Your due diligence process includes a source-of-funds verification step. Your team collects bank statements, confirms money moved from point A to point B, checks the box, and files the case. You've documented the funds' origin. You're compliant.
Except you've verified the wrong thing. You've proven the money moved. You haven't proven it's clean.
Why These Mistakes Keep Happening
Source-of-funds verification is caught between regulatory demands and operational needs. Regulators want proof that high-risk funds are legitimate. Your team needs a process that doesn't slow onboarding or create massive review queues.
The result? A verification process that defaults to easily collected evidence, bank statements, transaction histories, payslips, without questioning what that evidence actually proves. This approach confuses documentation with validation. It treats the paper trail as the answer instead of the starting point.
This isn't laziness. It's a structural problem. Most teams lack clear guidance on what "legitimate" means in practice, how to distinguish layered funds from clean ones, or when a bank statement raises more questions than it answers. So they fall back on the routine: collect a bank statement, confirm it shows the transaction, mark complete.
Mistake 1: Treating Bank Statements as Proof of Legitimacy
Why it happens: A bank statement is concrete, timestamped, and easy to obtain. It shows the customer had the money. It feels like evidence.
The consequence: Bank statements prove funds existed and moved. They don't prove origin. A customer wiring £500,000 from their business account could be transferring legitimately earned consulting fees, or the proceeds of a layering scheme that ran through three shell companies and two jurisdictions before landing in that "clean" business account. The statement shows the last hop, not the source.
The fix: Distinguish between source-of-funds (where the money came from immediately before this transaction) and source-of-wealth (how the customer accumulated assets in the first place). For high-risk or high-value relationships, you need both. When a bank statement shows a large transfer, your next question should be: what funded that account? If the answer is "another account," keep going until you reach an income-generating activity, salary, business revenue, asset sale, inheritance. Document that activity with corroborating evidence: employment contracts, tax returns, sale agreements, probate documents.
Mistake 2: Accepting Payslips Without Reconciling Income to Wealth
Why it happens: A customer provides payslips showing monthly salary. That's documented income. Box ticked.
The consequence: Payslips prove current earnings, not accumulated wealth. A customer depositing £200,000 who earns £4,000 per month has a math problem. Even if they've worked for five years, their gross salary totals £240,000, before taxes, living expenses, and everything else. Where did £200,000 in liquid funds come from? If your verification process stops at the payslip, you've missed the gap.
The fix: Calculate backwards. Take the amount being verified, estimate reasonable savings rates given the customer's income and lifestyle costs, and determine whether the timeline makes sense. If it doesn't, request additional documentation: inheritance records, loan agreements, investment account statements showing growth, or sale documentation for assets. If the customer claims they saved aggressively, ask for historical bank statements showing consistent deposits that match the claimed savings pattern.
Mistake 3: Ignoring the Jurisdiction Where Funds Originated
Why it happens: Your process focuses on the customer's current banking relationship and the immediate source account. Geographic origin feels like someone else's problem, maybe the correspondent bank's or the originating institution's.
The consequence: Funds that passed through high-risk jurisdictions carry elevated risk regardless of where they land. A wire from a business account in a well-regulated jurisdiction might look clean until you trace it back to a correspondent account in a jurisdiction with weak AML enforcement, widespread corruption, or known trade-based money laundering activity. If your verification process doesn't map the full transaction chain, you're accepting geographic risk blindly.
The fix: For transactions above your risk threshold, request full wire details including all correspondent banks and originating institutions. Cross-reference those jurisdictions against FATF mutual evaluation results, Transparency International's Corruption Perceptions Index, and your institution's own risk matrix. If the chain includes high-risk jurisdictions, escalate to enhanced due diligence and request additional documentation proving the business purpose, underlying commercial activity, or legitimate reason for routing through those jurisdictions.
Mistake 4: Failing to Question Round-Number Transfers
Why it happens: Round numbers are common in legitimate transactions. People transfer £50,000 for a house deposit or $100,000 to fund an investment. Your team sees round numbers constantly.
The consequence: Round numbers are also a hallmark of structuring and layering. Legitimate business transactions tend to reflect actual invoices, partial payments, or calculated amounts, £47,832.19, not £50,000. When a customer's source-of-funds documentation shows a series of round-number transfers between accounts, especially across multiple institutions or jurisdictions, you're looking at potential layering. If your process treats £50,000 the same as £50,347.82, you're missing a behavioral signal.
The fix: Flag round-number transfers above your threshold for secondary review. During that review, request underlying documentation proving the business purpose: invoices, contracts, purchase agreements. Legitimate transactions will have specific amounts tied to actual obligations. If the customer can't explain why the transfer was exactly £50,000 instead of the amount on an invoice or agreement, probe deeper. Look for patterns across the customer's transaction history, multiple round numbers suggest intentional structuring.
Mistake 5: Stopping Verification When You Reach a Corporate Entity
Why it happens: The funds came from the customer's business. They own the business. The corporate account is the source. Case closed.
The consequence: Corporate structures are money laundering vehicles. A customer transferring funds from their business account might be moving legitimately earned business income, or they might be using the corporate entity to layer illicit funds through seemingly legitimate business transactions. If your verification process stops at the corporate account without examining what funded it, you've outsourced your due diligence to a legal structure designed for opacity.
The fix: Treat corporate source-of-funds the same way you treat individual source-of-wealth: trace it to an income-generating activity. Request business bank statements showing revenue sources, customer payments, or asset sales that funded the corporate account. For high-risk relationships, request underlying contracts or invoices proving the business transactions were real. If the corporate account was funded by another corporate entity, especially one in a different jurisdiction or with different beneficial owners, continue tracing until you reach actual economic activity.
Prevention Checklist
Before closing a source-of-funds verification case, confirm:
- You've traced funds to an income-generating activity, not just to another account
- You've reconciled claimed income sources to the amount being verified (the math works)
- You've mapped the complete transaction chain, including all correspondent banks and jurisdictions
- You've flagged and investigated any round-number transfers above your risk threshold
- For corporate sources, you've verified the underlying business activity that funded the corporate account
- You've documented not just what moved, but why it moved and where it originated
- Your evidence would survive a regulatory examination asking "how do you know this money is legitimate?"
If you can't check every box, you haven't verified the source of funds. You've verified that money moved. That's not the same thing.
