Introduction

In crime research and policing practice, crime script analysis is adopted to generate, organise and systematise knowledge about the procedural aspects and procedural requirements of crime commission (Cornish, 1994). This method is increasingly used to examine organised crime (Chainey & Alonso Berbotto, 2022). Although crime scripting is oftentimes used to gain insight into procedural aspects of financial crimes and profit-driven crimes (Dehghanniri & Borrion, 2021; e.g., Savona et al., 2013), insight in the financial aspects is still largely lacking. As with for example human trafficking in particular (Broad et al., 2022), and despite some recent exceptions (Levi et al., 2015; Lord & Levi, 2017; Soudijn & Reuter, 2016; Terenghi, 2022), financial aspects associated with profit-driven crime have not been widely conceptualised nor empirically investigated (Levi & Soudijn, 2020). In this context, and to more systematically examine the ‘financing of crimes’, Levi (2015, pp. 294–295) suggested to ‘develop an empirical logistical approach that takes up crime in terms of the cost of the routine activities needed to develop it at different operational levels in different contexts’. In this article, we take up this task by proposing a further development of an existing analytical framework to analyse financial aspects in general and criminal money flows in particular. Drawing on crime script analysis and the initial work of van Santvoord and van Ruitenburg (2023), this article presents a framework to enhance insight in the financial aspects of profit-driven crime: financial crime scripting.Footnote 1

Whereas crime script analysis allows crime researchers and police analysts to organise and systematise knowledge about the procedural aspects and requirements of crime commission, financial crime scripting widens the scope by zooming in on the money flows coupled to the procedural aspects of a wide variety of (profit-driven) crimes. Importantly, financial crime scripting is not about creating a crime script for financial crimes per se (such as specific types of fraud and money laundering, see for example Gilmour, 2023), but about adding financial components in crime scripts of various forms of profit-driven crime. In doing this, it also accounts for linking the dots with financial crimes (e.g., bribery or bankruptcy fraud) and money laundering (as a succeeding offence). As a method, it also contributes to the increased focus and emphasis of western governments to fight criminal money flows, not only to fight money laundering for example but also to confiscate the illegal profits and in this way frustrate the inner working of the criminal network at large (Atkinson et al., 2017). In the EU Strategy to tackle Organised Crime 2021–2025, the European Commission (2021, p. 18) for instance stressed that ‘tackling criminal finances is crucial to uncover criminal activities, to deter crime and to prevent infiltration in the legal economy and society’.

The article proceeds as follows. The following section provides the backdrop that fuelled the introduction of financial crime scripting. After first acknowledging that most crime is profit driven, we note that the problem of today’s financial approach to crime does not invite law enforcement agencies to look any further than necessary to deprive criminals of their illicit earnings. We then explain that crime scripting as an analytical method has increased our knowledge on the many procedural aspects of various types of crime, but similarly has not yet fully adopted a financial perspective. In the ‘Financial Crime Scripting’ section, we argue and show that crime scripting does have the potential to include this perspective, after which we break apart the various components of a financial crime script and show how to construct and populate a financial crime script. In the ‘Relevance for Practice, Policy and Research’ section, we describe the added value of financial crime scripting for practice, policy and research. In the ‘Conclusion and Discussion’ section, we stress, amongst others, that for financial crime scripting to be successfully adopted by practice, its users must not take up financial crime scripting as a project, but (ideally) as a method to be incorporated into their day-to-day processes. We also put forward avenues for future (empirical and methodological) research.

Background

Profit-Driven Crime

Crime, and organised crime in particular, is driven largely by profit (Albanese, 2021; Broad et al., 2022; Fijnaut et al., 1998). Other than expressive acts such as domestic violence or public disorder, which often go unplanned, organised crimes such as drug trafficking are instrumental crimes planned to acquire tangible gains, often, but not necessarily, money. In an attempt to shift the focus of the study of organised crime from actors to actions, Naylor (2003) presented a general theory of profit-driven crimes. Because the theory focuses on the ‘what’ and the ‘how’ rather than on the ‘who’ and the ‘why’, the author argued that this framework is well suited for crime scripting and for taking a situational crime prevention approach. Naylor (2003) distinguishes three categories of profit-driven crime: predatory offences, market-based offences and commercial offences. Table 1 summarises these three categories of profit-driven crime, and how these differ in terms of commodities transferred, the basis act and the method used.

Table 1 Primary profit-driven offences according to Naylor (2003, p. 89)
Full size table

Both predatory and commercial crimes are parasitic forms of crime. This means that only the criminal benefits by taking or depriving others of something. Predatory crimes involve the involuntary transfer of property that belongs to another person. Examples include pickpocketing, ransom demands in cybercrime and extortion. Commercial crimes are committed by legitimate businesses. These businesses deal in legitimate goods and services in a legitimate market, but do so illegally by, for example, defrauding or misleading.

