Money laundering is, at its core, a magic trick. A drug cartel, a sanctions evader, a human trafficking ring all have the same problem: cash that cannot be spent without attracting attention. The solution is to run that money through enough transactions that by the time it surfaces in a legitimate account, nobody can trace where it started. Poof. Clean money.

Law enforcement has been chasing this trick for decades.

A team at USC’s Information Sciences Institute thinks the problem isn’t just resources or willpower. It’s imagination. And they’re building a system to fix that.

Getting Inside The Launderer’s Mind

The project is called GROAT — Generating Realistic Operations with Adaptable TTPs — and it is, in essence, a machine that aims to outsmart money laundering schemes by anticipating them and training systems to catch them.

GROAT is led by Stephen Schwab, Senior Supervising Computer Scientist and Research Director for Strategic Directions for Networking & Cybersecurity Division at ISI, serving as principal investigator. Co-principal investigators are Michael Collins, Lead Scientist at ISI, and Mayank Kejriwal, Principal Scientist at USC’s Information Sciences Institute and Research Associate Professor at the Daniel J. Epstein Department of Industrial and Systems Engineering at the USC Viterbi School of Engineering.

GROAT is part of a larger DARPA program called Anticipatory and Adaptive Anti-Money Laundering(A3ML[1]), whose goal is to eliminate global money laundering by replacing slow, manual analysis with algorithmic detection, all while preserving privacy. The program is divided into two teams. The blue teams build detectors. The red teams, such as the USC-ISI team — builds the threats those detectors have to find.

“The enemy gets a vote,” the team notes, borrowing a line from James Mattis. Criminals don’t keep using techniques that get them arrested. They adapt. Any detection system that only knows how to find yesterday’s schemes will always be a step behind.

GROAT is designed to make sure that doesn’t happen.

Guessing The Next Step In The Launderer’s Scheme

The system works in layers. At its foundation is something called the Money Laundering Atom Matrix, a knowledge base built from court records, investigative journalism, and consultation with domain experts. It breaks down money laundering into discrete building blocks called “atoms,” each representing a specific action with its own requirements and risks.

One common atom involves structuring: splitting a large sum into many small deposits to avoid the thresholds that trigger automatic reporting to regulators. Another involves recruiting money mules, individuals who move cash on behalf of criminal organizations, often without fully understanding what they’re doing. Each atom in the matrix carries information about what resources it requires, what can go wrong, and how detectable it is.

The next layer is the TTP generator. TTP stands for Tactics, Techniques, and Procedures. The generator takes atoms from the matrix and assembles them into coherent, internally consistent, notional laundering campaigns. It handles logistics: if a scheme requires 50 people each moving money through separate accounts, the system accounts for the recruitment step, the account setup, and the realistic probability that some of those 50 will disappear with their cut.

Then comes the instance generator, which turns the blueprint into something concrete. The TTP generator works in abstractions, building the logical structure of a scheme without worrying about names, places, or specifics. The instance generator populates all of that: which cryptocurrency, which bank, which city, basic profiles for the people involved. The fictional scheme becomes something that looks, in the data, like a real one.

Finally, the footprint generator creates the actual transaction records, emails, and financial documents that the detection teams will search through, the kind of evidence an investigator would encounter in a real case.

The Evidence That Arrives Too Late

Why not just study real money laundering cases? The USC team has a direct answer: by the time a case is prosecuted, documented, and made available for research, it’s old. The criminals have already moved on.

“Real-world data is cold,” as the team puts it. The schemes that ended in arrest are, almost by definition, the ones that failed. Studying them builds detectors tuned to catch the methods criminals have already abandoned.

GROAT can generate schemes that don’t exist yet, extrapolating from known patterns into plausible futures. That’s not speculation for its own sake. It’s an attempt to get ahead of a very fast-moving problem.

One example the team points to: money launderers have a history of exploiting obscure or low-profile value stores specifically because fewer people are watching them. Linden Dollars, the virtual currency from the online world Second Life, were used in the early days of Bitcoin to convert cryptocurrency into real-world cash. More recently, Robux, the in-game currency for the massively popular platform Roblox, has surfaced in money laundering cases. The pattern is consistent. When a new online game launches with its own currency, someone will likely eventually try to use it.

GROAT can model that. It can generate synthetic laundering schemes using the currencies of games that haven’t been exploited yet, so that when it happens in the real world, the detectors have already seen something like it.

Combining Industry Domain Expertise

The project brings together an unusual coalition. Inca Digital, a firm that specializes in tracking cryptocurrency flows and darknet activity, contributes real-world intelligence on how state actors and criminal organizations actually move money through digital channels. Capital One provides the perspective of a major retail bank processing millions of transactions a day. Law firms and subject matter experts ground the fictional schemes in regulatory reality, ensuring that the synthetic scenarios reflect how actual financial compliance rules work, including the know-your-customer requirements that legitimate institutions are required to enforce.

That combination matters. The USC team is explicit about the role of what they call tacit knowledge, the kind of expertise that doesn’t show up in textbooks. Knowing that criminals use the art market to launder money, or that Second Life’s currency was a Bitcoin on-ramp years before most people had heard of Bitcoin, requires people who have spent careers watching how money actually moves.

Why Dirty Money Has to Get More Expensive

The stakes are not abstract. Money laundering can be, as the team describes it, the financial backbone of some of the most serious threats in the world: weapons proliferation, human trafficking, terrorism financing. It works because the financial system is enormous and the number of people watching any given transaction is small.

The timeline is aggressive by design. The feedback loop between criminals and investigators is accelerating, and the window for getting ahead of it is not unlimited.

The goal, in three years, is a world where dirty money no longer moves easily, where the risk of detection is high enough that the economics of laundering stop working. Not through any single breakthrough, but through detection systems that are adaptive, anticipatory, and no longer fighting the last war.

The magic trick, in other words, would finally have an explanation.

[1] https://www.darpa.mil/research/programs/a3ml-anticipatory-adaptive

Published on June 23rd, 2026

Last updated on June 23rd, 2026