An Organised Crime Economy That Ignores Borders

When the UN Office on Drugs and Crime launched its latest threat assessment in Bangkok on 21 July 2026, it reframed Southeast Asia’s organised crime economy. Rather than a collection of national criminal ecosystems, the report describes a franchised network. Its operators share laundering channels, trafficking routes and digital infrastructure across borders.

“Their operating model looks like corporate franchising,” said Delphine Schantz, UNODC’s Regional Representative for Southeast Asia and the Pacific. Laundering, trafficking and data-harvesting run as specialised departments plugged into one shared service network.

For banks, that finding lands awkwardly on top of a screening framework built for a different kind of criminal economy. If organised crime increasingly operates as a cross-border network rather than a collection of national ecosystems, the appropriate unit of financial crime risk is the network. It is not the country it happens to touch.

The jurisdictions most associated with this network currently sit on three different rungs of the FATF risk ladder. One is blacklisted, one is grey-listed, one carries no FATF designation at all. UNODC says the same operators move between them regardless.

The Departments Inside One Franchise

UNODC’s report, An Interconnected Criminal Ecosystem: Transnational Organized Crime Threat Assessment for South-East Asia 2026, documents a shift.

Groups that once confined themselves to a single territory or a single type of crime now run several at once. Scam operations, human trafficking, migrant smuggling, drug trafficking and money laundering all move through shared financial and technical infrastructure.

Larger operators sell laundering pipelines, recruitment funnels and fraud platforms to smaller affiliates for a fee. UNODC describes this as a “crime-as-a-service” model, with specialist providers offering money laundering, recruitment and digital infrastructure to affiliated groups.

That service model extends even to purchased access inside corrupt police forces, immigration departments and corporations.

Losses across East Asia, Southeast Asia, Australia and New Zealand rose from an estimated USD 18–37 billion in 2023 to USD 88.3–114.1 billion in 2025.

UNODC lead analyst Inshik Sim said the network’s scale is “outpacing existing responses,” designed for far less sophisticated criminal activity than the region now faces.

One Network, Three Jurisdictions

Jurisdictional assessments remain indispensable for measuring the strength of a country’s AML and supervisory framework. The challenge is that organised criminal networks increasingly operate across those jurisdictional boundaries rather than within them.

Myanmar sits on FATF’s blacklist, formally the list of High-Risk Jurisdictions Subject to a Call for Action. FATF calls for enhanced due diligence proportionate to the risk there.

Laos sits on the grey list, added in February 2025 and still under increased monitoring as of FATF’s 19 June 2026 plenary statement. Cambodia, where the network’s most heavily sanctioned entities are domiciled, carries no FATF designation at all.

A bank’s jurisdiction-based screening model treats these three inputs completely differently by design. Maximum scrutiny applies to Myanmar, enhanced monitoring to Laos, and standard due diligence to Cambodia.

The Cost of Treating Networks as Countries

For financial institutions, that structural mismatch carries a measurable cost.

LexisNexis Risk Solutions surveyed the region in 2023, publishing its findings in March 2024. It put Asia-Pacific’s annual financial-crime compliance bill at roughly USD 45 billion across five markets, with 98% of institutions reporting costs still rising.

Although based on a 2023 survey published in 2024, it remains one of the few publicly available estimates of financial crime compliance costs in Asia-Pacific. Much of that investment still supports control frameworks built around customer, transaction and jurisdictional risk. That same network operates across those boundaries by design.

The Bank for International Settlements has documented the long-term decline in correspondent banking relationships, particularly affecting smaller and higher-risk jurisdictions. That trend reflects the growing cost of managing financial crime risk across borders.

FATF’s own guidance on correspondent banking encourages institutions to adopt genuinely risk-based assessments rather than relying solely on jurisdictional indicators. The guidance reflects an acknowledgement that country ratings alone cannot capture every source of financial crime risk.

When Regulators Target the Network Instead

One action against this network actually worked, because it targeted the network, not a country.

FinCEN first proposed severing Cambodia-based Huione Group from the US financial system under Section 311 of the USA PATRIOT Act in May 2025. It finalised the rule on 14 October 2025, alongside coordinated OFAC and UK sanctions that hit 146 targets inside Prince Group.

The finalised rule found Huione had laundered more than USD 4 billion in illicit proceeds between August 2021 and January 2025. Those funds moved for actors spanning Southeast Asian scam operations and North Korean cyber theft alike.

Treasury widened the sanctions against the same network again in June 2026.

“Scam centers in Southeast Asia steal billions of dollars from American victims each year,” said Scott Bessent, Secretary of the Treasury, in the accompanying statement. Each action treated the network as the unit of analysis, not the jurisdiction it happened to be sitting in that month.

How Regulators Are Redefining the Unit of Risk

Singapore’s regulator got there by a different road entirely.

On 4 May 2026, the Monetary Authority of Singapore began a Proof-of-Value exercise, pooling transaction data from five banks. It marked the first time MAS has combined bank-level data at the regulator tier, built for pre-emptive detection rather than post-loss reporting.

The rationale MAS gave is structural, not political. Any single institution only holds transaction history for its own customers. That limits how much of a fraud pattern spanning several banks can ever be visible to any one of them alone.

That is precisely the blind spot a franchised, service-sharing criminal network is built to exploit.

The Question This Leaves Banks

UNODC did not set out to write a banking compliance paper, but Schantz’s own language answers the question anyway. A network organised like a franchise is not disrupted by removing one franchisee. It is not seen by a control built to flag one jurisdiction at a time.

MAS’s pooled-data pilot and the Section 311 action against Huione are early proof of a shift already underway. Jurisdiction-based screening is giving way to network-based screening, for the institutions paying attention.

Every other bank still pricing risk by border will keep paying for the gap in its own model. That is the true cost of mistaking one franchise for three unrelated countries.