Published by Cartel DocsAbout 13 minutes to read
Investigations
Contents
When Zoom Zoom Motors S.A.R.L. filed its founding paperwork in Lebanon around 2014, the corporate registry described a conventional business: importing and exporting motor vehicles[1],[2]. But the cargo bills telling its actual story between 2014 and 2015 did not mention cars; they recorded tons of Colombian charcoal moving across the Mediterranean[1],[2]. Years later, when terrorism researcher Matthew Levitt laid those manifests before the U.S. Senate’s drug caucus, the discrepancy opened a window into the operations of Hassan Mohsen Mansour, a Canadian-Lebanese trader whose routine shipping receipts had quietly drawn him into a sprawling international net[1],[5].
There was a more direct reason to examine the cargo[2],[9]. According to research drawing on French case records, Mansour told undercover officers in 2015 that he used his trade to conceal cocaine shipments[2],[9]. He also described connections that could keep containers from being searched[2],[9]. The promise was access: to a route, to people along it, and to a business that could make an extraordinary consignment look routine[2],[9].
His other offer concerned money[2]. In a Paris conversation recounted by researcher Aurora Ortega, Mansour said he could move funds out of Europe to destinations including Colombia within two days[2]. Cargo needed ports and shipping schedules[2]. A payment needed someone at the other end willing to settle it[2]. He was presenting himself as a man who understood both journeys[2]. The two-day promise was a sales pitch, with a measurable deadline attached[2]. For an undercover customer, that offered a way to move the conversation beyond reputation: an arrangement could be tested against whether money reached the place promised[2].
That combination made him interesting to investigators pursuing criminal finance across continents[5],[6],[8],[11]. It also made his story difficult to follow[5],[6],[8],[11]. Different agencies encountered different transactions; criminal charges appeared in different jurisdictions; later researchers found companies whose business records overlapped with his[5],[6],[8],[11]. The central question grew more precise as those accounts accumulated: what did the charcoal trader actually provide, and which parts of the network could continue without him?[5],[6],[8],[11]
The customer who was listening
One route into that world ran through Mohammad Ahmad Ammar[3]. DEA attention had focused on him by January 2014 after an informant’s tip, according to ACAMS reporting based on more than 300 pages of agency records and transcripts[3]. Ammar advertised an enormous reach, claiming to handle 85 percent of Medellín’s laundering business[3]. Investigators treated that figure as a boast[3]. What mattered next was whether he could perform a transaction[3].
The proposed business exposed a different side of the salesman[3]. He worried about Miami, a place he considered dangerous for moving illicit money[3]. A seized Canadian-dollar transfer between Toronto and Beirut had already brought pressure from clients[3]. His supposed customers wanted funds collected in Australia and delivered into accounts in South Florida[3]. The alleged arrangement used accounts in Dubai and Hong Kong and paperwork presenting transfers as food purchases[3]. About $500,000 was involved[3]. The money was represented to the suspects as drug proceeds in a sting[3].
Investigators were buying a service[3],[26]. The distinction mattered because their immediate objective was to see who could arrange collections and payments, which businesses appeared along the way, and how the intermediaries explained what they were doing[3],[26]. In a 2012 essay, former undercover investigator Robert Mazur described the value of infiltrating a financial intermediary: access to records, hidden assets and clients beyond the first transaction[26]. A payment could reveal more than the money it contained[26].
Professional laundering has a commercial logic of its own[17]. FATF’s study of the business describes specialists earning fees for moving criminal funds, with prices shaped by difficulty and risk[17]. Their customers need not belong to one organization or share a political allegiance[17]. An intermediary can serve several networks because his useful asset is the ability to deliver[17]. Legitimate banks and other businesses may also appear in the chain without knowing what their services are being used for[17].
By October 2016, the Miami Herald was reporting arrests and charges[4]. Ammar had been arrested in Los Angeles and brought to Miami-Dade[4]. Ghassan Diab, described as based in Nigeria, remained at large[4]. Mansour was in France and was reported to face a separate, similar federal money-laundering case in South Florida[4]. The men were entering public view through a set of cases whose geography was easier to summarize than their legal boundaries[4].
The DEA’s 2017 National Drug Threat Assessment gave Mansour a boxed entry[5]. It described a worldwide set of contacts, couriers, companies and bank accounts, with transfers passing through South Florida banks[5]. It alleged that he had laundered more than $500,000 for a Colombian cartel and belonged to Hezbollah’s External Security Organization Business Affairs Component[5]. Those were the agency’s allegations[5]. The document placed the charge in the Southern District of Florida; the Ammar-Diab reporting also described a state prosecution in Miami-Dade[3],[5].
