Asset Recovery in Money Laundering Cases: Why Only 12% of Jurisdictions Say They Can Trace Scam Proceeds
Pathik Shah
- Asked whether they considered themselves successful at tracing and seizing proceeds laundered from cyber scam hubs, two of seventeen APG member jurisdictions said yes. That is 12%. The majority could not even estimate how much had been laundered in their jurisdiction.
- Most writing on asset recovery measures outputs: how much was confiscated, in which year, under which power. This article looks at something upstream of that. Not how much was recovered, but how many authorities believe recovery is achievable at all. A capability figure behaves differently from an outcome figure, and it explains more.
AML Expert
Get tailored guidance on your compliance obligations, SAR filing, or AML program review.
Attribution note. The 12% figure, the associated challenge percentages and the recovery case studies all come from the APG Yearly Typologies Report 2025, and were checked against the source document rather than against secondary coverage. The FATF definition of asset recovery and the UNODC interception estimate are cited to their own sources rather than to the APG. Full sourcing appears in the references.
- What asset recovery means in AML
- The 12% finding, and what it does and does not show
- What blocks recovery of scam proceeds specifically
- What successful recovery has looked like
- Managing what you seize
- What would actually move the number
- What this means for compliance teams
- Frequently asked questions
A note on the sample before anything else. Twelve per cent of seventeen respondents is two jurisdictions. That is a small number and the assessment is self-reported. Both caveats should travel with the figure wherever it goes, and I have repeated them at every point in this article where the number appears.
- Only 12% of APG members, two of seventeen jurisdictions, considered themselves successful at tracing and seizing cyber scam proceeds.
- The majority could not estimate the total value laundered in their jurisdiction at all, which sits upstream of the capability gap.
- 76% named cross-border cooperation as a challenge, 71% named virtual asset tracing, and 65% named a lack of specialist expertise.
- Where recovery succeeded, it was fast. In one business email compromise, USD 39 million was withheld after four cooperation channels were used in parallel.
- Asset management is the least discussed stage. Value lost between seizure and disposal is a recovery failure that never appears in confiscation statistics.
- The most decisive interventions happen inside financial institutions, within hours, before any court is involved.
What Asset Recovery Means in AML
The FATF defines asset recovery functionally, as the process of identifying, tracing, evaluating, freezing, seizing, confiscating and enforcing an order for, managing, and disposing of criminal property or property of corresponding value.
That definition is worth using rather than paraphrasing, because it makes clear that recovery is a lifecycle rather than an event. A jurisdiction can be competent at tracing and poor at managing, or capable of freezing and unable to confiscate. Aggregate confiscation statistics conceal exactly this. [1]
The Three Routes to Confiscation
| Route | How it works | Where it fails against scam proceeds |
|---|---|---|
| Criminal, conviction-based | Confiscation follows conviction of the offender | Offenders are usually outside the jurisdiction and often unidentified |
| Civil, non-conviction-based | Action against the property rather than the person | Requires the property to be located and within reach |
| Administrative | Forfeiture of cash or listed assets through a civil process | Effective for cash, largely irrelevant to converted virtual assets |
Table 1. Confiscation routes and their limitations against cyber scam proceeds. Framework based on FATF asset recovery guidance [1] and [2]; assessment by AML Guild.
Provisional Measures Come First
Restraint, freezing and seizure are the provisional measures that hold an asset in place while the substantive process runs. In practice these decide the outcome. If nothing was restrained in the first days, the later legal architecture has nothing to operate on.
The 12% Finding, and What It Does and Does Not Show
Only 12% of APG members surveyed, meaning two of seventeen jurisdictions, considered themselves successful at tracing and seizing proceeds laundered from cyber scam hubs, whether domestically or from foreign jurisdictions.
Figure 1. Self-assessed capability to trace and seize cyber scam proceeds among APG member jurisdictions. Data source: APG Cyber Scam Hubs and Human Trafficking Report 2025 [5].
The Finding Underneath the Finding
The majority of respondents were unable to provide an estimate of the total value of assets linked to cyber scam hubs laundered in their jurisdiction. That is arguably the more serious result. An authority that cannot size a problem cannot make a resourcing case for addressing it, cannot set a target, and cannot demonstrate improvement.