In contrast, market-based crime is a symbiotic form of crime that involves reciprocity: an illegal good or service that is in demand and not available on the legal market (at that price) is provided. Market-based crime involves the illegal trade of (illegal) goods and services. It distinguishes between three types of goods and services (Naylor, 2003):

  • Relative contraband: Goods and services that are available on the legal and controlled market, but offered illegally, such as steroids. The price of these goods is higher than the price of goods in the legal market.

  • Fiscal contraband: Goods and services on which no duties or taxes are paid, making the price lower than goods on which they are paid. Examples include tobacco, alcohol and fuel.

  • Absolute contraband: Prohibited goods and services offered on the illegal market, for example, narcotics or child sexual abuse images. Because the goods and services are prohibited, there is no corresponding legal price. Supply and demand in the illegal market determine the price.

In market-based crime, profit can be made by bridging (part of) the distance between the country where a good is produced or purchased and the country where the good is resold. In this way, criminal organisations profit from the difference between the cost of production or purchase price on the one hand and the selling price on the other. In addition, earning power depends on the cognitive and physical skills of a criminal organisation or network. Three different criminal cooperative groups can be distinguished in the criminal market:

  • Self-executing: these groups are able to carry out all parts of logistics chain in-house, allowing them to benefit from a large share of the total profits.

  • Part-executing: these groups execute part of the logistics chain by, for example, concentrating only on importing cocaine from South America.

  • Facilitators: these individuals provide a service or good that is critical to the execution of the criminal business process, but which a criminal organisation finds difficult or impossible to provide itself (Kruisbergen et al., 2012).

Despite the strong policy focus of state authorities on tracing and frustrating the money flows of profit-driven crime, empirical research on the financial aspects of organised crime is relatively scarce and mostly centred around money laundering (Broad et al., 2022; Kleemans, 2015; Kruisbergen et al., 2015). Also, financial police investigations are, at least in the Netherlands (Nelen, 2004; Public Prosecution Service, 2022), mostly aimed at confiscating the illegally obtained proceeds. Besides its own shortcomings (see Kruisbergen, 2017), the sole focus on the illicit earnings is problematic, or at least limited, because it fails to account for all the processes underlying the predicate crimes that generated the illicit proceeds in the first place and has a mere focus on profits, rather than all financial aspects related to the crime-commission processes.

Beyond Asset Confiscation

Precisely because most crime is profit-driven, state authorities around the world currently promote to ‘follow the money’ and stress to hit criminals ‘where it hurts the most’ as depriving criminals of their illicit earnings is believed to be more effective than incarcerating offenders (Nelen, 2004). Confiscating illegally obtained proceeds is set to take away the profitability of crime, hamper the ability to finance future criminal activities, compensate society for the harms caused to society and, on a more moral note, reinforce the societal norm that ‘crime should not pay’ (Kruisbergen, 2017, pp. 101–102). In the recently published EU Strategy to tackle Organised Crime 2021–2025, the European Commission (2021, p. 18) furthermore noted that ‘the financial trail that criminals leave behind is a key indicator of their activity’ and that ‘tackling criminal finances is crucial to uncover criminal activities, to deter crime and to prevent infiltration in the legal economy and society’.

The present focus on uncovering the ‘financial trail’ of crime is yet far from new. Since the mid-1980s, governments pushed by organisations such as the Financial Action Task Force (FATF) adopted a proceeds-of-crime approach which included a shift in the approach to serious and organised forms of crime: from a traditional approach focused on contraband and offenders to a financial approach focused on financial flows directly or indirectly related to the predicate crime (Nelen & Sabee, 1998). This shift in focus also went hand in hand with the introduction of new regulations and financial measures, including anti-money laundering legislation, legislation to confiscate criminal assets, criminal and civil forfeiture and the creation of special police agencies to conduct criminal financial investigations. International efforts to combat money laundering and the financing of terrorism gained special momentum following the 9/11 attacks (Kilchling, 2014; Levi, 2013). In more recent times, law enforcement agencies and private organisations such as commercial banks are increasingly analysing big data to detect and hinder money laundering (Soudijn & De Been, 2020).

Despite all these efforts, comprehensive insight in criminal money flows is still lagging behind (Levi & Soudijn, 2020). This is first and foremost due to the fact that criminals conceal their illicit proceeds from licit society, sometimes by setting up complex money laundering schemes across multiple jurisdictions. At the same time, criminal investigations often also lack a comprehensive financial approach to begin with. Levi and Soudijn (2020) observed that financial investigators are ‘often brought in at the tail end of investigations for asset recovery rather than being mainstreamed’ (p. 612). This is the result of the somewhat narrow focus in today’s legal frameworks and policy guidelines on money laundering and confiscation of assets. This was already foresighted by Van de Bunt in 1996, when the author argued that when financial criminal investigations are predominately geared towards money laundering and the confiscation of assets, ‘follow the money’ in practice will narrow down to ‘follow the loot’ (Van de Bunt, 1996, p. 15).