A business with more than one door
Zoom Zoom’s charcoal was not merely an investigator’s imagined cover story[10]. In a later interview, Ortega described both the trader’s admitted wood-charcoal business between Colombia and Lebanon and his alleged use of that trade for cocaine[10]. That distinction gives the company its significance[10]. A functioning business already has counterparties and commercial reasons to communicate across borders[10]. It does not have to invent every relationship each time someone wants a container moved[10].
The broader concealment method was familiar beyond Mansour’s case[22]. UNODC’s 2023 cocaine report identified charcoal among several carrier materials used to disguise the drug and described the growth of facilities recovering cocaine from such materials in Europe[22]. This was a development in the international market, not a laboratory finding about a particular Zoom Zoom shipment[22]. The brief phrase “black cocaine” described a way of concealing the product; it did not supply a complete itinerary for any individual consignment[22].
Moving drugs and disguising money can occupy the same commercial world while remaining different activities[25]. HM Revenue & Customs makes the distinction plainly in its trade-laundering handbook: smuggling concerns prohibited goods, whereas trade-based laundering uses apparently legitimate commerce to disguise value[25]. In this story, one allegation concerned what a cargo contained[25]. Another concerned what a bank payment purported to buy[25]. The documents had to answer both questions[25].
For the money, an invoice could be as consequential as a container[12]. FATF’s early study of trade laundering described three broad channels—financial transfers, physical cash and trade—and the ways they can overlap[12]. A payment may reach an account bearing the outward description of an ordinary purchase even though its real purpose is to settle a criminal debt elsewhere[12]. The paper trail offers an explanation to anyone looking at only that transaction[12].
The obstacle for investigators is that almost everyone sees only a portion of the business[20]. FATF and the Egmont Group later described banks observing fragments of networks spread across institutions and jurisdictions[20]. Customs officers may focus on a shipment, police on a drug offense, and financial investigators on the proceeds[20]. A successful examination of one fragment does not automatically connect the others[20]. The trader operates across those boundaries; the investigation has to cross them too[20].
The mismatch between a motor-business description and charcoal cargoes was therefore a question to pursue[21]. FATF’s risk-indicator guidance treats trade inconsistent with a stated business as a reason for closer examination, while emphasizing the need for context[21]. A company can diversify lawfully[21]. A shared address can have an innocent explanation[21]. The useful step is to compare records and transactions until a pattern acquires substance, rather than letting a striking company name do the work of a case[21].
One commodity, three questions
Different records illuminate different parts of the business.
Paris interrupts the route
The European investigation reached its public turning point in early 2016[18]. In its February announcement, the DEA said European authorities had begun an operation the previous February on the basis of its leads[18]. The effort involved seven countries and grew out of work on Lebanese Canadian Bank[18]. The agency described a Business Affairs Component handling criminal proceeds and alleged that revenue supported Hezbollah weapons purchases for its war in Syria[18].
Days before that announcement, Treasury designated Mohamad Noureddine, Hamdi Zaher El Dine and Noureddine’s company, Trade Point International[19]. This was an administrative attack on named financial facilitators and their assets[19]. The French cases would proceed on their own tracks[30]. In November 2018, AFP reported that Noureddine received seven years in prison for drug-money laundering and criminal conspiracy, with a €500,000 fine[30]. That was Noureddine’s sentence[30]. It did not resolve every defendant’s case[30].
Mansour was among those arrested in France in January 2016, according to subsequent research on the operation[2],[8],[9]. His later position is less clear[2],[8],[9]. Levitt’s 2020 study reported house arrest while awaiting trial and subsequent flight from France, presumably to Lebanon[8]. Ortega’s 2022 account retained the uncertainty between release and flight[2]. Neither account supplies a final conviction[2],[8]. The arrest interrupted his freedom of movement; the public record does not provide a comparably definite ending to his case[2],[8].
Another branch continued toward Miami[6],[7]. On March 9, 2019, Cypriot authorities arrested Diab at Larnaca airport after his arrival from Beirut[6]. A court found him extraditable that September, and he reached Miami on July 17, 2020[6]. The U.S. Justice Department identified the receiving case specifically: Florida’s Eleventh Judicial Circuit, Miami-Dade, arising from Operation Reconquista[6]. His eight counts covered laundering, conspiracy, unlicensed money transmission and unlawful use of a two-way communications device[6].