Measurement failure sits upstream of capability failure. It is the reason the 12% is not surprising.
Why a Capability Measure Behaves Differently from an Outcome Measure
Confiscation statistics are lagging, lumpy and easily distorted by a single large case. A self-assessed capability measure is none of those things. It tells you what the people doing the work believe is achievable, which is what determines whether a case is opened at all.
It is also, being self-reported, softer evidence. Two jurisdictions saying yes is not proof that fifteen cannot. It is a strong signal about institutional confidence across a region.
How This Sits Against the Global Picture
Set against the wider evidence, 12% is consistent rather than anomalous. UNODC has estimated that countries intercept and recover less than one per cent of global illicit financial flows, a figure reported by the FATF. [2] The Basel Institute on Governance has put financial institution spending on AML compliance at around USD 206 billion globally for 2023. [4] Neither figure is an APG finding.
Figure 2. Global AML compliance spending against the estimated share of illicit flows recovered. Sources: Basel Institute on Governance [4] and UNODC via FATF [2]. The two figures are drawn from different methodologies and are presented as context, not as a direct ratio.
The uncomfortable question this raises is not whether AML works. It is what we are measuring when we say it works. If the entire industry spends two hundred billion a year and recovers under one per cent of the flows, then either the objective is something other than recovery or the measurement is wrong. Both answers deserve more attention than they get.
Jyoti Maheshwari | AML/CFT Practitioner, AML Guild
What Blocks Recovery of Scam Proceeds Specifically
Cyber scam proceeds present recovery obstacles that generic asset recovery analysis does not capture. Four of them are quantified in the APG survey and a fifth is structural.
Figure 3. Challenges reported by APG member jurisdictions in investigating and prosecuting money laundering linked to cyber scam hubs. Data source: APG Cyber Scam Hubs and Human Trafficking Report 2025 [5].
Cross-Border Friction, Reported by 76%
Most members identified the cross-border nature of cyber scam hubs and associated trafficking as a key challenge. The specific frictions named are a lack of communication or delayed responses from jurisdictions hosting the hubs, legal and policy barriers to information sharing, and difficulties with mutual legal assistance requests.
Mutual legal assistance was designed for a world in which evidence and assets stayed still. Against proceeds that convert and move within a day, a process measured in months is structurally mismatched.
Virtual Asset Tracing, Reported by 71%
Tracing illicit funds through virtual asset service providers and cryptocurrencies was named a primary challenge in investigating and prosecuting these cases. The problem is rarely the blockchain itself, which is more transparent than most banking systems. It is the on and off ramps: unlicensed exchanges, over-the-counter brokers and peer-to-peer platforms operating with minimal customer due diligence, frequently outside the investigating jurisdiction.
Specialist Capacity, Reported by 65%
A lack of specialised expertise in cyber-enabled fraud and scams was named by 65% of member respondents. This compounds the previous point. A tracing capability that exists on paper but sits with two overloaded analysts is not a capability at operational scale.
Foreign Nominees and Front Companies
Members also identified the use of foreign nominees and front companies as an obstacle to successful confiscation. This blocker operates after tracing succeeds. You can establish where the money went and still be unable to confiscate it, because the registered owner is a person or entity you cannot reach and cannot prove to be a nominee.
Speed of Dissipation
This one is not in the survey but runs through the case evidence. In an Indonesian case, funds were used to buy USDT worth USD 295,373 through foreign virtual asset service providers and part of that holding was liquidated on the same day, with proceeds returning to domestic accounts by peer-to-peer transfer. Purchase and liquidation inside twenty-four hours.
Figure 4. Two recovery timelines from the APG case evidence. Above, a business email compromise where funds remained in a bank account. Below, cyber scam proceeds converted to stablecoin within the same day. Data source: APG Yearly Typologies Report 2025 [5].
Would your institution be able to freeze a receiving account inside twenty-four hours? An AML Guild specialist can measure your actual interdiction path and show you where the delay sits. Find your expert at amlguild.com.
What Successful Recovery Has Looked Like
The APG case set does contain substantial recoveries. They share a consistent profile: the report came quickly, a cooperation channel already existed, and the asset was still in a form that could be frozen.