The problem of this proceeds-of-crime approach is that it does not invite to look any further than necessary to deprive criminals of their illicit earnings. The benefit of the follow-the-money perspective, however, reaches much further. For instance, investigating criminal money flows helps to uncover the different roles within a criminal organisation, which in turn increases knowledge about the processes underlying the predicate crimes that generated the illicit proceeds. Such a financial perspective furthermore helps to determine how crimes are financed, the turnover and net earnings of criminal acts, the valuation of a criminal organisation's investments, and the way in which money and other assets are shielded from the tax authorities and the justice system (Van de Bunt, 1996). Criminal money flows are, however, transversal flows (Europol, 2021a), meaning that they cut across different activities and stages of the same crime type, as well as across different types of crime. Despite the fact that a great deal of knowledge and information is available, it has not been systematically compiled, which means that an overall picture of the criminal supply chain and the underlying financial structures and money flows is lacking. This not only poses a problem for the intelligence position, but also constitutes a barrier to multidisciplinary and international cooperation. We suggest that part of the solution for this problem lies in adding a financial perspective to the analytical method of crime scripting.

Crime Scripting

Crime scripting, also known as crime script analysis, is a script-theoretical approach that provides an analytical method for generating, organising and systematising knowledge about the procedural aspects and requirements of specific forms of crime (Cornish, 1994). The script-theoretic approach is borrowed from the cognitive sciences (Schank & Abelson, 1977) and has been further developed and applied in the form of crime scripting within criminology and crime research. Crime scripts are widespread and frequently used in criminological practice, such as by surveillance, enforcement and investigative agencies. The systematic approach that typifies this method allows for a simplified representation of complex concatenations of activities (e.g., the process of committing crime) and the opportunity structures that influence them. It is an abstract picture of the criminal process. Ekblom and Gill (2016) define crime scripts as: ‘abstracted descriptions of a particular kind of behavioural process, namely structured sequences of behaviour extended over time and perhaps space, which could be considered functionally self-contained units or subunits of longer sequences’ (p. 323).

Different types of crime scripts can be distinguished (Borrion, 2013). First, there are different levels of abstraction at which crime scripts can be made (see Table 2), with a meta script being the most abstract and general and a track being the most concrete and specific. At the latter level, situational crime prevention measures are usually employed (Haelterman, 2016). Second, there are different bases for a crime script; for example, a script can be based on a potential, a planned or a performed situation. Whereas potential scripts describe hypothetical sequences of actions, performed scripts involve a sequence of actions that actually took place. For crime types that occur repeatedly with the same modus operandi, performed crime scripts can provide a good basis for creating realistic potential crime scripts keeping in mind that contextual changes must be considered. In addition, planned scripts are a subset of potential scripts. They start from a sequence of actions a person has intended to perform. Finally, a crime script can be made up from different perspectives, resulting in different types of scripts. Traditionally, the focus of crime scripts is based on the offender perspective, but the script can also be constructed from a victim or guardian perspective (Leclerc, 2013). When the traditional offender perspective is taken, the focus is on the crime commission process and the goal of constituting the crime script is to frustrate this process. In the victim perspective, the focus is on the process of taking self-protection measures and the goal is to prevent victimisation. When the guardian perspective is taken, the focus is on crime prevention (Leclerc, 2017).

Table 2 Different levels of abstraction in crime scripting (translated from Snaphaan, 2021)
Full size table

Crime scripts map out the steps a criminal must take to ‘successfully’ complete a specific type of crime. Scripts are divided into different scenes, and within each scene, activities, roles, attributes and locations are specified. Scenes are the building blocks of the crime script. Scenes are smaller units in the overarching script that are arranged to pursue a specific sub-goal. Roles are the representation of actors who make decisions and perform activities in the script. A role includes a coherent set of activities that can be performed by one or more individuals. Activities are behavioural units of the central actors (e.g., perpetrator, victim, guardian) or any other actor that has an influence on the event chain. Attributes are the props employed in the execution of the crime script (Tompson & Chainey, 2011). Finally, the setting refers to the specific context in which the activities take place, both spatially and temporally.

Because of the adaptive capacity of criminals and consequently crime, new forms of crime and new modus operandi of existing types of crime are constantly emerging. Crime scripts have three main sources of variation (Abelson, 1981; Cornish, 1994). First, the so-called equifinal actions represent the different ways to pursue the subgoal of a scene and can be seen as the different modus operandi. Second, script paths include the development of alternative routes through the script, consisting of a concatenation of equifinal actions through the script. Cornish (1994) mentioned in this respect that ‘the various combinations of the alternative scenes provide a number of crime-commission routes to the same outcome’ (p. 173). All possible combinations (script paths) within a crime script are also called ‘permutations’ (Cornish, 1994; see also Morselli & Roy, 2008). Third, tracks involve the lowest level of abstraction of crime scripts and can be viewed as a specific script path that has been proven to the point where it can be considered a track.