Local10’s account of Diab’s arrival reported that Ammar, his brother-in-law, had already been convicted of laundering and conspiracy about two years after his 2016 arrest[7]. These proceedings give the investigation a chronology with actual consequences[6],[7]. They also show why a single label such as “the Mansour case” can mislead: one man’s arrest, another’s conviction and a third man’s uncertain whereabouts were separate developments within overlapping investigations[6],[7],[8].
The customers keep calling
The commercial problem did not disappear with an arrest[16]. In November 2015, Treasury had separately targeted Altaf Khanani’s laundering organization and Dubai’s Al Zarooni Exchange[16]. Its account described customers ranging from Chinese, Colombian and Mexican criminal groups to Hezbollah-associated individuals[16]. That breadth helps explain the attraction of a specialist broker: clients could obtain financial reach without building an international payments business themselves[16].
A year later, Treasury designated four more people and nine entities associated with the Khanani organization[27]. It alleged that leadership and relationships with other launderers had continued after the exchange’s designation[27]. The episode offers a concrete comparison for the network confronting Mansour’s investigators[27]. An exposed intermediary may be removed while contacts, commercial firms and demand for the service remain[27]. Disruption is a process, not a single photograph of an arrest[27].
Gil Riza’s INSS research on Hezbollah’s counterfeit-goods business places that adaptability in a wider financial setting[14]. Different criminal revenue streams can reduce reliance on a single patron, while creating additional openings for law enforcement[14]. The relevant connection is organizational flexibility, not a claim that Mansour traded counterfeit goods[14]. A movement with several ways to raise and move money has more options when one channel becomes costly[14].
In 2026, INSS researchers Noam Binstok, Orna Mizrahi and Esteban Klor returned to the same strategic problem: damaging physical infrastructure does not by itself dismantle an international financial network[29]. Their argument concerns later circumstances, but it helps explain why old commercial files keep resurfacing[29]. A shipping relationship can outlast the event that first put its owner under scrutiny[29]. Following it may reveal what the next intervention has to reach[29].
Charcoal returns to the file
Research into Mansour’s business opened onto another set of records[2]. Ortega identified Pelicanos and Desemcol as Colombian suppliers to Zoom Zoom, and a Cartagena address shared by Desemcol and Zanga, a charcoal company established by Mahdy Akil Helbawi[2]. The address was a link for further examination[2]. It did not establish the contents of all those companies’ cargoes[2].
The Rada family’s businesses then became the subject of a distinct U.S. action[11]. In September 2023, Treasury designated seven people and entities and alleged that Amer Mohamed Akil Rada used as much as 80 percent of his enterprise’s proceeds to benefit Hezbollah[11]. It identified his son Mahdy as Zanga’s chief executive and described approximately $40,000 in transfers from Lebanon’s Black Diamond SARL to Zanga, citing coal or charcoal purchases[11]. Here were named commercial payments, not just a general warning about a commodity[11].
In Colombia the story took another turn in August 2024[23]. Prosecutors accused Helbawi of unlawful exploitation of natural resources, laundering, illicit enrichment and using false documents[23]. He did not accept the charges[23]. A judge ordered pretrial detention[23]. The prosecution described more than 2.4 million kilograms of illegally sourced charcoal traded between 2016 and 2022 and 117 international transfers into related accounts[23]. The alleged criminal product in that account was charcoal itself[23]. No discovery of cocaine was necessary to explain those charges[23]. Prosecutors put the alleged laundering at more than 4.976 billion Colombian pesos[23]. The weights, transfers and money figure described different aspects of their case; together they shifted attention from a suspicious commodity to the business that produced, sold and received payment for it[23].
When charcoal itself became the alleged offense
The separate 2024 Colombian prosecution of Helbawi.
Colombian investigative outlet Cuestión Pública examined the company’s registration and business history[24]. Its reporting described Zanga’s 2015 establishment with a broad commercial remit covering animals, charcoal, construction materials and fruit, and identified Mahdy’s brother Mouhamed as a partner[24]. The reporters also raised questions about financial information recorded during the export business[24]. They said the company renewed its registration through 2022 but did not record assets and income during the exports[24]. The local investigation brought another kind of evidence into the picture: the company’s ordinary obligations as a Colombian enterprise[24]. The contrast was now between a business visible in international commerce and the information it placed on its domestic record[24].
