Layering stage of money laundering: what it is and how to prevent it
- azakaw
- Oct 12
- 14 min read
Updated: Nov 14
What is the layering stage of money laundering? How does it work?
In layering, criminals make a series of transactions designed to hide the money’s origin, create confusion, and make tracing very difficult.
In this article, we will dive deeper into the meaning of the layering phase of money laundering, what it entails, and how it differs from placement and integration.
We will also cover the techniques used, how institutions and worldwide regulators detect and prevent it (and the challenges they face), and how Anti-Money Laundering (AML) efforts could evolve in a digital world.
Key Takeaways about Layering in Money Laundering |
|
|
|
|
|
What is layering in money laundering terms?
Layering, also occasionally called “structuring”, is the second stage in the money laundering process: the one through which illegal funds are moved by bad actors in a web of financial transactions.
How does layering work in money laundering?
In more formal terms, layering involves splitting, transferring, converting, and restructuring money through multiple intermediaries and jurisdictions to sever the link to the original crime.
Criminals’ goal is to turn “dirty” money into several transactions that look legitimate.
It’s important to clarify that layering involves disguising and redirecting funds to hide their illicit origin.
Some transactions in layering can be completely legal when isolated, but when put together with the rest of them, they serve the purpose of money laundering.
The importance of the layering phase in the money laundering process
The layering stage plays an important role in the money laundering scheme, as it is the stage at which there are the greatest efforts to avoid detection.
The existing regulations around AML and/or law enforcement audits can trace the money back to its illegal sources.
Layering requires creativity and knowledge around jurisdictional and financial engineering, making it not only a complex stage but also the key one in the bad actors’ money laundering process.
Layering is fundamentally about deception; it makes life harder for those trying to uncover it.
This stage puts a lot of pressure on detection systems such as AML Transaction Monitoring, due diligence, and reporting suspicious activity, and increases the difficulty of the AML compliance process for both financial institutions and non-financial ones.
What is the difference between Layering, Placement, and Integration?
Let’s observe the differences between the different stages of money laundering: placement, layering, and integration:
Placement is the entry stage: bad actors deposit, wire in, or physically place illicit cash into bank accounts or financial institutions. This is possibly the riskiest stage, because large cash flows can be easily flagged.
Layering is the disguising stage: as soon as the illicit funds are in the system, they are separated from where they came from through multiple layers: transactions, conversions, transfers, and jurisdictional moves.
Integration is the legitimisation stage: the laundered funds re-enter the economy in ways that seem legitimate - for example, via the real estate business, luxury items, multiple sorts of investment, etc. - so that they can be used without raising suspicion.
Often, the transition between layering and integration is blurred: late layering transactions may already begin to approximate integration.
But conceptually, layering is focused on disguise and obfuscation, whereas integration is focused on usability and assimilation.
It’s a fine line between layering and integration, meaning both stages can eventually become intertwined.
Transactions made late in the layering stage can already start to resemble integration. However, conceptually, criminals in the integration stage are more concerned with assimilation, while layering is more concerned with disguise.
What are the techniques of layering in money laundering?
If you want to know how layering works in money laundering, it's important to know and understand the most common layering techniques:
complex financial transactions and obscuration,
shell companies, nominee structures, and offshore jurisdictions,
designated Non-Financial Businesses and Professions (DNFBPs),
cash-intensive businesses,
digital currencies and virtual asset platforms
etc
Complex financial transactions and obscuration
Criminals often do several things to generate complexity and create some chaos, such as:
several inter-account transfers,
foreign exchange conversions,
quick transactions (like wiring in money),
internal account automated transfers,
reinvestment into financial instruments, such as securities (e.g., stocks) or derivatives (e.g, stock options, whose value is based on the price of the underlying stock)
Even small fluctuations, cross-currency changes, or short holding intervals can contribute to a difficult tracing.
“Smurfing” is a common sub-technique within layering.