Finally, crime scripts can be both horizontally and vertically related to each other. Vertical interrelation occurs when the same crime phenomenon is considered at different levels of abstraction (e.g., cocaine trafficking is a form of illicit drug trafficking). Horizontal interrelation occurs when crime scripts of the same level of abstraction can be related to each other (e.g., money laundering is related to specific activities within the crime script of cocaine trafficking). In this context, Gómez-Quintero et al. (2023) distinguish between enabling and fuelled offences that are related to direct offences. Enabling offences facilitate the direct offences but do not necessarily involve the victim or the illegal commodity (e.g., money laundering, corruption or violence). Fuelled offences are facilitated by direct offences, such as using the proceeds to finance new criminal activities (e.g., human trafficking funded with the profit from illicit drug trafficking).

Financial Crime Scripting

Although crime scripting contributes to knowledge about criminal (business) processes and the modus operandi of criminals, as we argued above, there is still a lack of insight into the associated financial aspects, processes and structures (van Santvoord & van Ruitenburg, 2023). With financial crime scripting, we add financial components to the method of crime scripting. Whereas crime scripting focuses primarily on the procedural or logistical aspects of specific forms of crime, financial crime scripting offers the opportunity to enhance the view of the financial aspects of crime and the understanding of criminal business models and corresponding revenue models. Consequently, the method is applicable (however, not limitedFootnote 2) to and provides valuable insights for the analysis of all forms of profit-driven crime. Precisely because financial gain is paramount in these types of crimes, it is valuable to put financial aspects at the centre of the crime script analysis. In addition, in police or criminological analyses we try to give the role of financial flows in the criminal (business) process the place it deserves and also create opportunities for the integration of the other two flows according to supply chain management literature (e.g., Pfohl & Gomm, 2009) i.e. the flow of goods and the flow of information. In other words, where crime scripting focuses on the procedural or logistical aspects of specific forms of crime, financial crime scripting offers the possibility to gain insight into the financial aspects of crime in order to increase the understanding of financial aspects such as criminal money flows. Therefore, financial crime scripting can be seen as the backbone of financial intelligence. It is explicitly not about creating a crime script for financial-economic crime (such as specific forms of fraud and money laundering, e.g., Gilmour, 2023; Junger et al., 2020), but about adding financial components in crime scripts of various forms of (profit-driven) crime. In the following sections, we will first explain what financial components can be identified, then put the financial components in its place in the crime script, and, finally, elaborate on how financial crime scripts are constructed and populated.

The ‘F’ in FCS: Financial Components

The financial aspects related to crime scripts of profit-driven crimes fall into several components. These financial components concern the financing of criminal activities, revenues and costs, settlement of payment, payment methods and the linking dots with financial-economic crimes.

Financing can originate from both legal and illegal sources (Levi et al., 2015). Illegal funds come from previous criminal activities, whether self-inflicted or not, whilst legal funds are legitimately obtained. It is also common for legitimate entrepreneurs to invest the proceeds of their legal business activities in the illegal trade in exchange for a share of the profits from that illegal trade. Finally, a joint investment arrangement provides the opportunity to share the risks and costs of the illicit trade activities, as well as to obtain additional financing if needed.

The second financial component concerns the revenues or proceeds. As stated, financial crime scripting focuses on profit-driven crime. There are different manifestations of profit-driven crime, all of which have their own methods of generating profit, such as predatory (e.g., theft), market-based (e.g., cocaine trafficking) and commercial (e.g., VAT carousel fraud). Profits depend on myriad factors (see for example Terenghi & Di Nicola, 2015). In the case of market-based profit-driven crime, these include the market value of the traded product. At the individual level, proceeds also vary depending on the position or role the person occupies within a criminal organisation.

The third financial component involves costs. In market-based profit-driven crime, variations in the cost of purchasing the illicit goods depend on the size of the illicit batch, the frequency of cooperation, where it is purchased, and the level at which the criminal entrepreneurs operate (Terenghi & Di Nicola, 2015). In addition to the cost of purchasing the illegal goods, personnel and material costs can also be distinguished. These costs can vary depending on the modus operandi used. Indeed, one modus operandi requires more involved actors and logistical conditions than the other, which logically means that the costs are also higher.

In addition to these influencing factors specifically related to revenues and costs, there are also factors that affect both revenues and costs and in this sense are more general in nature. Factors such as the risks and urgency associated with activities are unambiguously related to revenues and costs: the higher the risk or urgency, the higher the revenues on the one hand and the costs on the other. The influence of quality is also unambiguous: the higher the quality, the higher the revenues or costs. The influence of quantity of the good or service is twofold: the higher the quantity, the higher the revenues and costs in absolute terms, but (mostly) the lower in relative terms.

The fourth financial component distinguished within financial crime scripting is the settlement of payments. Here a distinction can be made between payments at the organisational level on the one hand and payments at the execution level on the other (Kruisbergen et al., 2012). At the organisational level, payments relate to the purchase of illegal goods and other costs associated with (maintaining) the illegal trade. Here, three main recurring methods of settling payments can be distinguished, namely prepayment, revolving credit and phased payment (Terenghi & Di Nicola, 2015). Payments at the execution level relate to personnel costs. Profit-driven crime is not an isolated crime, but rather a complex series of interrelated acts in which different individuals perform a wide variety of roles. These individuals may be paid per unit of the illegal good (e.g., per kilogramme), or per load or batch of illegal goods. It is also possible that the individual is paid per job. Payment is usually only made at the time the activity is successfully completed. Those who often have a more coordinating role receive some kind of fixed salary for this.

