PCC money laundering sanctions: OFAC targets a crypto network as Brazil freezes 2 billion dollars

On 1 July 2026 the Office of Foreign Assets Control blocked a PCC money laundering network that moved more than 30 million dollars of United States drug proceeds through cryptocurrency. Two Brazilian nationals and four companies were designated. Days later Brazil's Operation Exchange blocked up to R$10.4 billion, about 2 billion dollars, across 24 warrants.

• OFAC designated two Brazilian nationals and four companies, three in Brazil and one in Portugal, under Executive Orders 14059 and 13224.
• The network laundered over 30 million dollars of drug proceeds using cryptocurrency to route funds from the United States back to Brazil.
• The targets sit inside Primeiro Comando da Capital, which the United States labelled a Foreign Terrorist Organization effective 5 June 2026.
• Brazil's Operation Exchange blocked up to R$10.4 billion, about 2 billion dollars, in cash, assets and crypto across 24 warrants on 3 July.
• Police said the wider network ran through 73 shell companies, a direct test of beneficial ownership screening rather than name matching.

What did OFAC actually sanction?

OFAC blocked the Sao Paulo node of a PCC money laundering network led by Victor Henrique de Oliveira Shimada and Stella Stefanie Nunes Henrique de Oliveira. Three Brazilian companies and one Portuguese company were named alongside them. Every United States person must now freeze any dealings with all six parties.

In the Treasury statement, Gene Lange, performing the duties of Under Secretary for Terrorism and Financial Intelligence, tied the move to "the increasing presence of Primeiro Comando da Capital's illicit revenue generation within our borders." The designation pairs a narcotics authority, Executive Order 14059, with the terrorism authority, Executive Order 13224, because Primeiro Comando da Capital is now a designated terrorist group. That combination widens the legal exposure for any firm that touches the funds.

The United States coordinated with an FBI Miami investigation that led to six arrests in Florida in January 2026, with charges filed in the Southern District of Florida. The sanctions turned a domestic criminal case into a cross-border blocking order that reaches a European Union member state.

How did the PCC money laundering network move the cash?

The PCC money laundering network converted street-level drug cash generated across United States cities into cryptocurrency, then moved it back to Brazil through wallets and front businesses. Crypto provided speed and reach; the companies provided a legitimate-looking home for the value once it landed. Shimada acted as the bridge between Florida operatives and foreign suppliers.

The structure is a classic three-stage laundering chain dressed in modern rails. Placement happened as bulk cash entered the crypto economy. Layering happened as funds hopped between wallets and jurisdictions. Integration happened when a trading firm, a payments company and a construction business absorbed the proceeds as ordinary revenue. Each corporate layer is a screening problem: the name on the invoice is clean until you resolve who ultimately owns and controls it.

The escalation ran across five weeks:

Brazil's federal police executed 13 search warrants and 11 arrest warrants with more than 50 officers across Sao Paulo, Santos, Praia Grande and Santana de Parnaiba. A court ordered up to R$10.4 billion, about 2 billion dollars, in assets and crypto blocked, and police said the wider group used 73 shell companies to hide proceeds drawn mainly from international hashish trafficking. Stella was detained; Shimada remains a fugitive. Federal Police Chief Andrei Rodrigues said the early public disclosure of the United States action hurt the case: "There was damage to our investigation." The timing forced Brazil to bring its operation forward before every target could be located.

What does this change for your compliance obligations?

The immediate duty is sanctions screening. OFAC applies strict liability, so a United States firm that processes value for any of the six parties is exposed even without intent. The 50 percent rule extends the block to any entity these parties own half or more, so the four named companies are a floor, not a ceiling. Refresh your watchlists against the current Specially Designated Nationals list today, not at the next cycle.

