A new customer orders goods, accepts the price and pays. For the sales team, it looks like a successful sale. But if the buyer, the party making the bank transfer and the recipient of the shipment are three different entities, it is worth understanding what connects them before closing the file. Risk can also arise in a transaction where the goods are real and are actually delivered.
On 28 October 2026, Spain’s Ministry of the Interior announced an investigation into a suspected network alleged to have laundered more than three million euros from cyberfraud by purchasing wine, machinery and industrial vehicles, which were then exported to Africa. The final phase of the operation took place on 20 and 21 October, with seven arrests following two on 11 August. These are the dates of the interventions, separate from the announcement date. [1]
According to investigators, supplying wineries were used as the formal exporters to separate the movement of goods from the flow of money. The statement does not establish criminal responsibility on the part of the suppliers: it describes a mechanism under investigation, not a judgment. Cadena SER reported the news on 28 October, attributing the account to the police. This is journalistic coverage, not an independent verification of the financial flows. [1][2]
Look at the sale, payment and delivery together
For an Italian exporting business, the useful question is how to check that the order makes sense as a whole. A check limited to the availability of payment can leave essential questions unanswered: why is another company paying? What relationship does it have with the customer? Who asked for that recipient to be named in the documents?
The indicators published by FATF and the Egmont Group in March 2021 specifically highlight third-party payments without a clear economic reason, discrepancies between trade documents and last-minute changes to payment instructions. They also explain that a single indicator does not necessarily provide sufficient grounds for suspecting money laundering: the context and the overall transaction profile matter. [3]
A triangular trading arrangement can have legitimate explanations. The approach proposed here is to ask for explanations that are understandable and can be documented, with scrutiny proportionate to the value and anomalies of the transaction. The destination country alone is not a basis for judging a customer.
Questions to resolve before shipment
A practical way to organise verification is to bring the parties involved into one record: the contractual customer, the payer, the recipient of the goods and any intermediary. For each, note the full legal name, company identifier, stated role and the document explaining its involvement. This primarily helps expose steps that might otherwise remain split between sales, finance and logistics.
If someone other than the customer pays, request the reason in writing and the information needed to verify it. A vague reference to “our group” still leaves open which companies belong to it and who authorised the payment. Where an explanation depends on corporate relationships, seek corroboration in accessible registries too, distinguishing verified information from the counterparty’s statements.
Before collection, compare the final order with the invoice and delivery instructions. Whoever authorises shipment should be able to reconstruct why a recipient changed and who approved the change. The organisational aim is to prevent a change accepted by telephone in one department from being treated by others as information already checked.
If a refund is requested to an account other than the one from which the funds arrived, have finance and the bank verify it separately. The presence of an incoming payment should not, by itself, become a reason to make a new transfer. This is an operational precaution proposed by the article, not an incident described in the Spanish case.
When explanations remain incomplete
It is useful to decide in advance who can stop the next step and who must resolve the uncertainty. Sales can collect explanations, but inconsistencies involving parties, money and documents require discussion with finance, advisers and the relevant control functions. Requests should be neutral, without accusing the customer on the basis of an anomaly.
Keeping the order, correspondence, instructions and checks performed makes it possible to reconstruct the decision. A well-documented file should explain the relationship between the buyer, payer and recipient, or explicitly identify what could not be clarified.
GRISK can support verification of counterparties and their corporate connections when the roles of buyer, payer and recipient of the goods require closer examination.
Sources and editorial note
The investigative facts are attributed to the Spanish ministry. Cadena SER reports police information and contains internal discrepancies in the number of arrests: this article uses the chronology of the primary source. The FATF indicators are methodological; the business verification steps are operational proposals by the article, not additional established facts or an assessment of the suppliers’ responsibility.
- Ministerio del Interior, «Desarticulada la red de blanqueo de una organización de ciberdelincuencia que inyectaba el dinero de las estafas en compra de vino y maquinaria industrial», 28 ottobre 2026. Fonte primaria.
https://www.interior.gob.es/opencms/es/detalle/articulo/Desarticulada-la-red-de-blanqueo-de-una-organizacion-de-ciberdelincuencia-que-inyectaba-el-dinero-de-las-estafas-en-compra-de-vino-y-maquinaria-industrial/ - David Callejo / Agencias, Cadena SER, «La Policía registra una vivienda en Fuenlabrada en el marco de una operación contra las ciberestafas», 28 ottobre 2026. Riscontro giornalistico basato sulla polizia.
https://cadenaser.com/cmadrid/2026/10/28/la-policia-registra-una-vivienda-en-fuenlabrada-en-el-marco-de-una-operacion-contra-las-ciberestafas-ser-madrid-sur/ - FATF–Egmont Group, «Trade-Based Money Laundering: Risk Indicators», marzo 2021. Documento metodologico primario, consultato il 29 ottobre 2026.
https://www.fatf-gafi.org/content/dam/fatf-gafi/reports/Trade-Based-Money-Laundering-Risk-Indicators.pdf.coredownload.inline.pdf