Inside Spain’s ’Ndrangheta-Linked Crime Networks: Drugs, Extortion and Illicit Investment

The arrest of 32 suspects in Spain in September 2022 exposed how Italian mafia-linked networks can combine international drug trafficking, extortion, tourism businesses and real-estate investment within a single criminal operating environment.

The coordinated action involved searches across Ibiza, Barcelona, Málaga and Tenerife. Authorities seized approximately €300,000 in cash, 18 kilograms of amphetamine, 4.5 kilograms of cocaine, firearms, ammunition and a cannabis plantation containing around 600 plants.

Official statements described two organised-crime groups operating in Spain and Italy with suspected links to the Calabrian ’Ndrangheta. One investigation concerned a mafia-type organisation based around Milan that also operated in Ibiza. The other focused on a Spain-based network allegedly involved in importing cocaine from South America and laundering the resulting proceeds.

The suspects were arrested on allegations including drug trafficking, money laundering and extortion. Arrests and investigative findings are not convictions, and the public record available from the coordinated action does not establish the eventual judicial outcome for every person detained.

The operation nevertheless provides a detailed case study of how transnational organised crime moves beyond drug distribution. Criminal networks do not simply sell narcotics and store the proceeds. They use businesses, property, intermediaries and coercive relationships to embed themselves within legitimate economies.

Listen the podcast

Watch the video

Why the Spanish operation matters now

Spain occupies a strategically important position within Europe’s illicit-drug market.

Its extensive coastline, commercial ports, proximity to North Africa and commercial links with Latin America create legitimate trade and tourism opportunities. The same infrastructure can be exploited by criminal organisations transporting cocaine, cannabis, cash and other illicit goods.

Spain remains one of the principal European entry points for cocaine. In 2024, Spanish authorities reported the seizure of 13 tonnes of cocaine concealed in a shipment of bananas—the country’s largest single cocaine seizure to that date.

Large container ports attract significant attention, but smaller marinas, coastal routes and tourist islands also create opportunities. Sailing boats and high-speed vessels can transport drugs through routes that are less visible than major commercial terminals.

Ibiza presents an especially attractive environment. Its international tourism sector generates intensive property activity, seasonal employment, nightlife businesses, luxury consumption and large volumes of legitimate cash and cross-border payments.

None of those characteristics is inherently suspicious. Their combination, however, can provide criminal groups with operational cover, customers, transport connections and mechanisms for integrating illicit proceeds.

What the 2022 investigation uncovered

The Italian investigation focused on an organisation operating in the Milan area and Ibiza. Its suspected leader was reported to be related to the head of a powerful Calabrian ’Ndrangheta family.

Authorities alleged that the organisation engaged in drug trafficking, money laundering and extortion through several economic activities. It was also suspected of maintaining links with the Sicilian Cosa Nostra.

Investigators believed the group had developed sufficient local influence to exercise forms of territorial control in Ibiza resembling mafia practices traditionally associated with Italy.

The Spanish investigation focused on another organised-crime network allegedly importing cocaine from South America aboard sailing boats. The drugs were then intended for distribution in Ibiza.

Authorities stated that the network operated several businesses to conceal its activities, including real-estate enterprises and apartments rented to tourists.

Information supplied by Italian investigators also linked two individuals settled in Ibiza to an ’Ndrangheta family. They were suspected of using extortion against local business owners.

The case therefore involved more than a trafficking route. It combined maritime logistics, local distribution, financial concealment, legitimate commercial activity and alleged coercion.

How the ’Ndrangheta operates internationally

The ’Ndrangheta originated in Calabria but has developed into a global criminal organisation with extensive influence over international cocaine markets.

Its resilience is partly connected to its family-based structure. Blood and marriage relationships can create trust, discipline and secrecy that are more difficult for law-enforcement agencies to penetrate than loosely organised criminal associations.

Individual clans can operate with significant autonomy while retaining cultural, familial and operational connections to Calabria. This allows the wider organisation to expand internationally without depending on a single central command.