Shell companies, nominee structures, and offshore jurisdictions
One of the most common layering strategies is using shell companies and nominee directors or shareholders in secrecy jurisdictions (tax havens).
The Ultimate Beneficial Owner (UBO) in these cases is hidden behind multiple layers of corporate entities to obscure both the control of the company and the source of the funds.
Criminals prefer offshore jurisdictions with strict privacy laws or loose disclosure regulations to act on this layering strategy.
They wire money around several shell entities across different countries, making each one of them appear legitimate (e.g., payments for services, loans, dividends, etc.), though in reality they are a sham.
The layering may incorporate phantom invoices, fake receivables, or intra-group payments.
Designated Non-Financial Businesses and Professions (DNFBPs)
Designated Non-Financial Businesses and Professions (DNFBPs), such as real estate agents, lawyers, accountants, casino owners, dealers of precious metals, and art dealers, among others, can act as conduits for the layering stage.
Real estate deals can be set up into the layering phase, as criminals can buy property at inflated or deflated prices without the real estate agent knowing their true intentions.
Bad actors can use illicit cash in casinos or gambling operations, and then route it back via chips, cash winnings, or conversions.
Lawyers or accountants can help as well, for example, through advisory fees and trust structures, masking money laundering flows.
Cash-intensive businesses
Feeding illicit cash into cash-intensive legitimate businesses, such as restaurants, retail stores, bars, and convenience stores, among others, is another common technique.
The money launderer wires out "cleaned" funds after overstating revenue and depositing mixed funds. The cash receipts eventually find their way into the company's registered operations.
It can be very challenging to identify illegal additions because there are usually large amounts of physical cash involved in many cash businesses.
Trade-Based Money Laundering (TBML)
Over-invoicing or under-invoicing goods and/or services, executing phantom shipments, and manipulating quantities or quality of goods are also common layering techniques.
The idea is to disguise the real value of the transfers through legitimate trade flows. Because global trade involves massive volumes, individual suspicious shipments can go unnoticed.
TBML is often combined with shell firms and offshore accounts to obscure the trail even further.
Digital currencies and virtual asset platforms
In the modern era, layering increasingly involves cryptocurrencies, mixers, tumbler services, decentralized finance (DeFi), atomic swaps, and cross-chain bridges.
Criminals convert illicit fiat to crypto, shuffle across wallets, use mixing services, convert to stablecoins, or route through privacy coins. Each conversion, wallet hop, or swap adds another layer of complexity.
This is especially attractive in jurisdictions with weak regulation for virtual asset service providers (VASPs).
Other techniques
Other layering strategies might include:
Loanback schemes: the laundered funds are lent back to the originator (via a shell company) as a loan, with interest payments.
Insurance policies: purchasing life or other policies, allowing them to mature or surrender, with payouts that appear legitimate.
Art, collectibles, and high-value goods: buying and reselling with shifting ownership, authentication stories, and cross-border transfers.
How to identify layering activities
Red flags for financial institutions and/or banks
Financial institutions such as banks should be alert for AML red flags that can indicate layering, for example:
Unusual and/or frequent transfers among several accounts with no clear business rationale.
Certain wiring patterns (for example, funds flowing to an account, then immediately being sent to another jurisdiction).
Transfers just below the regulatory reporting thresholds (structuring).
Inconsistent or suspicious documentation accompanying funds (for example, invoices or contracts that seem made up).
Involvement of shell companies or entities in high-risk jurisdictions with limited to no transparency.
Funds moving quickly in and out of accounts (for example, “sweeping” accounts) with little business logic (or none).
Use of multiple currencies or currency exchanges, especially involving less stable currencies.
Crypto withdrawals/deposits with sudden spikes.
Unexpected connections between accounts (for example, different accounts showing the same beneficial owner or address).
Sudden activity in accounts that usually have little to no activity.
The importance of AML Transaction Monitoring and due diligence
AML Transaction Monitoring systems are usually made to detect anomalies, unusual patterns, or behaviour that is inconsistent with a certain customer’s profile.