USD 39.3 Million Returned in a Business Email Compromise
In early July 2024 an employee of a Singapore company received an email appearing to come from the company's liquefied natural gas supplier, giving new bank details for a payment of USD 42.3 million. The supplier's email account had likely been compromised and the correspondence intercepted.
The transfer was made on 19 July 2024. The fraud was reported to police on 23 July. The Singapore Police Force requested assistance through four channels simultaneously: INTERPOL's Global Rapid Intervention of Payments mechanism, ARIN-AP, FIU-to-FIU channels and mutual legal assistance. On 24 July, USD 39.3 million had been withheld from the receiving account. Joint investigation produced nine arrests and recovery of over USD 2 million within two days. USD 39.3 million was returned to the victim.
| Factor | What made the difference |
|---|---|
| Elapsed time | Reported 23 July, funds withheld 24 July |
| Channels | Four used in parallel rather than sequentially |
| Asset form | Funds still sitting in a bank account, not converted |
| Pre-existing networks | INTERPOL GRIP and ARIN-AP already established |
| Outcome | USD 39.3 million returned, nine arrests |
Table 2. Factors behind the recovery in the Singapore business email compromise case. Source: APG Yearly Typologies Report 2025 [5].
Seizure of an Operating Business
In an Indonesian case, an entrepreneur suspected of running an illegal online gambling network received roughly IDR 356 billion, around USD 21.5 million, into one personal account and IDR 46 billion, around USD 2.8 million, into another, from nominee accounts managed by gambling agents. Approximately IDR 146 billion, around USD 8.8 million, was routed through a company directed by his son and used to build a four-star hotel. PPATK and the Indonesian National Police froze IDR 72.3 billion, around USD 4.4 million, and the hotel project was seized.
This is recovery at the integration stage, and it is much harder. The asset is illiquid, partially built, and now requires active management by the state.
Three Further Recoveries, and One That Failed
| Case | Recovered | What determined the outcome |
|---|---|---|
| Thailand, call centre scams | USD 12 million in crypto-assets, 50+ arrests | Central Fraud Registry allowed institutions to share and analyse suspicious transaction data |
| Australia, Operation Firestorm | AUD 1.3 million of AUD 1.9 million frozen | Australian banks froze funds while the scam centre was still operating in Bangkok |
| Singapore and Hong Kong, tech support scams | HKD 300,000 then a further HKD 1.3 million | Joint investigation after 185 reports totalling around USD 14 million in losses |
| Chinese Taipei, ransom payments | Nothing recovered | Proceeds moved to cryptocurrency wallets owned by foreign nationals and could not be seized in time |
Table 3. Four recovery outcomes from the May 2026 report. Source: APG Cyber Scam Hubs and Human Trafficking, May 2026 [3], Case Studies 5, 13, 18 and 30.
The last row is the instructive one. The report states plainly that the criminal proceeds were transferred to cryptocurrency wallets owned by foreigners and could not be seized in time, even though the court ordered confiscation of the illicit gains. A confiscation order against assets nobody can reach is a paper outcome.
What the Successful Cases Have in Common
Speed above all. A cooperation channel that existed before the case rather than being constructed during it. And an asset that had not yet been converted into a form outside the reach of a freezing order. Where all three are present, recovery rates look nothing like 12%.
Managing What You Seize
Asset management is the least discussed stage of the recovery lifecycle and one of the most consequential. An asset that loses most of its value between seizure and disposal is a recovery failure that never appears in the confiscation statistics.
Operating Businesses and Depreciating Assets
A partially constructed four-star hotel does not sit still. It requires security, maintenance, insurance and decisions about whether to complete construction. Every month of judicial process is a month of carrying cost, and the state is rarely equipped to run a hospitality development.
Virtual Asset Custody
Seized virtual assets raise custody and volatility questions that most asset management frameworks were not written for. Who holds the keys, under what governance, and what happens if the asset halves in value between seizure and forfeiture are questions with no settled answer in many jurisdictions.
What the APG Recommends
The May 2026 report sets out seven practices members identified as effective. They are worth listing because they are unusually concrete for a document of this kind.
- Professional and holistic financial analysis expertise with continuous professional development.
