Your team processes thousands of transactions daily. Somewhere in that flow, criminals are converting illicit funds into seemingly legitimate balances, and your current tools probably can't see it happening.
The layering stage of money laundering is where criminals add complexity: they split funds across jurisdictions, convert currencies, buy and sell assets, and route payments through entities designed to break the audit trail. In the UK, enforcement agencies receive an average of 460,000 Suspicious Activity Reports per year. Your analysts can't manually review that volume, and rule-based systems miss patterns that don't fit yesterday's typologies.
This guide walks you through building a detection stack that catches layering activity in cryptocurrency flows, peer-to-peer platforms, and cross-border transfers. You'll configure transaction monitoring, deploy behavioral analytics, and set up processes your team can maintain.
What You Need Before Starting
Access and authority:
- Admin access to your transaction monitoring system
- Authority to configure watchlist screening and case management workflows
- API credentials for any third-party data enrichment services you'll integrate
Data inputs:
- Transaction logs with timestamps, amounts, sender/receiver identifiers, and geographic metadata
- Customer due diligence records, including beneficial ownership data where applicable
- Historical Suspicious Activity Reports your institution has filed (for baseline pattern analysis)
Technical requirements:
- A system capable of ingesting real-time transaction feeds
- Storage for at least 12 months of transaction history to establish behavioral baselines
- Integration capability with external data sources (blockchain explorers, sanctions lists, corporate registries)
Team resources:
- At least one analyst trained in AML typologies who can tune rules and investigate alerts
- A compliance officer authorized to escalate findings and file SARs
- IT support for API integrations and data pipeline maintenance
If you're working with cryptocurrency transactions, you'll also need access to blockchain analytics tools that can trace wallet addresses and identify mixing services.
Step-by-Step Implementation
1. Configure Velocity and Structuring Rules
Start with the patterns criminals use to break large sums into smaller, less conspicuous amounts.
In your transaction monitoring system, set thresholds for:
- Multiple transactions just below your reporting threshold within a rolling 24-hour window
- Rapid sequences of outbound transfers to different beneficiaries (five or more within an hour)
- Round-number transactions in quick succession (exactly $9,000, $8,500, $9,200)
Example configuration (adapt to your platform's syntax):
IF SUM(outbound_transfers, customer_id, 24h) > $40,000
AND COUNT(outbound_transfers, customer_id, 24h) >= 5
AND MAX(single_transfer) < $10,000
THEN flag as potential_structuring
Don't set these as auto-block rules. Generate alerts for analyst review.
2. Deploy Cross-Border Layering Detection
Criminals move funds across jurisdictions to exploit gaps in information sharing. Build rules that flag:
- Transactions to or from jurisdictions identified as high-risk in your institution's risk assessment
- Rapid round-tripping: funds sent to a foreign account and returned within 72 hours
- Transfers to shell company indicators (recently incorporated entities, minimal operational history, mismatched business activity)
Integrate your monitoring system with:
- Watchlist screening tools that check beneficiaries against sanctions lists and Politically Exposed Person databases
- Corporate registry APIs to pull beneficial ownership data on receiving entities
- FATF-Style Regional Body reports to identify jurisdictions with weak AML enforcement
When a transaction involves a high-risk jurisdiction, your system should automatically escalate it for enhanced due diligence.
3. Add Cryptocurrency Monitoring
Cryptocurrency transactions bypass traditional correspondent banking, making them popular for layering. If your institution allows crypto on-ramps or off-ramps, configure:
- Blockchain analytics integration to trace deposit sources and withdrawal destinations
- Alerts for transactions involving known mixing services or tumblers
- Flags for wallet addresses previously identified in law enforcement advisories
For customers who deposit cryptocurrency, verify:
- The wallet address has a transaction history consistent with the customer's stated business activity
- Funds didn't originate from a mixer or high-risk exchange within the past 10 hops
Most blockchain analytics platforms (Chainalysis, Elliptic, TRM Labs) offer APIs you can query in real time. Configure your system to reject deposits from wallets flagged as high-risk before they settle.
