Bitcoin ATMs, which aren't covered by anti-money laundering laws the same as banks, are making it difficult for Spanish authorities to bring down a major money laundering operation.

Spanish police claim that a recent effort to bring down a money laundering syndicate — which used bitcoin ATMs as a front for illegal drug payments — has exposed a loophole in European anti-money laundering laws, according to a report in Bloomberg.

Earlier this year, Europol and Spain's Civil Guard dismantled a large-scale money laundering operation. They arrested eight people and charged eight more with their alleged involvement in transferring 9 million euros ($10 million) to Columbia.

As part of its money laundering operation, the syndicate had set up two bitcoin ATMs in a Madrid office, which innocently portrayed itself as a "center for sending remittances and trading cryptocurrencies." In fact, the machines played a critical role in allowing the cartel to clean their ill-gotten gains.

ABCs of cleaning money

As spelled out in moneylaundering.com, the process works something like this: drugs stemming from Columbia are sold in Europe in exchange for cash. The ill-gotten euros are then exchanged for cryptocurrency via bitcoin ATMs.

Once the cash is converted to crypto, the bitcoins — kept in digital wallets controlled by the money-laundering organization in Europe — are then handed off to another outfit reporting directly to the Colombian drug lords. The drug suppliers then use an online crypto currency exchange to swap the bitcoins for pesos. The swap usually happens within 48 hours to reduce the risk of bitcoin (which is highly volatile) dropping in value.

Spanish police are now having a rough time tying the final knot in their case. Along with the bitcoin ATMs, they have seized four cold wallets (used for storing cryptocurrency offline) and 20 hot wallets (used to store cryptocurrency online). In order to prosecute the criminals, they need to draw a line between the funds they confiscated and the crypto ATM machines.

But because Bitcoin ATM machines often allow users to purchase bitcoin without presenting proper identification to prove they are who they say that are, it's hard to track exactly where the cash is coming from or who deposited it. In many cases, the money trail is wiped clean.

A wider problem

Similar to the situation in the US and Canada, European laws intended to track the flow of cash and stop its use in money laundering and funding terrorist activities, don't apply to Bitcoin ATMs and cryptocurrency exchanges the way they do to banks or other money transfer services. This invites criminal activity.

As of now, there are 5,145 bitcoin ATMs in operation around the world, according to Coin ATM Radar, a site that tracks the machines. The machines are typically found in cafes and convenience stores. Most are in the US, followed by Canada. A much smaller number, about 80 machines, are in Spain.

New European Union legislation set to go into effect in January 2020 aims to include cryptocurrency exchanges and the custodians of online wallets in anti-money-laundering rules. But the law won't cover independent Bitcoin ATM operators—which is of no help to law enforcement.