Its overseas presence should not be understood merely as the relocation of Italian offenders. The organisation can establish relationships with local criminals, logistics specialists, brokers, business owners and professional facilitators.

INTERPOL has described the ’Ndrangheta as present across dozens of countries and supported by substantial financial power generated principally through drug trafficking, corruption, fraud and manipulation of public or commercial activity.

The organisation’s expansion strategy is economic as well as territorial. Illicit proceeds are reinvested into businesses and assets that can produce legitimate revenue, provide operational infrastructure and increase influence over local communities.

Criminal alliances rather than isolated organisations

The Spanish action involved Italian, Albanian and Hungarian suspects, illustrating the multinational composition of contemporary organised crime.

This does not mean every participant held the same status or belonged formally to the ’Ndrangheta. A transnational network can include mafia members, independent traffickers, transporters, property managers, financial intermediaries and local facilitators performing different roles.

Europol’s analysis of the European Union’s most threatening criminal networks found that most operate across several countries and that more than two-thirds include members of multiple nationalities.

These networks frequently cooperate where their capabilities are complementary. One group may control relationships with cocaine suppliers in South America, while another provides maritime transport, local storage or access to European distribution markets.

Albanian-speaking networks, Italian mafia groups, Latin American suppliers and local Spanish operators may collaborate without merging into one organisation.

For investigators and financial institutions, labels therefore have limitations. Identifying an ’Ndrangheta connection can be important, but the complete risk often sits within a wider ecosystem of associates and service providers who do not carry a recognised mafia name.

Maritime transport and hidden logistics

The suspects allegedly used sailing boats to move cocaine from South America to Spain, while other reporting described vehicles with concealed compartments and speedboats used in the wider trafficking activity.

Maritime trafficking can take several forms. Large consignments may be concealed within commercial containers, while smaller shipments can travel aboard recreational vessels, fishing boats or high-speed craft.

Sailing boats can appear consistent with the legitimate leisure activity surrounding Mediterranean islands. They may move between marinas, change crews or transfer cargo at sea before arriving at the final destination.

Vehicles equipped with hidden compartments can then transport drugs, cash, weapons or communications equipment between ports, warehouses and distribution locations.

The financial indicators do not necessarily resemble a conventional narcotics transaction. Relevant expenditure may appear as marina fees, vessel maintenance, fuel purchases, storage payments, vehicle repairs or payments to charter businesses.

A resilient investigation must connect those apparently ordinary expenses with ownership, routes, crew relationships and unexplained movements.

How property and tourism businesses support laundering

Authorities alleged that criminal proceeds were reinvested in Spanish real estate and that businesses, including tourist apartments, were used to mask illegal activity.

Property can support money laundering in several ways.

Criminal proceeds may fund a purchase directly, contribute to a deposit or finance renovation. Ownership can be concealed through companies, nominees, relatives or foreign legal structures.

A property may then produce rental income that appears legitimate. The criminal can mix genuine tenant payments with fabricated revenue, making the original capital more difficult to distinguish.

Tourism accommodation creates additional complexity because occupancy, pricing and revenue vary significantly by season. A company can report income from short-term visitors, management services or maintenance activity that may be difficult to verify without booking, tax and payment data.

Property also provides operational value. Apartments can house members, store drugs or cash, host meetings and support individuals travelling under false or temporary identities.

Europol’s analysis found that real estate is one of the principal industries used by Europe’s most threatening criminal networks to launder proceeds. The attraction is not limited to rising asset values. Property provides stability, social legitimacy and access to the legal economy.

Extortion as a mechanism of territorial influence

The alleged extortion of local business owners is important because it indicates a potential transition from criminal presence to criminal control.

A trafficking organisation can operate discreetly without seeking authority over the surrounding community. A mafia-type organisation may attempt to regulate local activity, punish resistance and create dependence.

Extortion payments generate proceeds, but the strategic objective may be broader. Intimidation can secure access to premises, influence business decisions, suppress reporting and force legitimate operators to cooperate.