Ongoing Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD) are common AML processes that help update risk profiles and spot discrepancies.
Screening against sanctions lists, Politically Exposed Persons (PEPs), negative descriptions of certain actors in national or international media, and beneficial ownership data help identify suspicious individuals or entities.
Compliance officers should also conduct frequent reviews, ideally with a determined cadence, of account activity and flag moments or transactions that indicate the issue should be escalated (escalation thresholds).
Suspicious Activity Reports (SARs) must be filed when layering signals exceed thresholds.
Case studies of layering detection
The NatWest bank accepted £365 million in cash deposits over several years from a single customer, and it didn’t properly escalate the situation. In the end, the bank was heavily fined for not being able to detect the red flags that led to this.
The DELATOR framework uses graph neural networks over transaction graphs to detect money laundering flows hidden in vast transaction networks with better accuracy.
The study “Catch Me If You Can” employed semi-supervised graph learning for spotting money laundering nodes in transaction graphs.
These technological advances show how graph analytics and machine learning are increasingly becoming key tools for spotting layering.
The role of technology in detection
AML software and tools
Modern AML solutions like azakaw integrate multiple modules: real-time AML Transaction Monitoring, digital KYC solutions, alert management, customer risk scoring, sanctions/PEP screening, beneficial ownership registry checks, adverse media screening, and case management workflows, among several others.
These modules help companies to detect and prevent money laundering, including in the layering stage.
The benefits of AI and machine learning in AML
Pattern recognition: money laundering models can detect transaction patterns that aren't obvious to the human eye, subtle behavioural shifts, and suspicious flows.
Adaptive learning: algorithms evolve based on feedback from users and adjust to new money laundering techniques.
Scalability: AI makes it possible to analyse massive volumes of transactional data in an amount of time that wouldn’t be possible if done by a human, not to mention the elimination of human error.
Graph embeddings and neural networks: this is used by models like DELATOR to learn node features and flag suspicious accounts.
Semi-supervised models: techniques like those mentioned in “Catch Me If You Can” show how a small labeled set can detect red flags in large unlabeled datasets.
The challenges of adapting to evolving techniques
Adversarial adaptation: criminals constantly improve their methods as well, in this case to evade AI detection (for example, they keep up with what’s considered “normal behaviour” and mimic it).
False positives/alert fatigue: there are overly sensitive models that might generate false alarms, which will then increase operational burden.
Data quality and access: some situations might restrict analysis, such as incomplete or siloed data, privacy rules, and limited cross-institution visibility, among others.
Compliance: usually, regulators ask for a clear justification for decisions, which means that “black box” AI models (systems where the internal decision-making processes are hidden and not understandable to the user) may complicate audits.
Cross-jurisdictional data sharing limitations: tools lose value if and when national boundaries block linking transactions in different countries.
How to prevent layering in money laundering
There are several ways to prevent the layering phase of money laundering.
Our team has several practical tips for financial institutions. It also advises to collaborate with authorities, follow, and adopt regulatory frameworks and AML compliance programs.
Best practices for financial institutions
These are some ways to prevent money laundering, such as
Implementing a risk-based approach, focusing resources on high-risk customers and jurisdictions.
Executing a customer segmentation and profiling, with ongoing updating of risk scores, usually based on behaviour and external data.
Enforcing strict Know Your Customer (KYC) and “Know Your Beneficial Owner” rules from the onboarding moment onward.
Maintaining a robust and comprehensive AML Transaction Monitoring and alert escalation protocols.
Conducting regular independent audits of the AML control framework.
Providing ongoing training and awareness for employees in the frontline, in operations, and in compliance, so they can recognise layering red flags and escalate them appropriately.
Designing document verification and source-of-funds checks, especially for borderline or high-risk transactions.