Finally, the payment methods form the fifth financial component. Here, a first distinction can be made between cash and non-cash payments. A cash payment is a commonly used payment method because it is less detectable and the transfers are more difficult for law enforcement agencies to trace compared to bank transactions (Terenghi, 2022). Non-cash payments include payments through legitimate bank transactions, money transfers and underground banking. In both money transfers and underground banking, physical movement of cash is required to a limited extent. For example, in money transfers, cash is deposited at money transfer offices to be virtually transported so that it can be withdrawn again in cash at another place in the world. Underground banking is a form of financial service offered outside the formal financial system, whereby cash deposited on one side of the world can be paid out again on the other side of the world through a network of unlicensed bankers. In addition to these fiduciary money payments, there are also virtual (such as crypto) currency with which payments can be made (e.g., Morgenthaler & Leclerc, 2023). These virtual currencies are part of a larger group of virtual assets. The FATF (2021) defines virtual assets as a ‘digital representation of value that can be digitally traded or transferred and can be used for payment or investment purposes’ (pp. 21–22). The FATF recognises the potential risks posed by these technological innovations, especially regarding the opportunities they offer in the context of money laundering and financing of criminal or terrorist activities (FATF, 2021). Moreover, (ostensibly) legitimate businesses, goods and services can be used (or better: misused) to transfer value, and thus also to make payments. In this process, the ostensibly legitimate goods themselves serve as transfers of value. This phenomenon is also known as Trade-Based Money Laundering. Finally, payments can also be offset against illicit (valuable) goods or services. This is also known as barter or payment in kind.

The last financial component relates to financial-economic crimes and money laundering. These crime types are considered as connected crimes (see Gómez-Quintero et al., 2023) that enable or are fuelled from the profit-driven crime. Despite some exceptions (e.g., Lavorgna, 2014), intelligence regarding specific money laundering methods associated with specific profit-driven crimes (such as illicit drugs manufacturing; Chiu et al., 2011) is often lacking. These connected crimes should also be linked to, and not nested in, the financial crime script of the primary offence (i.e. the financial crime script under consideration). These links can be established by cross-referencing to other (financial) crime scripts. Figure 1 contains an example to illustrate this cross-referencing. The dark blue boxes at the top of the figure (horizontally) represent the scenes of the crime script (in this case, the domestic process of cocaine trafficking in the Netherlands). The light blue boxes represent (vertically) various examples of equifinal actions for the scene ‘Recovery’. In the equifinal action ‘Rip-off–Switch method’, a number of roles and related activities can be distinguished. In this example, two roles (‘Coordinator’ and ‘Picker’) within this equifinal action of the cocaine trafficking crime script are reflected. Both roles have two primary activities (A1 and A2, and A4 and A5) and one secondary activity. For the secondary activities, we make a cross-reference to another crime script. For the primary activities, we collect information on the financial components (see the ‘Putting the Financial Components in Its Place’ section).

Fig. 1
figure 1

Cross-references to other crime scripts

Full size image

Putting the Financial Components in Its Place

The aforementioned financial components relate to several aspects of the structure of a crime script (see the ‘Crime Scripting’ section). First of all, the financial components are tied to the role-level. We distinguish between financial roles (e.g., a financer), the money flow between two or more roles (e.g., the payment in the context of cocaine trafficking overseas), and a ‘price tag’ that can be calculated when the costs are netted off from the revenues. Nevertheless, the activity-level is central within financial crime scripting, because, after all, a role in the context of a crime script is a coherent set of activities and thus the role is just an aggregation of activities (e.g., a ‘financer’ is only a financer because their activity entail financing crime).

At the activity-level, for analytical reasons, a distinction is made between primary and secondary activities for each equifinal action within a scene. The primary activities are important in the execution of the financial crime script in question. Gómez-Quintero et al. (2023) refer in this context to direct offences, i.e., directly related to the organised crime activity, e.g., recruitment of victims for human trafficking. Secondary activities are activities that are supportive to the execution of the script and can be linked to another crime script. Gómez-Quintero et al. (2023) refer in this context to ‘connected crimes’ and distinguish between enabling and fuelled offences (see the ‘Crime Scripting’ section). Secondary activities can be either legitimate or illegitimate. Illegitimate activities—activities that are criminalised by law, such as enabling offences—are cross-referenced to another crime script (e.g., bribery—which is a crime script in itself—of a port employee or customs officer when importing cocaine through the port). Given the nature of profit-driven crime, forms of financial-economic crime can play an important role in the crime script at hand. In distinguishing between primary and secondary activities, the focus remains on the present crime script whilst accommodating the interrelatedness of different forms of crime.

