance linked to overseas harms can involve UK-based assets, and the value of coordinated international disruption using sanctions and enforcement tools.Pay As You Go SIM Diversion | Cross-Sector Data Sharing Disrupts One-Time Password-Enabled Fraud Pathways
Pay As You Go SIM cards are increasingly being taken in bulk from UK retail supply chains and used to support large-scale fraud. Instead of being used for normal calls, they are used to receive one-time passwords. Criminals use these to set up social media or messaging accounts that appear to be based in the UK. Even when telecoms companies disconnect the SIM numbers for breaking their terms of service, the online accounts that were set up using those SIMs often stay live and are then reused for harmful activity.
Stop Scams UK has been bringing together companies in affected sectors so they can work on this problem jointly. By sharing data on blocked SIMs through Stop Scams UK, members can spot and take down fraudulent accounts, because a SIM being blocked for breaking terms is a strong indicator of fraud risk. This illustrates how tackling a technical enabler through cross-sector collaboration can reduce fraud at scale, and underpins the announcement of a new multi-agency Online Crime Centre in March 2026.
International law enforcement, industry, and regulators have brought their expertise together through Stop Scams UK and the National Economic Crime Centre to understand how widespread this weakness is. The focus is on matching data to support account takedowns and collecting feedback. As the work develops, it will bring in more industry partners and continue a whole-system approach, mapping the networks involved and making policy changes that make SIM activation harder to abuse, closing the gaps criminals use to defraud UK consumers.Aviation Parts Fraud: Forged Airworthiness Documentation Exposes Supply Chain Assurance Risks
In December 2025, the Serious Fraud Office secured the conviction of Jose Alejandro Zamora Yrala, director of UK-based aircraft parts trader AOG Technics, following a global fraud involving the sale of aircraft engine parts with forged Authorised Release Certificates. The business, operated from a home office in Surrey, sold more than 60,000 parts accompanied by forged documentation that purported to guarantee airworthiness leading to an estimated £39.3 million in losses.
The fraud came to light in 2023 when a routine authenticity check with manufacturer Safran identified a forged certificate, triggering safety alerts across the UK, United States of America, and European Union, and grounding aircraft worldwide. Zamora generated £7.7 million in revenue between 2019 and 2023. Zamora pleaded guilty to fraudulent trading and was sentenced to four years eight months’ imprisonment.
This prosecution highlights how sophisticated fraud can damage safety-critical supply chains and impose high economic and institutional harms beyond direct financial loss.