Wildlife trafficking doesn’t need to hide. The disguise is ready to wear.

Wildlife trafficking is often framed as a conservation issue. In reality, it operates as a global criminal market estimated to generate between $7 billion and $23 billion each year, placing it among the most profitable illicit trades worldwide.

It operates through the same infrastructure as legitimate trade, and is largely invisible to the systems designed to detect it. The signals are there. They are just being looked for in the wrong places and in the wrong way.

High-value products derived from endangered species, including ivory, exotic skins, live animals, and traditional medicine inputs, are sourced, transported, and sold through supply chains that mirror legal commerce.

The financial flows associated with wildlife trafficking pass through correspondent banking relationships, trade finance channels, and commercial payments without triggering alerts. This is by design. Trafficking networks use the camouflage that legitimate trade provides.

Same routes. Same documentation. Same counterparties.

Any detection model built on outbound trade signals will produce false positives at a volume that makes prioritization unworkable.

The more actionable signal is inbound.

When criminal proceeds flow back through newly established entities from counterparties in known destination markets, before any credible trading history exists, this is not a weak indicator. It is the laundering event itself. And it is visible at onboarding, not in the transaction stream.

Even then, the signal is only conclusive when seen across institutions. No single bank will see enough of the pattern to act with confidence.

The answer? Sharing insights from data and feature sharing. The key to discovering these risks and vulnerabilities lies in behavioral analysis of transactions, clients, and counterparties that lie in transactional and payment data.

This entails sharing features without moving data (mathematical representations of behavioral patterns make the network visible without exposing customer data).

This piece sets out why the current approach is structurally compromised, and what a more effective response looks like across three connected layers: KYB, inbound transaction monitoring, and cross-institutional behavioral feature sharing.

A global criminal market operating at a commercial scale

At the center of wildlife trafficking is demand. Products such as rhino horn continue to command significant prices in illegal markets, with reported values ranging from $20,000 to $60,000 per kilogram. That level of pricing supports coordinated cross-border supply chains, linking source regions to end markets through established routes.

This has real-world impact. Tragically, at least 20,000 elephants are killed each year, approximately 5% of the total population. UNODC analysis has recorded wildlife seizure incidents across 162 countries, affecting around 4,000 plant and animal species, showing how widely this activity is distributed across regions and trade corridors.

[Image sourced from The Washington Post]

The trade sits within legitimate global infrastructure

Cross-border payments are frequently cleared in major currencies. And FATF analysis highlights that wildlife trafficking networks make use of international financial systems, including correspondent banking relationships and trade-based money laundering techniques.

The physical movement of goods may appear regional. The financial system that supports it is not.

In fact, there are documented cases of wildlife products entering the United States through major logistics hubs, including international airports such as JFK, often concealed within legitimate cargo shipments. These flows are supported by the same financial infrastructure used for legitimate trade.

Detection is focused on the wrong end of the chain

Outbound flows are camouflaged by design. Trafficking networks deliberately embed within legitimate trade infrastructure, using the same routes, the same documentation, and the same counterparties as clean cargo. A shipment of wildlife products export look identical. Any detection model built on outbound signals will, by definition, fire on genuine exporters at significant volume.

This is not a calibration problem that better rules can solve. It is a structural feature of how the trade is constructed, and it means that outbound-focused detection will always carry a false positive burden that makes prioritization and escalation practically unworkable at scale.

Further reading:

• ➡FATF REPORT Money Laundering and the Illegal Wildlife Trade
• ➡UNOC World WildlifeCrime Report 2024 

[Image sourced from The Washington Post]

Significant global attention, limited structural progress

Over the past decade, wildlife trafficking has received sustained attention from governments, financial institutions, and civil society. It is not an overlooked issue.

Public–private initiatives have focused directly on the financial dimension of the trade.

The United for Wildlife Financial Taskforce, for example, brings together financial institutions, regulators, and law enforcement to identify and disrupt illicit financial flows linked to wildlife trafficking. The issue has also attracted significant global attention at a leadership level. Initiatives led by the Prince of Wales have helped convene governments, financial institutions, and conservation organisations, elevating wildlife trafficking as a coordinated international priority.