In the financial crime script, only the primary activities are further elaborated on. These are detailed by, for example, answering the 6W1H-questions (see also Clarke & Eck, 2003, p. 70) at the activity-level (see Fig. 2). The What-question relates to the primary action to which the financial information is collected. The Why-question relates to the motive for the activity carried out by the particular role; in most cases this will be generated profit. The Which-question relates to the revenues and/or the costs related to the specific activity. The Who-question considers from whom (sender) and to whom (receiver) money (or broader: value) flows through the script. The How-question related to the form of the financial transaction. The Where-question collects information on the location of the activity. Last, the When-questions considers temporal aspects and the settlement of payment.

Fig. 2
figure 2

Conceptual structure of a (financial) crime script with primary and secondary activities

Full size image

This conceptual clarity is highly relevant given the observed specialisation of criminal practices, leading to them being outsourced, as it were, or in other words provided as 'crime-as-a-service'. Recent research identified this development in areas such as contract killings (Van Gestel, 2023), cybercrime (Van Wegberg, 2020) and money laundering (FATF, 2018; Kramer et al., 2023). As a result, these criminal practices become profit-driven in themselves. Depending on which perspective is taken, it is determined whether a form of crime should be viewed as a secondary activity (which is consequently supportive of the primary offence) or as a profit-generating, primary offence in its own right. This is an important distinction in the context of financial crime scripting. We will provide an example in relation to money laundering.

Viewed from the above definition of a primary offence, e.g., cocaine trafficking, money laundering is a secondary activity to give the profits obtained an apparent legal origin. From the cocaine trafficking financial crime script, a cross-reference should therefore be made, if necessary, to a specific modus operandi from the money laundering crime script (see activity A6 in Fig. 1). This money laundering can be carried out independently by the criminal who obtained the profits (self-laundering) or can be outsourced. In case there is laundering of (criminally obtained) money from third parties for a fee (or outsourcing), it is also referred to as professional money laundering (FATF, 2018). For these professional money launderers, networks or organisations, money laundering is a business activity (Kramer et al., 2023) and thus constitutes the activity through which profit is obtained. More specifically, they deliver an illegal service that can be seen as a market-based, profit-driven crime.

Figure 3 provides an example of how financial information may be summarised in a visual manner. In this financial crime script, we assess activities on the role level and summarise all available information on the financial aspects of those activities: revenues, costs, bandwidths of both, the unit (e.g., per kilogram, per activity), the settlement of payment, and the form of the financial transaction (see icon above the arrows). We see from who the payment originates (in the case of revenues) and to whom it is paid (in the case of costs).

Fig. 3
figure 3

Financial components in the financial crime script

Full size image

Constructing Financial Crime Scripts

A financial crime script can be constructed in two ways: in a sequential or a parallel process. In a sequential process, a crime script already exists, or a crime script is created first and the financial components are added subsequently. In a parallel process, the financial components are directly included and the financial crime script is thus created in an integrated way. The roadmap below describes the generic creation process of a crime script, with the financial components being accounted for in step 2.

Tompson and Chainey (2011) propose a four-step plan (steps 1–3 and 5) to create a crime script. Snaphaan (2021) added two steps (steps 4 and 6), which make it a whole that pays attention to the dynamic and adaptive nature of crime (Wortley, 2012), as well as the importance of verification and validation of the script (Borrion, 2013). In line with the terminology and conceptualisation described above, the steps are as follows:

Step 1. Breaking the Crime Script Down Into Scenes

As described earlier, scenes are smaller units (process steps) in the overarching script that are arranged to pursue a concrete subgoal.

Step 2. Writing the Script: Describing the Equivalent Actions, Roles, Activities, Attributes, Settings and Financial Components

The components of the crime script described in the ‘Crime Scripting’ section are elaborated in this step. Dehghanniri and Borrion (2016) developed a step-by-step plan to write the crime script, namely: defining the required information (based on the defined purpose of the crime script), data collection, verifying and enriching the data, extracting required information from the data, organising the information in the format of the crime script. For specific guidance in using open source intelligence or court transcripts, we respectively refer to Chainey and Alonso Berbotto (2022), and Morgenthaler and Leclerc (2023). When preparing a financial crime script, this step also accounts for the financial components.

Step 3. Interpreting the Content of the Script and Visualising the Results

In this step, meaning is given to the information collected. The aim of this step is to explain the process of the specific form of crime, considering the interplay of roles, activities and attributes. What can help here is visualising the script, for example in the form of a flow chart. In this phase, it is also useful to recognise different tracks within the same script to shape the (financial) crime script as concretely as possible.

Step 4. Verification and Validation of the Financial Crime Script

To assess the quality of the crime script, it is important to verify and validate the prepared crime script. It is important to apply a formal verification and validation process to check the quality of generated crime scripts. Borrion (2013) developed a checklist consisting of 12 items (e.g., traceability, completeness and accuracy) for the quality development and evaluation of crime scripts.