A restaurant, property company, marina service or nightlife venue may be pressured to store goods, employ associates, accept cash or provide information.

The payment itself may appear as a consulting fee, loan repayment, supplier invoice or transfer to a connected company. Some victims may make regular cash withdrawals rather than sending a traceable payment.

Financial institutions should recognise that unusual transactions can involve victims as well as perpetrators. Closing an account without understanding the coercive context may remove visibility and increase the customer’s vulnerability.

Money laundering as an organisational capability

Drug trafficking generates a financial-management problem. Cash must be collected, transported, counted, stored and converted into assets that can be used without revealing its criminal origin.

Europol’s assessment of the EU’s most threatening criminal networks found that almost all of them manage at least part of their own laundering activity.

Some maintain direct control over the process. Others use specialist money launderers, accountants, legal advisers, property professionals, company-service providers and brokers.

The laundering architecture can include cash-intensive businesses, property investments, loans, false invoices, company acquisitions and transfers between related entities.

Funds may also be moved through informal settlement systems. A criminal organisation provides cash in one country, while an associated broker releases equivalent value elsewhere without the original money crossing the border directly.

The result is an economic network rather than a simple sequence of bank transfers. Investigators must identify who generated the proceeds, who controlled the companies, who provided professional services and where the value was ultimately retained.

Why conventional AML controls can miss the network

The first challenge is legitimate commercial cover. Property rental, tourism, maritime activity and vehicle ownership are ordinary features of Ibiza’s economy.

The second is fragmented visibility. One bank sees a property company, another sees a vessel-related business and a third holds the personal accounts of the beneficial owners.

The third is the use of cash. Drug sales and extortion can generate physical currency that is introduced gradually through businesses or used directly for expenses.

The fourth is ownership opacity. Companies may be controlled through relatives, associates or nominees who have no known criminal record.

The fifth is transactional plausibility. A payment for property maintenance, vessel services or tourism accommodation may appear reasonable without a wider understanding of the network.

Finally, traditional name screening may identify few concerns. Many facilitators will not be sanctioned, convicted or publicly recognised when the relationship begins.

Effective detection depends on behaviour, ownership, relationships and economic purpose rather than adverse media alone.

What an evidence-led investigation looks like

The investigation should begin by reconstructing the network rather than reviewing each customer independently.

Analysts should identify beneficial owners, directors, authorised signatories, property holders, vessels, vehicles and recurring counterparties. Shared addresses, telephone numbers, devices and professional advisers can reveal connections between apparently separate businesses.

Financial activity should be compared with the customer’s operational capacity. A tourist-rental company declaring substantial revenue should have properties, bookings, guests, employees and related expenses consistent with that income.

Property purchases should be assessed against source of wealth, financing arrangements, valuation and any rapid changes in ownership.

Maritime analysis should examine vessel registration, routes, marina usage, fuel expenditure and relationships between owners and crew.

Investigators should also combine banking information with tax, customs, property and law-enforcement intelligence. No single dataset is likely to expose the complete organisation.

Findings must remain precise. Association with a suspect, nationality or presence in Ibiza is not proof of criminal participation. The evidence should establish financial control, operational contribution, knowledge or benefit.

What a resilient control stack looks like

The first layer is risk-sensitive customer due diligence covering property, tourism, maritime and other cash-intensive businesses.

The second is reliable beneficial ownership analysis. Institutions should identify the individuals exercising actual control rather than relying solely on registered shareholders.

The third is source-of-wealth and source-of-funds verification for high-value property purchases, company investments and unexplained capital injections.

The fourth is network analytics capable of connecting customers through addresses, counterparties, devices, directors, properties and payment flows.

The fifth is cash monitoring calibrated to the customer’s business model and seasonal activity.

The sixth is transaction analysis across related accounts. Circular transfers, rapid movement between companies and payments lacking a clear commercial purpose should be assessed collectively.

The seventh is professional-intermediary risk management. Lawyers, accountants, property agents and corporate-service providers can be legitimate gatekeepers, but their involvement should not replace verification.

