Scope
This guide focuses on the layering stage of money laundering, where illicit funds are moved through complex transactions to hide their origin. You'll find requirement breakdowns, detection frameworks, and a quick reference table for daily use. This isn't an introduction to the three-stage model. For placement or integration guidance, consult your AML policy manual.
Key Concepts and Definitions
Layering: The second stage of money laundering, where criminals distance illicit funds from their source through multiple transactions and transfers. This stage exploits legislative gaps, cross-border delays, and transaction complexity to break the audit trail linking funds to the crime.
Offshore Banking: Financial institutions in jurisdictions with weak AML enforcement or strong privacy protections, often used during layering to move funds across borders and create jurisdictional complexity.
Shell Company: A business entity with no active operations or significant assets, used to hold accounts and execute transactions that obscure beneficial ownership and fund movement.
Cryptocurrency Mixing: A layering technique where digital currency passes through multiple addresses or mixing services to break the blockchain trail between sender and recipient.
Wire Transfer: Electronic fund movement between institutions, often used in rapid succession during layering to create transaction volume that overwhelms manual review.
Requirements Breakdown
Bank Secrecy Act Obligations
Your institution must maintain records of wire transfers exceeding $3,000 and report Currency Transaction Reports for cash movements above $10,000. During layering, criminals structure transactions below these thresholds or use multiple institutions to avoid triggering reports.
The FFIEC BSA/AML Examination Manual requires you to monitor for patterns indicating layering: rapid movement of funds between accounts, frequent just-below-threshold transactions, and wire transfers with no apparent business purpose.
Customer Due Diligence Under FinCEN Rules
Enhanced Due Diligence applies when you identify higher-risk customers. During layering, watch for customers who:
- Maintain accounts in multiple jurisdictions without clear business rationale
- Execute wire transfers to or from high-risk countries listed by FATF-Style Regional Bodies
- Show transaction patterns inconsistent with their stated business model
- Use multiple shell companies with overlapping beneficial owners
Suspicious Activity Report Filing
You must file a Suspicious Activity Report within 30 days of detecting facts requiring a report. Layering indicators include:
- Multiple deposits followed by immediate wire transfers
- Funds moving through several accounts within 24-48 hours
- Transactions involving known shell company registries
- Patterns matching your institution's historical SAR filings for layering schemes
Implementation Guidance
Transaction Monitoring Configuration
Configure your monitoring system to flag layering patterns, not just threshold violations. Set rules for:
Velocity checks: Alert when an account receives deposits and initiates outbound wires within a short timeframe (24-72 hours). Legitimate businesses rarely move funds this quickly.
Geographic risk scoring: Weight transactions involving jurisdictions with weak AML enforcement. A wire transfer to a tax haven following multiple domestic transfers deserves scrutiny even if amounts appear normal.
Network analysis: Map relationships between accounts, beneficial owners, and transaction counterparties. Layering schemes often involve circular fund movement between related entities.
Cryptocurrency Monitoring
In 2022, an estimated $23.8 billion in digital currency was transferred through illicit addresses as part of money laundering activities. Your monitoring must extend to:
- Customers who convert fiat to cryptocurrency and back to fiat within short periods
- Accounts receiving funds from known mixing services or privacy-focused cryptocurrencies
- Patterns where customers use your institution as an on-ramp and off-ramp around cryptocurrency transactions
Enhanced Due Diligence Triggers
Implement Enhanced Due Diligence when you observe:
- Business structures disproportionately complex for the stated activity
- Beneficial owners who are Politically Exposed Persons in high-risk jurisdictions
- Transaction patterns that change dramatically after account opening
- Multiple accounts with similar transaction patterns but different nominal owners
Common Pitfalls
Focusing Only on Placement
Your team catches structuring and large cash deposits but misses layering because you're not monitoring post-deposit activity. Criminals expect scrutiny at placement. They've already planned the layering phase by the time funds enter your institution.
Fix: Review 90 days of transaction history after any suspicious deposit. Layering doesn't happen instantly.
Treating Each Transaction Independently
Your rules flag individual transactions but miss the pattern. A $7,500 wire transfer looks routine. Ten of them in two weeks, each to a different offshore account, indicates layering.
Fix: Implement lookback windows in your monitoring rules. Set alerts based on cumulative activity, not single events.
Ignoring Shell Company Indicators
You verify the customer's business registration but don't investigate whether the company has actual operations. Shell companies are legal, but they're also the primary tool for layering.
Fix: During Enhanced Due Diligence, request evidence of business activity: invoices, contracts, employee records, operational expenses. A legitimate company can produce these. A shell company cannot.
Missing Cross-Border Complexity
Your monitoring works domestically but fails when funds cross borders. Criminals exploit this gap by routing transfers through multiple jurisdictions, creating delays in information sharing.
Fix: Set lower thresholds for international wires. Apply Enhanced Due Diligence to any customer conducting regular cross-border transactions without clear business justification.
Underestimating Cryptocurrency Integration
You monitor traditional banking but treat cryptocurrency as someone else's problem. Criminals use your institution to convert between fiat and digital currency, conducting the actual layering in cryptocurrency before returning to fiat.
Fix: Flag customers who regularly interact with cryptocurrency exchanges. Request source of wealth documentation when cryptocurrency-related deposits occur.
Quick Reference Table
| Indicator | Threshold | Action Required | Regulation |
|---|---|---|---|
| Wire transfers (domestic) | $3,000+ | Record retention | Bank Secrecy Act |
| Wire transfers (international) | All amounts | Enhanced monitoring | Bank Secrecy Act |
| Multiple just-below-threshold wires | 3+ in 30 days | Investigate for structuring | FFIEC BSA/AML Manual |
| Rapid fund movement | Deposits + wires within 72 hours | Enhanced Due Diligence review | FinCEN CDD Rule |
| Shell company transactions | Any pattern inconsistent with stated business | Enhanced Due Diligence | FinCEN CDD Rule |
| High-risk jurisdiction involvement | Per FATF list | Enhanced Due Diligence | FATF Recommendations |
| Cryptocurrency exchange interaction | Regular deposits/withdrawals | Source of wealth verification | FinCEN Virtual Currency Guidance |
| Circular fund movement | Between related entities | Network analysis, consider SAR | FFIEC BSA/AML Manual |
| Politically Exposed Person involvement | Any beneficial ownership | Enhanced Due Diligence | FinCEN CDD Rule |
| SAR filing window | Within 30 days of detection | File SAR, maintain confidentiality | Bank Secrecy Act |
Money laundering schemes are estimated to cost 2-5% of the world's total GDP, amounting to approximately $2 trillion annually according to the United Nations Office on Drugs and Crime. The layering stage is where criminals create the complexity that makes this volume possible. Your monitoring system must match that complexity, or you're simply documenting placement while missing the actual laundering.