FATF’s research on environmental crime explains why the charcoal distinction matters[28]. Illegal extraction can generate proceeds even when a shipment contains exactly the commodity declared[28]. Natural-resource products may also enter supply chains alongside lawful goods, making their origin difficult to reconstruct[28]. In such a case, the question begins before the port: where the product came from, whether its extraction was authorized, and who received the revenue[28].
The bank records and the shipping records must eventually meet[13]. A U.S. Government Accountability Office review found that trade-data partnerships could assist that work but faced incompatible formats and interruptions in information sharing[13]. It also emphasized that legitimate merchants can receive criminal payments unwittingly[13]. Later reforms addressed strategy and performance monitoring[13]. The practical challenge remained recognizable: a commercial trail scattered among countries has to become a usable account of a transaction[13]. The apparent precision of an invoice or a transfer total is only the beginning; the relationship between the buyer, seller, payer and goods gives those numbers their meaning[13].
A name in the hearing room
When Mansour’s name returned to congressional testimony in October 2025, the charcoal allegation was a decade old[1],[15]. Levitt pointed to the company and its shipments; Marshall Billingslea also invoked the case while discussing later scrutiny of charcoal networks and Helbawi’s arrest[1],[15]. The testimony showed the staying power of the investigative lead[1],[15]. It did not turn the later Rada proceedings into a verdict against Mansour or establish that every company in the commercial web performed the same task[1],[15].
What endured was more concrete than a slogan about a worldwide network[1],[2],[5]. There was a business registration, a set of cargoes, a trader’s recorded promises and payments investigators could follow[1],[2],[5]. Those records asked different questions of the same commercial world[1],[2],[5]. The company name pointed toward a car lot[1],[2]. The next line on the shipping paperwork pointed across the Atlantic[1],[2].
Sources
- Matthew Levitt, Senate Drug Caucus testimony, 21 October 2025
- Aurora Ortega, Hezbollah in Colombia, Policy Note 119, March 2022
- Daniel Bethencourt, Colombia-based Hezbollah Associate Knew Anti-Money Laundering Protocols, ACAMS, 23 February 2018
- David Ovalle, Hezbollah-linked group laundered drug money through Miami banks, Miami Herald, 11 October 2016
- DEA, 2017 National Drug Threat Assessment, printedp 131
- DOJ, Two Alleged Criminals Extradited from Cyprus, 18 July 2020
- Andrea Torres, Alleged Hezbollah money launderer arrives at Miami-Dade, Local 10, 17 July 2020
- Matthew Levitt, A Paris Reset on Hezbollah?, PolicyNote 87, October 2020
- Emanuele Ottolenghi, The Laundromat, BESA2021
- Breaking Hezbollah’s Golden Rule, Season 2 Episode 1, 27 September 2023
- Treasury, Rada network designations, 12 September 2023
- FATF, Trade-Based Money Laundering, 2006
- GAO, Trade-Based Money Laundering, GAO20-333, 2020
- Gil Riza, Hezbollah and the Counterfeit Goods Industry, INSS, 2023
- Marshall Billingslea, Global Gangsters, Senate testimony, 2025
- Treasury, Sanctions the Khanani Money Laundering Organization, 12 November 2015
- FATF, Professional Money Laundering, July 2018
- DEA, European arrests announcement, 1 February 2016
- Treasury, Key Hizballah Money Laundering Network, 28 January 2016
- FATF/Egmont, Trade-Based Money Laundering:Trends and Developments, 2020
- FATF/Egmont, Trade-Based Money Laundering:Risk Indicators, March 2021
- UNODC, Global Report on Cocaine, 2023
- Colombian Fiscalía, Helbawi charging announcement, 10 August 2024, republished by MiManizales
- Néstor Espinosa Robledo, Charcoal exports and endangered trees, Cuestión Pública, 16 August 2024
- HMRC, Trade-Based Money Laundering handbook, introduction, 29 October 2025
- Robert Mazur, Attacking Drug Cartels Through Undercover Money Laundering Operations, CTC Sentinel, 2012
- Treasury, Khanani individuals and entities, 11 October 2016
- FATF, Money Laundering from Environmental Crime, 2021
- Noam Binstok, Orna Mizrahi and Esteban Klor, Hezbollah’s Global Financial Network, INSS, 3 May 2026
- AFP, Hezbollah-linked businessman jailed in Paris drug trial, 29 November 2018