Read also: The importance of KYC in banking
Collaboration with authorities
Filing Suspicious Activity Reports (SARs) or Suspicious Transaction Reports (STRs) to the relevant Financial Intelligence Unit (FIU).
Cooperating in investigations, sharing relevant intelligence (within legal bounds, of course), and responding to law enforcement requests.
Engaging in Public-Private Partnerships (PPP) where regulators, banks, and enforcement agencies share typologies, red-flag indicators, and data that was made anonymous, all of this to improve detection.
Participating in joint task forces or industry forums to exchange best practices.
Regulatory frameworks and AML compliance obligations
Global AML standards are based on the Financial Action Task Force (FATF) Recommendations, which include obligations for:
CDD (Recommendation 10),
PEPs (Recommendation 12),
beneficial ownership,
guidance on DNFBPs.
Some national AML laws (for example, across countries in the EU under AMLD, the EU’s AML directives) build on these recommendations and require entities to report red flags, keep records of them, and complete certain compliance programmes.
Compliance with KYC, AML Transaction Monitoring, sanctions screening, beneficial ownership registers, and record retention are all pillars in preventing layering, as well as the rest of the money laundering stages.
In many jurisdictions, not complying with these recommendations leads to fines, damage to reputation, sanctions, or even criminal liability for institutions and officers.
In the future, more strict rules around the regulation of virtual assets/Virtual Asset Service Providers (VASP), cross-border data sharing, and real-time AML Transaction Monitoring may strengthen the defenses against layering in the field of digital finance.
Read also: UAE money laundering charges and penalties
Challenges in combating layering techniques
The two biggest challenges in combating layering techniques in money laundering are the new evolving methods and the resource limitations for law enforcement.
Evolving methods of money laundering
Criminals constantly adapt new methods to clean dirty money, some examples:
using new jurisdictions
mixing services
executing encrypted transactions
taking advantage of peer-to-peer systems
layering across traditional finance and cryptos simultaneously,
etc
They keep up with conventional AML controls as they become more robust, and thus have an incentive to migrate to less supervised domains.
International cooperation is very important here: many layering operations span multiple countries, jurisdictions, and regulatory regimes, which demand seamless cross-border exchange of financial intelligence and mutual legal assistance.
Resource limitations for law enforcement
Law enforcement and FIUs often face constraints, namely:
Limited budgets and technical capacities to analyse large volumes of data.
Jurisdictional fragmentation, delays in legal cooperation, and conflicts of law limit investigation capacity.
Accessing and interpreting complex financial instruments or offshore structures is resource-intensive.
The need for continual upskilling to tackle new technologies (blockchains and AI, for instance).
Backlogs and prioritisation often focus on predicate crimes (underlying criminal acts that serve as the foundation for money laundering schemes) rather than pure layering investigations.
Factors like public awareness, whistleblowers, and external reporting can help alleviate these limitations.
Examples of layering in money laundering
Russian Laundromat: between 2010 and 2014, an estimated $20–80 billion was laundered through a network of more than 500 shell companies, several banks in Moldova and Latvia, complex intercompany loans, and payments to disguise funds.
Troika Laundromat: this was a $4.8 billion scheme involving Russian entities, shell companies, and secret bank flows between Europe and Russia, from 2003 to 2013.
Danske Bank scandal: between 2007 and 2015, nonresident accounts in the Estonian branch processed massive suspicious flows, many of them related to multiple transfers through shell companies.
Trade-based example: a criminal network might fraudulently invoice goods imports to themselves and overpay, sending the excess amount to bank accounts abroad belonging to shell companies.
Art or luxury goods: someone could buy a piece of art using illegal funds through an offshore entity. They can then resell it in a gallery or in another way, passing the profit through other accounts.
The future of AML efforts
Innovations in detection and prevention
Enabling immediate flagging as transactions are made.
Using RegTech and FinTech for compliance, such as identity verification and screening.
Tracing transaction flows, clustering wallet addresses, and linking across chains.