4. Implement Peer-to-Peer Platform Monitoring
P2P platforms let users transfer funds without traditional institutional oversight. If your institution processes P2P transactions:
- Flag accounts that receive funds from multiple senders and immediately forward them to a single beneficiary (aggregation pattern)
- Monitor for customers who register multiple accounts using slight name variations or different phone numbers but the same device fingerprint
- Set alerts for accounts that go dormant after initial Know Your Customer onboarding, then suddenly activate with high-volume transfers
Integrate device intelligence tools to detect when a single user controls multiple accounts. Cross-reference transaction patterns with your customer due diligence records. If a customer described their account use as "personal expenses" but you're seeing business-scale volumes, escalate.
5. Build Behavioral Baselines
Rule-based detection misses novel patterns. Deploy behavioral analytics that learn what's normal for each customer, then flag deviations.
Configure your system to:
- Calculate each customer's typical transaction size, frequency, and counterparty count over a 90-day rolling window
- Generate alerts when current behavior exceeds two standard deviations from baseline
- Weight alerts by customer risk score (higher-risk customers get lower thresholds)
Example: A customer who typically sends three domestic transfers per month, averaging $1,200 each, suddenly sends 15 international transfers in one week, averaging $8,000 each. That's a deviation worth investigating, even if no single transaction breaks a rule.
Validation: How to Verify It Works
Run these tests before you go live:
Synthetic scenario testing: Create test accounts and simulate known layering patterns:
- Structuring: Send $9,500 six times in 24 hours from one account to six different beneficiaries
- Round-tripping: Transfer $50,000 to a foreign account, wait 48 hours, return $48,000
- Cryptocurrency mixing: Deposit funds from a wallet you've manually flagged as connected to a known mixer
Your system should generate alerts for all three. If it doesn't, your rules aren't calibrated correctly.
Historical case review: Pull five Suspicious Activity Reports your institution filed in the past year. Feed the transaction data that triggered those SARs into your new system. It should flag at least four of the five. If it misses known suspicious activity, tune your thresholds.
False positive rate check: Run your rules against one week of production transaction data in a test environment. Calculate your alert-to-case ratio: how many alerts do analysts need to review to identify one genuine suspicious pattern? If you're generating more than 50 alerts per confirmed case, tighten your rules to reduce noise.
Integration verification: Confirm your watchlist screening queries external databases by testing with a known sanctioned entity. Verify your blockchain analytics integration by checking a wallet address you know is flagged. If the integrations aren't pulling live data, your detection gaps are wider than you think.
Maintenance and Ongoing Tasks
Your layering detection stack isn't set-and-forget. Criminal methods evolve, and your rules need to keep pace.
Monthly:
- Review your alert queue. If analysts are closing more than 80% of alerts as false positives, your thresholds are too sensitive.
- Check for new mixing services or high-risk exchanges added to your blockchain analytics provider's database. Update your rejection lists.
- Audit accounts flagged for behavioral deviations but not escalated to SARs. Are you missing patterns, or are the deviations legitimate?
Quarterly:
- Recalibrate behavioral baselines. Customer behavior changes seasonally; don't let December holiday spending trigger false positives in January.
- Update your high-risk jurisdiction list based on FATF mutual evaluation reports and new AML Directives.
- Review SARs filed by peer institutions (if your regulatory framework shares this data). Are you seeing typologies you're not currently detecting?
Annually:
- Conduct a full model validation. Bring in an independent reviewer to test your rules against known money laundering cases.
- Reassess your risk scoring methodology. Are the factors you weighted heavily last year still the best predictors of suspicious activity?
- Train your analysts on new layering techniques. Cryptocurrency privacy coins, decentralized exchanges, and new P2P platforms emerge constantly.
Layering is the stage where criminals think they've broken the trail. Your job is to prove them wrong, not by reviewing every transaction manually, but by deploying systems that surface the patterns human analysts would never spot in 460,000 reports per year.
