Post offices, mule accounts and the £53m that vanished into crypto

The morning round

On a normal working day, Jigar Gheewala's people did a circuit of Leicester. 

First deposit in the east of the city, at a post office counter tucked inside a corner shop. Then a five-minute drive to the next shop, vege boxes out the front, windows papered with drinks decals, post office services sold alongside the scratchcards. A few minutes on to a branch between a chemist and a chicken shop. Then a retail park, then a parade of red-brick houses. Thousands of pounds paid within the hour. A morning's work.

Gheewala was a declared bankrupt on benefits who lived in a £1.3m house and sent three children to private school. Over 2020, his account took in more than £880,000 in cash across roughly 200 deposits. That mismatch is what put Leicestershire Police's economic crime team onto him.

The investigation became Operation Kilo. In two years, Gheewala's group moved around £53m. In December 2025, he was sentenced to almost 12 years, along with six co-conspirators.

According to The Guardian, Gheewala ran the whole thing from a laptop in an otherwise empty house, account logins written in a notebook, moving money out through crypto exchanges as fast as it landed.

How the post office counter became the choke point

Post offices are not a side channel any more. They are central to how dirty cash is cleaned through the banking system.

Since 2017, branches have accepted deposits on behalf of banks. Those deposits now run past £30bn a year. The mechanism is deliberately simple: hand the banknotes over to be counted, insert a bank card, enter the PIN. The post office talks to the bank, the bank credits the account. 

Simplicity is the problem. The postmaster has no visibility of the account behind the card, no way to know whether the person holding it owns it, and no sight of whether this is the tenth deposit that morning across ten branches. Any card, any PIN, any counter. None of the standard AML checks a bank teller runs exists in a post office.

The numbers show where the cash went. Cash use by the public has collapsed to fewer than one in ten transactions. Over the same years, monthly post office cash deposits climbed from £1.9bn in October 2020 to £2.9bn by October 2025, and have since passed an estimated £3bn a month. Cash use down, cash deposits up. Law enforcement estimates hundreds of millions of pounds of dirty money go through post office counters each year, against a National Crime Agency estimate of around £12bn in banknotes laundered in the UK annually.

There is a reason banks are content to hand this over. As high street branches close, two-thirds gone in a decade, moving and accepting cash is expensive and loss-making for banks. The result is that the highest risk activity of all, cash, is being pushed into the locations with the loosest AML controls.

Why nobody wants to touch it

This is the uncomfortable part. The reason the laundering story has been largely ignored is the other Post Office story.

After the Horizon scandal and Mr Bates vs the Post Office, evidence that originates in Post Office IT systems is radioactive in front of a jury. Documents from the Horizon inquiry show that in 2024, weeks after the ITV drama aired, a detective halted an investigation into large-scale laundering through Lancashire branches out of concern that defence lawyers would pull the evidence apart. One officer put it plainly: after the show, it became a hot potato nobody wanted to pick up, and for every case brought there are many more left in the background.

So the gap stays open. The best enforcement can do is take the most egregious operators off the board and accept that someone fills the vacancy. As one of the Leicestershire officers said after Gheewala went down: money needs to be laundered, and somebody else fills those boots.

Where this lands on a firm's file

The laundering happens at the counter. The proceeds do not stay there. They move outward, and some of that outward movement runs straight through the kinds of clients and transactions regulated firms see every week, whether that's a law firm, an accountancy practice, a property business or a financial institution. This is how a post office deposit can become a high-risk indicator, in four steps.

1. The mule with a clean profile
   
   The account taking the cash belongs to an ordinary person paid a small fee to rent it out. In the Leicester operation, mules were promised £50 per £10,000 laundered, often paid less. The individual passes every identity check. The name is real, the ID is genuine, the address is clean.
   
   What happens: Onboarding returns no red flags, because there are no red flags with the client. The client opens on a low-risk profile.
   
   
2. The front company with tidy book
   
   Not all the cash went through individuals. Some went through companies in Leicester's garment trade, where managers faked invoices to dress the deposits as legitimate trading receipts.
   
   What happens: The company presents accounts and invoices that reconcile on paper. Source of funds documentation is produced, and the evidence matches the client’s statement. However, it does not match reality, because the invoices are fabricated, but nothing on the file exposes that unless someone digs further into whether the claimed trading actually supports the cash volumes.
   
   
3. The money that is already gone
   
   By the time any suspicion is raised, the funds have been funnelled into various other shell companies and then converted to crypto to be dispersed. Gheewala moved money out the moment it appeared online. Sangiovanni, in the Bristol case, described collecting a carrier bag of cash from a supermarket car park and sending crypto back.
   
   What happens: The UK's whole AML model assumes suspicious funds can be frozen while they are investigated. Here they cannot. Any report filed after the deposit is a money report that no longer exists in a form anyone can seize. Detection after the fact is not the same as prevention.
   
   
4. The pattern no single firm can see
   
   Cash came into Leicester by courier from criminals in London and Yorkshire, was distributed among underlings, and paid into as many as ten accounts per branch. A firm could have no way to see the interlinked network of transactions across multiple individual accounts.
   
   What happens: Each firm assesses its own client correctly and sees a fragment. The mule looks like a single person. The garment company looks like one company. The structure only resolves when the fragments are put together, and no single firm holds all the information to link them all.

Red flags that only mean something together

None of the following, on its own, proves anything. Each is consistent with a legitimate client having an ordinary week. The pattern is the signal.

• Personal or company accounts receiving frequent cash deposits that might fit the account holder's known income or the business's trading profile but lack concrete long-term evidence to back it up
• Cash deposits made through post office counters rather than the account's own bank, particularly across multiple branches
• Source of funds that reconciles with supplied invoices but not with the plausible trading level of the business
• Newly onboarded individuals whose accounts show high-volume throughput shortly after opening, then rapid outward transfer
• Rapid conversion of deposited funds into cryptocurrency or onward transfer within hours of receipt
• Company invoices that support the numbers but can't be tied to identifiable customers or deliverables
• A client or contact who can't explain the commercial reason for the cash volumes passing through their account
• Common connections between separate clients that individually look unremarkable, for example shared addresses, directors or payment counterparties

The shift

The cash deposit problem at the post office counter is not an easy or quick fix. The Financial Conduct Authority (FCA) imposed cash deposit limits in 2023, and the political pressure to protect cash-reliant businesses means further tightening is unlikely. Firms downstream should assume the channel stays open and adjust accordingly.

• Interrogate source of funds against reality, not just against paperwork. Faked invoices reconcile. The question is whether the claimed trading plausibly generates the cash, not whether the documents match each other. Is there consistent long-term evidence in various formats to support their source of funds claim? What else can be provided aside from bank statements or annual accounts?
• Monitor for transaction volume across the entire client relationship, not just at onboarding. A clean identity that suddenly moves high volumes and disperses them fast is the signature here. That behaviour appears after the file opens, so monitoring has to run continuously, not at a fixed review date.
• Treat speed of onward movement as a risk factor in itself. Where the client asks for funds to be moved on within hours of receipt or a series of quick transactions to other entities, review the nature and purpose of the transactions before releasing funds through the firm’s client account. The window to act is before, not after.
• Look across the relationship, not just the engagement. Risk rarely shows up in a single transaction. It shows up across them: the same client in three separate matters, the same counterparty on the other side of unconnected deals. A firm that only sees one transaction at a time will rarely see the pattern, and that has to be fixed structurally rather than left to whoever happens to notice.