"Hidden bank" in Milan: shell companies, cash handed back and crypto, the scheme behind 110 million in false invoices

In breve: on 21 October 2026 the Guardia di Finanza (Italy's financial police) of Milan and Monza Brianza, acting on the delegation of the Milan Public Prosecutor's Office (Direzione distrettuale antimafia, the district anti-mafia directorate), carried out precautionary measures against 30 suspects and an urgent preventive seizure of over 21 million euros. According to the prosecution, behind a car rental company in Pero operated a "hidden bank" that sold false invoices through shell companies and handed back in cash what had been paid, then transferring the funds abroad and into cryptocurrencies. For anyone who must know the customer, this is a textbook case: shell companies in construction, logistics and services that, after a while, fail and are replaced by new ones.

What happened?

The preliminary investigations judge (G.I.P.) of the Court of Milan ordered personal precautionary measures against 30 suspects: 16 in prison and 14 under house arrest. Arrests are also under way in Spain, with European arrest warrants, and in Switzerland, with an international letter rogatory. Searches covered 26 locations in Lombardy, Piedmont, Emilia-Romagna, Tuscany, Apulia, Calabria and Campania, with over 350 military personnel deployed, and cash, bank accounts, cryptocurrencies, cars, boats, jewellery, luxury watches and cash-counting machines were seized.

The criminal association charged, according to the press release, is aggravated by facilitating mafia-type associations and by the use of mafia-type methods (systematic intimidation and protection of the group in the territory), and was engaged in international money laundering, tax fraud, bankruptcy offences, drug trafficking and weapons offences. The proceedings are at the preliminary investigation stage: the presumption of innocence applies until any conviction, as the press release itself recalls.

How the "hidden bank" worked, according to the prosecution

The press release describes a four-stage system which offered its "clients" (mainly drug traffickers and tax evaders) the services of a bank outside the official channels, the so-called underground banking:

1. Collection of cash from tax evasion and drug trafficking, in exchange for cryptocurrencies or for transfers to accounts in Asia, Canada and South America.
2. False invoices issued by shell companies registered in the names of nominees, with fictitious registered offices mainly in Lombardy and Campania, to compliant businesses mostly in construction, logistics and services, which thereby reduced their taxable income. After a certain period the shell companies were taken to bankruptcy and replaced with new companies.
3. Return of the cash: the business paid the false invoice by bank transfer and received back, through couriers, the same sum in cash, minus a commission of between 2% and 5%.
4. Money laundering: the money accumulated in the shell companies' accounts went to foreign accounts in Luxembourg, Lithuania and Germany, then to exchanges that converted it into cryptocurrencies sent to the organisation's wallets.

Transfers from victims of online cryptocurrency investment scams (phishing) also reached the same shell company accounts, and were laundered in the same way.

The figures from the investigation

Item	Amount or number
False invoices reconstructed	over 110 million euros
Transfers abroad	about 68 million euros
Urgent preventive seizure	over 21 million euros
Drug-trafficking cash handed over by a single money supplier	over 5 million euros
Commission withheld on the cash handed back	between 2% and 5%
Suspects subject to precautionary measures	30 (16 in prison, 14 under house arrest)

What signals does a scheme like this leave?

The press release does not name professionals involved in the fraud. The mechanism, however, leaves traces that an accountant, an AML officer or a purchasing department can see from their own side:

• suppliers in construction, logistics or services based in Lombardy or Campania, recently incorporated, with no employees or visible resources, that invoice significant amounts;
• suppliers that change often for the same type of service, while the previous ones end up in bankruptcy or liquidation;
• cash withdrawals or cash availability of the client that cannot be explained by its business, close to payments to suppliers;
• counterparties whose accounts move funds abroad or to cryptocurrency exchanges without a commercial reason.

What to do if you have clients or suppliers with this profile

• Find out who stands behind recurring suppliers in the sectors indicated: shareholders, directors, date of incorporation, registered office, insolvency proceedings.
• Check the history of the replaced suppliers: if the previous supplier went bankrupt shortly after the relationship began, it is a signal to record.
• Document the risk assessment of the client when nominees, cash without justification or unexplained transfers abroad emerge.

The first check is to know who owns and manages the business on the other side. The beneficial owner (9.90€) reconstructs from the Business Register the persons holding positions or significant shareholdings; with beneficial owner plus protests and insolvency proceedings (14.90€) you also see whether the business or those running it already have proceedings open. If the business is your client, the customer due diligence file (49€) puts the checklist, the beneficial owner and the report in a single PDF.

Sources

• Guardia di Finanza, «Smantellata "Banca occulta"» ("Hidden bank" dismantled), press release of 21 October 2026, read on 24/10/2026