Step 5. Identifying and Choosing Intervention Options

In this context, Haelterman (2016) distinguishes between first identifying intervention opportunities, for example using Cornish and Clarke's (2003) 25 situational crime prevention techniques, which can be divided into five categories: increase the effort, increase the risks, reduce the rewards, reduce provocations and remove excuses, and second, choosing the most promising intervention strategy for the purpose of implementation.

Step 6. Adjusting the Financial Crime Script (if Necessary)

Given the dynamic and adaptive nature of crime, it is likely that either due to changing opportunity structures or the interventions carried out, the modus operandi (and consequently the financial crime script) will change over time. These changes necessitate adjustment of the script. Any adjustment is done first at the level of scenes (step 1), then at the level of equivalent actions, roles, activities, attributes and settings (step 2), et cetera.

Populating Financial Crime Scripts

Besides the step-by-step plan of how a (financial) crime script can be constructed, validated and used to identify and choose interventions, it is important to address how the script can be populated. This can be done in multiple ways. For example, by answering questions that relate to the crime script components (such as roles, activities and props; see Table 3) to guide the identification and collection of information for the crime script. Another approach for populating the crime script is to use existing frameworks or taxonomies, such as the ASCOPE/PMESIIFootnote 3 framework that is borrowed from defence and military applications (United Nations, n.d.).

Table 3 Questions to populate the crime script (slightly adjusted from Chainey & Alonso Berbotto, 2022)
Full size table

Even more important are the sources of information that allow for populating the financial crime script. As with any analytical method, the quality of the output (financial crime script) is largely dependent on the input (sources of data, information and knowledge). A general premise is that it is recommended to combine information from different sources, for the benefit of the accuracy and completeness of the crime script (Haelterman, 2016).

Financial information is a specific form of information with specific properties. Regarding the retrieval of financial information, a number of factors can be identified that influence to what extent traces are left at all (Kruisbergen et al., 2012):

  • The person of the offender: individual offenders differ, for example, in the extent to which they are aware of possible attention from the authorities and in the discipline to adjust their behaviour as much as possible to that attention.

  • The scale and logistics of the criminal business process: criminal activities of a larger scale and of a more complex nature are more likely to require some form of administration than small-scale and more straightforward activities. For an offender who only interacts with a small number of relations and carries out a limited number of transactions, it is easier to do everything 'by heart' than for someone who deals with a significantly higher number of people and carries out a large number of transactions.

  • Whether or not a criminal organisation is linked to regular businesses, which can increase the visibility of money flows. Similarly, organised crime perpetrators sometimes use the regular payment system. In addition, criminal organisations sometimes use other companies to provide a necessary condition within the business process, e.g., to supply certain necessary substances for drug production or to launder criminal proceeds.

  • Ambiguities or obstacles during a criminal transaction: this sometimes causes offenders to be more or less forced to be more open than they would actually like.

Particular data and information sources can be distinguished that can make a useful contribution to retrieving financial insights, such as regular payment information, record of the (criminal) business process – (criminal) accounting, and (precipitation of) intercepted communication (Kruisbergen et al., 2012). A current example of the latter type of data sources are crypto communication data (e.g., EncroChat and Sky ECC; Europol, 2021b). These data sources deliver an unprecedented wealth of information for law enforcement agencies, which has already been shown to be useful in the context of crime script analysis (Vermeulen, 2019). Victims’ and offenders’ statements, which are often collected after criminal offences are established, also potentially represent a wealth of information. Besides this primary collection of financial information, these insights can also be retrieved in a secondary manner through qualitative research methods, such as interviews or focus groups.

Relevance for Practice, Policy and Research

Financial crime scripting, similar to crime scripting, holds significant relevance for practitioners, policymakers and researchers. There are several distinct benefits to incorporating a financial perspective into crime scripting. First, this approach provides a systematic framework for gathering existing knowledge on financial aspects of crime-commission processes. Experienced practitioners, such as financial investigators, possess valuable insights into the financial aspects of criminal activities. However, these insights are often not effectively recorded and consolidated into a knowledge base that can guide future investigations and interventions. Financial crime scripting offers a structured method for practitioners to collect and organise knowledge and information related to the financial dimensions of criminal processes. In other words, it serves as a means to preserve collective memory at both strategic levels (e.g., drafting trend reports and knowledge products) and operational levels. By organising available knowledge and intelligence, it also becomes easier to identify knowledge gaps. This, in turn, can inform policymakers to initiate new projects aimed at filling those gaps.

Second, drawing on the gathered financial intelligence, financial crime scripting facilitates the identification and selection of appropriate interventions to disrupt criminal money flows. Starting from a solid intelligence foundation is crucial when implementing crime prevention measures, in line with Ekblom's 5i model (2011), which emphasises the importance of gathering intelligence on offenders' modus operandi prior to designing interventions. Ideally, a financial crime script provides insights into critical points where interventions can effectively impede not only criminal money flows but also the broader criminal network. For instance, whilst a crime script for ecstasy production may primarily focus on the key roles involved in the actual manufacturing process, a financial crime script for such crimes shifts attention towards the financial support of production and the channels used for transferring illicit profits. The hypothesis is that intervening in these financial flows also hampers offenders’ involvement in drug-related crimes.

