When Mexican security forces killed a drug kingpin, the nationwide aftermath was immediate and violent. But for compliance professionals around the world, the bigger question is what happens to the billions in illicit funds that CJNG generated, moved and concealed under El Mencho’s leadership. VinciWorks compliance manager Naomi Grossman examines why the cartel’s money-laundering infrastructure doesn’t just disappear when the leader is eliminated and looks at what compliance teams should do now as the cartel’s financial network restructures.
When Mexican security forces killed Nemesio “El Mencho” Oseguera Cervantes on Feb. 22, in Tapalpa, Jalisco, the nationwide aftermath was immediate and violent, and when the dust settled, dozens of people, along with the drug kingpin, were dead. As the longtime head of the Cártel de Jalisco Nueva Generación (CJNG), Oseguera had built one of the most aggressive and globally connected trafficking networks in the Americas.
Within hours of his death, armed groups erected roadblocks, set vehicles and commercial properties ablaze and paralyzed transport in multiple states across Mexico. Banks were torched in Jalisco. Flights were disrupted. Schools closed. Hotels were told to keep guests inside.
The global coverage was dramatic to say the least.
But for compliance professionals, there is another aspect to this event: what happens to the billions in illicit funds that the cartel generated, moved and concealed under El Mencho?
What CJNG built and how it moved money
Under Oseguera’s leadership, CJNG evolved from a regional criminal group into a diversified enterprise generating billions in revenue from cocaine, methamphetamine and fentanyl trafficking into the US. It expanded into fuel theft, migrant smuggling and financial fraud. It embedded itself across over 20 Mexican states and forged links deep into supply and transit routes in Colombia and Ecuador. That kind of scale requires a sophisticated money-laundering infrastructure.
How do cartels of this size recycle their cash? They create shell companies. They acquire real estate through layered corporate vehicles. They disguise cash movement through structured trade transactions. Their funds will cross borders in ways designed to appear commercially routine. Lawyers, accountants and even company formation agents could unwittingly (or wittingly) become involved at different points in the process.
That infrastructure does not disappear when the cartel head is eliminated. It continues to function and could even accelerate illegal financial activity.
Financial risk intensifies
One thing that happens is that senior surviving figures in the cartel want to secure their personal funds before assets might be frozen. Also, factions start competing for control and attempt to consolidate revenue streams. Splinter groups may divert funds into new ventures. Some analysts think that CJNG faces a contested succession, mostly because so many of the family members are in jail and a clear heir does not appear to have been designated. This could further intensify the jockeying for financial position.
Long-dormant entities may suddenly become active. Ownership structures may be rearranged. The funds will still need to move. The question for compliance teams is whether their controls are positioned to detect the change in pattern.
The sanctions dimension financial institutions cannot ignore
In 2025, the US government designated CJNG, and more than a half-dozen others, as a foreign terrorist organization (FTO). That classification substantially increases the legal exposure for any institution that might, even inadvertently, facilitate the movement of funds connected to the cartel or its associates.
The material support prohibition that accompanies an FTO designation is broad. It extends beyond direct financial transfers to services, personnel and resources that benefit the organization. Compliance teams should factor that into their approach when reviewing Mexico-linked counterparties, particularly where beneficial ownership structures are complex or opaque.
US-Mexico security cooperation has grown, and enforcement attention will not diminish in the aftermath of El Mencho’s death. Prosecutors and regulators will be closely monitoring what happens to CJNG’s financial networks. Institutions that can demonstrate robust due diligence processes will be in a stronger position if questions arise.
The specific risks for financial institutions
Financial institutions handling cross-border transactions with any Mexican or Latin American nexus should be reviewing their risk frameworks. The concern is not primarily about obviously criminal transactions but rather structures designed to look ordinary.
Compliance teams should be alert to unusual patterns in wire transfers involving Mexican entities for which establishing the ultimate beneficial owner is difficult. Increased activity through correspondent banking relationships that touch Central American or Caribbean jurisdictions warrants scrutiny. Real estate transactions structured through multiple corporate layers, particularly all-cash purchases, require enhanced review. Trade finance professionals should examine invoice integrity carefully and flag shipment patterns that do not align with the stated commercial relationship.
There is also a geographic dimension. Funds may be shifted toward jurisdictions where enforcement capacity is perceived as lower or where political relationships with US authorities are less developed. Risk ratings for certain jurisdictions should be reviewed for currency.
Beneficial ownership data sits at the center of all of this. Much of what makes cartel-connected financial flows difficult to detect is the deliberate obscuring of who ultimately controls the assets. Surface-level customer due diligence is insufficient. Institutions need to understand the full ownership chain and have processes in place to detect when that chain is being rearranged.
What should compliance teams do now?
The risk here is real. And, as compliance leaders are well aware, all of this activity can appear, at least on the surface, entirely legitimate.
Risk assessments connected to Mexico and CJNG-adjacent jurisdictions should be reviewed and updated. Beneficial ownership information should be verified, not simply held on file. Accounts or entities flagged for high-risk geographic exposure should be subject to enhanced due diligence as standard.
Internal escalation processes matter, too. Frontline staff need to understand what suspicious activity looks like in this context and be confident that reporting it internally will be met with seriousness. Board-level briefings on geographic and sanctions exposure are worth scheduling for institutions with meaningful Latin American business.
It is tempting to view this recent spate of cartel violence as a security issue that’s not relevant to your company located in another country. But the financial network is transnational. CJNG’s network touched supply chains, markets and financial systems everywhere from South America to North America and beyond. Its destabilization won’t occur in isolation. It will echo through the many channels the cartel used to move its money.
Ultimately, El Mencho’s death could weaken CJNG. Or it may trigger additional targeted operations by Mexican authorities. But criminal organizations don’t just vanish after a single operation that eliminates one individual. Likely, the cartel will try to adapt and restructure.
While the public watches the cars burn, compliance teams should be watching the money flow.
Naomi Grossman is a compliance manager at VinciWorks, a provider of online compliance training and risk management software. 