- Rapid domestic interagency coordination mechanisms or task forces with supporting analytical infrastructure.
- International cooperation fast enough to draw in non-AML authorities including those responsible for trafficking victims.
- Enhanced public private partnerships.
- Dedicated awareness raising campaigns.
- Enhanced due diligence measures.
- Legislative or institutional change where the existing framework does not fit the nature of cyber scam hubs.
Note what sits at the top of that list. Not technology, and not new powers. Analytical expertise and speed of coordination.
Procedures and Manuals
The APG asked members about the availability of manuals and procedures for agencies involved in asset management. The thin response to that question is itself informative. Where formal asset management procedures do not exist, outcomes depend on the judgement of individual officers under time pressure.
What Would Actually Move the Number
Each recommendation below is tied to a specific blocker identified above. Generic calls for better cooperation are not useful, because everyone already agrees with them.
- Measure before building capability. The majority could not estimate the value laundered. Sizing the problem is a precondition for resourcing, targeting and demonstrating improvement, and it is achievable with existing suspicious transaction reporting data.
- Pre-position cooperation channels. The Singapore case worked because INTERPOL GRIP, ARIN-AP and FIU-to-FIU relationships existed before the case arose. Channels built during a case arrive after the money has gone.
- Put blockchain analytics inside recovery units, not only inside supervision. 71% named tracing as a primary challenge. Analytical capability located away from the people who can act on it does not close that gap.
- Use non-conviction-based confiscation where conviction is unavailable. Scam hub operators are frequently outside the jurisdiction and often unidentified. A recovery framework that requires a convicted defendant will recover nothing in a large share of these cases.
- Treat institutional interdiction speed as part of the recovery system. The decisive intervention in the Singapore case happened within a day, at the level of banks and payment providers, before any court was involved.
What This Means for Compliance Teams
Asset recovery is usually framed as a law enforcement problem. Three parts of it sit squarely inside a regulated institution, and all three are examinable.
Low Recovery Rates Raise Your Residual Risk
If recovery is unlikely once funds leave your institution, the weight of your control environment shifts forward, onto prevention and interdiction. That is a legitimate input into an enterprise-wide risk assessment and it is worth stating explicitly rather than leaving implicit.
Reporting Quality Is a Recovery Input
A suspicious transaction report that names the counterparty account, the amount, the timing and the destination institution is actionable for tracing. One that describes unusual behaviour in general terms is not. The difference costs nothing to fix and determines whether the report can support a freeze.
Interdiction Speed Is Measurable, So Measure It
Establish honestly how long it takes, from a customer report to a freeze on a receiving account held elsewhere. Not the target. The measured elapsed time, including out of hours. Then compare that with the same-day conversion speed shown in the case evidence. That comparison is the single most useful slide you can put in front of a board on this subject.
What We Still Do Not Know
Three limitations should accompany any use of the 12% figure.
The sample is seventeen respondents, so 12% is two jurisdictions. Small-sample percentages are unstable and should not be treated as a precise regional rate.
The assessment is self-reported. It measures institutional confidence, not audited performance. A jurisdiction with modest capability and high confidence would answer yes.
The question concerned scam-related proceeds specifically. It is not a general statement about asset recovery capability, and it should not be quoted as one.
Frequently Asked Questions
Everything you need to know about asset recovery in money laundering cases, and how AML Guild supports your business.
What is asset recovery in money laundering?
The FATF defines it functionally as identifying, tracing, evaluating, freezing, seizing, confiscating and enforcing an order for, managing, and disposing of criminal property or property of corresponding value. It is a lifecycle rather than a single event, which matters because a jurisdiction can be strong at one stage and weak at another.
How much criminal money is actually recovered?
Two different measures are often confused. UNODC has estimated that countries intercept and recover less than one per cent of global illicit financial flows, which is an outcome measure. Separately, 12% of APG members surveyed, meaning two of seventeen jurisdictions, considered themselves successful at tracing and seizing cyber scam proceeds, which is a self-assessed capability measure on a small sample.
What is the difference between seizure, confiscation and forfeiture?