Third, by promoting the development of ‘collective intelligence’ in a uniform and system-independent manner, financial crime scripting facilitates collaborations across borders, disciplines, organisations and public–private entities, including financial institutions. Since it is a method and not a specific tool, it can be easily applied in practice. Crime scripting in general and financial crime scripting in particular aligns with a problem-oriented policing approach (Goldstein, 1979) to gain in-depth insight into the financial aspects of profit-driven crime, focusing on the problem rather than how the system is organised to address these problems.

Fourth, financial crime scripting can help financial investigators to improve the quality of calculations of illegally obtained benefits, and ultimately improve confiscation and asset recovery. This is because the building blocks of financial crime scripting (revenue and costs, as well as settlement and payment methods) are also crucial elements in settlement calculations, and so the framework offers a model upon which asset recovery proceedings can be based.

Finally, financial crime scripting offers the ‘empirical logistical approach’ for conducting scientific research into what Levi (2015, pp. 294–295) refers to as the ‘financing of crimes’ – beyond the sole financial focus on crimes like money laundering. Indeed, as the review by Dehghanniri and Borrion (2021) has shown, whilst crime scripting has contributed extensively to our knowledge on criminal activities, the role of money within these scripts has received relatively little attention, although it is worth mentioning some exceptions (Broad et al., 2022; Levi et al., 2015). Furthermore, financial crime scripting enables a more comprehensive understanding of the interconnectedness between non-financial crimes, such as drug trafficking, and financial crimes including bribery and money laundering (see Fig. 1; see also Gómez-Quintero et al., 2023).

Discussion and Conclusion

In this article, we introduced financial crime scripting as a method to gain insight into the financial aspects of profit-driven crimes. It is not a new method per se, but it adds a financial perspective to the well-known and often used method of crime scripting. Whereas crime scripting allows researchers and practitioners to generate, organise and systematise knowledge and information about the procedural aspects and requirements of crime commission, financial crime scripting widens the scope by zooming in on the money flows coupled to the procedural aspects of a wide variety of (profit-driven) crime types.

The presented framework must be seen as a first step that needs to be put into practice by law enforcement agencies and other crime prevention partners to be developed even further. We are also aware that the mere description of the method, as outlined in this article, is no guarantee for its successful adoption. For financial crime scripting to work, as with crime scripting in general, the method should be adopted by law enforcement agencies not as a mere project, but should ideally be fully embedded in the day-to-day process of its users. Only then can informed choices regarding capacity allocation and interventions be made based on (financial) intelligence. It requires an (enduring) investment in time and personnel to apply this way of working in practice, just like it requires police practitioners to gather other pieces of information. Also, continuous effort is needed to keep a financial crime script and the intelligence up to date. To do so, a motivated ‘problem owner’ is crucial, in terms of accessing and storing the necessary data, information and knowledge. They not only play a crucial role in updating the crime script, but in creating broader support for the implementation of the method. The success of financial crime scripting is then also dependent on the availability of data with the cooperating public and private partners, and the readiness of those partners to share this information. Financial crime scripting might be a modus of working together to, amongst others, exchange knowledge on the financial aspects of crime-commission processes. Law enforcement agencies and crime prevention partners (e.g., gatekeepers of the financial systems, such as banks) should implement and upscale the application of financial crime scripting, to incorporate the financial dimension in intervention strategies. Future applications in practice and policy could exploit available data for strategic purposes and preserve the acquired insights (e.g., Soudijn et al., 2022) by means of this analytical method.

Although financial crime scripting offers a promising framework to enhance insight into profit-driven crime, there is still little understanding of the (cost)effectiveness of this and the base method of crime scripting: it is unknown what works, for whom, and under what circumstances or conditions. Also, there is much to gain from researching how (financial) crime scripting can include new evolving forms of (big) data (e.g., Barros et al., 2022) or synthetic data (e.g., Jensen et al., 2023), and how these sources of knowledge connect with the existing knowledge of the professionals involved in preventing and controlling crime on a day-to-day basis. Future studies could further develop this method, as well as empirically explore to what extent and how this method is applicable to other forms of crime, that are not necessarily profit-driven, but in which financial aspects do play a role (e.g., financing of terrorism). From a methodological point of view, future research should assess how to combine or integrate the proposed framework with other analytical methods. For example, as has been done in combining social network analysis and crime scripting (Bellotti et al., 2022; Duijn & Klerks, 2014), by combining or integrating financial crime scripting with the APPT-framework (Tiwari et al., 2023) specific for money laundering techniques or the Business Model Canvas which has also been experimentally used to gain insight in business models of organised crime groups (e.g., Smith & McElwee, 2016). Finally, it is important to acknowledge that (financial) crime scripts are never finished. As long as the modi operandi of offenders change, not least in the face of the interventions raised by state agencies, (financial) crime scripts will always be work-in-progress. With this article, we hope to have added a useful tool to the toolbox to conduct meaningful analysis with a view to reduce profit-driven crime.