Layering

What Is Layering?

Layering is the second of the three classic stages of money laundering. After criminal proceeds have entered the financial system through placement, layering separates the money from its source by moving it through a series of transactions, accounts, entities and jurisdictions. The aim is to create so much distance and complexity between the original crime and the funds that investigators cannot easily follow the trail. The final stage, integration, returns the funds to the criminal in a form that appears legitimate.

The three-stage model is a simplification. Real schemes often overlap the stages or skip one, and in some cases, such as fraud proceeds that already sit in a bank account, laundering begins directly with layering. Even so, the model is useful because layering is the stage where financial institutions see the most activity and have the best chance of detecting it.

Why Layering Matters

Layering is where laundering becomes visible as a pattern of transactions rather than a single event. That makes it the main target of transaction monitoring and investigation work.

It matters to firms because:

• Layering transactions pass through ordinary products, such as current accounts, payment accounts, card accounts, securities accounts and crypto wallets, so almost any firm can be used.
• Each institution sees only part of the chain, so a firm may be processing layering activity without realizing it.
• Failure to detect layering exposes a firm to regulatory action, reputational damage and, in some jurisdictions, criminal liability for facilitating money laundering.

Common Layering Techniques

Rapid Movement Between Accounts

Funds are moved quickly between accounts at the same or different institutions, often in amounts that change slightly each time. Networks of money mules are frequently used so that each account holds the money only briefly.

Cross-Border Transfers

Money is wired through several countries, sometimes through jurisdictions with limited cooperation or weak AML controls. Each border adds legal and practical barriers for investigators. See cross-border transactions.

Corporate Structures

Shell companies and front companies are used to make payments look like business activity. Funds move between related companies under the cover of loans, consultancy fees or intercompany invoices. Ownership is often hidden behind nominee directors or complex structures.

Trade Transactions

Payments for goods or services that are overvalued, undervalued or never delivered allow value to move under the appearance of trade. This overlaps with trade-based money laundering.

Asset Conversion

Funds are converted into other assets and back again: securities, insurance products with early surrender, high-value goods, real estate, or virtual assets. Each conversion adds a layer.

Virtual Assets

Crypto-assets can be moved across many addresses, exchanged between different tokens, sent through mixing services or bridged between blockchains. Blockchain analytics can trace many of these flows, but the speed and volume of transactions make layering through virtual assets attractive to criminals.

Red Flags

• Funds that arrive and leave an account within a short period, with little remaining balance
• Transactions with no clear economic purpose, or a purpose inconsistent with the customer's profile
• Circular flows in which money returns to its origin after passing through several parties
• Payments between companies that share directors, addresses or agents
• Frequent changes of currency, asset type or jurisdiction without commercial reason
• Large incoming payments followed by many smaller outgoing payments, or the reverse
• Loans between related parties that are never repaid, or repaid immediately
• Customers who seem uninterested in fees, exchange rates or investment returns

Regulatory Expectations

Regulators do not use a separate rule for layering, but the controls they require are designed to catch it:

• FATF Recommendation 10 requires ongoing due diligence and scrutiny of transactions to ensure they are consistent with the institution's knowledge of the customer.
• FATF Recommendation 20 requires financial institutions to report promptly to the financial intelligence unit when they suspect, or have reasonable grounds to suspect, that funds are the proceeds of crime.
• EU: Directive (EU) 2015/849 and the AML Regulation (EU) 2024/1624 require ongoing monitoring and the examination of complex or unusually large transactions and unusual patterns that have no apparent economic or lawful purpose.
• UK: the Money Laundering Regulations 2017 require ongoing monitoring of business relationships, and the Proceeds of Crime Act 2002 sets out suspicious activity reporting obligations.
• US: the Bank Secrecy Act requires suspicious activity reporting, and FinCEN rules require ongoing customer due diligence.

Detection Best Practices

• Monitor velocity and pass-through behavior, not only transaction size.
• Link related accounts and entities, using shared identifiers, addresses, devices and directors, so that a network can be seen as a whole.
• Screen counterparties and their owners, since layering often involves companies with hidden ownership.
• Investigate the full chain where possible, including inbound and outbound counterparties.
• Report suspicions through a suspicious activity report and avoid tipping off the customer.

How on8.ai Helps

Layering often depends on companies whose real owners are hidden. SmartSanction provides an ownership and relationship graph for KYB, applies the OFAC 50 Percent Rule and screens people, companies, crypto wallets and addresses against more than 520 list and registry sources, with the reasoning behind each match. This helps investigators see which counterparties in a chain carry sanctions, PEP or other risk.

Related Terms

• Placement
• Integration
• Money Mule
• Shell Company
• Transaction Monitoring System (TMS)
• Smurfing