Seizure and restraint are provisional measures that hold an asset in place while proceedings run. Confiscation is the permanent deprivation of the asset following a court order. Forfeiture generally refers to civil processes applied to cash or listed assets without requiring a conviction. The terminology varies by jurisdiction, so the FATF glossary is the safer reference in cross-border work.
What is non-conviction-based confiscation?
It is action taken against the property rather than the person, so it does not require the offender to be convicted or even identified. It matters against cyber scam proceeds because the operators are frequently outside the jurisdiction and often unidentified, meaning a conviction-based framework alone would recover nothing in a large share of cases.
Why is it so hard to recover cryptocurrency proceeds?
The blockchain is generally more transparent than a banking system. The difficulty is at the on and off ramps: unlicensed exchanges, over-the-counter brokers and peer-to-peer platforms operating with minimal customer due diligence and usually outside the investigating jurisdiction. 71% of APG members named tracing through virtual asset service providers as a primary challenge, alongside a shortage of specialist expertise reported by 65%.
How quickly do authorities need to act to freeze scam funds?
Faster than most frameworks are designed for. In one APG case, funds were used to buy USDT and part of the holding was liquidated on the same day. In the successful business email compromise case, the fraud was reported on 23 July 2024 and USD 39.3 million was withheld the following day. The difference between recovery and loss in these cases is measured in hours.
Can scam victims get their money back?
Sometimes, and the determining factors are speed and asset form. Where funds remain in a bank account and the report is fast, restitution is achievable, as in the Singapore case where USD 39.3 million was returned. Where proceeds have been converted to virtual assets and dispersed across jurisdictions, recovery is rare.
What is mutual legal assistance and why is it slow?
Mutual legal assistance is the formal process by which one jurisdiction requests evidence or action from another. It is slow because it involves central authorities, legal review in both jurisdictions and, often, translation. APG members named delays and non-response as a key obstacle. It was designed for evidence that stays still, which is a poor fit for proceeds that convert within a day.
What happens to seized assets before confiscation?
They have to be managed, and this is the least discussed stage of the lifecycle. Operating businesses need running, construction projects need securing, and virtual assets need custody arrangements and a policy for volatility. Value lost between seizure and disposal is a recovery failure that never appears in confiscation statistics.
Can confiscated assets be returned to another country?
Yes. Repatriation and asset sharing arrangements exist, and the APG case set includes examples of returns to victims in other jurisdictions. The Singapore business email compromise case involved cooperation across three jurisdictions to return USD 39.3 million to the victim.
Why can't authorities estimate how much is laundered?
The APG found that most respondents could not provide an estimate of the total value linked to cyber scam hubs laundered in their jurisdiction. The reasons include fragmented reporting, cross-border flows that no single authority sees in full, and the absence of a consistent methodology. Measurement failure sits upstream of capability failure.
What role do banks play in asset recovery?
A decisive one, at the interdiction stage. The most important intervention in the Singapore case happened within twenty-four hours, at the level of banks and payment providers, before any court was involved. Reporting quality also matters: a report naming the counterparty account, amount, timing and destination institution is actionable for tracing, whereas a general description of unusual behaviour is not.
Does filing a suspicious transaction report help recover funds?
It can, but only if it contains what a tracing team needs. The determining factors are specificity and speed. A detailed report filed quickly can support a freeze. A general report filed after the standard internal review cycle usually arrives after the funds have moved.
Which jurisdictions are good at asset recovery?
The APG survey does not answer this, and it would be wrong to infer it. Responses were anonymised and self-assessed, so the two jurisdictions reporting success are not identified. The findings describe a regional pattern, not a ranking.
What does the APG recommend to improve asset recovery?
The May 2026 report identifies seven practices members found effective: holistic financial analysis expertise with continuous professional development; rapid domestic interagency coordination and analytical infrastructure; international cooperation quick enough to involve non-AML authorities including those handling trafficking victims; enhanced public private partnerships; awareness raising campaigns; enhanced due diligence; and legislative or institutional change where the framework does not fit. Analytical expertise and coordination speed sit above technology and new powers on that list.
Are there examples of scam proceeds being recovered?