Financial institutions have also taken leadership roles. Standard Chartered, for example, has been active in advancing industry understanding of the financial flows associated with wildlife crime.

These efforts have strengthened awareness, typologies, and information exchange across the industry. However, they remain largely dependent on institution-level detection and case-led collaboration. As a result, the ability to identify distributed patterns across institutions, and to act preventatively rather than reactively remains limited.

The issue has also entered broader public consciousness through advocacy and media, including work such as The Last Days, which highlights the human and environmental cost of the trade.

This is reflected in formal global analysis. The Financial Action Task Force has published detailed work on money laundering linked to wildlife trafficking, while the Egmont Group has examined the role of financial intelligence units in investigating these networks.

There is no lack of intent or attention.

However, the impact of these efforts has been constrained by the structure of the systems they operate within. Information sharing remains limited, slow, and often bilateral. Detection approaches are largely institution-specific, relying on typologies and transaction monitoring frameworks that were not designed for distributed, cross-border criminal networks. Collaboration is encouraged, but the mechanisms to do so at scale and in a preventative way remain underdeveloped.

As a result, institutions are attempting to identify a networked global activity using localised and fragmented views of risk.

The challenge is not awareness. It is the architecture.

Why wildlife trafficking is difficult to detect within financial systems 

The scale of the market is documented. The financial investigation that should follow from it is not. Understanding why requires looking at how AML frameworks are built, and where wildlife trafficking sits within them.

Transactions, counterparties, and payment flows are monitored by systems built to identify financial crime risk.

Most detection models are calibrated to identify deviations. Unusual values, unexpected behavior, and known typologies are at the center of alerting logic. Because of this, activity that aligns with expected trade patterns can move through these systems without triggering alerts.

Activity linked to wildlife trafficking does not necessarily trigger alerts when assessed individually.

FATF has identified a range of indicators associated with wildlife trafficking, including the use of front companies, trade in wildlife-related goods, and links to high-risk jurisdictions.

These indicators are valuable. But they rely on activity presenting as identifiable signals. Wildlife trafficking does not always behave that way.

AML frameworks and distributed criminal networks

Here’s why wildlife trafficking is difficult to recognize through conventional monitoring approaches. 

AML frameworks have been shaped by established typologies

Detection models are calibrated around recognizable behaviors. Alerting logic is designed to surface deviation from expected behaviors, supported by thresholds, scenarios, and typology-driven rules. That approach works where behavior follows defined and repeatable signals.

Wildlife trafficking operates differently

It is structured as a distributed network, with distinct roles across sourcing, transport, and sales. Because of this, activity is spread across entities, jurisdictions, and transactions. Payments move through multiple counterparties. And relationships extend across regions. No single point in the chain reflects the full picture.

Operational challenges of typology-driven approaches

Typology-driven models rely on known patterns of behaviors. They perform well where the patterns are clearly defined and can be distinguished from legitimate activity. 

In the case of wildlife trafficking, the issue is more nuanced. 

The underlying activity can exhibit identifiable patterns, including the use of trade-based structures, front companies, and cross-border payment flows. These have been documented in FATF and UNODC analysis.

However, these patterns often overlap with legitimate commercial activity. Import-export businesses, logistics providers, and cross-border payments are all standard components of global trade. As a result, distinguishing illicit activity from legitimate behavior becomes more complex

Inbound payments are the more actionable signal

If outbound is camouflaged by design, inbound is where the network is forced to reveal itself. Criminal proceeds must flow back toward source markets. That return flow carries a combination signal that is structurally harder to disguise:

• ➡significant inbound payments
• ➡into a newly incorporated entity
• ➡from counterparties in known destination markets
• ➡before any credible trading history exists

There is no plausible, legitimate explanation for a newly registered UK or US import-export company receiving material inbound flows from Vietnam or Laos before it has documented supply chains, established customers, or a track record of completed trade. This is not a yellow flag requiring further investigation. It is a near-definitive signal and one that should be caught before it ever reaches the transaction stream.