The eighth is protected escalation for possible extortion victims and employees facing intimidation.

Finally, institutions need retrospective review. When law enforcement identifies a person, company, vessel or property connected to an organised-crime network, historical activity should be re-examined across the customer portfolio.

Why cross-border cooperation was essential

The 2022 action depended on coordination between Spanish and Italian judicial and law-enforcement authorities, supported by Europol and Eurojust.

Italian authorities contributed intelligence concerning suspected mafia relationships. Spanish investigators developed evidence concerning businesses, trafficking and local activity.

Eurojust hosted coordination meetings and supported the judicial arrangements required for a simultaneous action. Europol provided analytical support, secure information exchange and a mobile office during the operational phase.

This cooperation prevented the network from being viewed as separate domestic cases. The alleged activity in Milan, Calabria, Ibiza and South America formed parts of the same international threat.

Cross-border coordination also reduces the opportunity for suspects to exploit differences in evidence, timing and legal procedure between jurisdictions.

The continuing ’Ndrangheta exposure in Spain

The 2022 arrests did not end the wider risk.

In August 2025, Spanish police and Italy’s Carabinieri arrested three separate ’Ndrangheta-linked fugitives in Ibiza under European Arrest Warrants. Searches in Ibiza and Barcelona recovered cash, high-value jewellery, false identity documents, drugs and records allegedly connected with narcotics activity.

That operation was not presented as a continuation of the 2022 case and should not be conflated with it.

It does, however, demonstrate why Spanish authorities continue to monitor possible ’Ndrangheta implantation within the country’s economic and social structures.

Criminal organisations are resilient. Arrested personnel can be replaced, businesses transferred and trafficking routes adjusted. Sustainable disruption therefore requires asset recovery, prosecution of facilitators and continued monitoring after the initial action day.

What this means for financial crime leaders

The Spanish case demonstrates that organised crime cannot be understood through narcotics transactions alone.

Drug trafficking provides the proceeds, but businesses, property, vessels, intermediaries and coercion allow the organisation to preserve and expand its power.

Financial crime leaders should ask whether their institutions can identify when several individually plausible customers form part of one connected network.

They should also examine whether real-estate and tourism-related activity receives scrutiny proportionate to ownership opacity, cash exposure and unexplained cross-border flows.

The strongest control environments will distinguish legitimate international business from criminal infiltration without using nationality, location or industry as substitutes for evidence.

The ’Ndrangheta’s principal advantage is not secrecy alone. It is the ability to combine trusted relationships, global criminal partnerships and legitimate economic structures.

Effective financial-crime defence reverses that process—connecting the property to the company, the company to its controllers, the controllers to the transactions and the transactions to the underlying criminal activity.

What Financial Institutions Should Consider

• Strengthen Organised Crime Risk Assessments
• Apply Enhanced Due Diligence to Higher-Risk Real Estate Activity
• Monitor Unexplained Property Investment
• Strengthen Source-of-Wealth and Source-of-Funds Verification
• Identify Links to Known Organised Crime Networks
• Monitor High-Risk Cross-Border Payment Corridors
• Detect Cash-Intensive and Pass-Through Activity
• Strengthen Beneficial Ownership Analysis
• Review Complex Corporate Structures Used for Property Acquisition
• Apply Network Analytics Across Customers and Counterparties
• Integrate Drug-Trafficking Typologies Into AML Monitoring
• Conduct Retrospective Reviews Following Major Law Enforcement Actions
• Monitor Transactions Involving High-Risk Associates and Intermediaries
• Strengthen Adverse Media and Law Enforcement Intelligence Integration
• Identify Rapid Movement or Conversion of Criminal Proceeds
• Coordinate AML, Fraud and Financial Intelligence Functions
• Support Asset-Tracing and Confiscation Processes
• Treat Real Estate Investment as a Potential Integration Mechanism for Criminal Proceeds

Download the briefing

Spain’s ‘Ndrangheta-Linked Crime Networks: Economic Infiltration and Trafficking Logistics