As long as they collect their money from the victims, they can't be too hard to pin down. Sounds more like a bureaucracy issue, falling between the responsibility boundaries of different agencies.

The problem is with how user acquisition is done on the shady side of the industry.

At the top, there's a lender. In this story, the lender is Yellowstone. The lender actually gives money to the customer.

A lender like Yellowstone has 200+ brokers they work with. The brokers are independent companies - "Business Lending LLC" or some generic name.

The brokers do whatever they can to find customers interested in a loan. They package that customers info into a loan application, and send it to Yellowstone. Yellowstone then decides to fund it or not. If they do, the rest of the contact is between Yellowstone and the small business borrower.

How does the borrower know which broker they worked with? Fax letterhead? Fake generic business name. Email of the rep they worked with? Possibly some random gmail. Etc. They get super unlucky and get fined? Declare bankruptcy, make a new company called "Business Lending 2 LLC".

It's not impossible to catch these guys, but it is hard enough to enforce that no current agency is especially interested.

I still assume there are wire transfers of money involved, even if its between the enterprises. The whole point of this activity is criminal profit. There is absolutely no way to anonymously cash out that in 2018 unless transferring out to offshore havens. And often even then, if the US govt throws its weight.