This is where KYB and transaction monitoring need to work in sequence.

KYB is the entry point. The mismatch between entity maturity and inbound counterparty profile is visible at onboarding, and that is where enhanced scrutiny should be triggered.

Transaction monitoring then operates on top of that elevated risk classification, tracking how inbound flows behave over time, whether volumes escalate, and whether the counterparty network expands or changes. 

Transaction monitoring is being used to identify activity that should already have been addressed at onboarding, but the due diligence question needs to be asked earlier: who is paying this entity, from where, and does its business maturity justify that flow?

A broader analytical lens

The focus moves toward understanding how activity connects across a network, rather than identifying individual events.

This requires a broader view across entities, counterparties, and flows. And it requires a more complete interpretation of risk, moving beyond individual transactions toward patterns that emerge across relationships.

Risk sits across the network, rather than within individual transactions, making it harder to identify through typology-driven approaches.

Exposure is closer to routine activity than expected

Flows linked to the movement of wildlife products pass through payments, trade finance, and commercial banking channels. These are standard components of global trade. This means that activity is often assessed within existing AML processes, rather than being defined and analysed as a specific risk typology. 

This creates a structural gap.

The underlying patterns are not absent. They include identifiable characteristics: trade-linked payments, use of intermediary entities, cross-border flows between source and destination markets, and links to sectors associated with wildlife products. These have been documented in FATF and UNODC analysis.

However, these patterns are not consistently mapped or operationalised within detection frameworks. Where they are implemented, they often sit within broader categories of activity, where signals are diluted by volume and overlap with legitimate trade. This makes prioritization more difficult.

This challenge is compounded by how these flows are observed across the financial system.

Wildlife trafficking typically spans source, transit, and destination markets, each with different levels of visibility, control, and analytical focus. Payments may appear routine at the point of origin, commercially valid in transit, and consistent with expected demand at the point of destination.

As a result, no single institution or jurisdiction necessarily sees the full pattern. Detection remains local. The activity is not.

No single bank can see the network, but the network is there. The need for collaboration is critical.

The inbound signal has a second structural limitation. It is only fully visible across institutions, and often across borders.

Each institution has insufficient grounds to escalate or to suspect the transaction. Collectively, they may see that the transactions are exposing at a trafficking network.

But no single bank will ever see enough of the trafficking behavior to act with confidence. And conventional data sharing is not a viable solution. No institution will expose its customer relationships to competitors or accept the regulatory and security risks of pooling raw data and PII.

The mechanism that enables cross-institutional pattern recognition without data sharing is federated machine learning.

Each bank contributes not its customer data, but features and weights (mathematical representations of behavioral patterns), including:

• ➡change in deposit pattens
• ➡new counterparty jurisdiction profile
• ➡inbound payment volume relative to declared business activity
• ➡rate of counterparty network expansion

These features can be compared and combined across institutions without any bank identifying another bank’s customer.

When the same feature combination recurs across multiple institutions at the same time, the signal strength increases.

What looks like a plausible new trading relationship at Bank A becomes, in aggregate, an identifiable suspect network.

The suspicious activity and network are revealed. Without any institution exposing what it individually knows.

US-linked cases reinforce this proximity. Wildlife products have entered the United States through major logistics hubs, supported by financial flows that align with standard trade activity.

[Image sources from The Washington Post]

Exposure to wildlife trafficking is often within routine financial activity without being connected or assessed as a single risk.

Wildlife trafficking: A banking risk hidden in plain sight

Wildlife trafficking continues to operate at scale, supported by demand. It uses the same structures as global trade. Activity linked to this trade does not always register as a distinct risk. 

One architecture, three points of application through Federated Learning

Outbound detection is structurally compromised.

The camouflage is too effective, and the false positive burden is too high for it to serve as the primary line of defence. The focus needs to change across three connected layers.

Closing this gap is the only way detection can keep up with how this trade operates. 

📕Further reading in this series:

• AML and the money behind child exploitation: An industry imperative