Using a more nuanced detection, for example, through graph neural networks and AI, of subtle layering flows in big transaction networks.
Enabling digital identity and reducing onboarding friction (for example, via decentralised KYC) while maintaining security.
Cross-border AML data sharing platforms, so that FIUs and financial institutions can exchange patterns and red flags.
Financial systems are becoming more interconnected and digital, leading to layering techniques evolving in adjustment to that, which means that AML strategies must keep evolving as well.
Related content: Crypto KYC requirements
Role of public awareness and education
Layering is a specialised domain, meaning that raising awareness among professionals and the general public helps create a culture that is intolerant of financial crime.
When lawyers, accountants, real estate agents, and art dealers, among others, understand the risks of this stage of money laundering, they are more likely to flag suspicious transactions and adopt adequate compliance measures.
Other factors, like public reporting hotlines, media coverage of laundering scandals, and educational campaigns, also help to deter laundering facilitators and encourage ethical behaviour.
Everyone needs to keep informed, as informed citizens can pressure institutions and regulators to sustain strong AML standards and close loopholes that criminals exploit.
FAQs
Which method is commonly used during the layering stage of money laundering?
The most common method used during the layering stage is the utilisation of shell companies, followed by complex wire transfers across multiple bank accounts and jurisdictions.
Bad actors frequently set up networks of corporate entities, usually in offshore tax havens or countries where transparency is limited or even non-existent, to move funds, making them seem like they're legitimate business transactions.
Each transfer adds another “layer” between the money and its illicit origin.
What happens in the layering stage of the money laundering process?
During the layering stage, illicit funds that have already entered the financial system (in the placement stage) are moved and disguised through some transactions.
The objective is to distance the money as much as possible from its illegal origin and make it nearly impossible for authorities to trace the funds back to the initial crime. This can involve:
Transferring funds between multiple accounts, often in different countries or currencies.
Using offshore companies, trusts, and intermediaries to hide ownership.
Converting funds into financial instruments like securities, derivatives, crypto assets, etc..
Exchanging cash for assets (for example, gold, real estate, art, among others) that can later be resold.
By the end of the layering stage, the funds have changed form and location many times, making it look as though they originated from legitimate activity.
What are examples of layering techniques in money laundering?
Wire transfers through multiple banks and countries, using shell companies and nominee accounts, Trade-Based Money Laundering (TBML), crypto layering, loanback arrangements, and investment in financial instruments are some of the most common layering techniques.
Each of these techniques is complex and misleading, which are the two defining characteristics of the layering stage.
How can financial institutions detect layering activities?
Financial institutions can detect layering activities through data analysis, human judgment, and sturdy AML programs.
Monitoring for rapid movement of funds through accounts or across borders, identifying transactions that lack a clear economic purpose or involve unusual counterparties, and using AI-driven analytics to detect complex transaction patterns that traditional rule-based systems might miss are some of the key detection practices.
Financial institutions that combine technology with well-trained compliance teams are way better positioned to detect layering attempts early and prevent funds from moving further into the laundering process.
Why is the layering stage so difficult to detect and investigate?
The layering stage is difficult to uncover because it is intentionally designed to create confusion for those who investigate this kind of crime.
Bad actors confuse investigators by:
Executing large numbers of transactions quickly overwhelms monitoring systems.
Engaging in cross-border transfers means investigators must coordinate with multiple authorities, each with its own laws and data access limits.
Using shell companies and trusts, concealing true ownership.
Taking advantage of digital assets, DeFi, and instant transfers makes flows difficult to trace.
Conclusion
To fight layering, financial institutions, DNFBPs, regulators, and law enforcement must join efforts and combine strong risk-based controls, ongoing AML transaction monitoring, advanced technology (like AI and graph analytics), cooperation (both within and across jurisdictions), and a culture of compliance and training.
The world’s digitalisation also applies to such schemes, meaning AML strategies must continuously evolve to combat the also evolving money laundering techniques.
Related articles