Transaction monitoring and reporting follow. If historical review surfaces exposure to the PCC money laundering network, file a Suspicious Activity Report through the correct channel and preserve the trail. Customer due diligence and enhanced due diligence duties bite hardest on the corporate layer: a payments firm, a trading company and a construction business only reveal their risk once beneficial ownership is resolved to the natural persons behind them. Generic know your customer on the legal entity would have passed all four.

Crypto businesses carry a parallel load. Virtual asset service providers must screen wallet counterparties, apply the Travel Rule to transfers, and treat newly blocked addresses as immediate freeze triggers. European Union crypto-asset service providers face the Transfer of Funds Regulation zero threshold, so even small transfers between platforms need originator and beneficiary data. Firms weighing crypto KYC compliance should note that address screening and entity screening are now one workflow, not two.

What is still uncertain about the case?

The open questions start with attribution. Blocking a wallet does not freeze the coins already moved, and tracing crypto across mixers and bridges is probabilistic, not certain. Investigators face a live risk that value has already been layered beyond reach. The premature disclosure that let Shimada evade arrest shows how fragile the operational window can be when a public designation and a covert investigation collide.

The corporate structure raises a second risk. Front companies are cheap to replace, so a single order rarely ends a PCC money laundering network; it prompts new shells in new names. Portugal's role also tests cross-border recovery, since assets held inside the European Union sit under a different seizure regime than those in Brazil or the United States. Over-broad de-risking is the quieter danger: banks may exit legitimate Brazil corridors rather than screen them, pushing lawful flows into thinner, less transparent channels. None of these risks is resolved by the designation alone.

Why does the terrorist designation raise the stakes?

A Foreign Terrorist Organization label changes the criminal exposure, not just the paperwork. Knowingly providing material support to a designated group is a distinct federal offence, so a firm that ignores clear red flags now risks more than a civil penalty. The Specially Designated Global Terrorist overlay under Executive Order 13224 also broadens the categories of prohibited dealings.

For compliance teams this means adverse media and sanctions screening can no longer be treated as a box-ticking layer bolted onto onboarding. A construction firm linked to a terrorist-designated cartel is not an edge case a rules engine will catch on name alone. This designation echoes the pattern in the Prince Group sanctions expansion, where OFAC widened a net across companies and individuals at once and left firms to map their own exposure fast.

How should compliance teams respond?

Start with the mechanical steps. Rescreen your book against the updated Specially Designated Nationals list and apply the 50 percent rule to the four named companies. Run a lookback over crypto and payment flows touching Brazil and Portugal. Confirm your beneficial ownership data resolves corporate customers to real people, and that adverse media screening covers cartel and terrorism keywords, not only sanctions hits. Understanding the split between KYC and AML duties helps you route each finding to the right control.

The structural lesson is about where identity data lives. A PCC money laundering network like this survives on opaque corporate ownership and reusable stolen identities. Zyphe resolves ultimate beneficial owners recursively through the natural persons behind each corporate layer, across European and international registries, and verifies real people through an NFC chip read with no central store of identity images to breach. See how Zyphe works or book a demo to pressure-test your onboarding against exactly this kind of layered network.

The bottom line

A PCC money laundering network became a sanctions case, a terrorism case and a two billion dollar asset freeze inside a single week. For teams running KYC and AML, the lesson is not that crypto is the problem; it is that clean-looking companies and thin identity checks are. Screening the wallet and screening the ultimate owner are now the same job, and the firms that resolve real people and real ownership fastest will carry the least exposure when the next blocking order lands.

Cited sources

• U.S. Treasury, Treasury Sanctions Brazilian Criminal Network (press release sb0549, 1 July 2026)
• U.S. Department of State, Terrorist Designation of Comando Vermelho and Primeiro Comando da Capital (28 May 2026)
• Office of Foreign Assets Control, Recent Actions
• Exame, Operation Exchange: Federal Police block R$10.4 billion tied to PCC (3 July 2026)
• Bitcoin.com News, Brazilian Federal Police dismantle a 2 billion dollar PCC laundering ring (Andrei Rodrigues remarks)