Yes, though they are a minority. The May 2026 report documents USD 39 million withheld in a Singapore business email compromise, USD 12 million in crypto-assets recovered by Thailand alongside more than 50 arrests, AUD 1.3 million of AUD 1.9 million frozen by Australian banks in Operation Firestorm, and HKD 1.6 million recovered in a joint Singapore and Hong Kong technical support scam investigation. It also documents a Chinese Taipei case where proceeds moved to foreign-owned cryptocurrency wallets and could not be seized in time despite a court confiscation order.
Is asset recovery a good measure of AML effectiveness?
It is contested. Recovery is the most tangible outcome available and the FATF treats depriving criminals of assets as a core objective. Against that, the Basel Institute on Governance has argued that low confiscation rates alongside roughly USD 206 billion in annual compliance spending should prompt harder thinking about what success means. Both positions are defensible and a risk assessment should acknowledge the debate rather than assume a resolution.
References
Primary sources are listed first. Where this article reports a figure that the APG cited from another organisation, the reference points to that organisation rather than to the APG. Links were checked on 9 August 2026.
[1] Financial Action Task Force (2025) Asset Recovery Guidance and Best Practices. November 2025. Source of the functional definition of asset recovery. Download the guidance (PDF)
[2] Financial Action Task Force. Asset Recovery topic page, including the UNODC estimate that countries intercept and recover less than one per cent of global illicit financial flows. fatf-gafi.org asset recovery
[3] Asia-Pacific Group on Money Laundering (2026) Cyber Scam Hubs and Human Trafficking. Sydney, Australia, May 2026. Published 7 July 2026. Survey base: 17 public sector responses from 17 jurisdictions, 156 private sector responses from 14 jurisdictions, four blockchain analytics companies and one VASP. Includes Appendix A, Red Flag Indicators. Download the report (PDF)
[4] Basel Institute on Governance (2025) Anti-money laundering: what is success? February 2025. Source of the USD 206 billion annual AML compliance spend estimate for 2023. baselgovernance.org
[5] Asia/Pacific Group on Money Laundering (2025) Yearly Typologies Report 2025. November 2025. Source of the 12% capability finding, the challenge percentages, and the recovery case studies including the Singapore business email compromise case and the Indonesian hotel seizure. apgml.org/typologies/apg-typologies-reports
Chart and Data Reuse
The four charts in this article were produced by AML Guild from the published data. You may reproduce them free of charge, in commercial and non-commercial work, provided the conditions below are met.
- Credit the chart to AML Guild and include a link to this page.
- Carry the underlying data source with the chart. For example: Chart: AML Guild. Data: APG Cyber Scam Hubs and Human Trafficking Report 2026.
- Do not alter the underlying values or remove the source line from the caption.
- Where a chart states a limitation, reproduce that limitation alongside it.
- Do not attribute figures from UNODC, the IMF, GI-TOC or the Basel Institute to the APG or to AML Guild.
The underlying statistics are the property of the organisations named in the references. AML Guild claims no rights over them. The licence granted here covers the charts and the arrangement of material on this page only.
How to Cite This Page
Shah, P. (2026) Asset Recovery in Money Laundering Cases: Why Only 12% of Jurisdictions Say They Can Trace Scam Proceeds. AML Guild, 9 August 2026. Available at: amlguild.com/blogs/insights/asset-recovery-gap-scam-proceeds (Accessed: [your date]).
When citing an individual statistic, cite the originating body directly rather than this page.
Disclosure and Verification
This article was written by Pathik Shah, Founder of NIYEAHMA Consultants LLP, and reviewed by the AML Guild expert panel named at the head of the page. AML Guild has no commercial relationship with the APG, UNODC, the IMF, GI-TOC or the Basel Institute on Governance, and receives no funding from any of them. No part of this article was sponsored.
The 12% figure is a self-assessed capability measure drawn from a sample of seventeen respondents, meaning it represents two jurisdictions. Anyone reproducing it should carry both the sample size and the self-assessment caveat. Figure 2 places two figures from different methodologies alongside one another for context and should not be read as a direct ratio.
If you find an error on this page, write to info@amlguild.com. Corrections are made in place and recorded below.
Work With Pathik Shah Through AML Guild
Pathik Shah and the AML Guild network provide on-demand, CAMS-certified AML/CFT support for regulated businesses, from building and remediating compliance programmes to measuring interdiction speed and strengthening reporting quality.