For scammers and fraudsters, the initial crime is just the beginning, as part of a criminal network operating at scale, they have large sums of illegally acquired funds they need to launder into the financial system if they want to truly profit from their enterprise. The most often attempt to cover up the criminal origins of their money with complicated sequences of subsequent transactions, this is known as layering in money laundering.

In this post, we describe how layering in money laundering works, and how anti-money laundering (AML) technology can help financial institutions (FIs) identify these transactions sooner.

What is layering in money laundering?

Layering in money laundering can be the process of making multiple transactions, in order to hide a criminal’s tracks. Layering therefore, obscures the origins of illegally obtained money or other assets.

Money launders often use complex transactions — through multiple financial products and or companies (sometimes in different regulatory markets) — to make it harder for investigators to peel back those layers. With enough layers, they hope, their funds will become fully integrated and nearly impossible to connect the funds with past crimes.

The three phases of money laundering

The end goal of money laundering is to turn the proceeds of criminal activity into assets that appear legitimate and can used without suspicions. It usually includes some or all of the following phases.

Placement: Placing finds into legitimate businesses through businesses with high cash volumes, false/dummy invoicing, trusts or offshore companies, foreign bank accounts, aborted transactions or even smurfing: loading small amounts of money (below AML reporting thresholds) to bank account and credit cards and using them to pay expenses.

Integration / Extraction: The final stage, where money that has been laundered is then used without attracting attention from law enforcement, tax authorities, or AML teams. It often involves paying ‘legitimate’ expenses such as taxes, and criminal networks expect up to a 50% ‘shrinkage’ in the wash of their final funds. Fake employees, fake loans to directors or shareholders, or dividends paid to shareholders at companies under the control of the criminal network are common tactics for extracting the funds.

Layering: The repeated use of placement and integration and extraction techniques over time to make investigations as challenging as possible for AML and law enforcement. The transactions will be made at varying values over time to add more complexity to identifying money laundering.

Layering is the phase where FIs can apply new machine learning technologies to outsmart the criminals.

How does layering work?

Layering involves a variety of schemes, all intended to hide the money’s illegal origins, which is commonly fraud or scams. Money launderers often do this by moving money through several accounts or transfers or by converting money into assets such as real estate, gold, cryptocurrencies, prepaid cards, jewelry, art, or casino chips. Additionally, money can be moved overseas or into shell companies to create new layering complexities. Layering is a combination of placement, integration, and extraction.

Diversity is key here; below are historic examples of what this would look like:

  • Funds can be taken to a casino, exchanged for chips, then the chips later exchanged for a check.
  • Funds can be used to buy bitcoin, then used to buy gift cards.
  • Funds can get used to buy pawn shop jewelry.
  • Funds can be wired to an offshore company, which then wires that money to new, and or different intermediaries.

The more assets the funds pass through, the more intermediaries and the more international borders it can cross, the harder it becomes to connect that money to the crimes through which it was acquired.

A typical example of layering in money laundering

Here is what a common layering scheme might look like:

Imagine a criminal enterprise has stolen $1 million and was able to deposit it into an offshore account.

Over time, members of that organisation will facilitate small wires from that account. The withdrawals are always small so that AML systems are unlikely to flag them, or so the criminals hope.

Those transactions are then sent via wire transfer to yet another offshore account potentially through money mules. When the account reaches $500,000, those funds are used to buy real estate. When the next $500,000 accumulates, it gets used to buy an art collection.

At this point, the original $1 million that was stolen has crossed three international borders and been turned into a variety of assets such as a house and valuable collectables like art.

In all likelihood, the criminals will layer further — e.g., selling the art to buy cryptocurrencies — to blur the money trail further.

Layering stage of money laundering

Money laundering typically happens across three ‘workstreams’. Not all these stages need to be present to be considered layering, and it usually presents with activity occurring concurrently across all three.

  • Placement, when criminals put (place) their illegal funds into the financial system, instruments products etc.
  • Layering, when criminals typically use complex transactions and flows to hide their illicit tracks.
  • Integration, when criminals finish moving their laundered funds around the financial system. Establishing a perceived ‘legitimate origin’ of the illicit funds for their use with very little chance of detection or clawback.

By the time a laundering operation reaches the Integration stage, the money is no longer being tumbled through complex transactions. That money is being used for actual expenses and investments.

This is an explanation of the basics of layering, but there are other layering patterns we may see with regard specific typologies such as terrorist financing where the money laundering does not originate with fraud, it is more linear in nature. For example, a person may use legitimate income to fund terrorist activity. This shows how challenging it is to detect money laundering across its varying typologies.

Layering: How do financial institutions fight money laundering?

The AML process mirrors the three ‘workstreams’ of money laundering outlined above. It looks for instances of placement, investigates layering activities and flags integrated funds when there’s suspicion about the funds’ origins.

Integration is the most difficult point for FIs to identify money laundering, but there are a few points where financial institutions have an advantage over money launderers:

  • The layering stage is a vulnerable moment for financial criminals. An effective AML program will have know-your-customer (KYC) checks and enhanced due diligence protocols, both of which act as tall hurdles for criminals when trying to reintroduce illegal money to the financial system.
  • The layering stage is also ripe for investigation. Machine learning can sort through a staggering number of transactions and even spot connections that human investigators cannot. Sometimes, the creativity of a money launderer is simply no match for the processing power of some machine learning-powered AML programs.
  • In recent years, the fraud and the AML teams inside of financial institutions have been collaborating and sharing data. This is a strategy known as FRAML, and it has given financial institutions new perspectives on financial crime.

Our AML solution

Data is the key to unraveling money laundering. Machine learning is particularly effective at peeling back the layers of financial crime.

Our AML solution, ARIC™ Risk Hub, uses machine learning to profile both the good and bad behaviors of individual banking customers. The model quickly learns which behaviors are genuine and which behaviors are suspicious allowing a first response enabling investigators to spot possible criminal activity quicker and cause as little disruption to genuine customers as possible. ARIC Risk Hub is uniquely skilled in understanding how genuine behaviors change over time for individual customer profiles, leveraging proprietary adaptive machine learning and deep learning technologies, Adaptive Behavioral Analytics and Automated Deep Behavioral Networks.

With this capability, ARIC Risk Hub can:

  • Monitor transactions effectively, efficiently and at scale.
  • Reduce false positives and prioritise alerts when a customer’s behavior indicates potential money laundering activity.
  • Reveal unknown threats by finding novel, unexpected connections in the data.


Learn more 

Watch this video with the United Nations, Fiserv, and Featurespace, discussing worldwide initiatives to rid the world of financial crime.

When you’re ready to take the next step, have a look at our AML solutions, or request a demo today.